To integrate with Remedy SSO

To integrate BMC Discovery with Remedy SSO, you must first configure the Remedy SSO server and then enable the integration.

See this video (04:38) for an overview of how the integration between Remedy SSO and BMC Discovery takes place.

OpenID Connect support

BMC Discovery supports connections to BMC Helix SSO, and Remedy SSO version 20.02 with OpenID Connect.

Recent versions of modern browsers are starting to enforce more privacy-preserving defaults and are changing the way cross-site cookies are handled. 

Remedy Single Sign-On relies on cookies to enable your users to seamlessly access all integrated applications. As browsers implement changes to their default SameSite attributes, cross-site cookies will not be sent by default. As a result, your users will be prevented from accessing your applications.

To continue to use Remedy SSO with newer browser versions, you must do the following:

• Use the secure HTTPS protocol for all of your applications.
• Upgrade to Remedy SSO 20.02.
• Set the following configuration options in Remedy SSO:
• Enable Secured Cookie
• Use Cross Site Cookie

For instructions, see Configuring settings for Remedy SSO server .

Note: If you subscribe to Remedy SSO 20.08 and later releases (SaaS), no action is required. BMC will update your configuration.

To obtain the OpenID Connect Client ID and Secret

To obtain the OpenID Connect Client ID and Secret from BMC Helix SSO or Remedy SSO version 20.02 with OpenID Connect:

1. From the menu, select OAuth2.
2. On the Clients tab, enter the client name into the Client Name field.
3. Click Add Redirect URI.
4. Enter the redirect URI into the edit field. The URI is of the following form, where appliancename is the resolvable (from your browser, not from SSO) hostname or IP address of your appliance:
   https://appliancename/ui/OICRedirect
5. Click Add.
6. A registration successful banner is displayed. Ensure that you save the Client ID and Client Secret. You can find the Client ID from the BMC Helix SSO or Remedy SSO system again, but there is no way to access the Client Secret. If you lose this, you must perform the procedure again.

Before you begin

Before you begin integrating BMC Discovery with Remedy SSO, ensure that following considerations are in place:

Mandatory settings

Ensure that following settings are in place:

Considerations for configuring certificates

Communication between BMC Discovery and Remedy SSO can take place only over secured protocol (HTTPS). To enable communication by using HTTPS, you must obtain the HTTPS certificate from the Remedy SSO server. For more information, see Pinning an HTTPS certificate.

You can supply a CA bundle that is trusted by your organization, pin the certificate downloaded from Remedy SSO, or use both.

A pinned certificate is more secure than a CA bundle; however, pinned certificates require more frequent renewal.

Note

We recommend that you use both a pinned certificate and a trusted CA bundle to verify the identity of the Remedy SSO server.

Configuring the connection to the BMC Helix SSO or Remedy SSO server

The connection parameter types required are the same for BMC Helix SSO, and Remedy SSO. You should obtain the values required from your SSO administrator. For:

Before you configure the connection to the SSO server, ensure that the LDAP settings are configured and you are able to log in to the BMC Discovery appliance as an LDAP user with administrative privileges. After you activate the SSO integration, as an administrator, you can log in again and change the configuration, if required.

To apply the SSO settings, perform the following steps:

1. On the main menu, click the Administration icon. 

2. In the Security section, click Single Sign On. 
   By default, the Remedy SSO tab opens.

3. On the Remedy SSO tab, enter the following parameters:

   Parameter name	Description
   RSSO Server URL	Important When connecting to the Remedy SSO server (or BMC Helix SSO server) using OpenID Connect, the "same domain" restriction is removed. For Remedy SSO: Enter the URL for the Remedy SSO server. The Remedy SSO server URL must begin with https and have the same domain as the BMC Discovery appliance. For example, use discovery.calbro.com and rsso.calbro.com (not discovery.calbro.com and rsso.calbro-internal.com).  For BMC Helix SSO: Enter the URL for the BMC Helix SSO server.
   OpenID Connect Client ID	To use OpenID Connect, enter the OpenID Connect Client ID. See To obtain the OpenID Connect Client ID and Secret for information on obtaining the OpenID Connect Client ID and Secret.
   OpenID Connect Client Secret	To use OpenID Connect, enter the OpenID Connect Client Secret.
   RSSO Realm ID	Realms are used to support multitenancy for integrated applications and split application availability. Each realm is identified by a unique identifier and contains one or more application domains. Enter the Realm ID.
   RSSO Agent ID	The RSSO Agent ID identifies the application integrated with Remedy SSO. Enter the RSSO Agent ID.
   RSSO Token revalidation period	Enter the revalidation period in minutes. Contact your Remedy SSO administrator for more information.
   RSSO server timeout	Enter the server timeout in seconds. You need to monitor this parameter and accordingly increase or decrease the number of seconds required for the RSSO server to respond.

4. Click Save.

Uploading a CA bundle

We recommend that you upload a trusted CA bundle. Trusted CA bundles enable you to validate the Remedy SSO server certificate.

To upload a CA bundle, perform the following steps:

1. In the Trusted CA section, click Choose File and select the CA bundle file from your local file system.
2. Click Upload CA Bundle.
   The new certificate bundle is uploaded.

Pinning an HTTPS certificate 

The following section explains how to pin an HTTPS certificate:

1. Download the HTTPS certificate by clicking Get certificate from server. 
   After the certificate is downloaded, details such as Fingerprint, Validity dates, and certificate content are displayed. 
2. After the certificate is retrieved from the server and you have verified that it exactly matches the certificate on the Remedy SSO server, click the Pin certificate button. 

   Certificate pinning involves additional security measures of certificate checks. BMC Discovery administrator must check the channels through which the certificate is received. If the server certificate and the uploaded certificate are not identical, click Unpin Certificate and upload a valid certificate. 

After the configuration completes successfully, the Enable button becomes available. The HTTPS certificate validity is subject to a baseline check. A baseline alert is raised five days before the certificate expires.

For information about troubleshooting Remedy SSO configuration in BMC Discovery, see troubleshooting.

Enabling Remedy SSO Integration

To enable the Remedy SSO integration, click Enable.

Troubleshooting 

If you are unable to log in to BMC Discovery using Remedy SSO, use the local login URL to access the BMC Discovery UI and log in as a local user.