This implementation is not able to pick up and act on invalid SSO data. This means that if the password for a user in the target system has been changed, it will not be learned automatically by Hybrid Access Gateway, as with other SSO types, for example, Formbased and Adaptive.

-

1. Log in to the Hybrid Access Gateway administration interface with your admin user.

1. In the Hybrid Access Gateway administration interface, go to Manage Resource Access.
2. Click Global Resource Settings.
3. Go to the Filters tab and click Add Filter...
4. Add these three filters and configure them as follows:
   

   • sso_set_username

     Panel
     title Configure sso_set_username
     Display Name: sso_set_username Script name: sso_set_username Type of Filter: Request Resource host: Difficult SSO Resource Path: login_form.aspx Apply Filter To: Content Content Type: *

     
     

   • sso_set_password

     Panel
     title Configure sso_set_password
     Display Name: sso_set_password Script name: sso_set_password Type of Filter: Request Resource host: Difficult SSO Resource Path: login_form.aspx Apply Filter To: Content Content Type: *

     
     

   • Inject_script

     Panel
     title Configure inject_script
     Display Name: inject_script Script name: inject_script Type of Filter: Response Resource host: Difficult SSO Resource Path: login_form.aspx Apply Filter To: Content Content Type: * Script variable: setTimeout(function() {document.getElementById("Password").value="secret_password"; document.getElementById("Username").value = "secret_username";document.getElementById("LoginButton").click();}, 100);

     For help, click the ?-sign.

Information about the filters

This table gives information about the filters:

Regarding the path

The path should be the target of the post, that is, what the form is configured to post its reply to. No web service is equal to another and sometimes this might not be a possible approach. The web page may post back to itself for example. So if a path can not be used, for whatever reason, use a * as path. This means that all requests will be inspected. In that case it is better to replace the dummy strings with something that will not under any circumstances be posted, to make sure not to replace other values. It could, for example, be that the web service actually has a reference to the string secret_username and in that case secret_username should be replaced with something random. For example, replace secret_username with hag_secret_username_lesuhfow8h2. The scripts must be edited accordingly. In the case of problems or questions contact Nexus Technical Support.

Regarding the script variable in Inject_script

The getElementById function calls are searching for the form fields Password, Username and LoginButton in the HTML of the login form. These are most likely named differently in other systems and must be updated accordingly by inspecting the HTML of the login form of the system that should be provided with SSO. These are typically the input fields where the user gives his/her credentials.

Update the inject form script to introduce the script configured above (in the inject_script filter) in the correct position in the HTML.

1. In the Hybrid Access Gateway administration interface, click Browse.
2. Navigate to access-point/custom-files/scripts.

3. Edit inject_script.wascr.

   Code Block
   [root] STRING="</body>";def ACTION=del("7"),ins("<script>"),ins(script), ins("</script></body>");0 TRANS=root;root

   
   

4. Find a place in the HTML to inject the script with correct syntax and without modifying functionality. This might not be trivial and sometimes changes to existing scripts may be needed. The above approach should however work in most conditions (find the end body tag and insert it just before the end).

The language above is called wascr and is somewhat complex. Basically the above script will do the following:

• Search for the string </body> in the html file.
• Delete 7 characters.
• Insert "<script>"
• Insert what is contained in the script variable (configured in the filter screen above)
• Insert "</script>"
• Insert "</body>"

1. In the Hybrid Access Gateway administration interface, go to Manage Resource Access.
2. Click Web Resources.
3. Mark the web resource and click Edit Resource Host...
4. CheckEnable Single Sign-On.
5. Select Script as Single Sign-On Type.
6. Select SSO Domain.
7. Click Save and then Publish.