How to configure Active Directory SSO for Spider

Summary

This article provides steps for configuring Active Directory Single Sign On (SSO).

Synopsis

Configuring Active Directory Single Sign On (SSO) allows automatic log-in to Spider when a user is in a an Active Directory group that is synchronised with Spider

Requirements:

• Active Directory has to be configured and users need to be able to log into Windows
• IIS (Spider Application) has to allow Windows Authentication and disallow Anonymous Authentication

Configure SSO:

1. Log on to your Spider with an administrative account
   and go to System (1) > Active directory (2)
   
2. Then click New and fill out the form:

   Login context	<NETBIOS name of the domain>
   Prefix	<Short form of the domain (max. 2 characters)
   Top Level	<Top level of your domain. E.g.: LDAP://mycompany.local/dc=mycompany,dc=local> Always set it to the root domain (2)
   User	<AD user with rights to read the active directory>
   Password	<Password>
   Menu	Menu
   Active	Set to active to activate this domain configuration
   Authentication only	If ticked only accounts out of the active directory are allowed (2)

   
   Save this configuration an test it by clicking the Test button (3)
   
   If your test is successful you will get the following message:
   
   otherwise check your username/password and your top level entry
3. Change to the register Groups and click Assign groups (1)
   With the Search (2) button all active directory groups for a certain domain user (Domain login) are listed.
   Select all groups which should have access to Spider 
   
   Then transfer the selected groups by clicking Port
4. The ported groups then will appear in the Start tab under assigned groups
   
5. As soon as the groups are listed, roles have to be assigned to them
   Do so by clicking onto the group name
   
   Then change to the register Mandators and click Add mandator (Information: This also has to be done if only one mandator is available!) and select the appropriate mandator
   
6. Afterwards change to the register Roles and assign the required roles by selecting them and clicking onto the green arrow
   
   The same way roles can be removed from active directory groups (though the other way around)
7. The AD configuration in Spider is complete now

In order to get SSO working the configuration in Spider LCM / Heat LM is not enough. IIS has to be configured accordingly.

1. Open the IIS Manager and click Authentication (1)
   
2. Check whether Windows Authentication is available
   If yes proceed to 4.
   
3. To add the Windows Authentication feature goto the Server Manager > Manage > Add Roles and Features and choose the Windows Authentication feature as shown in the picture below:
   
   Click Next and then Install
   
   Information

   Wait until the installation has completely finished before doing any further changes in the IIS Manager and restart the IIS service after the installation

   Now you do have an entry Windows Authentication in the Authentication list
   

4. Enable Anonymous and Windows Authentication and
   disable the Forms Authentication
   

   Information

   Authentication can be set on the application level only and does not need to be set on top level