Creating a Single Sign-On (SSO) account

SDS Enterprise allows users to log in to SDS Enterprise automatically and seamlessly using the SSO mode that links the SDS Enterprise account to their Windows user account. SDS Enterprise uses the encryption and signature keys stored in the Windows Certificate Store.

In the security policy, the use of SSO accounts can be configured. User accounts will then be automatically created on their workstations.

  • The Stormshield Data Card Extension feature must be installed on users' workstations, with the other features from the SDS Enterprise agent. For more information, refer to the sections Deploying the SDS Enterprise agent installation package on user workstations and Configuring the middleware required for Card or USB token accounts.

  • Users' encryption and signature certificates must be stored beforehand in the Personal store in the Microsoft certificate manager on workstations.

    These certificates must have been issued by the certification authorities that were declared in the security policy, when SSO accounts were configured, as indicated in the next two following sections.

    Ensure that users have a private key that matches each certificate stored on the TPM chip or in the Microsoft certificate manager.

To configure SSO accounts and ensure that users' SDS Enterprise accounts are associated with their Windows user accounts, configure the following options in SDMC:

  1. Go to the Accounts menu of the relevant security policy.

  2. In the Parameters tab, select Single Sign-on (SSO). For further information, refer to the section Configuring generic account settings.

  3. In the Creation tab, under Key management, select the use of accounts with single keys or key pairs. For further information, refer to the section Setting account creation parameters.

  4. In both cases, select the certification authorities that issued the encryption and signature keys.

  5. Once the security policy is ready, deploy it on users' workstations as indicated in Installing SDS Enterprise agents on the user stations and deploying the security policies or Updating the policy on SDS Enterprise agents.

Next, refer to the section Using the SSO account.

To manually configure SSO accounts directly in a security policy's .json file, the following fields must be filled in:

  1. Indicate SSO as the type for the "AccountMode" parameter:

    "accountPolicy": {
    	"parameters": {				
      		"accountMode": "SSO"
	}			 
    }

  2. Indicate the number of keys in the "accountKeyMode" parameter ("dualKey", "singleKeyEncryption" or "singleKeySignature"):

    "accountPolicy": {
    	"creation": {				
      		"accountKeyMode": "dualKey"
	}			 
    }

  3. In the parameters "encryptionKeyAuthorityId" and "signatureKeyAuthorityId", indicate the ID of the certificate from the authority that issued the keys to be used to create the accounts:

    "accountPolicy": {
    	"creation": {				
      		"automatic": {
    "encryptionKeyAuthorityId": "0123456789ab-cdef-0123-4567-89abcdef",
"signatureKeyAuthorityId": "0123456789ab-cdef-0123-4567-89abcdef"
                    }
    	}			 
    }

  4. In the "certificateData" parameter, indicate the data of the certificates mentioned in step 3 in "base 64" format:

    "certificateData": [
    	{
           "id": "0123456789ab-cdef-0123-4567-89abcdef",
           "data": "LS0tLS1CRUdJTiBDR [...] GSUNBVEUtLS0tLQ0K"
	 }			 
    ]

  5. Once the security policy is ready, deploy it on users' workstations as indicated in Installing SDS Enterprise agents on the user stations and deploying the security policies or Updating the policy on SDS Enterprise agents.

To configure the security policy in .json format, refer to the SDS Enterprise SDS Enterprise Advanced configuration guide.

Next, refer to the section Using the SSO account.

Once the policy has been deployed on workstations, users' SDS Enterprise SSO accounts will automatically be created the next time they log in to their Windows accounts. They can then use SDS Enterprise without going through its connection window.

To specify a location for SDS Enterprise account files on the user's workstation, use the parameters "RootPath1" and "RootPath2" in the SBox.ini configuration file. Files are saved in a sub-folder named after the current user of the Windows session. This sub-folder itself is located in an "SSO" sub-folder in the path specified by the "RootPath1" and "RootPath2" parameters.

To configure the Sbox.ini file, refer to the section Configuring advanced settings in the Sbox.ini file..

Users are automatically logged in to and out of the SDS Enterprise account every time the user's Windows session is opened and closed. The same occurs when the account is locked and unlocked.

SSO accounts have the following particular characteristics:

  • Connection and locking menus remain visible by clicking on the SDS Enterprise SDS Enterprise icon icon in the Windows task bar, but are grayed out.

  • However, users can choose in the properties of their SDS Enterprise accounts > Connection settings > Screensaver tab to lock the SDS Enterprise session when the Windows screensaver begins or when the Windows session is locked, and to not unlock when session resumes. In this case, users can use the Unlock menu by clicking on the SDS Enterprise SDS Enterprise icon icon in the task bar.

  • In the user's key ring, which can be accessed from the SDS Enterprise SDS Enterprise icon icon in the Windows task bar, the Operations button is not shown in the Encryption and Signature tab.