Difference between revisions of "Common QPR Authentication"
Jump to navigation
Jump to search
| (80 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
| − | Common authentication enables linking from one QPR | + | Common authentication enables linking from one QPR product to the other without the need of a separate login for the product that is the link target. When you are authenticated to one QPR product, you are automatically authenticated all other QPR products as well. It is possible to configure a common authentication between following QPR products: |
| − | * QPR | + | * QPR Suite Portal |
| − | * QPR | + | * QPR Suite Web Services |
| − | * QPR | + | * QPR UI |
| − | |||
| − | |||
| − | Common authentication | + | Common authentication works in a way that if there is a valid (non expired) session existing in any of the systems, sessions for the other systems are refreshed automatically without the need to login again. If all sessions have expired, there is a need to relogin. If a session has been expired, a valid session in other system is able to renew the expired session without notifying user. |
| − | + | Common authentication needs to be setup for each QPR product according to the instructions described in this page. | |
| − | + | In common authentication, '''username''' attribute is used to match user accounts between QPR products. | |
| − | + | == Configuring Common Authentication for QPR Suite Portal and QPR Suite Web Service == | |
| + | # In the QPR application server, open file '''C:\ProgramData\QPR Software\QPR 2019\2019.1\Servers\Settings\QPR_Servers.ini'''. Note that you may have other version than QPR Suite 2019. | ||
| + | # In the '''[UMS Settings]''' section, set '''EnableSSOForPortal=1''' (if EnableSSOForPortal setting already exists, change the existing setting. If the setting doesn't exist, create it as a new). | ||
| + | # If you are adding the common authentication to QPR UI, in the '''[WAS Settings]''' section, add <br> '''<nowiki>AuthenticationService_1=ENTICE,http://SERVERNAME:8080</nowiki>''' <br> SERVERNAME is the name of the QPR UI server that is used when accessing QPR UI (note that the url does not contain a path part, such as ''EnticeServices''). If you also need to add common authentication to QPR ProcessAnalyzer, add<br>'''<nowiki>AuthenticationService_2=PA,http://SERVERNAME</nowiki>'''<br>as a new line. Also, increase the number in the setting name if AuthenticationService_1 is already used. | ||
| + | # If using QPR Suite 2019.1 or later, check also that in the '''[WAS Settings]''' section, '''UseAuthenticationToken''' is set to '''1'''. | ||
| + | # If using QPR Suite 2019.1 or later, add the following line to the '''[WAS Settings]''' section:<br>'''<nowiki>AuthenticationService_1=WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll</nowiki>'''<br>It's important that the servername and protocol are same as defined in the '''HostScriptLocation''' setting (in the [WAS Settings] section). Also, increase the number in the setting name if AuthenticationService_1 and/or AuthenticationService_2 are already used. This setting is needed for the QPR Suite Web Service (WS) to use the common authentication to validate a session token from QPR Suite Web Application server (WAS). | ||
| + | # Restart QPR Suite Windows service. | ||
| − | + | == Configuring Common Authentication for QPR UI == | |
| − | # | + | To configure Common Authentication for QPR UI, follow these instructions: |
| − | + | # Determine the needed setting string as follows: it uses format PRODUCTNAME,URL;PRODUCTNAME,URL;... where PRODUCTNAME is either '''WAS''', '''WS''' or '''PA'''. Example:<pre><nowiki>PA,http://localhost/QPRPA/MainService.svc/webHttp/;WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll;WS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll/wsforward/MainService.svc/webHttp/;</nowiki></pre> SERVERNAME is the name of the corresponding server. | |
| − | <pre> | + | # Login to the QPR UI database using '''SQL Server Management Studio'''. |
| − | + | # Right click QPR UI database, select '''New Query''', and define following query:<br />'''SELECT VALUE_FIELD FROM [DATABASENAME].[dbo].[CONFIGURATIONENTITY] WHERE KEY_FIELD ='AUTHENTICATION_SERVICES';'''<br />If the query returns a row, store the result for backup. | |
| − | + | # If the step 4 query didn't return anything, run the following:<br />'''INSERT INTO [DATABASENAME].[dbo].[CONFIGURATIONENTITY](KEY_FIELD,VALUE_FIELD) VALUES ('AUTHENTICATION_SERVICES', 'SETTINGSTRING');'''<br />(replace the SETTINGSTRING with the one determined in step 1). | |
| − | + | # If the step 4 query returned a row, run the following:<br />'''UPDATE [DATABASENAME].[dbo].[CONFIGURATIONENTITY] SET VALUE_FIELD = 'SETTINGSTRING' WHERE KEY_FIELD = 'AUTHENTICATION_SERVICES';'''<br />(replace the SETTINGSTRING with the one determined in step 1). | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | </ | ||
| − | == | + | == Embed QPR Suite Portal in QPR UI == |
| + | QPR Suite Portal can be embedded into QPR UI using [[External Content Properties|External Content]] presentation object. When setting QPR Suite Portal url (in the '''External Content URL''' field), add the following parameter to the url: '''&xsession=<#sys:sessionId>'''. When the session id is passed to the Suite QPR Portal, user is automatically authenticated to QPR Portal using the common authentication. | ||
| − | + | == QPR UI Session Expiration == | |
| − | + | QPR UI user session will expire if there is no communication with the QPR UI server within the defined time, which is by for 2 hours. The default expiration timeout can be changed by adding or editing the '''SESSION_EXPIRATION_TIME''' value (in minutes) in the '''CONFIGURATIONENTITY''' table in [[QPR UI System Settings|QPR UI database configuration table]]. | |
| − | |||
| − | + | If session in QPR Suite or QPR ProcessAnalyzer is still valid when QPR UI session has expired, QPR UI session is automatically renewed without the need to input credentials. | |
| − | |||
| − | |||
| − | + | If federated authentication is in use, the user is redirected to the identity provider. Note that the session in the identity provider server may still be valid and thus there is not need to input credentials. | |
| − | |||
| − | + | [[Category: QPR UI]] | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Latest revision as of 13:13, 4 June 2024
Common authentication enables linking from one QPR product to the other without the need of a separate login for the product that is the link target. When you are authenticated to one QPR product, you are automatically authenticated all other QPR products as well. It is possible to configure a common authentication between following QPR products:
- QPR Suite Portal
- QPR Suite Web Services
- QPR UI
Common authentication works in a way that if there is a valid (non expired) session existing in any of the systems, sessions for the other systems are refreshed automatically without the need to login again. If all sessions have expired, there is a need to relogin. If a session has been expired, a valid session in other system is able to renew the expired session without notifying user.
