me and my team have started upgrading to 8.3.2 from 8.1.47. We have used SSO to enable easy logins for the operators. We know it has been deprecated for a while and have been using the insecuresso wrapper in the servers config file, and the SSO property in the project properties.
We use an IDP with AD connection and it has been working fine with SSO all this time. But when we made the update, we can no longer log in using SSO. The operators don’t have their own accounts but uses the windows username instead. The clients they use also have SSO so they don’t know the password.
Our backup is still running 8.1.47 since it is necessary for production to be able to use SSO and we run everything via that until we can solve this, unless it is no longer possible, in any way, to get it to work again.
Has something been changed with this in the new version and is it possible to get this to work?
It hasn't been intentionally disabled and would be expected to still work in 8.3.
The system property name was migrated to ignition.gateway.enableInsecureAdSso, but the 'legacy' key should still work (ignition.enableInsecureAdSso).
If you look in the gateway's logs for messages from the Authentication.SSOHelper logger, do you see a WARN level message indicating SSO is enabled?
If so, you can try setting that logger to DEBUG and logging in again, which logs some useful information that might help with troubleshooting.
Yes we did get the warning, we put on debug mode but still got nothing. And changing the wrapper did not change anything either, we got the same warning.
After some checking we noticed that in the settings of the user source, the SSO Enabled had been turned off after updating.
We just tried to upgrade to 8.3.7 and cannot get SSO to work. The checkbox for SSO Enabled was "disabled" during the upgrade but we re-enabled it.
ignition.conf
wrapper.java.additional.7=-Dignition.enableInsecureAdSso=true
and we also tried:
wrapper.java.additional.7=-Dignition.gateway.enableInsecureAdSso=true
Sorry for the vagueness. We actually ended up getting this working but SSO only works with sAMAccountName as the User Name Attribute when using Windows and Vision Client Launcher.
The Project is setup with an Active Directory user source and SSO Enabled. We also have SSO Enabled on the Gateway web page for the user source and:
wrapper.java.additional.7=-Dignition.gateway.enableInsecureAdSso=true
We really wanted to use userPrincipalName (firstname.lastname@ourdomain.com) but it seems that Windows always passes the sAMAccountName (such as firstinitiallastname) when launching the Vision Client Launcher and using SSO. The %username% variable in Windows is set to to the sAMAccountName (firstinitiallastname).
Is there any way to have Vision Client Launcher in Windows send the userPrincipalName for SSO attempts instead?
No. This implementation of "SSO" is a dead feature only maintained for backwards compatibility; we're not adding new functionality to it. At some point we're going to figure out "real" SSO that delegates to the OS in a more secure manner, but no timeline on that feature.
To restate; this SSO is deprecated and locked behind a flag because it's a total nightmare, security wise. We're blindly trusting that "OS username == stored Ignition username" means "is the same user as stored Ignition username".