Container-based Authentication

XperienCentral supports the trusting of the authentication of a backend web container. This means that a user who is successfully logged in on the backend container is trusted and may therefore access XperienCentral without having to supply a username/password combination. XperienCentral supports container-based authentication for all the supported application servers (Apache Tomcat, JBoss, and IBM WebSphere).

In addition to automatically logging a user in, their role (and therefore their permissions) can also be retrieved and passed on to XperienCentral. You also have the option of dynamically creating a new user in XperienCentral if/when a user unknown to XperienCentral logs in. In that case, the user is created in XperienCentral and the role(s) which are assigned in the container can be applied.

Backend SSO for AD FS can also be configured and used in conjunction with the functionality described here. This sits on top of the XperienCentral backend container-based authentication. See Logging in to XperienCentral for complete information on logging in to XperienCentral.

In This Topic

Enabling Backend Container Authorization

To enable XperienCentral for backend container authorization, follow these steps:

1. Navigate to the XperienCentral Setup Tool (<xperiencentral-root>/web/setup).
2. Navigate to the section website_settings.
3. Select the property enable_backend_container_filter.
4. Scroll to the bottom of the Setup Tool dialog box and click [Save Changes].

Back to top

Enabling Dynamic User Creation

XperienCentral makes it possible to create new users when delegating authentication from the web container if they don’t already exist. When an unknown user is authenticated on the web container and accesses XperienCentral for the first time, their username will be added to XperienCentral if enable_backend_container_filter is active, and  'container managed' as access method is added

To enable dynamic user creation, follow these steps:

1. Navigate to the XperienCentral Setup Tool (<xperiencentral-root>/web/setup).
2. Navigate to the section website_settings.
3. Select the property enable_dynamic_user_creation.
4. Scroll to the bottom of the Setup Tool dialog box and click [Save Changes].

Multiple Websites

When XperienCentral receives a log in request from the web container, the filtering mechanism only applies to one specific website (based on the URL). If your XperienCentral deployment contains multiple websites, the new user will only be created in the channel into which they log in. Because an XperienCentral installation cannot contain multiple users with the same username, if a user exists in a website other than the one being accessed and the enable_dynamic_user_creation setting is active, no new user is created, but the existing user will be made available to the channel being logged into.

Back to top

Enabling External Role Synchronization

Users in XperienCentral are assigned one or more roles and each role itself has permissions assigned to it that determine what actions the user has the right to perform. When you enable external role synchronization, when a user is logged in to XperienCentral from a web container and enable_dynamic_user_creation is active, their role(s) are retrieved and are assigned to the user in XperienCentral.

To enable external role synchronization, follow these steps:

1. Navigate to the XperienCentral Setup Tool (<xperiencentral-root>/web/setup).
2. Navigate to the section website_settings.
3. Select the property enable_external_role_synchronization.
4. Click [Save Changes].

Assigning Roles to Users in the Backend Container

Depending on how you implement your backend container solution, how you assign roles to users can be done in any number of ways. What is naturally important is that you do assign roles to users and that the roles you assign can be matched to existing roles in XperienCentral. It is not possible to create new roles within XperienCentral using the role synchronization mechanism. What this means is that typically you will have already created roles in XperienCentral before assigning them to users in your backend container solution.

When matching roles assigned to the user authenticated on the web container against XperienCentral roles, they are matched against the value in the “External name” field of the XperienCentral roles.

Back to top