Configure single sign-on (SSO) for your Adobe Connect account

Search
Connect

Connect

Open app

How administrators can configure single sign-on (SSO) for an Adobe Connect account to authenticate via proxy server or NTLM.

About single sign-on

Single sign‑on is a mechanism that allows a user to authenticate once and gain access to multiple applications. Single sign‑on uses a proxy server to authenticate users so they need not log in to Adobe Connect.

Adobe Connect supports the following single sign‑on mechanisms:

HTTP header authentication

Configure an authentication proxy to intercept the HTTP request, parse the user credentials from the header, and pass the credentials to Adobe Connect.

Microsoft NT LAN Manager (NTLM) authentication

Configure Adobe Connect to attempt to automatically authenticate connecting clients against a Windows domain controller using the NTLMv1 protocol. Microsoft Internet Explorer on Microsoft Windows can negotiate NTLM authentication without prompting the user for credentials.

Note:

NTLM authentication doesn't work on edge servers. Use LDAP authentication instead.

Note:

Mozilla Firefox clients may be able to negotiate NTLM authentication without prompting. For information about configuration, see this Firefox document.

You can write your own authentication filter as well. For more information, contact Adobe Support.

Configure HTTP header authentication

When HTTP header authentication is configured, Adobe Connect login requests are routed to an agent positioned between the client and Adobe Connect. The agent can be an authentication proxy or a software application that authenticates the user, adds another header to the HTTP request, and sends the request to Adobe Connect. On Adobe Connect, you must uncomment a Java filter and configure a parameter in the custom.ini file that specifies the name of the additional HTTP header.

Configure HTTP header authentication on Adobe Connect

To enable HTTP header authentication, configure a Java filter mapping and a header parameter on the computer hosting Adobe Connect.

  1. Open the file [root_install_dir]\appserv\web\WEB-INF\web.xml and do the following:

    1. Remove the comment tags around the filter and filter-mapping elements for HeaderAuthenticationFilter.

    2. Add comment tags around the NtlmAuthenticationFilter filter and filter-mapping elements.

  2. Stop Adobe Connect Central Application Server and Meeting Server.

  3. Add following row to the custom.ini file. Your authentication agent must add a header to the HTTP request that is sent to Adobe Connect. The name of the header must be header_field_name.

    HTTP_AUTH_HEADER=header_field_name

    Your authentication agent must add a header to the HTTP request that is sent to Adobe Connect. The name of the header must be header_field_name.

  4. Save the custom.ini file and restart Adobe Connect Meeting Server and Adobe Connect Central Application Server.

Write the authentication code

The authentication code must authenticate the user, add a field to the HTTP header that contains the user login, and send a request to Adobe Connect.

  1. Set the value of the header_field_name header field to an Adobe Connect user login.

  2. Send an HTTP request to Adobe Connect at the following URL: 
    http://example.com/system/login

    The Java filter on Adobe Connect intercepts the request, looks for the header_field_name header, then looks for a user with the ID passed in the header. If the user is located, the user is authenticated and a response is sent.

  3. Parse the HTTP content of the Adobe Connect response for the string "OK" to indicate a successful authentication.
  4. Parse the Adobe Connect response for the BREEZESESSION cookie.
  5. Redirect the user to the requested URL on Adobe Connect, and pass the BREEZESESSION cookie as the value of the session parameter, as follows: 
    http://example.com?session=BREEZESESSION
    Note:

    You must pass the BREEZESESSION cookie in any subsequent requests to Adobe Connect during this client session.

Configure HTTP header authentication with Apache

The following procedure describes a sample HTTP header authentication implementation that uses Apache as the authentication agent.

  1. Install Apache as a reverse proxy on a different computer than the one hosting Adobe Connect.

  2. Choose Start > Programs > Apache HTTP Server > Configure Apache Server > Edit the Apache httpd.conf Configuration file and do the following:

    1. Uncomment the following lines:

      • LoadModule headers_module modules/mod_headers.so
      • LoadModule proxy_module modules/mod_proxy.so
      • LoadModule proxy_connect_module modules/mod_proxy_connect.so
      • LoadModule proxy_http_module modules/mod_proxy_http.so

    2. Add the following lines to the end of the file:

      RequestHeader append custom-auth "ext-login"
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://hostname:[port]/
ProxyPassReverse / http://[hostname]:[port]/
ProxyPreserveHost On

  3. Stop Adobe Connect Central Application Server and Adobe Connect Meeting Server.

  4. Add the following to the custom.ini file. The HTTP_AUTH_HEADER parameter must match the name configured in the proxy. The parameter is the additional HTTP header.

