MediaBin and SSO

I have a question on integrating MediaBin with single sign on. We are plannning to have SSO for our MediaBin, as users outside the company domain need to access MediaBin to search and get images. The user authentication will be completely done by SSO and it will put back the user ID and email ID to the header after the authentication. We need to modify the Default.asp of the webclient accordingly. We find that MediaBin authentication also requires the domain which we do not get from the SSO. Can anyone suggest how to go about with this?

Env: MB 4.5.3 build 15/Win 2003

TIA

Find more posts tagged with

Comments

lyman

While we have successfully integrated with various SSO solutions, no two are precisely the same and there is no easy formula. However, if you contact consulting they will be happy to step you through the steps necessary for your circumstances. Roughly, MediaBin provides a trusted mode than can be turned on to specify that authentication has been accomplished by an outside entity.

Cheers,

Lyman Hurd

suj

While we have successfully integrated with various SSO solutions, no two are precisely the same and there is no easy formula. However, if you contact consulting they will be happy to step you through the steps necessary for your circumstances. Roughly, MediaBin provides a trusted mode than can be turned on to specify that authentication has been accomplished by an outside entity.

Cheers,

Lyman Hurd

Lyman,

As you suggested we had contacted contacted consulting and spent a lot of money. It so happened that, since there was a lag in SSO implementation, consulting took all the money and left us with a documentation which does not have steps to configure SSO but just how SiteMinder integrates with MediaBin. This is all we have got in the document reg SSO authentication.
---------------------------------------------------------------------------
5.5 SiteMinder Authentication
The SiteMinder Authentication/Authorization Process

1. The user requests access to a SiteMinder protected resource.
2. SiteMinder challenges the user who then presents their credentials to the SiteMinder Agent on the Web server.
3. These credentials are passed to the SiteMinder Policy Server.
4. SiteMinder Policy Server authenticates the user against LDAP or Active Directory.
5. SiteMinder Policy Server grants access to the protected resource.
6. SiteMinder passes user profile and entitlements to the Web application/site.
7. The application/site serves up customized content to the user.

Following is the header information used when connecting to a MediaBin server.

<header>Host: mbprod</header>
<header>Connection: Keep-Alive</header>
<header>Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFASgKAAAADw==
</header>
<header>Cookie: UserName=****; DomainName=global; ServerName=mbprod; ImageInfoHeight=605; ImageInfoWidth=890; FolderWindowWidth=298; AdvDownloadHeight=644; AdvDownloadWidth=580; BrowseMBHeight=540; BrowseMBWidth=780</header>
<header />
</requestheaders>
<cookies>
<sent>
<cookie name="UserName">****</cookie>
<cookie name="DomainName">global</cookie>
<cookie name="ServerName">mbprod</cookie>
<cookie name="ImageInfoHeight">605</cookie>
<cookie name="ImageInfoWidth">890</cookie>
<cookie name="FolderWindowWidth">298</cookie>
<cookie name="AdvDownloadHeight">644</cookie>
<cookie name="AdvDownloadWidth">580</cookie>
<cookie name="BrowseMBHeight">540</cookie>
<cookie name="BrowseMBWidth">780</cookie>
</sent>
<received />
<header>Cookie: UserName=****; DomainName=global; ServerName=pcmsmb02; ImageInfoHeight=605; ImageInfoWidth=890; FolderWindowWidth=298; AdvDownloadHeight=644; AdvDownloadWidth=580; BrowseMBHeight=540; BrowseMBWidth=780</header>
<header />
</requestheaders>

The UserName, DomainName and ServerName are passed to MediaBin in the HTTP header. The user password is contained in the Authorization
--------------------------------------------------------------------------

I would like to clarify whether the trusted mode you have suggested is the same as integrated_login flags in global.asa or is it something different that needs to be done in the registry or DLLs.

I'm surprised that if consulting has done SiteMinder-MediaBin integrations then why is it that we are not getting a proper documentation of how this needs to be set up? We are chasing up with consulting but so far no luck!!

