Configuring Authentication

(LDAP, Active Directory, and SSO)

 

Applies to: Predict! Risk Controller 6 and Higher

 

Overview

Predict! Risk Controller supports multiple authentication methods beyond the built-in database login:

• Active Directory via LDAP
• Single Sign-On via Azure Entra ID (OpenID Connect)
• Windows Authentication with Microsoft SQL Server.

This article covers how to configure each.

Note: Any users authenticated against Active Directory must also exist as users in the Predict! database.

Their Predict! password does not matter as it will not be used.

 

Configure LDAP / Active Directory Authentication

Information required:

• LDAP URL (e.g. ldap://adserver.domain.company.com)
• Bind credentials (domain account username and password)
• Base context (distinguished name of the users folder)
• Short domain name and Fully Qualified Domain Name

 

Configuration Steps:

• Open the file below in a text editor: 
  • \prc6\wf26\standalone\configuration\standalone.xml
• Locate raw-ldap-realm and update the values below with the organisation's Active Directory structure:
  •  search-base-dn
  • filter-base-dn
• Locate <dir-contexts> and update:
  •  the LDAP URL
  • principal (bind account)
  • credential (bind password)
• If using LDAPS (secure LDAP):
  • Change the port from 389 to 636
  • Change the protocol prefix from ldap:// to ldaps://
  • Import the LDAP server's certificate using the InstallCert tool
    • found in the installation media under Scripts\InstallCert 
  • Add the certificate to the jssecacerts trust store.
  • Copy it to \prc6\JDKXX\lib\security
• Save standalone.xml
• Restart the Predict! service for changes to take effect.

Note: The AD login modules must always be placed last in the authentication chain in standalone.xml.

• This prevents failed AD authentication attempts locking Windows accounts when users log in with their Predict! database password.

 

Configure Single Sign-On (SSO) with Azure Entra ID

Part A — Register the application in Azure

1. Go to the Azure Portal (https://portal.azure.com) and navigate to Entra ID.
2. Click Add > App Registration.
   1. Enter a name (e.g. Predict_ServerName)
   2. Select Single Tenant
   3. Enter the Redirect URL as: https://<FQDN>/oidc/oidc.xhtml
   4. Click Register.
3. Navigate to Certificates & Secrets > Client Secrets
4. Click New Client Secret.
   1. Add a description and expiry, then click Add.
   2. Copy the secret value immediately — it will not be shown again.
   3. Store it securely.
5. Note the secret's expiry date.
   1. A new secret must be created and updated in standalone.xml before it expires.
6. Navigate to Token configuration and click Add optional claim.
7. Select the ID token type.
   1. At minimum, tick:
      1. email
      2. family_name
      3. given_name
8. Enable the Microsoft Graph permission when prompted.
9. Repeat for Access token type.
10. Return to Overview and note the following:
    1. Application (client) ID
    2. Directory (tenant) ID.

 

Part B — Configure Predict! for SSO

1. In the Predict! Admin Portal settings, set oidc.enabled to true.
2. Confirm the oidc.war folder is present in: \wf26\standalone\deployments
   • If the folder is missing, fill out a Support form from the Lumivero Community Support Page.
3. Stop the Predict! service.
4. Edit standalone.xml
   1. Locate the OIDC subsystem line
   2. replace it with the full OIDC configuration block:
      1. substituting the tenant ID, client ID, and client secret values obtained from Azure.
5. Save standalone.xml.
6. In \WF26\standalone\deployments, create a file named oidc.war.dodeploy
   1. ensure the file extension is exactly .dodeploy, not .dodeploy.txt
7. Start the Predict! service.
8. On the Predict! login page, click Log in with Microsoft to authenticate via SSO.

Note: The first time the App registration is used, admin consent will be required in Azure. Once granted, this prompt will not appear again.

 

Windows Authentication with Microsoft SQL Server

1. Copy mssql-jdbc_auth-11.2.1.x64.dll from \prc6\DbConnectors\auth\x64 to the Windows system32 folder.
2. Open standalone.xml
3. Locate the datasource node for the Predict! database.
4. Remove the <security> node containing the username and password elements.
5. Append ;integratedSecurity=true to the connection-url element.
6. In the Windows Services control panel:
   1.  Open the Predict! Risk Controller service properties.
   2. On the Log On tab:
      1. Change the account from Local System to the domain account that has access to the Predict! database.
7. Restart the Predict! service.

Note: The account used must have both the 'Log on as a service' right and local administrator access on the host machine.

 

Troubleshooting

• If users cannot authenticate via AD
  • Test the connection from the application server by running: telnet AD_Server:port
    • This confirms whether the AD server is reachable.
• If LDAP certificates expire
  • The InstallCert process must be repeated to avoid interrupting Predict! access.
• If SSO is configured but users are redirected to a consent screen repeatedly
  • An Azure administrator must grant consent for the App registration.