45.4 Configuring Access Manager to Work with Identity Manager

To ensure that Access Manager recognizes Identity Manager as a trusted service provider, add the metadata text for OSP to the Identity Server and configure an attribute set. This process includes the following activities:

45.4.1 Copying the Metadata for Identity Manager

Access Manager needs the metadata text for OSP. You should copy the contents of the metadata .xml file to a document that you can open on the Access Manager Identity Server.

  1. In a browser, navigate to the URL for the OSP metadata. By default, Identity Manager uses the following URL:

    https://server:port/osp/a/idm/auth/saml2/spmetadata

    where server:port represent the Tomcat server that hosts OSP.

  2. View the page source for the spmetadata.xml file.

  3. Copy the contents of the file to a document that you can access in Adding Identity Manager as a Trusted Service Provider

45.4.2 Creating an Attribute Set for SAML

To ensure that SAML can perform an assertion exchange between Access Manager and OSP, create an attribute set in Access Manager. Attribute sets provide a common naming scheme for the exchange. OSP looks for an attribute value that identifies the subject of the assertion. By default, the attribute is mail.

For more information, see “Configuring Attribute Sets” in the NetIQ Access Manager Identity Server Guide.

  1. Open the Administration Console for Access Manager.

  2. Click Devices > Identity Servers > Shared Settings > Attribute Sets > New.

  3. Specify a name for the attribute set. For example, IDM SAML Attributes.

  4. Click Next, and then click New.

  5. For Local Attribute, select Ldap attribute: mail [LDAP Attribute Profile].

  6. For Remote Attribute, specify mail.

  7. Click OK, and then click Finish.

45.4.3 Adding Identity Manager as a Trusted Service Provider

Configure Access Manager to recognize Identity Manager as a trusted service provider. For more information, see “Creating a Trusted Service Provider for SAML 2.0” in the NetIQ Access Manager Identity Server Guide.

  1. Open the Administration Console for Access Manager.

  2. Click Devices > Identity Servers > Edit > SAML 2.0.

  3. Click New > Service Provider.

  4. For Provider Type, specify General.

  5. For Source, specify Metadata Text.

  6. In the Text field, paste the contents of the spmetadata.xml file that you copied in Copying the Metadata for Identity Manager.

  7. Specify a name for the new OSP service provider.

  8. Click Next, then click Finish.

  9. On the SAML 2.0 tab, select the OSP service provider that you created in Step 7.

  10. Click Attributes.

  11. Select the attribute set that you created in Creating an Attribute Set for SAML. For example, IDM SAML Attributes.

  12. Move the attributes available for the OSP service provider set to the Send with authentication panel on the left side of the page.

    The attributes that you move to the Send with authentication panel are the attributes that you want to be obtained during authentication.

  13. Click OK twice.

  14. To update the Identity Server, click Devices > Identity Servers > Update > Update All Configuration.