Creating a Single Sign-On (SSO) account

SDS Enterprise allows users to log in to SDS Enterprise automatically and seamlessly using the SSO mode that links the SDS Enterprise account to their Windows user account. SDS Enterprise uses the encryption and signature keys stored in the Windows Certificate Store.

In the security policy, the use of SSO accounts can be configured. User accounts will then be automatically created on their workstations. You can configure the security policy in the SDMC web interface or in advanced mode directly in the .json policy file.

This table describes the various steps involved in deploying SDS Enterprise in SSO mode. Click on a link to open the corresponding procedure in this guide.

Steps Description
1 Observe the requirements
2

Configure the security policy in SSO mode:
3 Downloading and signing a security policy
4 Deploy the SDS Enterprise agent installation package and a custom security policy to user workstations
5 Use the SSO accounts

  • The Stormshield Data Card Extension feature must be installed on users' workstations, with the other features from the SDS Enterprise agent. For more information, refer to Deploy the SDS Enterprise agent installation package and a custom security policy to user workstations and Configuring the middleware required for Card or USB token accounts.

  • Certificates for user encryption and signing keys must have been previously stored on workstations in the Personal certificate store via the Microsoft Certificate Manager.

    These certificates must have been issued by the certification authorities that were declared in the security policy when the SSO accounts were configured, as indicated in the two following sections.

  • Users must possess a private key for each of their certificates stored in the Windows Certificate Store.

  • Two certificates must first be added to the SDMC Certificate Library:

    • The certificate of the certification authority that issued the user certificates,

    • The certificate of the recovery account.

    For more information, refer to the section Adding certification authority certificates.

  • Your LDAP directory must first have been added to the SDMC LDAP Library.
    For more information, refer to the section Managing LDAP directories in SDMC.

To set the SSO account type and ensure that users' SDS Enterprise accounts are associated with their Windows user account, configure the following options in SDMC:

  1. Go to the Accounts menu of the relevant security policy.

  2. In the Parameters tab, select:

  3. In the Creation tab, select:

    Key management: Account with two keys (encryption key and signature key).

    Filter authorities during automatic creation: Certification authorities issuing encryption keys and user signing.
    For more information, refer to the section Setting account creation parameters.

  4. In the Data recovery tab, add the recovery account certificate.

  5. In the Policies > Features menu, keep the default settings or configure the various features to suit your needs.
    For more information, refer to Configuring features.

  6. In the Policies > Authorities menu, add the path to the *.crl revocation list file, generated by the certification authority that issued the users' certificates.Policy >Authorities menu

  7. In the Policies > Distribution menu, add the path to the distribution point for the Policy.jwt file. This file matches the format of your security policy after signing by the policy signatory account.
    For more information, refer to the section Configuring policy distribution points.

  8. Once the security policy is ready, deploy it on users' workstations as indicated in Installing SDS Enterprise agents on the user stations and deploying the security policies or Updating the security policy on SDS Enterprise agents.

Next, refer to the section Using the SSO account.

To manually set the SSO account type directly in the .json file of a security policy, fill out the following fields:

  1. Indicate SSO as the type for the "AccountMode" parameter:

    "accountPolicy": {
    	"parameters": {				
      		"accountMode": "SSO"
	}			 
    }

  2. Indicate the number of keys in the "accountKeyMode" parameter ("dualKey", "singleKeyEncryption" or "singleKeySignature"):

    "accountPolicy": {
    	"creation": {				
      		"accountKeyMode": "dualKey"
	}			 
    }

  3. In the parameters "encryptionKeyAuthorityId" and "signatureKeyAuthorityId", indicate the ID of the certificate from the authority that issued the keys to be used to create the accounts:

    "accountPolicy": {
    	"creation": {				
      		"automatic": {
    "encryptionKeyAuthorityId": "0123456789ab-cdef-0123-4567-89abcdef",
"signatureKeyAuthorityId": "0123456789ab-cdef-0123-4567-89abcdef"
                    }
    	}			 
    }

  4. In the "certificateData" parameter, indicate the data of the certificates mentioned in step 3 in "base 64" format:

    "certificateData": [
    	{
           "id": "0123456789ab-cdef-0123-4567-89abcdef",
           "data": "LS0tLS1CRUdJTiBDR [...] GSUNBVEUtLS0tLQ0K"
	 }			 
    ]

  5. Once the security policy is ready, deploy it on users' workstations as indicated in Installing SDS Enterprise agents on the user stations and deploying the security policies or Updating the security policy on SDS Enterprise agents.

To configure the security policy in .json format, refer to the SDS Enterprise SDS Enterprise Advanced configuration guide.

Next, refer to the section Using the SSO account.

Once the policy has been deployed on workstations, users' SDS Enterprise SSO accounts will automatically be created the next time they log in to their Windows accounts. They can then use SDS Enterprise without going through its connection window.

To specify a location for SDS Enterprise account files on the user's workstation, use the parameters "RootPath1" and "RootPath2" in the SBox.ini configuration file. Files are saved in a sub-folder named after the current user of the Windows session. This sub-folder itself is located in an "SSO" sub-folder in the path specified by the "RootPath1" and "RootPath2" parameters.

To configure the Sbox.ini file, refer to the section Configuring advanced settings in the Sbox.ini file..

Users are automatically logged in to and out of the SDS Enterprise account every time the user's Windows session is opened and closed. The same occurs when the account is locked and unlocked.

SSO accounts have the following particular characteristics:

  • Connection and locking menus remain visible by clicking on the SDS Enterprise SDS Enterprise icon icon in the Windows task bar, but are grayed out.

  • However, users can choose in the properties of their SDS Enterprise accounts > Connection settings > Screensaver tab to lock the SDS Enterprise session when the Windows screensaver begins or when the Windows session is locked, and to not unlock when session resumes. In this case, users can use the Unlock menu by clicking on the SDS Enterprise SDS Enterprise icon icon in the task bar.

  • In the user's key ring, which can be accessed from the SDS Enterprise SDS Enterprise icon icon in the Windows task bar, the Operations button is not shown in the Encryption and Signature tab.