Configuring › Administration Configuration Options › Set Administration Configuration Options › Single Sign On Authentication

Single Sign On Authentication

As part of setting the administration configuration options, you configure the following single sign-on authentication parameters. Give special care to the parameters for configuring CA Service Catalog to use external applications to authenticate CA Service Catalog users.

Allow Login with GET

When this configuration value is set to Yes, users can log in using an HTTP GET request.

When this configuration value is set to No, users cannot log in using an HTTP GET request.

Note: This parameter is not related to external authentication. Instead, it is used for backward compatibility of authentication-related features.

External Authentication Parameters

The external authentication parameters follow. To enable external authentication of users, configure these parameter values to match the external application that you are using.

Artifact Name

Specifies the name of the cookie, header, or request parameter that contains the authenticated user ID. This name varies according to the external authentication system and your site-specific implementation.

The default value is sm-user.

For example, if you are using CA SiteMinder, select Header as the authentication type and sm-user as the artifact name. With this configuration, CA Service Catalog checks the header named sm-user whose value is the userid.

When the Artifact Type is request, the artifact name is ignored.

Artifact Type

Specifies the mechanism that the external application uses to send the authenticated user ID to CA Service Catalog, as follows:

• Cookie: Cookie in the request
• Header: Header in the request
• Parameter: request parameter
• Request: request user

Bypass Nodes

Specifies the GUI nodes that you want the authentication check to skip. These GUI nodes typically do not require the user to log in.

Examples include the following: icguinode.login, icguinode.logout, iclaunchpad.launch, icguinode.changepwdlockout, and icguinode.lockout.

Login Page

Specifies the page that displays to the user when either the artifact type is set incorrectly or CA Service Catalog does not find an authenticated user.

An example is wpf?Node=icguinode.login.

Single Sign-on Type

Specifies one of the following options:

• Disabled: Specifies that CA Service Catalog does not use single sign-on.
• Artifact Based Single Sign-on: Configures CA Service Catalog to use single sign-on based on the artifacts specified on this page.
• NTLM (NT LAN Manager): Configures CA Service Catalog to use single sign-on based on Windows NT authentication.