Novell ACCESS MANAGER 3.1 SP2 BETA 1 - SCENARIOS... User manual

Access Manager 3.1 SP2 Beta 1 Scenarios 1

novdocx (en) 17 September 2009

Novell®

Access Manager 3.1 SP2 Beta 1

Scenarios

December 21, 2009

The following scenarios have been designed to introduce you to the new features in Access Manager

3.1 SP2.

Section 1, “Linux Access Gateway Appliance Scenarios,” on page 1

Section 2, “Timeout Per Protected Resource Scenarios,” on page 5

Section 3, “Access Gateway Service Scenarios,” on page 10

Section 4, “SSL VPN Server Scenarios,” on page 11

1 Linux Access Gateway Appliance Scenarios

Section 1.1, “Installing the SLES 11 Version,” on page 1

Section 1.2, “Upgrading the Linux Access Gateway Appliance,” on page 2

Section 1.3, “Migrating a SLES 9 Access Gateway to SLES 11,” on page 3

Section 1.4, “Configuring Timeout Per Protected Resource,” on page 5

1.1 Installing the SLES 11 Version

This beta scenario introduces you to the new Access Gateway Appliance which is built on SUSE®

Linux Enterprise Server (SLES 11). The SLES 11 version of the Access Gateway Appliance

supports newer hardware, and SLES 11 is a supported operating system that provides security

updates.

The previous version of the Access Gateway Appliance is built on SLES 9 SP3. The SLES 9

operating system is no longer a supported operating system and does not run on the latest hardware.

1.1.1 Assumptions

You need an installed 3.1 SP2 version of the Administration Console and Identity Server. For

installation information, see the Access Manager Installation Guide (http://www.novell.com/

documentation/beta/novellaccessmanager31/installation/data/bookinfo.html).

1.1.2 Known Issues

Bug 554518 -Network mode of installation through TFTP is not supported

Bug 560278 -Installation: There is no provision to return to the configuration screen to make

changes

Bug 559398 - The network gateway address is removed when the network interface is restarted.

Bug 558698 - The Linux Access Gateway SLES 11 appliance installation summary screen does

not display SSL VPN, even if the Install and Enable SSL VPN option is selected. Also, the

installation does not perform a password strength check.

2Access Manager 3.1 SP2 Beta 1 Scenarios

novdocx (en) 17 September 2009

1.1.3 Procedure

For installation instructions, see “Installing the Linux Access Gateway Appliance” (http://

www.novell.com/documentation/beta/novellaccessmanager31/installation/data/bd1egh.html).

1.1.4 Test Results

To verify the installation of the Linux Access Gateway Appliance:

1Log in to the Administration Console.

2Click Devices > Access Gateways.

If the installation was successful, the IP address of your Access Gateway appears in the Server

list.

1.1.5 Troubleshooting Tips

For installation issues, refer to the following logs:

RPM installation log file:

/tmp/novell_access_manager/inst_lag.log

Autoimport log file:

/tmp/novell_access_manager/inst_lag_import_<date>.log

Auto partition log file:

/var/adm/autoinstall/logs/diskParitition.sh.log

JCC configuration logs:

/opt/novell/devman/jcc/logs/configure.log.0

1.2 Upgrading the Linux Access Gateway Appliance

This scenario explains how you can upgrade the SLES 9 Linux Access Gateway Appliances in a

cluster from 3.0 SP4 to 3.1 SP2 and use the timeout per protected resource feature.

1.2.1 Assumptions

Your current Access Manager setup has a 3.0 SP4 IR4 version of the Administration Console, the

Identity Server, and the Linux Access Gateway Appliance. The secondary Linux Access Gateway

Appliance in your cluster also has the SSL VPN server installed.

1.2.2 Known Issues

In Access Manager 3.0 SP4, the SSL VPN server installed with the Linux Access Gateway

Appliance is accelerated by using its public IP address. After upgrading to 3.1 SP2, you must

change the Web server IP address to the loopback IP address , 127.0.0.1. For more information,

see Section 2.2.7: Configuration Changes to the SSL VPN Server Installed with the Linux

Access Gateway in the SSL VPN Server Guide (http://www.novell.com/documentation/beta/

novellaccessmanager31/sslvpnhelp/?page=/documentation/beta/novellaccessmanager31/

sslvpnhelp/data/bmmi1it.html)

The session timeout for Identity Server is 15 minutes in 3.0 SP4 and this is reflected in the

default authentication timeout for all the contracts in the Identity Server. The session timeout

for Identity Server is 60 minutes in 3.1 SP2.

