Is it possible to achieve Single Sign-On for RTC/CLM with company's internal user authentication?
Lets say a company uses a centric user management system, (I believe LDAP is required for this), and already has several apps configured to do Single Sign-On (SSO) including the intranet and several other apps.
I would like to know if it is possible to extend the SSO capability to include CLM, so with one login to the internal system, we wish to enable automatic logging into CLM products like RTC.
At this moment I think from version 6 onwards, Kerberos/SPNEGO SSO is the only likely candidate with the potential, but there is limited documentation and blogs to confirm if it is really possible. (And the setting up process seem extremely complicated to 'just try' if it works). There are some relevant documentation below.
Question:
Q. Is it possible to achieve Single Sign-On for RTC/CLM with company's internal user authentication?
Q. Has anybody achieved it? Or any specific documentation?
Q. If possible, is Kerberos/SPNEGO SSO the only way? With the following pre-conditions:
- Microsoft Active Directory running on Windows Server 2008 R2 or later
- IBM® WebSphere® Application Server Version 8 or later
Information I read:
"Kerberos is a well-established SSO protocol that is also the default authentication protocol used by Microsoft Windows, so if your organization uses Windows workstations, Microsoft Active Directory for user management, and deploy Jazz applications in WebSphere 8 or later, it will be possible to configure CLM so that your Windows login session is automatically used to log in to CLM. Kerberos can also be used with non-Windows workstations, as long as you use a Microsoft Active Directory server to manage your user accounts."
New single sign-on options in CLM 6.0
Single sign-on authentication in CLM
Supported platforms for Kerberos/SPNEGO SSO authentication
Configuring Kerberos/SPNEGO single sign-on authentication
3 answers
Sorry I wasn't here four years ago... but YES! My company has had SSO with Windows and Linux for the past four years in CLM. We use Microsoft Active Directory for both Windows and Linux logins, so once a user is logged into their machines, they need only go to any favorite or link that opens CLM and they are automatically authenticated for in Chrome, Edge, Firefox, and cough even Internet Explorer. We accomplished this maybe even 5 or 6 years ago now using WebSphere Application Server 8.5.5.11.
Comments
Lonnie VanZandt
Apr 29 '17, 1:23 p.m.This is not the Answer; this is more of the same Question.
Donald Nong
May 02 '17, 1:54 a.m.Lonnie, I don't know why you said the SSO between Jazz appliactions is not SSO. If you implement SSO using WebSphere Application Server, all applications (Jazz or not) deployed in the WAS cluster are SSO enabled. SSO is based on different specifications and/or implementations, so it is hard to say which one is "true". In the case of KeyCloak and OpenID, have a read on this blog.
https://advantage.ibm.com/2016/02/04/websphere-liberty-makes-it-easier-to-build-openid-connect-security-services/