Skip to content

Overview

In an Active Directory-based environment, integrated Windows authentication allows single sign-on to Pleasanter.

Prerequisites

Server requirements

Client PC requirements

  • The system is joined to the Active Directory domain.
  • The client PC must be logged in as an Active Directory domain user.
  • The browser must support integrated Windows authentication.
  • Open "Internet Options" from the control panel and configure the following settings.
    • "Advanced Settings" tab: "Use integrated Windows authentication" is checked.
    • "Security" tab: The security zone of the Pleasanter server is registered as "Intranet" or "Trusted sites".
    • "Security" tab: At the security zone level, the "User authentication - Logon" column is set to "Automatically log on with current user name and password".

Setup single sign-on using integrated Windows authentication

  1. Install Windows authentication
  2. Enable Windows authentication
  3. Settings for batch processing such as user synchronization and reminders

Install Windows authentication

  1. Launch "Server Manager".

  2. Open the "Management (M)" menu and click "Add roles and functions".
    Server Manager with the Management (M) menu open on 'Add roles and functions'

  3. When the "Before you begin" screen appears, click the "Next (N)" button.
    The Add Roles and Features wizard on the 'Before you begin' screen

  4. When the "Select installation type" screen appears, click the "Next (N)" button.
    The Add Roles and Features wizard on the 'Select installation type' screen

  5. When the "Select server" screen appears, select the target server and click the "Next (N)" button.
    The Add Roles and Features wizard on the 'Select server' screen

  6. When the "Select server role" screen appears, check the "Windows Authentication" checkbox. Confirm that the check box is checked and click the "Next (N)" button.
    The 'Select server role' screen where Windows Authentication is selected
    The server role list confirming that the Windows Authentication check box is checked

  7. When the "Confirm Installation Options" screen appears, click the "Install (I)" button.
    The Add Roles and Features wizard on the 'Confirm Installation Options' screen

  8. Wait for the installation to complete.
    The wizard while Windows Authentication is being installed

  9. After the installation is complete, click the "Close" button. This procedure is complete.
    The wizard after installation finishes, with the Close button available

Enable Windows authentication

  1. Launch "Internet Information Services (IIS) Manager".
    The Internet Information Services (IIS) Manager window

  2. In the left pane, click [Site] - "Default Web Site". Then click Authentication in the center pane.
    IIS Manager with Default Web Site selected and Authentication in the center pane

  3. "Windows Authentication" is "enabled" and "disable" all other authentication methods.
    The IIS authentication list with only Windows Authentication enabled

Setup for batch processing of user synchronization and reminders

To run scripts that perform user synchronization and reminders via LDAP in an environment with integrated Windows authentication enabled, you have to add a maintenance application by following the steps below.

Create a maintenance application pool

Create a maintenance application pool to run with anonymous authentication.

  1. Launch "Internet Information Services (IIS) Manager".

  2. Select "Application Pools" in the left pane and click "Add Application Pool..." in "Operations" on the right.

  3. Enter the following and click "OK".

    Column name Setting value
    Name Set any name (e.g. MainteAppPool)
    .Net CLR version No managed code
    Managed pipeline mode Integrated
    Start application pool immediately On

    The IIS 'Add Application Pool' dialog filled in for the maintenance pool

  4. Right-click [Sites] and click "Add website".

  5. Enter the following and click "OK.

    Column name Setting value
    Site name Set any name (e.g. Mainte Site)
    Application pool Select the one created in the previous step (e.g. MainteAppPool)
    Content directory - Physical path C:\web\pleasanter\Implem.Pleasanter
    Binding - Type http
    Binding - IP address All unused IP addresses
    Binding - Port 8080 (any port)
    Binding - Host name (blank)
    Start the website immediately On

    The IIS 'Add Website' dialog filled in for Mainte Site on port 8080

  6. Click Mainte Site, double-click authentication, and set it as shown below.

    Column name Setting value
    Anonymous authentication Enabled
    Other than the above All disabled

    The authentication list for Mainte Site with only Anonymous Authentication enabled

  7. Click "Browse *.8080(http)" on the right side of the screen to confirm that Pleasanter login screen will launch.

Setup user synchronization/reminder/API execution via LDAP

Follow the steps below to set up.

In this case, set the "port" specified in step 2 above to be the URL when the process is executed.

(Example) If the port is set to "8080"

  • Usersync URL: http://{ServerName}:8080/users/syncbyldap
  • Reminder URL: http://{ServerName}:8080/reminderschedules/remind?NoLog=1
  • API execution URL: http://{ServerName}:8080/api/items/{record ID}/get

Setup AbsoluteUri

If the above URL is used to execute reminders or to send notifications via API updates, set the normal Pleasanter URL to AbsoluteUri in Service.json to avoid the problem of the URL in the email being the above.
Parameter setting：Service.json

Column name Setting value
AbsoluteUri http://{ServerName}