Single Sign On (SSO)

the single sign on feature enables users to connect to target databases without knowing the privileged user credentials below are single sign on settings for oracle 12c and mssql dbs sql proxy configuration for sso a parameter can be configured to enable the sso feature 1 establish an ssh connection to the kron pam server 2 set the required parameter in /pam/sql /config/application properties with the commands below · vi /pam/sql/config/application properties · add/edit the following parameter with the true value · sql proxy user swap enabled\ true 3 after the parameters are set, save and exit the vi editor, and restart sql proxy service with the command · systemctl restart pam sql user settings to use sso create a user that will connect to the target database with sso the second password definition is required to provide authentication to the sql proxy when using sso in the portal functions screen, the second password enabled function should be assigned to the user group that will use the sql proxy sso feature to activate the second password use 1 navigate to portal function > function group definition > add+ 2 create a function group that has netright users module visibility and second password enabled 3 fill in the realm name, select the sso function group and the user group that will be using the sso feature for sql proxy, and click save after enabling the second password for a user group, the users in that group can assign their second passwords to their own accounts in the account settings screen the second password expiration parameter should be defined in the system config manager the ttl day parameter defines the maximum use time allowed for the second password navigate to administration > system config man add the aioc second password ttl parameter with a value (in days) device group configuration in sso to utilize the sso feature effectively, the global username or assigned credential settings must be configured when a kron pam user with privileged access (e g , system admin, system) connects to databases, they can do so without needing the privileged user’s password always verify that the database user specified in the direct credential configuration has the necessary permissions for the intended operations establish connection to database with sso · use the sso user and the second password to establish a database connection · verify the connection by checking the following logs · active sessions the sso user should be visible · session logs the sso user should be recorded for all activities · comment logs commands executed by the sso user should appear here