Kjkjk Hjh

|[pic] |[pic] |


Single Sign-on Services for Microsoft Enterprise Application Integration Solutions:
Enterprise Single Sign-On Integrated with Microsoft BizTalk Server 2004 and Microsoft Host Integration Server 2004
Microsoft Host Integration Server 2004 Technical ArticlePublished: December 2004

Copyright

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any informationpresented after the date of publication.

This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into aretrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided inany written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2004 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, BizTalk, SharePoint, SQL Server, and Windows are either registered trademarks or trademarks of Microsoft Corporation in the UnitedStates and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.


Contents


1.0 Introduction to Enterprise Single Sign-on 4
2.0 SSO Components and Services 13
3.0 SSO Roles and Accounts 17
4.0 Implementation Scenarios 22
5.0 SSO Installation and Configuration 40
6.0 SSO Client Utility and Administrationtools 48
7.0 SSO Mappings and Affiliate Application Types 49
8.0 Configuring Host Initiated SSO 57
9.0 Configuring Password Synchronization 61
10.0 Security 84
10.1 Secure Deployment 85
11.0 Troubleshooting 87
References 92
1.0 Introduction to Enterprise Single Sign-on

In an enterprise-wide computing environment, users are likely to access different applications as they go about theirday-to-day routines. A user may begin his or her day by turning on a Microsoft Windows XP workstation, logging on to a Windows network, and then accessing applications on a mainframe system or an SAP application running on an AS/400. Each system with which the user comes into contact enforces its own security requirements and logon procedures. For example, a Windows domain account may require asix-character user name and an eight-character, mixed-case password, whereas a mainframe environment may require a seven-character user name and seven-character alphanumeric password. Frequently, users have to remember several different combinations of user names and passwords to gain access to various resources on the network. In addition, system administrators have to manage multiple accounts for asingle user.

A key problem within many enterprise organizations is cross-platform security, system integration, and management. For example, when Line-of-Business (LOB) applications and other systems require separate logons users must keep track of, and use, multiple credentials. For many IT support teams the most common support incidents are password resets. This situation reduces end-user...