Access Manager 3.1 SP2 Beta 1 Scenarios 3

novdocx (en) 17 September 2009

1.2.3 Procedure

1Upgrade the Administration Console and Identity Server to 3.1 SP2. For more information, see

Upgrading Access Manager Components (http://www.novell.com/documentation/

novellaccessmanager31/installation/?page=/documentation/novellaccessmanager31/

installation/data/bookinfo.html) in the Installation Guide.

For upgrade information, see Upgrading from Access Manager 3.0 SP4 to Access Manager 3.1

SP2 (http://www.novell.com/documentation/beta/novellaccessmanager31/installation/data/

bgfx9yh.html) in the Access Manager Installation Guide (http://www.novell.com/

documentation/beta/novellaccessmanager31/installation/data/bookinfo.html).

2Upgrade the secondary Linux Access Gateway Appliance to 3.1 SP2. For more information,

see, Upgrading Access Manager Components (http://www.novell.com/documentation/

novellaccessmanager31/installation/?page=/documentation/novellaccessmanager31/

installation/data/bookinfo.html)

3Upgrade the primary Linux Access Gateway Appliance to 3.1 SP2.

After the successful upgrade of the Linux Access Gateway Appliances, the timeout per

protected resource feature is not enabled by default.

4To enable the timeout per protected resource feature:

4a Modify the authentication contract configuration at the Identity Server.

4b Apply the changes to the Linux Access Gateway Appliance cluster.

The timeout per protected resource feature is enabled on the Linux Access Gateway

Appliances.

5If you have an SSL VPN server installed on the Linux Access Gateway Appliance, apply

changes to the SSL VPN server after it is upgraded to 3.1 SP2, to get the 3.1 SP2 features.

NOTE: Any SSL VPN connection made before the changes are applied at the SSL VPN server

are not enabled for the new client cleanup options.

6Upgrade the policies.

For upgrade information, see “Upgrading the Policies” (http://www.novell.com/

documentation/beta/novellaccessmanager31/installation/data/bgfx9yh.html#bhn7nna) in the

Access Manager Installation Guide (http://www.novell.com/documentation/beta/

novellaccessmanager31/installation/data/bookinfo.html).

1.3 Migrating a SLES 9 Access Gateway to SLES 11

This scenario explains how to migrate a SLES 9 SP3 Access Gateway Appliance on 3.1.1 to the

SLES 11 version of the Access Gateway Appliance. The 3.1 SP1 version of the Access Gateway

Appliance should be in a test environment.

1.3.1 Assumptions

You have an installed SLES 9 version of the Access Gateway that is imported into the

Administration Console.

You have an Administration Console and Identity Server that have been upgraded to 3.1 SP2.

For installation information, see the Access Manager Installation Guide (http://

www.novell.com/documentation/beta/novellaccessmanager31/installation/data/bookinfo.html).

4Access Manager 3.1 SP2 Beta 1 Scenarios

novdocx (en) 17 September 2009

1.3.2 Known Issues

None.

1.3.3 Procedure

1Upgrade the 3.1 SP1 Access Gateway Appliance to 3.1 SP2. For installation instructions, see

“Upgrading the Linux Access Gateway Appliance” (http://www.novell.com/documentation/

beta/novellaccessmanager31/installation/data/bbycmhz.html).

2Back up the SLES 9 Access Gateway configuration.

The backup script allows you to restore touch files and customized error page configurations.

2a At the Access Gateway machine, log in as root.

2b Run the following script:

lag-backup-restore.sh

This script creates the following files:

lagNoRestore.tar.gz: This file contains information and files that don’t need to be

restored after migrating to SLES 11.

lagRestore.tar.gz: This file contains information and files that need to be restored

after migrating to SLES 11.

2c Copy the tar files to another physical location.

3Disconnect the Access Gateway Appliance from the network.

4Install the SLES 11 version of the Access Gateway Appliance.

For installation instructions, see “Installing the Linux Access Gateway Appliance” (http://

www.novell.com/documentation/beta/novellaccessmanager31/installation/data/bd1egh.html)

Use the same DNS name and IP address as the SLES 9 version of the Access Gateway.

Import the Access Gateway into the same Administration Console.

The Administration Console pushes the SLES 9 configuration details to the SLES 11

Access Gateway.

5Restore the touch files and customized error pages:

5a Copy the

lagRestore.tar.gz

file to the Access Gateway.

5b Use the

lag-backup-restore.sh

script to restore the files.

1.3.4 Test Results

Check the health of the Access Gateway in the Administration Console.

Check the configuration of the Access Gateway, its policies, and its certificates.

Check the system configuration settings, such as network settings and secondary IP addresses.

