MBPM 9.2.1.1 Web Server SSO Issue

Hello all

I am running MBPM 9.2.1.1 with separate engine and web servers. Both are running Windows Server 2008 R2 SP1. Database is SQL 2008 R2 SP1, on a separate SQL server machine.

I have both standard login and SSO set up on both the engine server and web server. In other words, the MBPM client should be able to be accessed in the following ways:

http://AppServer/metastorm (standard login to app server web client)
http://AppServer/metastormsso (SSO login to app server web client)
http://WebServer/metastorm (standard login to web server web client)
http://WebServer/metastormsso (SSO login to web server web client)

My issue is: The web server SSO will only work if I am actually on the web server itself (via Remote Desktop). If I browse to the web server SSO site from any other machine, I get the following error:

No Engines are available in the "Metastorm BPM Server" service.

I can successfully log in if I browse to the app server SSO address from any machine on the network. I can also manually log in to both the app and web server clients from any machine on the network. But if I attempt an SSO login to the web server client from any machine other than the actual web server itself. I get the above error (“No engines are available”). I have walked through every bit of documentation and troubleshooting I have found (including the V9 Admin Guide and /awd/forums/questions/3409089) and nothing works.

Has anyone successfully configured SSO in 9.2.1.1 with separate web and engine servers?

Any help would be greatly appreciated!!

Find more posts tagged with

BPM

Comments

Jacob_Eastman

This sounds like a case of Kerberos not being configured correctly. By default, Windows Authentication uses NTLM. This works fine for all in one setups, but NTLM cannot pass credentials past one "hop". In an all in one setup, your client PC to the all in one box is one "hop" so it succeeds as is your case when hitting the appserver's SSO site. Likewise, if you are logged into the webserver, there is still only one "hop" from the webserver to the engine. NTLM works in this case and you are able to login as you noted.

However, when the client PC connects to the web server and the web server connects to the engine, there are two "hops" and NTLM cannot handle this. My guess is that if you check the IIS logs on the engine server after attempting to login and getting the "no engines' error, you will be getting a 401 as your end user's credentials are not making it the second "hop" to the engine. For this, we need Kerberos.

Kerberos is fairly complicated and can be very dependant on your AD structure and configuration. Per our Admin guide, you will need both machines (web and appserver) trusted for delegation in AD as well as the "trusted user" which both server's app pools should be running as and your eSSO_Web.js should be modified to include.

After the servers and trusted user are trusted for delegation in AD, SPNs must be set to tell Kerberos what users and protocols and servers are able to use Kerberos. This is described in our Admin guide as well however this technet article goes into more depth:

http://technet.microsoft.com/en-us/library/cc731241%28v=ws.10%29.aspx

There are also useful kerberos troubleshooting tools such as DelegConfig which you install as a separate virtual directory. Configure the tool the same as your BPM web client (same app pool, auth settings, etc) and browse to the site and step through the tool to help diagnose the problem (duplicate SPNs, users not trusted for delegation, etc)

http://blogs.iis.net/brian-murphy-booth/archive/2009/04/22/delegconfig-v2-beta.aspx