Java System Solutions

SSO Plugin: single sign-on for the BMC Remedy Midtier platform

Product factsheet

The Java System Solutions SSO Plugin solution provides a generic single sign-on (SSO) solution for the BMC Remedy Midtier platform.

Where a user is already properly identified to the corporate computer network or extranet, it is frustrating for the Remedy system to make the user identify themselves all over again. SSO Plugin aims to ‘pick up’ the existing user identification and automatically identify the user to the Remedy system so that the user doesn't have to go through the process manually: on clicking the appropriate logo, the user will find they are ‘signed on’ to Remedy.

SSO Plugin complements an existing SSO system (such as ClearTrust or SiteMinder), and supports Integrated Windows Authentication, allowing Windows domain users to be transparently signed-onto Remedy systems through their standard workstation login.

Single sign-on solutions implemented with SSO Plugin are in production and trial in companies around the world.

Widely interoperable

SSO Plugin's reliability and flexible design allow JSS rapidly to adapt the product to any single sign-on environment. Supported ‘out of the box’:

• Remedy 6.3, 7.0 and 7.1
• Platforms including Windows, Linux, Solaris and HP-UX
• Java EE web containers including Apache Tomcat, Weblogic, Websphere and New Atlanta ServletExec
• External authentication systems that expose usernames by HTTP header or cookie mechanisms, including ClearTrust and SiteMinder
• Web browsers including Microsoft Internet Explorer and Mozilla Firefox (Firefox requires configuration to enable Integrated Windows Authentication)

Remedy and SSO: overview and comparison

Remedy is promoted as featuring single sign-on support, and the existence of plenty of alternatives are suggested. However whilst an interface to ‘support’ SSO is provided, there is no actual implementation shipped with the Remedy platform.

How does SSO Plugin differ from others?

There are a number of companies offering general-purpose ‘password management’ applications, that happen to work with Remedy Midtier, as a single sign-on solution.

Password managers simply store Remedy login details on each computer used by each user. This approach is popular for consumer-level web site access, but has significant drawbacks for corporate networks:

• convenience: when a user's password changes, the stored passwords on each password manager installation must be manually updated to match;
• security: the user's Remedy passwords—typically matching their domain passwords—are stored on each computer used. Should a computer be compromised by a trojan, virus, spyware or other attacker, the passwords themselves can be extracted and stolen, potentially causing a wider compromise.

SSO Plugin, as the only known Remedy-specific ‘true’ SSO provider currently available, ties Remedy access to existing secure login systems, instead of simply storing password strings.

Building your own solution

A Remedy whitepaper documents building one's own SSO solution, and it's certainly possible, given sufficiently-skilled C and Java programmers with AR API experience.

However writing reliable AR System plugins is a complex task and all too often, less-experienced developers can produce solutions that occasionally crash the Remedy plugin server and leak memory.

Should the SSO architecture in use—or the AR System's own SSO interfaces—be updated, further (potentially expensive) development and re-testing would then also become necessary, increasing costs further.

JSS's SSO Plugin acts as clean, standards-based middleware, connecting Remedy and arbitrary SSO systems whilst decoupling them from each other's implementation details. Its retail cost and TCO are likely to be lower by far than the costs of developing a similarly well-supported, tried-and-tested bespoke Remedy SSO implementation.

Installation

Typical install time: under 1 hour

SSO Plugin is installed as an AREA plugin to the ARS server installation, and a plugin to the Midtier. Both installations are typically simple: a file copy into the relevant locations and a little configuration.

Configuration of the Midtier plugin is performed using a web interface provided with SSO Plugin. Configuration of the AREA plugin is performed through a simple configuration file.

Once installation is complete, you can access your Midtier via the normal URLs. Direct access to Remedy applications will be protected; the SSO system protects Midtier URLs (such as /home, /forms and /apps). The NTLM plugin provided is configured to protect these URLs, however this behaviour can easily be modified.

Evaluation

We provide a free trial of our single sign-on solution allowing you to ‘try before you buy’.

Installation is relatively straightforward but does require familiarity with the installation of Remedy AREA plugins and configuration of the Midtier. Assuming the relevant skills and the availability of internal network configuration details (such as Active Directory login credentials), installation can be performed in under an hour.

A JSS engineer can also perform the installation for you. A remote desktop connection will be required and the server should meet a list of pre-installation criteria.

Contact us for more information or to request an evaluation.