Configure SmartForms for SQL Server User Manager (SQLUM)

It is not required to have your SmartForms site enabled for SSL but it is recommended.

1. Open Internet Information Services (IIS) Manager.
2. In this example the K2 site is used. Right click the K2 site and select Edit Bindings.
   
3. Click Add.
4. Select https from the Type drop down list and type a new number into the Port field.
5. Select the certificate used for your site. In this example it is the *.denallix.com April 2015 Certificate, which was purchased from a valid Certificate Authority.
   

   When working with systems that are internal to the organization, Self-signed and Domain Certificates can work in the place of purchased certificates. If you plan to also integrate with an online system like Azure Active Directory you will need to use a purchased certificate.

   
   
6. To make sure that the new HTTPS configuration is updated properly in the K2 configuration rerun the K2 blackpearl Setup Manager and the K2 SmartForms Setup Manager

In order for K2 to authenticate the users against SQLUM a K2 Security Provider needs to be installed and configured.

1. Open SQL Manager and connect to the SQL Server where the K2 database is hosted.
2. Execute the following query to register the SQLUM security provider.

3. Restart the K2 blackpearl service.

In order to be able to use the K2 Forms STS for login, the Use for Login setting for the issuer needs to be set to true.

1. Open the K2 Management site and browse to Authentication > Claims > Issuers.
2. Select the K2 Forms STS and click Edit.
3. Check the Use for Login checkbox and click OK.
   
   

   The thumbprint can be obtained from the web.config file located at the following address: C:\Program Files (x86)\K2 blackpearl\WebServices\Identity\Sts\Forms\web.config
   

Claim mappings are used to identify the incoming claims and map them to the appropriate K2 security label.

1. Open the K2 Management site and browse to Authentication > Claims > Claims.
2. Click New on the Security Label section, the New Claim Mapping page opens.
3. Select the Security Provider you configured in Step 2 from the Security Label drop down.
4. Ensure the Claim Type Info checkbox is checked.
5. Select K2 Forms STS from the Issuer drop down.
6. For the Identity Provider Original Issuer textbox enter FormsSTS.
7. For the Identity Provider Claim Type textbox enter http://schemas.microsoft.com/identity/claims/identityprovider.
8. For the Identity Provider Claim Value textbox enter FormsSTS.
9. For the Identity Original Issuer textbox enter FormsSTS.
10. For the Identity Claim Type textbox enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name.
11. Leave the Identity Claim Value textbox empty as this claim will be different for each user at runtime.
12. For Security Label Original Issuer textbox enter FormsSTS.
13. For Security Label Claim Type textbox enter http://schemas.k2.com/identity/claims/securitylabelname.
14. Click OK to add the mapping.
    

    

The Realm is the unique value that associates the SmartForms site with the claims authentication options. Audience URIs are the actual URLs that will be used to access the SmartForms site. Additional Audience URIs can be specified for a single Realm. For example if you use https://k2.denallix.com/Runtime and http://dlx:81/Runtime to access the SmartForms site you will need both URLs registered as Audience URIs.

1. Open the K2 Management site and browse to Authentication > Claims > Realms.
2. The list of Realms should be pre-configured with your Runtime, Designer, and View Flow realms and Audience URIs. For each realm that you want to enable SQLUM authentication on, follow the steps below:

1. Select the desired Realm and click Edit.
2. In the Edit Realm dialog use the check box list to select the desired issuers to map to the realm. For SQLUM select the K2 Forms STS.
3. Click OK.

If K2 Forms STS is the only authentication configured in the Realm to Issuer mapping then you should be redirected to a login screen. If there are other authentication modes configured then you will see a page with a drop down that lets you select the authentication type that you want to use. You may need to clear your browser cache to clear any currently cached credentials.