Open topic with navigation

Enable SSO Off-Site Authentication Using GE Digital APM Server Setup

Steps

1. In GE Digital APM, access Operations Manager.

2. Select Host Names.

   The Host Names page appears.

   

3. In the left pane, select .

   The workspace for a new host name appears, displaying default values.

   

4. In the Name box, replace the default text with the GE Digital APM Server's fully qualified hostname.
5. In the IDP URL box, replace the default text with the SAML Issuer ID that is specified on the IDP.

6. Select the SSO Enabled check box.

7. Select .

   The host name is saved.

8. Log out of GE Digital APM.

9. On the GE Digital APM Server, in the GE Digital program files, navigate to the folder ..\ApplicationServer\api.

   Note: If you installed the software in the default location, the folder location will be C:\Program Files\Meridium\ApplicationServer\api.

10. Via an application that you can use to modify XML script (e.g., Notepad), open the file saml.config and uncomment the following section:

    <PartnerIdentityProvider Name="urn:componentspace:MvcExampleIdentityProvider"

    SignAuthnRequest="false"

    WantSAMLResponseSigned="true"

    WantAssertionSigned="true"

    WantAssertionEncrypted="false"

    SingleSignOnServiceUrl="http://foundationvm/SSOIDP/SAML/SSOService"

    SingleLogoutServiceUrl="http://foundationvm/SSOIDP/SAML/SLOService"

    CertificateFile="idp.cer"/>

    Note: The settings in saml.config must be configured to match the environment to which you are connecting. For example, the URL listed in SingleSignOnServiceUrl should point to the URL where you want to authorize the users.

11. In the uncommented section, replace the text urn:componentspace:MvcExampleIdentityProvider with the SAML Issuer ID that is specified on the IDP.

12. In the uncommented section, modify the assertion and response signing settings to match the signing settings that are specified on the IDP, and then save and close the file.

13. In your system's IDP, specify urn:componentspace:Meridium as the Audience Restriction.

    Note: If the IDP is doing assertion and/or response signing, then the IDP signature algorithm must be SHA1.

14. Place the idp.cer file in the following location C:\Program Files\Meridium\ApplicationServer\api.

    Note: The idp.cer file should be obtained from the team responsible for setting up the SAML Identity Provider (IDP).

15. Reset IIS.

    IIS is reset.

16. Access GE Digital APM via a web browser.

    The user is logged in, and SSO off-site authentication is enabled.

Copyright © 2018 General Electric Company. All rights reserved.