NetIQ Access Manager 3.2 SP3 Identity Server Guide

NetIQ Access Manager 3.2 SP3 Identity Server Guide

Configuring an Identity Server

Managing a Cluster Configuration

Enabling Role-Based Access Control

Enabling External Attributes Policy

Configuring Secure Communication on the Identity Server

Security Considerations

Translating the Identity Server Configuration Port

Using netHSM for the Signing Key Pair

Customizing Login Pages, Logout Pages, and Messages

Customizing the Identity Server Login Page

Customizing the Identity Server Logout

Customizing Identity Server Messages

Sample Custom Login Pages

Preventing Cross-site Scripting Attacks

Configuring Local Authentication

Configuring Identity User Stores

Creating Authentication Classes

Configuring Authentication Methods

Configuring Authentication Contracts

Specifying Authentication Defaults

Managing Direct Access to the Identity Server

Configuring Advanced Local Authentication Procedures

Configuring for RADIUS Authentication

Configuring Client Integrity Check

Configuring Mutual SSL (X.509) Authentication

Creating an ORed Credential Class

Configuring for OpenID Authentication

Configuring Password Retrieval

Configuring Access Manager for NESCM

Configuring for Kerberos Authentication

Configuring Active Directory

Configuring the Identity Server

Configuring the Clients

Configuring the Access Gateway for Kerberos Authentication

Defining Shared Settings

Configuring Attribute Sets

Editing Attribute Sets

Configuring User Matching Expressions

Adding Custom Attributes

Adding Authentication Card Images

Creating an Image Set

Metadata Repositories

Configuring SAML and Liberty Trusted Providers

Understanding the Trust Model

Configuring General Provider Options

Managing Trusted Providers

Modifying a Trusted Provider

Configuring Communication Security

Selecting Attributes for a Trusted Provider

Managing Metadata

Configuring an Authentication Request for an Identity Provider

Configuring an Authentication Response for a Service Provider

Routing to an External Identity Provider Automatically

Defining Options for Liberty or SAML 2.0

Defining Options for SAML 1.1 Service Provider

Defining Session Synchronization for the A-Select SAML 2.0 Identity Provider

Configuring the Liberty or SAML 2.0 Session Timeout

Managing the Authentication Card of an Identity Provider

Using the Intersite Transfer Service

Enabling or Disabling SAML Tags

Sample Configurations

Configuring CardSpace

Overview of the CardSpace Authentication Process

Prerequisites for CardSpace

CardSpace Configuration Scenarios

Configuring the Identity Server as a Relying Party

Configuring the Identity Server as an Identity Provider

Using CardSpace Cards for Authentication to Access Gateway Protected Resources

Managing CardSpace Trusted Providers

Managing Card Templates

Configuring Authentication Cards

Cleaning Up Identities

Configuring STS

Configuring STS Attribute Sets

Configuring Authentication Methods

Configuring the Authentication Request

Configuring WS Federation

Using the Identity Server as an Identity Provider for ADFS

Using the ADFS Server as an Identity Provider for an Access Manager Protected Resource

Managing WS Federation Providers

Modifying a WS Federation Identity Provider

Modifying a WS Federation Service Provider

Configuring Active Directory Federation Services with SAML 2.0

Prerequisites and Requirements

Configuring Access Manager as a Claims or Identity Provider and AD FS 2.0 as Relying Party or Service Provider

Configuring AD FS 2.0 as the Claims or Identity Provider and Access Manager as the Relying Party or Service Provider

AD FS 2.0 Basics

Troubleshooting

Overview

Configuring the SP Broker

Creating and Viewing Brokering Groups

Generating the Brokering URLs by Using an ID and Target in the Intersite Transfer Service

Assigning The Local Roles Based On Remote Roles And Attributes

Configuring User Identification Methods for Federation

Defining User Identification for Liberty and SAML 2.0

Defining User Identification for SAML 1.1

Defining the User Provisioning Method

User Provisioning Error Messages

Configuring Communication Profiles

Configuring a Liberty Profile

Configuring a SAML 1.1 Profile

Configuring a SAML 2.0 Profile

Configuring Liberty Web Services

Configuring the Web Services Framework

Managing Web Services and Profiles

Configuring Credential Profile Security and Display Settings

Customizing Attribute Names

Configuring the Web Service Consumer

Mapping LDAP and Liberty Attributes

Maintaining an Identity Server

Managing an Identity Server

Editing Server Details

Configuring Component Logging

Configuring Session-Based Logging

Monitoring the Health of an Identity Server

Monitoring Identity Server Statistics

Monitoring API for the Identity Server Statistics

Enabling Identity Server Audit Events

Monitoring Identity Server Alerts

Viewing the Command Status of the Identity Server

Tuning the Identity Server for Performance

Basic Tuning Options

Disabling User Profile Objects

Configuring a Specific IP Address for Proxied Requests

Configuring Java Memory Allocations

Troubleshooting Identity Server and Authentication

Useful Networking Tools for Linux Identity Server

Troubleshooting 100101043 and 100101044 Liberty Metadata Load Errors

Authentication Issues

Problems Reading Keystores after Identity Server Re-installation

After Setting Up the User Store to Use SecretStore, Users Report 500 Errors

When Multiple Browser Logout Option Is Enabled User Is Not Getting Logged Out From Different Sessions

302 Redirect to 'RelayState' URL after consuming a SAML Response is being sent to an incorrect URL

Configuring SAML 1.1 Identity Provider Without Specifying Port in the Login URL Field

Attributes are Not Available Through Form Fill When OIOSAML Is Enabled

Issue in Importing Metadata While Configuring Identity Provider or Service Provider Using Metadata URL

Enabling Secure or HTTPOnly Flags for Cluster Cookies

Apache Portable Runtime Native Library Does Not Get Loaded in Tomcat

Metadata Mentions Triple Des As Encryption Method

Issue in Accessing Protected Resources with External Identity Provider When Both Providers Use Same Cookie Domain

SAML Intersite Transfer URL Setup Does Not Work for Non-brokered Setups After Enabling SP Brokering

Orphaned Identity Objects

Users cannot Log In to Identity Provider When They Access Protected Resources With Any Contract Assigned

Attribute Query from OIOSAML.SP Java Service Provider Fails with Null Pointer

Disabling the Certificate Revocation List Checking

Step up Authentication for the Identity Server Initiated SSO to External Provider Does not Work Unless It has a Matching Local Contract

Metadata Cannot be Retrieved from the URL

Requesting the Authentication to a Service Provider Fails

SAML 2.0 POST Compression Failure Does not Throw a Specific Error Code

SAML 1.1 Service Provider Re-requests for Authentication

LDAP Authentication Fails while Accessing the Secret Store

Issue in Generating WS-Federation Claim for SharePoint 2010 On Windows

Understanding How Access Manager Uses SAML

Attribute Mapping with Liberty

Trusted Provider Reference Metadata

Identity Federation

Authorization Services

What's New in SAML 2.0?

Identity Provider Process Flow

SAML Service Provider Process Flow

Data Model Extension XML

Elements

Writing Data Model Extension XML