TIA

Migrateduser

The integrated login flag in the web client's global.asa is intended to be used with Internet Explorer's/IIS's Integrated Windows Authentication. If you look at the Properties for your MediaBin web site (or any web site on IIS), under the Directory Security tab, you'll see an EDIT button. Pressing this button opens a page that allows you to disable anonymous logon and enable Windows Integrated Authentication. Windows Integrated Authentication allows an IE user to log into MediaBin using the domain account specified when his/her PC was booted. IE will pass those credentials to IIS. If MediaBin server and IIS are on the same physical server, NTLM authentication can be used to pass those credentials from IIS to the MediaBin server. Otherwise, Kerberos must be used. Active Directory must be appropriately configured to make the Kerberos solution work.

It is unlikely from your explanation, that a Windows based authentication mechanism would work for you, since you imply you want to allow users to connect to MediaBin that are not part of your Active Directory. As Lyman mentioned, SiteMinder or some other third party authentication tool would be a solution. We have customers that are successfully using SiteMinder. I'm not familiar with the details, but I know they have customized default.asp to meet their needs.

suj

It is unlikely from your explanation, that a Windows based authentication mechanism would work for you, since you imply you want to allow users to connect to MediaBin that are not part of your Active Directory. As Lyman mentioned, SiteMinder or some other third party authentication tool would be a solution. We have customers that are successfully using SiteMinder. I'm not familiar with the details, but I know they have customized default.asp to meet their needs.

MediaBin_MTS,

Thanks for your reply.

Here's a detailed explanation of our situation. We are actually trying to integrate SiteMinder with MediaBIn

The current situation is that we are trying to get the SSO integration working in the internal network before proceeding to the servers in DMZ.

We have the MB server set up on our MB dev server and the IIS is on staging server which are on the same network. The URL /MediaBin is
protected by siteminder and provides an SSO login screen which successfully authenticates but fails to login to the MediaBin Server with
the following error.

Unable to connect to server. Reason: The user logon failed. The user name or password may be invalid for the specified domain. (0x8004041B)

We have the following lines in the global.asa on the staging web server

Application("ENABLE_INTEGRATED_LOGIN") = true
Application("INTEGRATED_LOGIN_SERVER") = "<our mediabin dev server>"

In the MediaBin virtual directory we have 'Anonymous Access' unchecked and 'Integrated Windows Login' checked. I have verified that our network is kerberos enabled.

As far as application headers are concerned, we do not get the password or domain in the header, but siteminder puts the
userid and emailid to the header.

I have verified that the Integrated login works when we go through the web client in mediabin server itself.

I understand from your reply that we need to customize the default.asp for this (although consulting never mentioned this!)
Do we need any change in the script model dlls as well? Also do you know roughly what kind of modifications are there in the default.asp?

Also I believe LDAP details are not required for SSO. Do we need the LDAP details (where the SSO users reside) for fine grained permission settings in MediaBin or how does MB determine the fine grained access (e.g, folder permissions) etc in
case of SSO logins?

TIA

Migrateduser

As far as editing default.asp, that particular customer had edited it to meet their needs. In other cases, perhaps it would not be required.
As Lyman said, it all depends on the individual configuration. Unfortunately, this is not my area of expertise. I do client-side programming for MediaBin, so I was familiar with Windows Integrated login for the MediaBin web client.
Please try contacting Interwoven Support or Interwoven Consulting Services as they would have more expertise in integrating with third party authentication tools.

suj

Please try contacting Interwoven Support or Interwoven Consulting Services as they would have more expertise in integrating with third party authentication tools.

Appreciate all your replies. Atleast, I have been able to get more insight in to this issue from here rather than support/consulting. Our plight is that we have a support case open (1246186) for past 80 days and looks like they have given up and stopped responding to our emails/calls. So far the fight has been revolving around windows authentication while I see from your reply that it may have nothing to do with SiteMinder-MB integration.

Roughly I get the idea that, similar to TS-SiteMinder integration there should be "some module" that will place the required headers for MediaBin, mainly the password and domain and there is a setting that needs to be turned on "somewhere" for MB to run in trusted mode.

Any pointers to resolve the uncertain elements in the above assumption is highly appreciated.

TIA