    HTTP_AUTH_HEADER=custom-auth

  5. Save the custom.ini file and restart Adobe Connect Meeting Server and Central Application Server.

  6. Open the file [root_install_dir]\appserv\web\WEB-INF\web.xml and uncomment the complete HeaderAuthenticationFilter filter and NtlmAuthenticationFilter filter.

Configure NTLM authentication

NTLMv1 is an authentication protocol used with the SMB network protocol in Microsoft Windows networks. You can use NTLM to allow a user to prove their identity to a Windows domain once and thereafter be authorized to access another network resource, such as Adobe Connect. To establish the user's credentials, the user's web browser automatically performs a challenge and response authentication with the domain controller through Adobe Connect. If this mechanism fails, the user can log in to Adobe Connect directly. Only Internet Explorer on Windows supports single sign-on with NTLMv1 authentication.

Note:

Set up Adobe Connect and NTLM on Windows 2003, as Adobe Connect supports NTLM v1. Also, Windows 7 and later versions do not support NTLM v1 SSO.

Note:

By default, Windows Server 2003 domain controllers require a security feature called SMB signatures. The default configuration of the NTLM authentication filter does not support SMB signatures. You can configure the filter to work within this requirement. For more information on this and other advanced configuration options, see the JCIFS NTLM HTTP authentication documentation.

Add configuration parameters

Do the following for each host in an Adobe Connect cluster:

  1. Synchronize LDAP users from your domain in Adobe Connect via 8510 Management Console. To integrate Adobe Connect with LDAP, see Integrate Adobe Connect with an LDAP directory.

    Note:

    After synchronizing LDAP in Adobe Connect, filter LDAP data in such a way that NTLM Domain user name is populated in the Adobe Connect database. Otherwise NTLM SSO login does not work and you notice logon failures in debug.log.

  2. Edit Login Policies for Adobe Connect, to change login to DOMAIN user name. By default its email but NTLM does not allow email.

  3. Open the [root_install_dir]\custom.ini file in a text editor and add the following parameters:

    NTLM_DOMAIN=[domain]
    NTLM_SERVER=[WINS_server_IP_address]

    The value [domain] is the name of the Windows domain that users are members of and authenticate against, for example, CORPNET. If necessary, set this value to the pre-Windows 2000 compatible version of the domain name. For more information, see TechNote 27e73404. This value is mapped to the filter property jcifs.smb.client.domain. Setting the value directly in the web.xml file overrides the value in the custom.ini file.

    The value [WINS_server_IP_address] is the IP address or a comma-separated list of IP addresses of WINS servers. Use the IP address, the host name does not work. The WINS servers are queried in the order specified to resolve the IP address of a domain controller for the domain specified in the NTLM_DOMAIN parameter. (The domain controller authenticates users.) You can also specify the IP address of the domain controller itself, for example, 10.169.10.77, 10.169.10.66. This value is mapped to the filter property jcifs.netbios.wins. Setting the value in the web.xml file overrides the value in the custom.ini file.

  4. Save the custom.ini file. 

  5. Open the file [root_install_dir]\appserv\web\WEB-INF\web.xml in a text editor and uncomment:

    • the complete NtlmAuthenticationFilter and filter-mapping elements
    • the complete HeaderAuthenticationFilter filter and filter-mapping elements

  6. Save the web.xml file and restart Adobe Connect Server.

Reconcile login policies

Adobe Connect and NTLM have different login policies for authenticating users. Reconcile these policies before users can employ a single login.

The NTLM protocol uses a login identifier that can be a user name (jdoe), an employee ID number (1234), or an encrypted name, depending on the policy or the organization. By default, Adobe Connect uses an email address (jdoe@mycompany.com) as a login identifier. Change the Adobe Connect login policy so that Adobe Connect shares a unique identifier with NTLM.

  1. Open Adobe Connect Central.

    To open Adobe Connect Central, open a browser window and enter the FQDN of the Adobe Connect Host (for example, http://connect.mycompany.com). You entered the Adobe Connect Host value on the Server Settings screen of the Application Management Console.

  2. Select the Administration tab. Click Users and Groups. Click Edit Login and Password Policies.

  3. In the Login Policy section, select No for Use email address as the login.

More like this

 Adobe

Get help faster and easier

New user?

Quick links

View all your plans Manage your plans
View quick links
Hide quick links

Legal Notices    |    Online Privacy Policy