2.2.3 Managing a Cluster of Identity Servers

Base URL

Specify the application path for Identity Server. Identity Server protocols rely on this base URL to generate URL endpoints for each protocol.

Default Timeout

Specify the session timeout you want assigned as a default value when you create a contract. This value is also assigned to a session when Identity Server cannot associate a contract with the authenticated session. During federation, if the authentication request uses a type rather than a contract, Identity Server cannot always associate a contract with the request.

Deleting Previous User Sessions

You can configure Identity Server to delete the previous user sessions if the number of open sessions reaches the maximum limit of allowed sessions that you have specified in Limit User Sessions. Set the DELETE OLD SESSIONS OF USER option to true and restart Identity Server. For information about how to configure this option, see Configuring Identity Server Global Options. Previous sessions are cleared across Identity Server clusters only when a fresh authentication request comes in. When Identity Server deletes previous user sessions, it sends a logout request to the service provider through the SOAP back channel.

For example, a user is accessing a protected resource from a machine and wants to access the same protected resource from another device. Identity Server will not give access to the user if the Limit User Sessions has reached a maximum limit. Identity Server must terminate the old session of the user so that the user can access the new session seamlessly.

Proxy

Specify the duration (in seconds) that a request to another cluster member can take before timing out. When a member of a cluster receives a request from a user who has authenticated with another cluster member, the member sends a request to the authenticating member for information about the user.

Level Four Switch Port Translation

Configure the L4 switch to translate the port of the incoming request to a new port when the request is sent to a cluster member. Because the cluster members communicate with each other over the same IP address/port as the L4 switch, the cluster implementation needs to know what that port is. The translated port is the port on the cluster members where other cluster members can contact it. This is the IP address and port where cluster members provide proxy requests to other cluster members.

ALLOW GRACE LOGIN FOR EXPIRING PASSWORD

(Access Manager 4.5 Service Pack 4 and later)

When the value is set to true, users get grace logins when their password is about to expire. By default, the property is set to true on all Identity Server clusters.

Select false if you do not want users to get a grace login for an expiring password.

In case of Active Directory, this option works when the pwdlastset attribute has a zero value (pwdlastset=0) in the user store. This means users must change their password at the next login.

If you set this option to false, the user will not be redirected to Password Management Servlet (if configured).

CLUSTER COOKIE PATH

Set this property to change the Path attribute of the Identity Server cluster cookie. The default value is /nidp.

For example, see Configuring X.509 Authentication to Display the Access Manager Error Message.

DELETE OLD SESSIONS OF USER

Select true to enable Identity Server to delete the previous user sessions if the number of open sessions reaches the maximum limit of allowed sessions that you have specified in Limit User Sessions. The default value is false.

HTTP POPULATE LOGINNAME FROM SAML AUTH REQUEST

(This option is available in Access Manager 4.5 Service Pack 1 or later versions)

Select true to auto-populate the email ID on the Identity Server login page for a SAML 2.0 authentication. The default value is false.

For more information about this option, see Auto-Populating the Username on the Identity Server Login Page.

HTTP POPULATE LOGINNAME FROM WSFED AUTH REQUEST

(This option is available in Access Manager 4.5 Service Pack 1 or later versions)

Select true to auto-populate the email ID on the Identity Server login page for a WS-Fed authentication request. The default value is false.

IS SAML2 POST INFLATE

Select true to enable Identity Server to receive deflated SAML 2.0 POST messages from its trusted providers. The default value is false.

You can configure post binding to be sent as a compressed option by configuring this property. For example, see the note in Step 4.

LOGIN CSRF CHECK

Select true to enable Cross-Site Request Forgery (CSRF) check for the Password Class and TOTP Class.

This is applicable for Access Manager default pages. If you have modified any page, you must add the CSRF token to the page. To add the CSRF token, add the following:

JAVA:

<%
String sid = request.getParameter("sid")!=null ? request.getParameter(NIDPConstants.SID) : (String)request.getAttribute(NIDPConstants.SID);
NIDPSessionData sData = NIDPContext.getNIDPContext().getSession(request).getSessionData(sid);
boolean csrfCheckRequired = NIDPEdirConfigUtil.isConfigured(NIDPConfigKeys.LOGIN_CSRF_CHECK.name()) ?     NIDPEdirConfigUtil.getValueAsBoolean(NIDPConfigKeys.LOGIN_CSRF_CHECK.name()) : false; 
%>

HTML:

<% if (csrfCheckRequired) { %>
           <input type="hidden" name="AntiCSRFToken" value=" <%=sData.getAntiCSRFToken()%>">
<% } %>

RENAME SESSION ID

Select false to prevent changing the session ID automatically. The default value is true.

