Difference between revisions of "Common QPR Authentication"

From Mea Wiki
Jump to navigation Jump to search
 
(80 intermediate revisions by 3 users not shown)
Line 1: Line 1:
Common authentication enables linking from one QPR Suite product to the other without the need of a separate login for the product that is the link target. When you are authenticated to one QPR Suite product, you are automatically authenticated all other QPR Suite products as well. It is possible to configure a common authentication between following QPR Suite products:
+
Common authentication enables linking from one QPR product to the other without the need of a separate login for the product that is the link target. When you are authenticated to one QPR product, you are automatically authenticated all other QPR products as well. It is possible to configure a common authentication between following QPR products:
* QPR ProcessAnalyzer Web Service
+
* QPR Suite Portal
* QPR ProcessAnalyzer Web Client
+
* QPR Suite Web Services
* QPR MobileDashboard
+
* QPR UI
* QPR Portal
 
* QPR Web Services
 
  
Common authentication needs to be setup for each QPR Suite product according to the following instructions.
+
Common authentication works in a way that if there is a valid (non expired) session existing in any of the systems, sessions for the other systems are refreshed automatically without the need to login again. If all sessions have expired, there is a need to relogin. If a session has been expired, a valid session in other system is able to renew the expired session without notifying user.
  
== Configuring Common Authentication for QPR ProcessAnalyzer ==
+
Common authentication needs to be setup for each QPR product according to the instructions described in this page.
  
The configuration file '''web.config''' in QPR ProcessAnalyzer Service is used for registering servers belonging to the common authentication server group. The servers can then share user sessions created for users.  
+
In common authentication, '''username''' attribute is used to match user accounts between QPR products.
  
To set up a common authentication server group:
+
== Configuring Common Authentication for QPR Suite Portal and QPR Suite Web Service ==
 +
# In the QPR application server, open file '''C:\ProgramData\QPR Software\QPR 2019\2019.1\Servers\Settings\QPR_Servers.ini'''. Note that you may have other version than QPR Suite 2019.
 +
# In the '''[UMS Settings]''' section, set '''EnableSSOForPortal=1''' (if EnableSSOForPortal setting already exists, change the existing setting. If the setting doesn't exist, create it as a new).
 +
# If you are adding the common authentication to QPR UI, in the '''[WAS Settings]''' section, add <br> '''<nowiki>AuthenticationService_1=ENTICE,http://SERVERNAME:8080</nowiki>''' <br> SERVERNAME is the name of the QPR UI server that is used when accessing QPR UI (note that the url does not contain a path part, such as ''EnticeServices''). If you also need to add common authentication to QPR ProcessAnalyzer, add<br>'''<nowiki>AuthenticationService_2=PA,http://SERVERNAME</nowiki>'''<br>as a new line. Also, increase the number in the setting name if AuthenticationService_1 is already used.
 +
# If using QPR Suite 2019.1 or later, check also that in the '''[WAS Settings]''' section, '''UseAuthenticationToken''' is set to '''1'''.
 +
# If using QPR Suite 2019.1 or later, add the following line to the '''[WAS Settings]''' section:<br>'''<nowiki>AuthenticationService_1=WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll</nowiki>'''<br>It's important that the servername and protocol are same as defined in the '''HostScriptLocation''' setting (in the [WAS Settings] section). Also, increase the number in the setting name if AuthenticationService_1 and/or AuthenticationService_2 are already used. This setting is needed for the QPR Suite Web Service (WS) to use the common authentication to validate a session token from QPR Suite Web Application server (WAS).
 +
# Restart QPR Suite Windows service.
  
