Configure Your First Gateway

Purpose

This section covers configuring the JD Edwards nodes required for SSO, including gateway, web server, and enterprise server components.

Procedure

Step 1: Access the SSO Configuration Tools in JD Edwards

• Log in to JD Edwards as an administrator.

• Access the SSO Configuration Tools using one of the following paths:

Path A - Via menu navigation:

1. Navigate to Single Sign-On → SSO Environment Configuration Tools.

2. The SSO Environment Configuration Tools screen opens displaying three options relevant to this setup: Single Signon Node Configuration, Single Signon Token Lifetime Configuration, and Single Signon Trusted Node Configuration.

Path B - Via application P986115:

1. Launch application P986115 directly.

2. On the Machine Search & Select screen, click Form in the toolbar.

3. Three options are available: Node Configuration, Token Lifetime Cfg, and Trusted Node Config.

Step 2: Configure Nodes in JD Edwards

1. Select Single Signon Node Configuration (Path A) or Node Configuration from the Form menu (Path B).

2. On the Single Sign-On - Work With Node Configuration form, click Add.

3. Create nodes for each JD Edwards component:

   • Gateway - Required for token generation.

   • Web Server - Recommended per server; covers AIS and JAS. You may create separate nodes for AIS and JAS, or share nodes if desired.

   • Enterprise Server - Each JD Edwards component is represented as a node. Trust must be established between nodes for token handoff.

4. On the SSO Node Configuration Revisions form, complete the following fields:

5. Click Save.

The new nodes now appear in the list of nodes.

Step 3: Set Token Lifetime

1. Navigate to the token lifetime configuration: via menu select Single Signon Token Lifetime Configuration; via P986115 select Token Lifetime Cfg from the Form menu. On the Single Sign-On - Work With Token Lifetime Configuration form, click Add.

2. In the Node Name field, enter or search for the required node.

3. Select the appropriate node.

4. On the Single Sign-On - Token Lifetime Configuration Revision form, complete these fields:

   • Regular Token Lifetime

     Specify the expiration time for a regular token. The default value for a node is 720 minutes (12 hours).

   • Extended Token Lifetime

     Specify the expiration time for an extended token. The default value is 4320 minutes (three days).

5. Click Save.

Step 4: Add Enterprise Server Trusted Node Configuration

Trusted node configuration establishes which nodes are permitted to validate tokens generated by other nodes. This is required so that authenticated tokens can be passed securely between the gateway, web server (JAS/AIS), and enterprise server without each connection requiring a separate login. Configure trust so that each enterprise server trusts its web server, and each web server trusts the gateway node. Enterprise servers do not need to trust the gateway directly.

For more information, see How a Node Validates an Authenticate Token.

1. Navigate to the trusted node configuration: via menu select Single Signon Trusted Node Configuration; via P986115 select Trusted Node Config from the Form menu. On the Single Sign-On - Work With Trusted Node Configuration form, click Add.

2. In the Node Name field, enter or search for the node that will trust another node (for example the web server node).

3. In the Trusted Node Name field, enter or search for the node being trusted (for example the gateway node).

4. Repeat for all required trust relationships.

5. Click Save.

Result

The JD Edwards nodes are configured, token lifetimes are set, and trust relationships between enterprise servers, web servers, and the gateway have been established. The gateway configuration is complete and ready for SSL certificate and IdP setup.

Purpose

This section covers configuring SSL certificates required for signing JWT tokens generated by the gateway. This requires storing the certificate in a Java keystore on the JD Edwards web servers. Node configuration must already be completed before starting this step.

Procedure

Step 1: SSL Certificate Creation and Configuration

Create an SSL certificate to be used for JWT token signing.

• The certificate can be self-signed, internally signed, or publicly signed

• The certificate must include a private key

• Load the certificate into a Java keystore format

• Ensure the keystore file is local to the JD Edwards web server where it will be used

• Securely store the keystore location and keystore password

Step 2: Apply SSL Certificate to JD Edwards Services

After setting up the SSL certificate, the next step is to apply it to the JD Edwards services (JAS and AIS) and ensure the proper configuration for token signing.

• Apply the certificate to the JAS and AIS servers.

• If multiple servers are used, repeat this configuration on each server

• Ensure that Allow JWT Token Login is enabled.

• If PS token login is in use, Allow PS Token Login should be enabled as well.

• After configuring, synchronise the settings and restart the affected services to apply the changes.

