Single Sign On

1. Copy the folders SSOWeb and SSOWebSvc into an IIS directory e.g. C:\Inetpub\wwwroot
2. Open INETMGR
3. Perform the following steps for both SSOWeb, and SOWebSvc:
   1. Right click on component (SSOWeb or SOWebSvc) and select Convert To Application. The selected application Pool must use .NET Framework 4.0.
   2. In IIS Manager, left pane, select component (SSOWeb or SOWebSvc).
   3. In the right pane, select IIS Authentication, and right click.
   4. Select Open Feature.
   5. Set Windows Authentication to Enabled. Disable all other authentications.

      If Windows Authentication is not listed, the IIS Security Role Windows Authentication must be installed. To do this:
      
      i. In the IIS Manager, left pane, select Web Server IIS.
      ii. In the right pane, click Add Role Services. Find and install Windows Authentication.)

4) Configure the web.config file

For SSOWeb

The <configSections> element must be the first directive in <configuration>.

In the following example, two tenants are configured: default, and tenant1.

<configuration>
 <configSections>
  <section name="tenant" type="SoftdialSSOWeb.TenantSection"/>
 </configSections>
 <tenant>
  <tenants>
   <add TenantName="default" RedirectUrl="http://paulvmb/softdial/ssostart.php" TenantKey="secret"/>
   <add TenantName="tenant1" RedirectUrl="http://paulvmb/softdial/ssostart.php" TenantKey="secret"/>
  </tenants>
 </tenant>
...
</configuration>

<tenants> Parameter Descriptions

• TenantName - name of Softdial tenant
• RedirectUrl - http://SOFTDIALSERVER/softdial/ssostart.php (where SOFTDIALSERVER is the IP address of the Softdial server)
• TenantKey - Tenant Token (must match the corresponding Tenant Token configured for the Softdial Tenant.)

Save and close the web.config file.

Changing the Prefix for the Active Directory Group Names

If it is required to have a prefix other than Softdial, use the <appSettings> key SoftdialGroupPrefix to configure. In the following example, the <appSettings> section contains a commented out directive. Simply uncomment it, and change the value to the desired prefix.

<appSettings>
 <!--The Active Directory SoftdialGroupPrefix defaults to "Softdial".-->
 <!--<add key="SoftdialGroupPrefix" value="Softdial"/>-->
</appSettings>

For SSOWebSvc

The <configSections> element must be the first directive in <configuration>.

In the following example, two tenants are configured: default, and tenant1.

<configuration>
 <configSections>
  <section name="tenant" type="SSOWebSvc.TenantSection"/>
 </configSections>
 <tenant>
  <tenants>
   <add TenantName="default" TenantKey="secret"/>
   <add TenantName="tenant1" TenantKey="secret"/>
  </tenants>
 </tenant>
...
</configuration>

<tenants> Parameter Descriptions:

• TenantName - name of SCC tenant
• TenantKey - Tenant Token (must match the corresponding Tenant Token configured for the SCC Tenant.)

Save and close the web.config file.

To change the prefix for Active Directory Group names, follow the procedure described in the SSOWeb configuration above.

INETMGR, select SSOWebSvc, open the Authorization features, and enable Anonymous Authentication (in addition to Windows authentication).

After the normal tenant provisioning is complete, the tenant should be edited and the following three fields set: (See Edit/ Delete Tenant Services in Landlord Administration)

1) Tenant Token

This is used to authenticate that the tenant is trusted. This token is set on the SCC Server, and a matching value must be set at each trusted correspondent (SSOWeb or SSOWebSvc) in the client tenant’s domain.

• The SCC Server value is set using the Web Tenant Provisioning Tool. See Tenant Provisioning
• The Tenant’s matching values must be configured within the Tenants IIS components. See below for configuration instructions.
• This value may be changed, but SSO will only work if the client and server values are the same for a particular tenant.
• This value provides security, so it should not be disclosed except to client and server administrators. The value is never sent “down the wire”, but it is used to validate that the logon message is from a trusted source. It is used by the IIS components to generate a non reversible hash encryption, which is validated by the server.

Set this value to any desired string of characters.

2) Tenant Redirect URL

This is required for Web SSO. It is the web address of the SSOWeb component, which runs in IIS on the same domain as the client’s Active Directory. When the client user logs onto the system using SSO, the server will redirect to the SCC SSOWeb IIS component within the clients domain. The SSOWeb component will gather the Window user’s credentials from the client’s Active Directory, and forward them to the SCC Server.

e.g. http://CLIENTIISSERVER/SSOWeb/

Where CLIENTIISSERVER is the IP Address of the clients IIS machine which must be on the same domain as the client on the intranet.

CLIENTIISSERVER must be a simple intranet system name, with no periods (dots). If there are dots in the name, the user will always be prompted for a windows user and password when trying to log on. This is a restriction documented by Microsoft.

3) Tenant Web Service

This is required for Softdial Scripter™ 2 SSO. It is the web address of the SSOWebSvc component, which runs in IIS on the same domain as the client’s Active Directory. When the client user logs onto the system using SSO, the server will redirect to the SCC SSOWeb IIS component within the clients domain. The SSOWeb component will gather the Window user’s credentials from the client’s Active Directory, and forward them to the SCC Server.

e.g. http://CLIENTIISSERVER/SSOWebSvc/SSOWebService.svc/GetSSODataXML/

Where CLIENTIISSERVER is the IP Address of the clients IIS machine which must be on the same domain as the client on the intranet.

CLIENTIISSERVER must be a simple intranet system name, with no periods (dots). If there are dots in the name, the user will always be prompted for a windows user and password when trying to log on. This is a restriction documented by Microsoft.

The following Groups (Active Directory Global Security Groups) should to be added to Active Directory:

• SoftdialCampaignAdmin
• SoftdialConfiguration
• SoftdialJobControl
• SoftdialRecordMonitor
• SoftdialSuperUser
• SoftdialSupervisor
• SoftdialSystem
• SoftdialUser

These groups map one-to-one with the existing SCC agent permissions.

In order to allocate one or more SCC permissions to a Windows user, it will be necessary to make the user a member of one or more of the above SCC groups.

Note that SoftdialSuperUser is equivalent to making the user a member of all of the above groups.

Changing the Active Directory Group Prefix

In some cases, a client may have a standard prefix for Active Directory Global Security Groups.

To cater for this, the Softdial prefix for these global security groups is configurable.

See Changing the Prefix for the Active Directory Group Names above.

In Internet Options:

1. Advanced tab
   Check the option Enable Integrated Windows Authentication
2. Security tab / Local Intranet, Custom Level… / within “User Authentication/Logon”:
   Select Automatic logon with current user name and password

The following IIS Roles must be installed:

• IIS Role Security: "Windows Authentication"
• IIS Http Redirection Service
• ASP.NET Service

To avoid errors, ensure that the following has been run on the IIS machine:

1. Run the aspnet_regiis.exe program from a command line (within Command Prompt):
   run %windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe –i

Enter the following URL into the browser:

http://localhost/softdial/user/?tenant=default&sso=true#login

where

localhost - replaced by the host address of the SCC Web Server
default - replaced by the name of the tenant

The SCC Login UI will contain only the language selection control and the login button.

Enter the following URL into the browser:

http://localhost/scripter/default/app/browserapp.xbap?sso=true