AMX RMS CODECRAFTER Installationsanleitung PDF herunterladen (Seite 125)

Appendix E: Windows Pre-Authentication Configuration

119

RMS Enterprise - Installation Guide

Appendix E: Windows Pre-Authentication

Configuration

Overview

Purpose

The purpose of configuring Windows-based pre-authentication in RMS Enterprise is to provide users with a

single sign-on (SSO) solution. Users who have already logged into their Windows computers can immediately

access RMS Enterprise via their browser and not be challenged with a login prompt by RMS.

How It Works

Microsoft's Internet Information Services (IIS) must be installed and sit in front of the Tomcat Server that

hosts RMS Enterprise. IIS can be hosted on the same physical server as Tomcat or can be on a different server

altogether. Users access RMS through IIS rather than browsing to the Tomcat Server directly. IIS receives the

Windows user name from the browser and then packages that user name into a request header before

forwarding the request on to the Tomcat Server. The RMS application, when configured for pre-authentication,

retrieves the user name from the request header and trusts IIS that the user's identity has already been

authenticated.

All users that want to leverage SSO must already have an RMS User account in the RMS database.

Another possibility would be if RMS is configured for LDAP / Active Directory User management,

the user account must already exist in that repository for SSO to work.

Security Implications

Because the RMS Enterprise Windows Pre-Authentication mechanism depends on a trust between IIS and

Tomcat, it is strongly advised that the HTTP/1.1 Connector in Tomcat be disabled (see Appendix B: Tomcat

Configuration on page 105 for more details).

All web traffic to RMS Enterprise should come through IIS, and no users should be able to access Tomcat

directly.

Client Gateway Authentication

Client gateways built upon the RMS 4 SDK do not participate in SSO, but they do communicate to RMS

through IIS when the system is configured for Windows Pre-Authentication. In this case, a client gateway's

requests simply pass through IIS anonymously and the RMS application challenges the client gateway to

authenticate with Digest Authentication.

If the Tomcat HTTP/1.1 Connector is left enabled, it is trivial to spoof any RMS user

by simply putting the appropriate header into the HTTP request.

Client gateways built with the RMS 3 Legacy SDK still communicate directly to the

RMS Server through port 3839. They have no authentication.

1 2 ... 120 121 122 123 124 125 126 127 128 129 130 ... 135 136

Keine Kommentare

AMX RMS CODECRAFTER Installationsanleitung Seite 125