1.3.5 Troubleshooting Tips

For installation issues, refer to the following logs:

RPM installation log file:

/tmp/novell_access_manager/inst_lag.log

Autoimport log file:

/tmp/novell_access_manager/inst_lag_import_<date>.log

Access Manager 3.1 SP2 Beta 1 Scenarios 5

novdocx (en) 17 September 2009

Auto partition log file:

/var/adm/autoinstall/logs/diskParitition.sh.log

JCC configure logs:

/opt/novell/devman/jcc/logs/configure.log.0

1.4 Configuring Timeout Per Protected Resource

This scenario explains how to restrict session availability based on user activity. It explains how to

configure the Timeout Per Protected Resource feature.

In previous versions of Access Manager, there is one global session timeout for all the protected

resources. With Access Manager 3.1 SP2, session availability for individual protected resources can

be configured and managed for each resource by using Timeout Per Protected Resource. You can

configure a specific authentication timeout value for each individual contract at the Identity Server,

then assign the contracts to the protected resources of the Access Gateway.

1.4.1 Assumptions

If the authentication method used for the contract is Name/Password-Basic, the session might be

active after the timeout because the browser can still send requests with the basic authentication

header.

1.4.2 Procedure

1At the Identity Server, configure authentication contract C1, using the Name/Password-Form

method. Set the authentication timeout value to 15 minutes and set the Activity realm to

test

2At the Access Gateway, create protected resource PR1 and assign C1 to it.

3Use valid credentials to access the protected resource at 7:00 pm.

4Leave the session idle for 5 minutes and access the resource again at 7:05 pm.

5Leave the session idle for 10 minutes and access the resource again at 7:15 pm.

6Leave the session idle for 15 minutes and access the resource again at 7:30 pm.

1.4.3 Test Results

For Step 5: The session does not time out by 7:15 because the user was active at 7:05 pm.

For Step 6: The session times out by 7:30 and the user is required to log in again.

1.4.4 Troubleshooting Tips

If the user does not time out after the configured timeout value has elapsed, check the defined

contracts at the Identity Server to ensure that there is no other contract in the

test

activity realm.

User activity in another contract in the same activity realm can affect your contract's timeout.

If the activity realm had not been configured and is left blank, any activity by the user at the Identity

Server can affect the user’s session timeout. You must specify a unique activity realm for this

scenario to work.

2 Timeout Per Protected Resource Scenarios

Section 2.1, “Same Activity Realm,” on page 6

Section 2.2, “Unique Activity Realms,” on page 8

6Access Manager 3.1 SP2 Beta 1 Scenarios

novdocx (en) 17 September 2009

2.1 Same Activity Realm

The purpose of this scenario is to introduce you to the Timeout Per Protected Resource feature,

which is new in Access Manager 3.1 SP2. This scenario is designed to help you understand the

effect of having two authentication contracts in the same activity realm.

2.1.1 Assumptions

You have an installed and configured 3.1 SP2 version of an Administration Console, an Identity

Server, and an Access Gateway. The Access Gateway can be either an Access Gateway

Appliance or an Access Gateway Service.

The base URL of the Identity Server is secure (it uses SSL/HTTPS).

You understand authentication methods and authentication contracts.

You have read “Assigning a Timeout Per Protected Resource” (http://www.novell.com/

documentation/beta/novellaccessmanager31/accessgatehelp/data/prlist.html#bmn94qo).

2.1.2 Known Issues

None

2.1.3 Procedure

1Create a new authentication method (M1):

1a Select Secure Name/Password – Form for the class.

1b Select the Identifies User option.

1c Select a user store.

2Create a new authentication contract (C1).:

2a Make sure the URI is unique.

2b Set the Authentication Timeout to 5 minutes.

2c Specify

Same

for the Activity Realm.

2d Select

for the Method.

2e Click Next.

2f Modify the Text and Image to fit your needs.

2g Click Finish.

3Create a new authentication method (M2):

3a Select Secure Name/Password – Form for the class.

3b Select the Identifies User option.

3c Select a user store.

4Create a new authentication contract (C2):

4a Make sure the URI is unique.

4b Set the Authentication Timeout to 10 minutes.

4c Specify

Same

for the Activity Realm.

4d Select

for the Method.

Access Manager 3.1 SP2 Beta 1 Scenarios 7

novdocx (en) 17 September 2009

4e Click Next.

4f Modify the Text and Image to fit your needs.

4g Click Finish.

5Update the Identity Server.

6Make sure the Access Gateway has two protected resources (PR1 and PR2). Create them if

necessary.

7Assign authentication contract C1 to protected resource PR1.

8Assign authentication contract C2 to protected resource PR2.

9Update the Access Gateway.

10 Access a page on protected resource PR1 from a client browser.

You should be prompted to authenticate.

11 Access a page on protected resource PR2 with the same browser session.

You should be prompted to authenticate again. Make sure to use the same user for both logins.

12 Refresh the page on protected resource PR2 at least once a minute over a time period greater

than 5 minutes.