#Create or change usernames in both the source and target QPR products, so that the usernames are identical in both products.
+
== Configuring Common Authentication for QPR UI ==
#Configure common authentication settings by adding the URL of the product where the linking is done from to the web.config file of the target product. For example, to link between QPR ProcessAnalyzer Web Client, QPR MobileDashboard, and QPR Portal, do as follows:
+
To configure Common Authentication for QPR UI, follow these instructions:
::*Add three groups, ServerGroupPA, ServerGroupMD, and ServerGroupMEA, to the web.config file under <Qpr.ProcessAnalyzer.Common.Properties.Settings> section. Specify the QPR ProcessAnalyzer service URLs for ServerGroupPA, the QPR MobileDashboard service URL(s) for ServerGroupMD, and the QPR Portal service URLs for ServerGroupMEA. See example below:
+
# Determine the needed setting string as follows: it uses format PRODUCTNAME,URL;PRODUCTNAME,URL;... where PRODUCTNAME is either '''WAS''', '''WS''' or '''PA'''. Example:<pre><nowiki>PA,http://localhost/QPRPA/MainService.svc/webHttp/;WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll;WS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll/wsforward/MainService.svc/webHttp/;</nowiki></pre> SERVERNAME is the name of the corresponding server.
<pre>
+
# Login to the QPR UI database using '''SQL Server Management Studio'''.
            <setting name="ServerGroupPA" serializeAs="Xml">
+
# Right click QPR UI database, select '''New Query''', and define following query:<br />'''SELECT VALUE_FIELD FROM [DATABASENAME].[dbo].[CONFIGURATIONENTITY] WHERE KEY_FIELD ='AUTHENTICATION_SERVICES';'''<br />If the query returns a row, store the result for backup.
                <value>
+
# If the step 4 query didn't return anything, run the following:<br />'''INSERT INTO [DATABASENAME].[dbo].[CONFIGURATIONENTITY](KEY_FIELD,VALUE_FIELD) VALUES ('AUTHENTICATION_SERVICES', 'SETTINGSTRING');'''<br />(replace the SETTINGSTRING with the one determined in step 1).
                    <ArrayOfString xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+
# If the step 4 query returned a row, run the following:<br />'''UPDATE [DATABASENAME].[dbo].[CONFIGURATIONENTITY] SET VALUE_FIELD = 'SETTINGSTRING' WHERE KEY_FIELD = 'AUTHENTICATION_SERVICES';'''<br />(replace the SETTINGSTRING with the one determined in step 1).
                        xmlns:xsd="http://www.w3.org/2001/XMLSchema">
 
                        <string>http://pa1.qpr.com</string>
 
                        <string>http://pa2.qpr.com</string>
 
                    </ArrayOfString>
 
                </value>
 
            </setting>
 
            <setting name="ServerGroupMD" serializeAs="Xml">
 
                <value>
 
                    <ArrayOfString xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 
                        xmlns:xsd="http://www.w3.org/2001/XMLSchema">
 
                        <string>http://mobiledashboard:8080/EnticeServices/</string>
 
                    </ArrayOfString>
 
                </value>
 
            </setting>
 
            <setting name="ServerGroupMEA" serializeAs="Xml">
 
                <value>
 
                    <ArrayOfString xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 
                        xmlns:xsd="http://www.w3.org/2001/XMLSchema">
 
                        <string>http://mea1.qpr.com/QPR/Portal/QPRIsapi.dll</string>
 
                        <string>http://mea2.qpr.com/QPR/Portal/QPRIsapi.dll</string>
 
                    </ArrayOfString>
 
                </value>
 
            </setting>
 
</pre>
 
  
== Configuring Common Authentication for QPR MobileDashboard ==
+
== Embed QPR Suite Portal in QPR UI ==
 +
QPR Suite Portal can be embedded into QPR UI using [[External Content Properties|External Content]] presentation object. When setting QPR Suite Portal url (in the '''External Content URL''' field), add the following parameter to the url: '''&xsession=<#sys:sessionId>'''. When the session id is passed to the Suite QPR Portal, user is automatically authenticated to QPR Portal using the common authentication.
  
There are two ways to configure Common authentication for QPR MobileDashboard:
+
== QPR UI Session Expiration ==
# during QPR MobileDashboard installation using the installation wizard
+
QPR UI user session will expire if there is no communication with the QPR UI server within the defined time, which is by for 2 hours. The default expiration timeout can be changed by adding or editing the '''SESSION_EXPIRATION_TIME''' value (in minutes) in the '''CONFIGURATIONENTITY''' table in [[QPR UI System Settings|QPR UI database configuration table]].
# after the installation directly the database using SQL
 
  
=== During QPR MobileDashboard installation ===
+
If session in QPR Suite or QPR ProcessAnalyzer is still valid when QPR UI session has expired, QPR UI session is automatically renewed without the need to input credentials.
To add an URL, select the Service type (e.g. "QPR Portal") , define the Service URL (e.g. "http://<service_hostname>/QPR2016-1/Portal/QPR.Isapi.dll/"), and click Add.
 
If you need to change an existing definition, you can either remove the latest definition by clicking Remove last or remove all the definitions by clicking Clear, and then define the definition(s) again.
 