Common authentication needs to be setup for each QPR product according to the instructions described in this page.
In common authentication, username attribute is used to match user accounts between QPR products.
Configuring Common Authentication for QPR Suite Portal and QPR Suite Web Service
- In the QPR application server, open file C:\ProgramData\QPR Software\QPR 2019\2019.1\Servers\Settings\QPR_Servers.ini. Note that you may have other version than QPR Suite 2019.
- In the [UMS Settings] section, set EnableSSOForPortal=1 (if EnableSSOForPortal setting already exists, change the existing setting. If the setting doesn't exist, create it as a new).
- If you are adding the common authentication to QPR UI, in the [WAS Settings] section, add
AuthenticationService_1=ENTICE,http://SERVERNAME:8080
SERVERNAME is the name of the QPR UI server that is used when accessing QPR UI (note that the url does not contain a path part, such as EnticeServices). If you also need to add common authentication to QPR ProcessAnalyzer, add
AuthenticationService_2=PA,http://SERVERNAME
as a new line. Also, increase the number in the setting name if AuthenticationService_1 is already used. - If using QPR Suite 2019.1 or later, check also that in the [WAS Settings] section, UseAuthenticationToken is set to 1.
- If using QPR Suite 2019.1 or later, add the following line to the [WAS Settings] section:
AuthenticationService_1=WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll
It's important that the servername and protocol are same as defined in the HostScriptLocation setting (in the [WAS Settings] section). Also, increase the number in the setting name if AuthenticationService_1 and/or AuthenticationService_2 are already used. This setting is needed for the QPR Suite Web Service (WS) to use the common authentication to validate a session token from QPR Suite Web Application server (WAS). - Restart QPR Suite Windows service.
Configuring Common Authentication for QPR UI
To configure Common Authentication for QPR UI, follow these instructions:
- Determine the needed setting string as follows: it uses format PRODUCTNAME,URL;PRODUCTNAME,URL;... where PRODUCTNAME is either WAS, WS or PA. Example:
PA,http://localhost/QPRPA/MainService.svc/webHttp/;WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll;WS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll/wsforward/MainService.svc/webHttp/;
SERVERNAME is the name of the corresponding server. - Login to the QPR UI database using SQL Server Management Studio.
- Right click QPR UI database, select New Query, and define following query:
SELECT VALUE_FIELD FROM [DATABASENAME].[dbo].[CONFIGURATIONENTITY] WHERE KEY_FIELD ='AUTHENTICATION_SERVICES';
If the query returns a row, store the result for backup. - If the step 4 query didn't return anything, run the following:
INSERT INTO [DATABASENAME].[dbo].[CONFIGURATIONENTITY](KEY_FIELD,VALUE_FIELD) VALUES ('AUTHENTICATION_SERVICES', 'SETTINGSTRING');
(replace the SETTINGSTRING with the one determined in step 1). - If the step 4 query returned a row, run the following:
UPDATE [DATABASENAME].[dbo].[CONFIGURATIONENTITY] SET VALUE_FIELD = 'SETTINGSTRING' WHERE KEY_FIELD = 'AUTHENTICATION_SERVICES';
(replace the SETTINGSTRING with the one determined in step 1).
Embed QPR Suite Portal in QPR UI
QPR Suite Portal can be embedded into QPR UI using External Content presentation object. When setting QPR Suite Portal url (in the External Content URL field), add the following parameter to the url: &xsession=<#sys:sessionId>. When the session id is passed to the Suite QPR Portal, user is automatically authenticated to QPR Portal using the common authentication.
QPR UI Session Expiration
QPR UI user session will expire if there is no communication with the QPR UI server within the defined time, which is by for 2 hours. The default expiration timeout can be changed by adding or editing the SESSION_EXPIRATION_TIME value (in minutes) in the CONFIGURATIONENTITY table in QPR UI database configuration table.
If session in QPR Suite or QPR ProcessAnalyzer is still valid when QPR UI session has expired, QPR UI session is automatically renewed without the need to input credentials.
If federated authentication is in use, the user is redirected to the identity provider. Note that the session in the identity provider server may still be valid and thus there is not need to input credentials.