13 Go back to the page on protected resource PR1.

Access should still be allowed. The user has not been inactive, so the activity has kept the

session to PR1 active.

14 Access the page on protected resource PR2 again.

15 Let the browser sit idle for a time period greater than 5 minutes but less than 10 minutes.

16 Refresh the page on protected resource PR2.

The page should refresh without prompting you to authenticate.

17 Access the page on protected resource P1.

You should be prompted to authenticate again. You have been idle longer than the contract’s

timeout limit.

2.1.4 Test Results

Activity on a protected resource with the same realm as other protected resources prevents

authentication timeout on the other protected resources.

Each protected resource can have a different authentication timeout.

2.1.5 Troubleshooting Tips

An authentication contract with an empty realm or a realm of

Any

allows activity from any

protected resource to prevent a timeout on a protected resource that uses that contract.

8Access Manager 3.1 SP2 Beta 1 Scenarios

novdocx (en) 17 September 2009

Single sign-on can give the appearance that an authentication timeout has not occurred.

Keeping the authentication method of each authentication contract unique eliminates single

sign-on. Having two contracts with the same method essentially gives both contracts the

longest timeout of the two. Single sign-on allows the user to access the resource with the

shorter timeout as long as the resource with the longer timeout has not expired.

The Any Contract option can be assigned the authentication timeout of any of the

authentication contracts. The Any Contract option is assigned the timeout of the authentication

contract that the user used to authenticate. In the case of an unknown authentication contract

from a federated authentication, the contract is assigned the default session timeout. When the

Any Contract option times out, it can be assigned a different timeout if single sign-on gives the

user access by using a different authentication contract than the contract that was used with the

previous authentication with the Any Contract option. To prevent authentication timeout

confusion, all authentication contracts should be assigned the default session timeout if the Any

Contract option is used.

2.2 Unique Activity Realms

The purpose of this scenario is to introduce you to the Timeout Per Protected Resource feature and

to help you understand that protected resources that use authentication contracts with unique activity

realms are not affected by activity on other protected resources with different contracts.

2.2.1 Assumptions

You have an installed and configured 3.1 SP2 version of an Administration Console, an Identity

Server, and an Access Gateway. The Access Gateway can be either an Access Gateway

Appliance or an Access Gateway Service.

The base URL of the Identity Server is secure (it uses SSL/HTTPS).

You understand authentication methods and authentication contracts.

You have read “Assigning a Timeout Per Protected Resource” (http://www.novell.com/

documentation/beta/novellaccessmanager31/accessgatehelp/data/prlist.html#bmn94qo).

2.2.2 Known Issues

None.

2.2.3 Procedure

1Create a new authentication method (M1):

1a Select Secure Name/Password – Form for the class.

1b Select the Identifies User option.

1c Select a user store.

2Create a new authentication contract (C1):

2a Make sure the URI is unique.

2b Set the Authentication Timeout to 5 minutes.

2c Specify

AR1

for the Activity Realm.

2d Select M1 for the Method.

2e Click Next.

Access Manager 3.1 SP2 Beta 1 Scenarios 9

novdocx (en) 17 September 2009

2f Modify the Text and Image to fit your needs.

2g Click Finish.

3Create a new authentication method (M2):

3a Select Secure Name/Password – Form for the class.

3b Select the Identifies User option.

3c Select a user store.

4Create a new authentication contract (C2):

4a Make sure the URI is unique.

4b Set the Authentication Timeout to 10 minutes.

4c Specify

AR2

for the Activity Realm.

4d Select M2 for the Method.

4e Click Next.

4f Modify the Text and Image to fit your needs.

4g Click Finish.

5Update the Identity Server.

6Make sure the Access Gateway has two protected resources (PR1 and PR2). Create them if

necessary.

7Assign authentication contract C1 to protected resource PR1.

8Assign authentication contract C2 to protected resource PR2.

9Update the Access Gateway.

10 Access a page on protected resource PR1 from a client browser.

You should be prompted to authenticate.

11 Access a page on protected resource PR2 with the same browser session.

You should be prompted to authenticate again. Make sure to use the same user for both logins.

12 Refresh the page on protected resource PR2 at least once a minute over a time period greater

than 5 minutes.

13 Go back to the page on protected resource PR1.

You should be prompted to authenticate again.

2.2.4 Test Results

Activity on a protected resource with a different activity realm and different protected

resources does not prevent the authentication timeout from happening on the other protected

resources.

Each protected resource can have a different authentication timeout.

2.2.5 Troubleshooting Tips

An authentication contract with an empty realm or a realm of

Any

allows activity from any

protected resource to prevent a timeout on a protected resource that uses that contract.

10 Access Manager 3.1 SP2 Beta 1 Scenarios