  
=== After the installation to the database ===
+
If federated authentication is in use, the user is redirected to the identity provider. Note that the session in the identity provider server may still be valid and thus there is not need to input credentials.
Example: WAS,http://SERVER/QPR/Portal/QPR.Isapi.dll;WS,http://SERVER/QPR/Portal/QPR.Isapi.dll/wsforward/MainService.svc/webHttp/;
 
  
== Configuring Common Authentication for QPR Portal and QPR Web Services ==
+
[[Category: QPR UI]]
More information: http://kb.qpr.com/qpr2016-1/index.html?common_qpr_authentication.htm
 
 
 
== Linking between QPR Products ==
 
 
 
Common QPR authentication enables opening links, such as QPR ProcessAnalyzer reports in QPR Portal, without additional authentication.
 
 
 
=== QPR ProcessAnalyzer in QPR Portal ===
 
To view an analysis created with QPR ProcessAnalyzer in QPR Portal, do as follows:
 
 
 
# In QPR ProcessAnalyzer Excel Client, open the analysis you want to view.
 
# To save the current analysis view as a bookmark, click the [[File:Portal Bookmarks.png|bottom]]'''Bookmark''' button, select '''New Bookmark''' and in the Bookmark Properties dialog that opens, click '''OK'''.
 
# Find out the '''Id''' of the bookmark you just created by opening the [[Bookmark|Bookmark Properties dialog]] for the bookmark you created and see the Id in the '''Statistics''' group of that dialog.<br/>Optionally, in [[Manage Bookmarks|Manage Bookmarks dialog]], right click a column title, select '''Column Chooser''' from the popup and drag the Id column to the table.
 
# In QPR Portal, create a new bookmark. Paste the bookmark Id to the end of a URL that is formatted as follows:<br/>'''<nowiki>http://<QPR ProcessAnalyzer server>/#bookmark=<bookmark id>&ui=1&XSESSION={#sessionid}</nowiki><br/>'''Do not make changes to the {#sessionid} tag, just copy it exactly like it is written above.<br/>For example: <nowiki>http://pa.qpr.com/#bookmark=1&ui=1&XSESSION={#sessionid}</nowiki>.<br/>Note that using the "&ui" parameter with the value "1" will open the bookmark in [[Full Screen Mode]] inside the web page it was embedded in.
 
# In QPR Portal, open the bookmark you created in the previous step and you will see the analysis without additional authentication.
 
 
 
=== QPR ProcessAnalyzer in QPR MobileDashboard ===
 
To view an analysis created with QPR ProcessAnalyzer in QPR MobileDashboard, do as follows:
 
# In QPR ProcessAnalyzer Excel Client, open the analysis you want to view.
 
# To save the current analysis view as a bookmark, click the [[File:Portal Bookmarks.png|bottom]]'''Bookmark''' button, select '''New Bookmark''' and in the Bookmark Properties dialog that opens, click '''OK'''.
 
# Find out the '''Id''' of the bookmark you just created by opening the [[Bookmark|Bookmark Properties dialog]] for the bookmark you created and see the Id in the '''Statistics''' group of that dialog.<br/>Optionally, in [[Manage Bookmarks|Manage Bookmarks dialog]], right click a column title, select '''Column Chooser''' from the popup and drag the Id column to the table.
 
# In QPR MobileDashboard, add a new External Content presentation object to the view, and define its URL as:<br/>'''<nowiki>http://<QPR ProcessAnalyzer server>/#bookmark=<bookmark id>&ui=1&XSESSION={#sessionid}</nowiki>'''<br/>Do not make changes to the {#sessionid} tag, just copy it exactly like it is written above.<br/>For example: <nowiki>http://pa.qpr.com/#bookmark=1&ui=1&XSESSION={#sessionid}</nowiki>.<br/>Note that using the "&ui" parameter with the value "1" will open the bookmark in [[Full Screen Mode]] inside the web page it was embedded in.
 
 
 
Note: you can also show tabular QPR ProcessAnalyzer analyses in QPR MobileDashboard by using the Table presentation object.
 

Latest revision as of 13:13, 4 June 2024

Common authentication enables linking from one QPR product to the other without the need of a separate login for the product that is the link target. When you are authenticated to one QPR product, you are automatically authenticated all other QPR products as well. It is possible to configure a common authentication between following QPR products:

  • QPR Suite Portal
  • QPR Suite Web Services
  • QPR UI

Common authentication works in a way that if there is a valid (non expired) session existing in any of the systems, sessions for the other systems are refreshed automatically without the need to login again. If all sessions have expired, there is a need to relogin. If a session has been expired, a valid session in other system is able to renew the expired session without notifying user.

