Question

How can SSO be implemented with Active Directory Infrastructure and Domain IE browsers?

Answer 1

SSO for IBM BPM / BAW against Active Directory has two halves: AD as the user registry (WebSphere federated repositories over LDAP) and desktop SSO (Kerberos / SPNEGO so that domain users are not prompted). Setup on traditional WebSphere:

1. Registry: Global security > Federated repositories > add an LDAP repository of type Active Directory (host, port 389/636, bind DN, base entry), login property sAMAccountName (or userPrincipalName), group member attribute member; test with a user login in Process Admin.
2. Kerberos: on the AD side create a service account for the BPM web hostname and register the SPN HTTP/bpm.example.com; export a keytab (ktpass -princ HTTP/bpm.example.com@EXAMPLE.COM -mapuser svc_bpm -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -pass ... -out bpm.keytab); copy the keytab and a krb5.conf to the WebSphere nodes.
3. SPNEGO web authentication: Global security > Web and SIP security > SPNEGO Web authentication: enable, set the Kerberos configuration (krb5.conf, keytab), add a filter for the BPM hostname with a filter criteria that excludes REST / non-browser clients (exclude the API paths so that basic auth still works for integrations), and a fallback to the form login for clients without a ticket.
4. Browsers: the BPM hostname in the intranet zone (IE / Edge) or network.negotiate-auth.trusted-uris (Firefox), Chrome follows the OS.
5. BAW specifics: the Process Portal / Workplace and REST work unchanged; tw_admins etc. are mapped to AD groups; Process Designer (desktop) still uses user / password; LTPA SSO between IHS and the members needs the same LTPA keys.

# krb5.conf minimal
[libdefaults]  default_realm = EXAMPLE.COM  default_tkt_enctypes = aes256-cts  default_tgs_enctypes = aes256-cts
[realms]       EXAMPLE.COM = { kdc = dc1.example.com  admin_server = dc1.example.com }
[domain_realm] .example.com = EXAMPLE.COM
# SPNEGO filter example (exclude APIs): request-url!=/rest/;request-url!=/bpm/;request-url!=/ops/

Alternatives: SAML (WebSphere SAML TAI) with AD FS when Kerberos is not possible (external users, non-domain devices); on CP4BA neither TAI exists - configure AD as LDAP in IAM and add AD FS / Azure AD as an OIDC or SAML identity provider (question on SSO on CP4BA).

References

• BAW documentation - configuring single sign-on (SPNEGO, SAML) and LDAP