Logging into your PC and then launching Maximo without needing to authenticate is never SAML/OpenID to the best of my knowledge. Most of time when you're talking Windows into WebSphere you're talking SPNEGO. If you're using SPNEGO to access Maximo, you've gone down the wrong path. It's bad, don't do it.
Utilizing tools like Okta, Ping Identity, and Azure AD, you typically have a dashboard in the product that shows all apps you have access to as a user. You authenticate into this "dashboard" and then launch into those products. Depending on the rules you setup will determine whether another factor, username/password, etc. is required each time or just into the dashboard.
See this video for Ping specifically (towards the end especially) to get an idea of what I'm talking about.
https://www.youtube.com/watch?v=lHHL6E1kG0o&t=3s. Now all of these products allow you to synchronize credentials from AD so your same AD username/password can be your username/password in these products. But AD by design has to work offline (need to use your PC on a plane for example) and people are going to connect from devices that aren't part of your domain (such as from a Mac, iPhone, Android, etc.). Good security practices also require 2 factor into systems, especially from high risk devices or locations, which is where Azure AD, Okta, Ping Identity, etc. really shine. Utilizing conditional access policies, you can block access from certain areas (such as out of the country), block them from accessing it outside of certain time windows (good for temporary employees), you can require them to accept a 2 factor prompt, etc. There's a lot of capabilities when you use the products. But in all of those, you're going to be accessing that web dashboard and then launching into the app for the most part.
Now some products (including WebSphere) can redirect to your identity provider and if the user has already authenticated it'll log them in without authenticating again. But they're going to have to authenticate into your identity provider.
As for the setup, utilize this for the Maximo specifics:
Implementing Security Assertion Markup Language (SAML) security in Maximo Asset Management - IBM DocumentationUtilize this for the WebSphere specifics:
SAML web single sign-on - IBM Documentation------------------------------
Steven Shull
Director of Development
Projetech Inc
Cincinnati OH
------------------------------
Original Message:
Sent: Thu May 20, 2021 03:48 PM
From: mx pro
Subject: Maximo SSO with multiple Identity Providers
thanks Steven,
so what i understood from u is that in our scenario, group 1 users (from Azure AD) and group 2 users (from Ping Identity) both groups users when they login to their systems (meanning login to Windows) then some identifier is sent from the Identity authentication system to Maximo and rest is seamless and all the users can then login to maximo, without again providing the credentials.
is my understanding correct
my next question s while doing the configuration for SSO (Single Sign On), we would require to do 2 interfaces (or something)... and both configs will be as if there was config with one system
can you clarify the config part also ...
appreciate ur guidance...
------------------------------
mx pro
ON
Original Message:
Sent: Thu May 20, 2021 10:57 AM
From: Steven Shull
Subject: Maximo SSO with multiple Identity Providers
1) Yes, if you configure multiple identity providers WebSphere will handle as many IdP initiated logins as you want. With SAML, you're essentially just providing the loginid to Maximo and that's it. As long as the login id matches what the identity provider is sending to WebSphere, you're good.
2) The redirect piece was what I mentioned here "WebSphere has a redirect function to take the user to an identity provider when not authenticated that won't support redirecting to 2 unless you setup separate URLs...". If you setup separate URLs (IE url-idp1.mydomain.com and url-idp2.mydomain.com) you could redirect to different identity providers with some filter rules but otherwise it can only redirect to one. So if you have users that want to go to url.mydomain.com/maximo, it will only redirect to 1 identity provider if they're not authenticated because it can't determine where to route them.
------------------------------
Steven Shull
Director of Development
Projetech Inc
Cincinnati OH
Original Message:
Sent: Thu May 20, 2021 10:47 AM
From: Biplab Choudhury
Subject: Maximo SSO with multiple Identity Providers
Hi Steve,
This is an interesting suggestion.
There are 2 type of SSO Initiation( I am talking about SAML):
1. IDP Initiated : This is where User tries to access Maximo from a IDP's portal. Maximo/websphere understands and authentication the SAML Response from 2 different idp as per the configuration you have mentioned. Is my understanding correct?
2. Maximo/Webspehre Initiated : In this case User clicks on a Maximo url and depending on the redirect java code Maximo reaches out to the appropriate IDP. How does this process work if we have configured 2 IDP urls? I do not remember a way to write a code which would smartly decide on which idp to send the SAML request. Would you please explain this bit more?
Thanks,
Biplab
------------------------------
Biplab Choudhury
Maximo Consultant
Tata Consultancy Services
Melbourne
Original Message:
Sent: Thu May 20, 2021 08:58 AM
From: Steven Shull
Subject: Maximo SSO with multiple Identity Providers
We actually do this quite a bit. WebSphere has a redirect function to take the user to an identity provider when not authenticated that won't support redirecting to 2 unless you setup separate URLs, but if you're comfortable with one of them having to launch from the Identity Provider it's not much different than setting up one identity provider. When you're setting up the identity provider you have a lot of properties you configure on the trust interceptor. You'll have a sso_1.idp_1.SingleSignOnUrl for example. But you can easily create a second identity provider (IE sso_1.idp_2.SingleSignOnUrl) with the settings of the other identity provider utilizing a similar process to the first.
We suggest utilizing email address as the login id (which does NOT have to match the USERID) to avoid conflicts (IE two JSMITH users).
------------------------------
Steven Shull
Director of Development
Projetech Inc
Cincinnati OH
Original Message:
Sent: Wed May 19, 2021 05:01 PM
From: mx pro
Subject: Maximo SSO with multiple Identity Providers
Hello guys,
We want to have SSO in Maximo. We have are implementing Maximo 7.6 instance with multiple identity providers (e.g. Azure AD & Ping Identity)
Can any one help and guide... is that possible.. if yes then how and all?
Regards...
------------------------------
mx pro
ON
------------------------------
#Maximo
#AssetandFacilitiesManagement