Configuring Security Services

The asynchronous facility supports Security Services for authentication of the asynchronous session. When calling requests on a different site, both the calling and destination site must use the same Teamcenter Security Services directory. In addition, you must configure Teamcenter and Security Services to define a shared mediator key. A type of Teamcenter Security Services token is used only in conjunction with mediating applications. Mediating applications (such as Teamcenter when invoking the AsyncService service) can assume the role of a Security Services session agent and submit special Security Services log on requests. All log on requests to Security Services return a Teamcenter Security Services application token built for the target application, but the token that Teamcenter Security Services returns to the mediating application has a special structure: It contains an inner token, which is intended for the target application. This token is returned to the mediating application wrapped in an outer token that is separately encrypted. The mediating application decrypts the outer token and extracts and forwards the inner token to the target Teamcenter Security Services application, which subsequently validates that token back with Security Services. Note Configuring asynchronous services with Security Services depends on a valid security services session that has not been affected by a timeout or expiration. To configure Teamcenter Security Services application tokens: Set a mediator password in Security Services (using Web Application Manager while building Security Services). Set the same mediator password for Teamcenter (using install_encryption_keys). Run the install_encryptionkeys utility as follows, and enter the mediator password when the utility prompts for the password: install_encryptionkeys -u=user_name -p=password -g=dba -f=install_mediator_key If the default one week lifetime is not adequate, set the ASYNC_credentials_lifetime site preference. When the server calls an asynchronous request, it obtains an special double-encrypted token from the Security Services Identity Service and stores it in the DispatcherRequest along with the other information for the request. When the Dispatcher schedules and invokes the request, the AsyncService service uses the mediator key to decrypt the token and uses it to log on to the new Teamcenter session as the original user. Configure HTTP enabled Multi-Site for single sign-on If you use Security Services single sign-on (SSO) functionality, configure the TC_SSO_app_id_of_site_site-name preference at the site. Here, site-name represents the name of the site, and this preference does not exist by default. The preference value must match the Application ID value for the site as defined in the Application Registry table. Note All sites that are using SSO must be in the same SSO domain.