Result

SSL certificates are configured and applied for secure JWT token signing.

Purpose

This part covers the configuration of Single Sign-On (SSO) in your Identity Provider (IdP) for user authentication with Cantara.

Procedure:

Step 1: Register Application in IdP

• Log in to your Identity Provider (IdP) (for example, Microsoft Entra ID, Okta and so on).

• Register the Application that will be used for Single Sign-On.

Step 2: Configure Redirect URI

• Set the Redirect URI in the IdP:

  • Ensure the Redirect URI matches what is configured in Cantara, as it must be registered with your IdP to avoid errors during the authentication flow.

  • Example Redirect URI:
    https://<instance-name>.gw.cantara.cloud/security/oauth/auth

Step 3: Generate Client Secret

• Generate the Client Secret for the application.

Step 4: Configure SSO Endpoints

• Obtain the following SSO endpoints from the IdP’s application configuration:

  • Authorization Endpoint

  • Token Endpoint

  • JWKS URL

Step 5: Configure ID Token Claims

• Configure the ID token to include the JDE username field (email or USERID).

(Optional) Step 6: Configure Access Control

• Access can be further restricted by assigning users or groups in the IdP.

• Go to Users and Groups and assign the users or groups allowed to access the application.

Result

SSO is configured in the Identity Provider and ready for integration with Cantara.

Purpose

Configure the Cantara gateway by uploading the SSL certificate and defining gateway, authentication, and service settings required to connect to JD Edwards.

This procedure involves three steps:

1. Load the SSL certificate into Cantara.

2. Configure the gateway, including authentication, security, and OAuth 2.0 settings.

3. Configure the AIS or JAS service connection.

Procedure

Step 1: Load SSL Certificate

1. In Cantara, navigate to Certificates.

2. Click + Add Certificate.

3. Click + Choose file and upload the certificate.

4. Complete the following fields:

5. Click Save Certificate.

Result

The certificate is uploaded and available for use. The expiry date is displayed to confirm validity. The certificate can be reused across namespaces.

---

Step 2: Configure Gateway in Cantara

1. In Cantara, navigate to Gateways.

2. Select the appropriate namespace.

3. Click + Add Gateway.

4. Complete the following fields:

Add Gateway

Complete the following required fields:

The following fields are optional and can be configured as needed:

JWT Authentication

JDE Security

OAuth 2.0 Configuration

 Result
The gateway is configured with authentication, identity mapping, and connectivity to JD Edwards.

---

Step 3: Configuring AIS or JAS Service in Cantara

1. Select the required service:

• AIS

• JAS

2. Set Up Connection Node

• Select the Scheme from the dropdown:

  • HTTP

  • HTTPS

• Enter Host details.

  • DNS name of your secure endpoint

Result

The gateway is configured to route requests to the JD Edwards.

---

Step 4: Network Requirements

Before the gateway can communicate with JD Edwards, ensure the following network configurations are complete.

IP Whitelisting

Allow traffic from Cantara IP addresses:

Configure firewall and network controls to allow traffic only from the aforementioned IPs. Collaborate with your network or system administrators to ensure these settings are applied correctly.

Optional: Load Balancing

If your environment uses multiple AIS or JAS nodes, load balancing can be configured.

• Additional nodes can be added in Cantara

• Health checks should be enabled for multi-node setups

For single-node environments, load balancing is not required.

Result:

The AIS or JAS service is now available through the Cantara gateway using the configured authentication and network settings.

What’s next? 

• You can now optionally set up SCIM provisioning, see Part Five: (Optional) SCIM Provisioning.

• Once the gateway is configured, Gateway Access Control can be configured to manage access to services and functions, see .

Purpose

Configure SCIM provisioning to automate user and group synchronisation between your Identity Provider (IdP) and the Cantara platform.

Overview

SCIM is an optional feature that automates user provisioning and manages access across your Identity Provider and Cantara. It does not affect user authentication. If your IdP supports SCIM, you can enable automatic provisioning so that user accounts and group memberships are managed in the IdP and synced into Cantara.

For detailed setup instructions, see the following topics:

• Configure SCIM Provisioning — Step-by-step guide for generating a provisioning token and configuring SCIM in your IdP.

• Configure OAuth 2.0 Authentication for Cantara with Microsoft Entra ID — Includes Microsoft Entra ID–specific SCIM provisioning steps.