Overview

Recent All Opmantek applications releases since late 2015 have introduced included a simple form of cross-server Single-Sign-On (which is not enabled by default). This page describes the configuration and operational characteristics of this SSO setup.

Requirements

1. On every node server that should be subject to SSHSSO, at least one of your (commercial) Opmantek Application releases must be newer than 12 Nov 2015.
   As our applications share a common core, the SSO capabilities become available as soon as you upgrade or install one sufficiently new product release.
   A simple test without checking application version numbers is to look for the property "auth_sso_domain" in /usr/local/omk/install/opCommon.nmis;
   if it's present (but blank or undef) then your installation is SSO-capable.
2. If any Opmantek Application releases newer than 22 May 2018 are installed on any involved server, then all involved servers require one or more new application releases to be installed.
   Our SSO setup cannot interoperate across old and new applications.

1. All servers in question must share a common DNS domain, and all servers must be accessed via their fully qualified DNS names within that domain.
   This is because our current SSO setup relies on an HTTP cookie that is shared between nodes in the same domain.
2. All servers in question must have at least one shared application secret in their omkd_secrets config properties.
   Pleases note that all Opmantek software released after 27 October 2016 set the application secret to a unique new value on installation or upgrade; to enable SSO you have to change the first entry under omkd_secrets to the same value on all your nodes. For maximum security we recommend that you configure a single application secret only.
3. If you want the Opmantek SSO setup to also cover NMIS, then you need NMIS version 8.6.3G or 8.6.4G for older Opmantek Applications, or 8.6.5G and newer for releases newer than 22 May 2018.

Configuration

To enable SSO you need to edit the configuration file /usr/local/omk/conf/opCommon.nmis, set the 'omkd_secrets' to your shared secret, and set the 'auth_sso_domain' property to your desired DNS domain with an extra leading ".", like in the example below:

...

• Setting up SSO has to be done at least one of your involved servers, not necessarily all of them.
  The first system with SSO on that you log in to will create a session cookie for subsequent server accesses, and as long as all your nodes share the same application secret, the SSO session cookie will be accepted by them.
• Our SSO setup with a shared domain strictly requires that your shared domain has at least two DNS name components.
  Hence, using test.mydomain.id.au would work for nodes a.test.mydomain.id.au, an.other.test.mydomain.id.au and so on.
  However, attempting to set the SSO domain to .com or .au will not work.
• SSO across Opmantek Applications and servers is not supported by legacy application series (like opMaps, opFlow 2) or NMIS at this pointbefore 8.6.3G.
• The authentication code component logs SSO-related issues to log/opDaemonauth.log.