SAML2 ATTRIBUTE CONSUMING INDEX

This option can be used to identify globally the value of AttributeConsumingServiceIndex of SAML 2 authentication requests. If SAML2 ATTRIBUTE CONSUMING INDEX is not configured in SAML 2.0 options, then Access Manager considers the SAML2 ATTRIBUTE CONSUMING INDEX configuration in Identity Server global options. If you require to assign the property values for multiple entries, you can use comma (,) as separator.

You can provide the value in the format specified in the following example:

For protected resource URL: https://www.example.com:446/test/Test/test.php->2

In this example, the value 2 is assigned to AttributeConsumingServiceIndex of SAML 2 authentication request coming from the mentioned protected resource.

For default value: default->10

If the SAML 2 authentication request comes from the protected resource that is not configured, then the default value, 10 gets assigned to AttributeConsumingServiceIndex.

For multiple protected resource URLs: https://www.example.com:446/test/Test/test.php->2,https://www.example.com:446/test/Test/view.php->3

STS CHANGE ISSUER

Specify the value in this format: SPentityID:UPNDomain -> new IssuerID. For example, urn:federation:MicrosoftOnline:support.namnetiq.in -> https://namnetiq.in/nidp/wsfed/

In case of multiple children domains, add each parent domain and child domain separated by a comma. For example, if namnetiq.in is the parent domain and support.namnetiq.in and engineering.namnetiq.in are children domains, specify the following entries:

urn:federation:MicrosoftOnline:namnetiq.in -> https://namnetiq.in/nidp/wsfed/, urn:federation:MicrosoftOnline:support.namnetiq.in -> https://namnetiq.in/nidp/wsfed/, urn:federation:MicrosoftOnline:engineering.namnetiq.in -> https://namnetiq.com/nidp/wsfed/

For example, see Configuring Federation for Multiple Domains.

WSF SERVICES LIST

Select full to enable users to access the Services page.

Select 404 to return an HTTP 404 status code: Not Found.

Select 403 to return an HTTP 403 status code: Forbidden.

Select empty to return an empty services list.

The default value is full.

For example, see Blocking Access to the WSDL Services Page.

WSTRUST AUTHORIZATION ALLOWED ACTAS VALUES

Specify the user names who can perform ActAs operations. Allowed user names are the user accounts that the intermediate web service provider uses to authenticate with STS when sending a request with ActAs elements.

You can specify more than one user name separated by a comma.

For example, see Adding Policy for ActAs and OnBehalfOf.

WSTRUST AUTHORIZATION ALLOWED VALUES

Specify the user names who can perform both ActAs and OnBehalfOf operations.

You can specify more than one user name separated by a comma.

For example, see Adding Policy for ActAs and OnBehalfOf.

SESSION ASSURANCE USER AGENT REGEX EXCLUDE LIST

Specify the user-agent REGEX for that you want to disable the session validation.

For example, see Disabling Advanced Session Assurance for Identity Server.

SESSION ASSURANCE URL REGEX EXCLUDE LIST

Specify the URL REGEX for that you want to disable the session validation.

For example, see Disabling Advanced Session Assurance for Identity Server.

OTHER

Specify Property Name and Property Value if you want to configure any other property.

ENCODE_TARGET_URL_QUERY

Click OTHER to configure this property.

When this option is set to true, the target URL query (SAML Request) is URL encoded. This option is set to true by default.

When you set this option to false, the following will happen after authentication:

persist_caches_on_reconfigure

(This option is available in Access Manager 4.5 Service Pack 3 or later versions)

Click OTHER to configure this property.

After you update a configuration or reconfigure it, the user session details and read attributes get deleted from the cache. Set this option to true to retain the details after a configuration update.