For one of the project we are working on SSO solution. The scenario is that to access Maximo enterprise for internal users the SSO has to be enabled. But there are contractors who are external users and they will be using Work Center users for whom SSO will not be required.  

We are considering to create separate UI JVM cluster one for internal and other for external users. But we are also looking at other efficient ways of configuring this solution so that we are use the same UI cluster instead of two separate ones.

Please suggest or share documents  if there is any solution related to above scenario

thanks
Satish

------------------------------
SATISH SOMANNA NARASIMHA
------------------------------

#Maximo
#AssetandFacilitiesManagement

Hi Satish,
what kind of SSO are you implementing? Is it based on Kerberos/Spnego or something else?
Anyway I think that you can configure the app-server to check the SSO token used by internal users and if not present degrade to the form login for external ones.
E.g. you can can configure WebSphere with Spnego to permit fall back to application authentication selecting the "Allow fall back to application authentication mechanism" check box:





------------------------------
Diego Visentin
EAM BU Director
Tempestive S.p.A.
Pordenone
------------------------------

Kerberos-based SSO also allows 2 URLs ... with and without SSO

SSO -> https://afoovsmaxapu.wapa.int/maximo

Non-SSO -> https://afoovsmaxapu.wapa.int/maximo/webclient/login/login.jsp?appservauth=true

------------------------------
Dinesh Shenoy
Maximo Consultant
Samagra
N/A
------------------------------

Original Message:
Sent: Thu May 07, 2020 08:35 PM
From: Diego Visentin
Subject: Maximo SSO

Hi Satish,
what kind of SSO are you implementing? Is it based on Kerberos/Spnego or something else?
Anyway I think that you can configure the app-server to check the SSO token used by internal users and if not present degrade to the form login for external ones.
E.g. you can can configure WebSphere with Spnego to permit fall back to application authentication selecting the "Allow fall back to application authentication mechanism" check box:





------------------------------
Diego Visentin
EAM BU Director
Tempestive S.p.A.
Pordenone
------------------------------

Hi Satish,

Solution from Diego and Dinesh is good  and can be used for SSO solution using Kerberos/Spnego.
I would just add 1 small information here. You can configure Security profile in Web sphere. This is part of Security module of Web sphere.  Benefit of creating a security profile is that you can apply the security profile to clusters and JVM levels.You can create SSO configuration in your security profile in place of doing it on global security. This would also be helpful if you do not want to apply SSO for MIF/CRON clusters. So, for example you have 2 UI JVMs for Maximo then apply the SSO enabled security profile to 1 UI JVM and let the other UI JVM use the LDAP or native authentication. I do not have much info about your SSO requirement but Security profiles and filter properties can used to achieve a lot of scenarios like the one you have mentioned above. 
If you are using SAML based SSO then you can use SP_filter custom property in TAI to skip SSO for Work Centers. 

Thanks,
Biplab

------------------------------
Biplab Choudhury
Maximo Consultant
Tata Consultancy Services
Melbourne
------------------------------