Skip to main content

Configure Primary Authentication Controller

Updated

Primary Authentication Controller (PAC) allows one SmartSimple instance to authenticate users into a separate instance without a separate login (Single Sign-On). The instances can reside on the same server or on separate servers. Access can be granted to all users or limited to a subset of users. PAC is relevant only to clients that use multiple SmartSimple instances. For definitions of each setting, see Primary Authentication Controller Settings Reference.

Who: Global administrators

When to Use Primary Authentication Controller

Use Primary Authentication Controller when:

  • Users on one SmartSimple instance need access to a separate instance without logging in separately.
  • Access to the separate instance is limited to a select number of users.
  • Accounts on each instance use different email addresses.

↑ Back to top

Configure the Authentication Member Instance

Enable the Authentication Member instance before configuring the Primary Authentication Controller (PAC) instance. The Authentication Member instance is the target instance that users access. Enable Authentication Member on this instance and generate the Security Key that the PAC instance uses to gain access.

To enable the Authentication Member instance and generate the Security Key:

  1. Click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Integrations tab.
  2. Locate the Authentication Settings section and then toggle Authentication Member on.
  3. Click Authentication Member Configurations.
  4. Click the New Authentication Member Configuration [+] button.
  5. Add the applicable information and then click Save. See Primary Authentication Controller Settings Reference for setting field definitions.

The Security Key that is populated after the settings are saved is entered in the configuration of the PAC instance.

↑ Back to top

Configure the Primary Authentication Controller Instance

The Primary Authentication Controller (PAC) instance authenticates logins for the Authentication Member instance. Configure this instance after the Authentication Member instance is configured and the Security Key is generated.

To configure the instance that will act as the Primary Authentication Controller:

  1. Click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Integrations tab.
  2. Locate the Authentication Settings section and then toggle Primary Authentication Controller on.
  3. Click Primary Authentication Controller Configurations.
  4. Click the New Primary Authentication Controller Configuration [+] button.
  5. Add the applicable information and then click Save. See Primary Authentication Controller Settings Reference for setting field definitions.

After the configuration is saved, it appears on the list of Authentication Members with a button for selecting which users within the PAC instance can access the Authentication Member instance.

↑ Back to top

Add Enabled Users Options

Enabled Users options define which users on the Primary Authentication Controller (PAC) instance can access the Authentication Member instance. One or more options can be set, depending on which settings are applied within the PAC and Authentication Member configurations.

NOTE  If more than one Enabled Users option applies to a user account, the All Users setting takes precedence when it is configured.

All Users to All Users

Set up an All Users to All Users option when Allow All Users is enabled on the Authentication Member instance. This configuration looks for an enabled user account on the Authentication Member instance that matches the email address of the person logged into the PAC instance.

To add an All Users to All Users option:

  1. Click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Integrations tab.
  2. Locate the Authentication Settings section and click Primary Authentication Controller Configurations. 
  3. Click the edit [pencil] icon next to the applicable configuration.
  4. Locate the User Settings section and click the Users List icon.
  5. Click the Controller User field and select All Users from the drop-down menu.
  6. Click the Member User field and select All Users from the drop-down menu.
  7. Click Add and then click the [X] icon in the upper right corner to close the window.

This is the most common setting, because there is a one-to-one relationship between accounts in each instance.

If a user on the PAC instance does not exist or is not enabled on the Authentication Member instance, the user is denied access or a new account is created. The outcome depends on the Create Users setting in the Authentication Member configuration.

↑ Back to top

Named User to Named User

Set up a Named User to Named User option when only a select number of users on the PAC instance are permitted to connect to the Authentication Member instance. Each permitted user is defined individually.

To add a Named User to Named User option:

  1. Click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Integrations tab.
  2. Locate the Authentication Settings section and click Primary Authentication Controller Configurations.
  3. Click the edit [pencil] icon next to the applicable configuration.
  4. Locate the User Settings section and click the Users List icon.
  5. Click the Controller User field and select the required user from the drop-down menu.
    • If Allow All Users is enabled on the Authentication Member instance, select the individual user from the drop-down menu in the Controller User field. 
  6. Click the Member User field and select the required user from the drop-down menu.
    • This should be the same user as the Controller User.
    • If Allow All Uses is enabled on the Authentication Member instance, select either the specific user or All Users from the drop-down menu in the Member User field. The result is the same, because the Primary Authentication Controller instance tries to match the email address of the selected user with an enabled user with the same email address on the Authentication Member instance.
    • If the user is not listed in the Member User field but Create Users is enabled on the Authentication Member instance, select All Users from the drop-down menu in the Member User field. The account is created on the Authentication Member instance the first time the named user attempts to connect.
  7. Click Add and then click the [X] icon in the upper right corner to close the window.

Named User to Named User can also connect accounts that have different email addresses on each instance. Multiple accounts on the Primary Authentication Controller instance can be configured to connect to the same account on the Authentication Member instance.

IMPORTANT  Each account within a SmartSimple instance can be logged in at only one workstation. If one account is connected to the Authentication Member instance using a shared account, and a second person logs in with the same account, the first user is disconnected. The second login can occur through the PAC instance or directly through the Login Page. Caution is recommended when sharing an account on the Authentication Member instance.

↑ Back to top

All Users to One User

Set up an All Users to One User option to connect all users on the PAC instance to one named account on the Authentication Member instance. This is similar to configuring multiple named accounts on the PAC instance to connect to the same account on the Authentication Member instance.

To add an All Users to One User option:

  1. Click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Integrations tab.
  2. Locate the Authentication Settings section and click Primary Authentication Controller Configurations. 
  3. Click the edit [pencil] icon next to the applicable configuration.
  4. Locate the User Settings section and click the Users List icon.
  5. Click the Controller User field and click All Users from the drop-down menu.
  6. Click the Member User field and click the required user from the drop-down menu.
  7. Click Add and then click the [X] icon in the upper right corner to close the window.
IMPORTANT  Each account within a SmartSimple instance can be logged in at only one workstation. If one account is connected to the Authentication Member instance using a shared account, and a second person logs in with the same account, the first user is disconnected. The second login can occur through the PAC instance or directly through the Login Page. Caution is recommended when sharing an account on the Authentication Member instance.

↑ Back to top

Delete an Enabled Users Option

Enabled Users options cannot be edited. If a mistake is made, delete the option and create it again.

To delete one or more Enabled Users options:

  1. Click the System Administration gear in the upper navigation bar, select Global Settings from the drop-down menu, and click the Integrations tab.
  2. Locate the Authentication Settings section and click Primary Authentication Controller Configurations. 
  3. Click the edit [pencil] icon next to the applicable configuration.
  4. Locate the User Settings section and click the Users List icon.
  5. Locate Enabled Users and check the box next to the user you want to remove access for.
  6. Click Delete.

↑ Back to top

A direct link within the Primary Authentication Controller (PAC) instance authenticates the user to the Authentication Member instance and directs the user to a specific page. Use this syntax to create the link:

/pacforward/memberalias/id/url_of_page_in_member_instance.jsp

 

Example

This link connects directly to the Workflow Request page on the Authentication Member instance.

/pacforward/smart/80/Apps/WFE2/wf_viewworkflows.jsp

To open the link in a new tab or window, append this text to the end of the link:

' target='_blank

 

Example

This link opens the Workflow Request page in a new tab or window.

/pacforward/smart/80/Apps/WFE2/wf_viewworkflows.jsp' target='_blank

↑ Back to top

Helpful Links