Home
HCL Sametime® Administration Guide 12
Securing
This section provides information on securing your HCL Sametime environments.
Enabling Single Sign-on
The HCL Sametime server installer enables required JSON Web Token (JWT) authentication. Additionally, the Sametime server supports Security Assertion Markup Language (SAML) and Lightweight Third Party Authentication (LTPA) Single Sign-on (SSO).
Setting up SSO using LTPA
You can implement SSO into your environment using Lightweight Third Party Authentication (LTPA) which requires LTPA keys.
Configuring LTPA in Kubernetes
This topic includes the steps to configure LTPA keys on Kubernetes.

HCL Sametime® Administration Guide 12
- Accessibility features for Sametime
  Accessibility features help users who have a disability, such as restricted mobility or limited vision, to use information technology products successfully. HCL® strives to provide products with usable access for everyone.
- New features in Sametime 12
  The current version of HCL Sametime and HCL Sametime Premium includes new features and enhancements.
- Planning
  This section describes the system requirements and server configurations needed for HCL Sametime and HCL Sametime Premium.
- Installing
  This section provides information on installing and configuring the servers for HCL Sametime and HCL Sametime Premium.
- Configuring
  This section provides information on configuring the HCL Sametime server.
- Securing
  This section provides information on securing your HCL Sametime environments.
  - Encryption usage in Sametime
    HCL Sametime uses several types of encryption to protect data.
  - Securing connections
    The various interactions that occur on the Sametime server can be secured.
  - Enabling Single Sign-on
    The HCL Sametime server installer enables required JSON Web Token (JWT) authentication. Additionally, the Sametime server supports Security Assertion Markup Language (SAML) and Lightweight Third Party Authentication (LTPA) Single Sign-on (SSO).
    - Setting up SSO using LTPA
      You can implement SSO into your environment using Lightweight Third Party Authentication (LTPA) which requires LTPA keys.
      - Generating LTPA keys
        Lightweight Third Party Authentication (LTPA) uses keys to encrypt and decrypt data being passed.
      - Configuring LTPA in Docker or Podman
        This topic includes the steps to configure LTPA keys on Docker.
      - Configuring LTPA in Kubernetes
        This topic includes the steps to configure LTPA keys on Kubernetes.
      - Integrating with HCL Connections
        You can integrate Sametime to enable chat services in HCL Connections.
      - Integrating Sametime with HCL Domino
        This topic includes the procedure to enable LTPA when Sametime is integrated with the Domino server for use with web based mail, Verse and iNotes.
    - Setting up SSO using SAML
      You can implement SSO into your environment using Security Assertion Markup Language (SAML). The process is different for Kubernetes and Docker.
  - Enabling security in MongoDB
    To enable MongoDB securing, edit the mongod.conf file authorization: enabled setting.
  - Setting up TLS for the Mongo database
    You can update the MongoDB connection with the Sametime server to encrypt data flowing between the Sametime server and a TLS-enabled MongoDB. This step is optional but is recommended for multi-Kubernetes-cluster deployments.
  - Obtaining the cert.key and cert.crt files for Sametime
  - Replacing the TLS certificates for Web Chat and Meetings
    The Sametime server is pre-configured with a self-signed certificate. You can replace the self-signed certificate with a third-party certificate.
  - Applying Let's Encrypt certificates
    This topic describes how to replace the self-signed certificate with a third-party certificate.
- Administering
  This section provides information on administering on Sametime environments.
- Troubleshooting
  This section provides information on troubleshooting and supporting Sametime environments.
- Uninstalling Sametime
  In the event that Sametime must be uninstalled, follow these steps to uninstall the Community, Proxy, and Meetings servers.
- Migrating and Upgrading
  This section provides information on migrating data from an earlier release to Sametime 12.
- Notices

Configuring LTPA in Kubernetes

This topic includes the steps to configure LTPA keys on Kubernetes.

Before you begin

You must have already created a secret that contains your LPTA keys before you can compete this task. For more information on using WebSphere Liberty to generate LTPA keys, see Generating LTPA keys.

About this task

The changes in this task affect the following pods:

community

Procedure

Create a secret that contains your LTPA keys.

kubectl create secret generic ltpa-keys --from-file=./ltpa.keys

Change to the helm/templatesdirectory and open the sametime-secrets.yaml file.
Find the base64 encoded value for your pass code.
To base64 encode the password, you can enter the following command in a Linux shell:
```
echo -n ltpa_key_password
```
Locate the LtpaKeysPassword line and replace the existing text with the base64 encoded LTPA key password.
Save and close the sametime-secrets.yaml file.
In the helm/values.yaml file set enableLtpa to true.
enableLtpa = true
Apply your changes to the environment.
Verify that you are in the helm directory and run the following command to apply changes. Specify the Sametime deployment name for your environment. The default for Sametime Premium version 12 is sametime.
```
helm upgrade sametime_deployment_name .
```
Note: Be sure to include the dot at the end. It is part of the command.
If you are unsure of your deployment name, issue the helm list command to find the name. If you upgraded from an earlier Sametime release, the default name is sametime-meetings.
Restart the pods with the changes. Use the kubectl scale command to scale the pods to zero and then to one that have been changed. You must run the commands for each pod that the change affects.
1. Run the following command to scale the pod to zero.
  Scale the pod to zero, where pod_deployment_name is the pod name.
```
kubectl scale deploy pod_deployment_name --replicas=0
```
2. Run the following command to scale the pod to one.
```
kubectl scale deploy pod_deployment_name --replicas=1
```