Common authentication needs to be setup for each QPR product according to the instructions described in this page.

In common authentication, username attribute is used to match user accounts between QPR products.

Configuring Common Authentication for QPR Suite Portal and QPR Suite Web Service

  1. In the QPR application server, open file C:\ProgramData\QPR Software\QPR 2019\2019.1\Servers\Settings\QPR_Servers.ini. Note that you may have other version than QPR Suite 2019.
  2. In the [UMS Settings] section, set EnableSSOForPortal=1 (if EnableSSOForPortal setting already exists, change the existing setting. If the setting doesn't exist, create it as a new).
  3. If you are adding the common authentication to QPR UI, in the [WAS Settings] section, add
    AuthenticationService_1=ENTICE,http://SERVERNAME:8080
    SERVERNAME is the name of the QPR UI server that is used when accessing QPR UI (note that the url does not contain a path part, such as EnticeServices). If you also need to add common authentication to QPR ProcessAnalyzer, add
    AuthenticationService_2=PA,http://SERVERNAME
    as a new line. Also, increase the number in the setting name if AuthenticationService_1 is already used.
  4. If using QPR Suite 2019.1 or later, check also that in the [WAS Settings] section, UseAuthenticationToken is set to 1.
  5. If using QPR Suite 2019.1 or later, add the following line to the [WAS Settings] section:
    AuthenticationService_1=WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll
    It's important that the servername and protocol are same as defined in the HostScriptLocation setting (in the [WAS Settings] section). Also, increase the number in the setting name if AuthenticationService_1 and/or AuthenticationService_2 are already used. This setting is needed for the QPR Suite Web Service (WS) to use the common authentication to validate a session token from QPR Suite Web Application server (WAS).
  6. Restart QPR Suite Windows service.

Configuring Common Authentication for QPR UI

To configure Common Authentication for QPR UI, follow these instructions:

  1. Determine the needed setting string as follows: it uses format PRODUCTNAME,URL;PRODUCTNAME,URL;... where PRODUCTNAME is either WAS, WS or PA. Example:
    PA,http://localhost/QPRPA/MainService.svc/webHttp/;WAS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll;WS,http://SERVERNAME/QPR2019-1/Portal/QPR.Isapi.dll/wsforward/MainService.svc/webHttp/;
    SERVERNAME is the name of the corresponding server.
  2. Login to the QPR UI database using SQL Server Management Studio.
  3. Right click QPR UI database, select New Query, and define following query:
    SELECT VALUE_FIELD FROM [DATABASENAME].[dbo].[CONFIGURATIONENTITY] WHERE KEY_FIELD ='AUTHENTICATION_SERVICES';
    If the query returns a row, store the result for backup.
  4. If the step 4 query didn't return anything, run the following:
    INSERT INTO [DATABASENAME].[dbo].[CONFIGURATIONENTITY](KEY_FIELD,VALUE_FIELD) VALUES ('AUTHENTICATION_SERVICES', 'SETTINGSTRING');
    (replace the SETTINGSTRING with the one determined in step 1).
  5. If the step 4 query returned a row, run the following:
    UPDATE [DATABASENAME].[dbo].[CONFIGURATIONENTITY] SET VALUE_FIELD = 'SETTINGSTRING' WHERE KEY_FIELD = 'AUTHENTICATION_SERVICES';
    (replace the SETTINGSTRING with the one determined in step 1).

Embed QPR Suite Portal in QPR UI

QPR Suite Portal can be embedded into QPR UI using External Content presentation object. When setting QPR Suite Portal url (in the External Content URL field), add the following parameter to the url: &xsession=<#sys:sessionId>. When the session id is passed to the Suite QPR Portal, user is automatically authenticated to QPR Portal using the common authentication.

QPR UI Session Expiration

QPR UI user session will expire if there is no communication with the QPR UI server within the defined time, which is by for 2 hours. The default expiration timeout can be changed by adding or editing the SESSION_EXPIRATION_TIME value (in minutes) in the CONFIGURATIONENTITY table in QPR UI database configuration table.

If session in QPR Suite or QPR ProcessAnalyzer is still valid when QPR UI session has expired, QPR UI session is automatically renewed without the need to input credentials.

If federated authentication is in use, the user is redirected to the identity provider. Note that the session in the identity provider server may still be valid and thus there is not need to input credentials.