PAS for OpenEdge SSO supports the sealing and validation of both single and multi-tenant Client-Principal tokens via the OEClientPrincipalFilter bean, which is configured in the oeablSecurity.properties file. The OEClientPrincipalFilter bean becomes the single point that manages all aspects of translating Spring tokens to Client-Principal tokens, the sealing of Client-Principal tokens, and the validation of Client-Principal tokens across all methods of direct-login and SSO.

All OpenEdge products that produce or consume Client-Principal tokens, including PAS for OpenEdge, are expected to define and use unique OE domain names, with each OE domain having a secret access code that is configured in each product that uses the OE Domain. Each OpenEdge product is configurable to use some or all of the enterprise’s defined OE Domains, in effect adding a level of Domain authorization to a Progress component. PAS for OpenEdge supports this architectural model

PAS for OpenEdge’s web service SSO requires configuring a minimum of one Domain/Access-code pair, and may support multiples by using a multi-domain Registry (generated by the gendomreg utility). The ABL business application that receives an SSO token is expected to be configured with the same OE Domain name(s) and access codes. An SSO token MUST be validated using a Domain configuration before it can be accepted as proof of the client’s ability to use services and to be passed to the ABL business applications.