Novell ACCESS MANAGER 3.1 SP2 - README 2010 User manual

Novell®
www.novell.com
novdocx (en) 16 April 2010
AUTHORIZED DOCUMENTATION
Novell Access Manager 3.1 SP2 Identity Server Guide
Access Manager
3.1 SP2
June 29, 2010
Identity Server Guide

novdocx (en) 16 April 2010
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on
the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.
You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the
Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on
exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2006-2010 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 16 April 2010
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010

Contents 5
Contents
novdocx (en) 16 April 2010
About This Guide 13
1 Configuring an Identity Server 15
1.1 Managing a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.1.1 Creating a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1.1.2 Assigning an Identity Server to a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . 21
1.1.3 Configuring a Cluster with Multiple Identity Servers . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.1.4 Configuring Session Failover. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1.1.5 Editing Cluster Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.1.6 Removing a Server from a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.1.7 Enabling and Disabling Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.1.8 Modifying the Base URL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.2 Enabling Role-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.3 Configuring Secure Communication on the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.3.1 Viewing the Services That Use the Signing Key Pair . . . . . . . . . . . . . . . . . . . . . . . . 28
1.3.2 Viewing Services That Use the Encryption Key Pair . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.3.3 Managing the Keys, Certificates, and Trust Stores . . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.4 Security Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.4.1 Federation Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.4.2 Authentication Contracts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.4.3 Forcing 128-Bit Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.4.4 Securing the Identity Server Cookie . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
1.4.5 Configuring the Encryption Method for the SAML Assertion . . . . . . . . . . . . . . . . . . . 35
1.4.6 Configuring SAML 2.0 to Sign Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
1.4.7 Blocking Access to Identity Server Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
1.5 Translating the Identity Server Configuration Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
1.5.1 Changing the Port on a Windows Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
1.5.2 Changing the Port on a Linux Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
1.6 Using netHSM for the Signing Key Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
1.6.1 Understanding How Access Manager Uses Signing and Interacts with the netHSM
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
1.6.2 Configuring the Identity Server for netHSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
2 Customizing Login Pages, Logout Pages, and Messages 59
2.1 Customizing the Identity Server Login Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
2.1.1 Selecting the Login Page and Modifying It . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
2.1.2 Configuring the Identity Server to Use Custom Login Pages . . . . . . . . . . . . . . . . . . 72
2.1.3 Troubleshooting Tips for Custom Login Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
2.2 Customizing the Identity Server Logout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
2.2.1 Rebranding the Logout Page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
2.2.2 Replacing the Logout Page with a Custom Page . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
2.2.3 Configuring for Local Rather Than Global Logout . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
2.3 Customizing Identity Server Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
2.3.1 Customizing Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
2.3.2 Customizing the Branding of the Error Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
2.3.3 Customizing Tooltip Text for Authentication Contracts . . . . . . . . . . . . . . . . . . . . . . . 84
2.4 Sample Custom Login Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
2.4.1 Modified login.jsp File for Credential Prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
2.4.2 Custom nidp.jsp File with Custom Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

6Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
2.4.3 Custom 3.1 login.jsp File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
2.4.4 Custom 3.0 login.jsp File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
3 Configuring Local Authentication 103
3.1 Configuring Identity User Stores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
3.1.1 Using More Than One LDAP User Store. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
3.1.2 Configuring the User Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
3.1.3 Configuring an Admin User for the User Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
3.1.4 Configuring a User Store for Secrets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
3.2 Creating Authentication Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
3.2.1 Creating Basic or Form-Based Authentication Classes . . . . . . . . . . . . . . . . . . . . . . 119
3.2.2 Specifying Common Class Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
3.3 Configuring Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
3.4 Configuring Authentication Contracts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
3.4.1 Using a Password Expiration Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
3.4.2 Using Activity Realms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
3.5 Specifying Authentication Defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
3.5.1 Specifying Authentication Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
3.5.2 Creating a Contract for a Specific Authentication Type . . . . . . . . . . . . . . . . . . . . . . 132
3.6 Managing Direct Access to the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
3.6.1 Logging In to the User Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
3.6.2 Specifying a Target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
3.6.3 Blocking Access to the User Portal Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
3.6.4 Blocking Access to the WSDL Services Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
4 Configuring Advanced Local Authentication Procedures 139
4.1 Configuring for RADIUS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
4.2 Configuring Mutual SSL (X.509) Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.2.1 Configuring Attribute Mappings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
4.2.2 Setting Up Mutual SSL Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
4.3 Creating an ORed Credential Class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
4.4 Configuring for OpenID Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
4.5 Configuring Password Retrieval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
4.6 Configuring Access Manager for NESCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
4.6.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
4.6.2 Creating a User Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
4.6.3 Creating a Contract for the Smart Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
4.6.4 Assigning the NESCM Contract to a Protected Resource . . . . . . . . . . . . . . . . . . . . 156
4.6.5 Verifying the User’s Experience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
4.6.6 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
5 Configuring for Kerberos Authentication 159
5.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
5.2 Configuring Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
5.2.1 Installing the spn and the ktpass Utilities for Windows Server 2003 . . . . . . . . . . . . 161
5.2.2 Creating and Configuring the User Account for the Identity Server. . . . . . . . . . . . . 162
5.2.3 Configuring the Keytab File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
5.2.4 Adding the Identity Server to the Forward Lookup Zone . . . . . . . . . . . . . . . . . . . . . 163
5.3 Configuring the Identity Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
5.3.1 Enabling Logging for Kerberos Transactions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
5.3.2 Configuring the Identity Server for Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . 164
5.3.3 Creating the Authentication Class, Method, and Contract . . . . . . . . . . . . . . . . . . . . 165
5.3.4 Creating the bcsLogin Configuration File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Contents 7
novdocx (en) 16 April 2010
5.3.5 Verifying the Kerberos Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
5.4 Configuring the Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
5.5 Configuring the Access Gateway for Kerberos Authentication. . . . . . . . . . . . . . . . . . . . . . . . 171
6 Defining Shared Settings 173
6.1 Configuring Attribute Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
6.2 Editing Attribute Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
6.3 Configuring User Matching Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
6.4 Adding Custom Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
6.4.1 Creating Shared Secret Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
6.4.2 Creating LDAP Attribute Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
6.5 Adding Authentication Card Images. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
6.6 Creating an Image Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
7 Configuring SAML and Liberty Trusted Providers 183
7.1 Understanding the Trust Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
7.1.1 Identity Providers and Consumers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
7.1.2 Embedded Service Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
7.1.3 Configuration Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
7.2 Configuring General Provider Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
7.2.1 Configuring the General Identity Provider Options . . . . . . . . . . . . . . . . . . . . . . . . . 186
7.2.2 Configuring the General Identity Consumer Options . . . . . . . . . . . . . . . . . . . . . . . . 187
7.2.3 Configuring the Introductions Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
7.2.4 Configuring the Trust Levels Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
7.3 Managing Trusted Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
7.3.1 Creating a Trusted Provider for Liberty or SAML 2.0 . . . . . . . . . . . . . . . . . . . . . . . 190
7.3.2 Creating a Trusted Service Provider for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . 192
7.3.3 Creating a Trusted Identity Provider for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . 194
7.4 Modifying a Trusted Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
7.5 Configuring Communication Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
7.5.1 Configuring Communication Security for Liberty and SAML 1.1 . . . . . . . . . . . . . . . 197
7.5.2 Configuring Communication Security for a SAML 2.0 Identity Provider . . . . . . . . . 197
7.5.3 Configuring Communication Security for a SAML 2.0 Service Provider . . . . . . . . . 199
7.6 Selecting Attributes for a Trusted Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
7.6.1 Configuring the Attributes Obtained at Authentication . . . . . . . . . . . . . . . . . . . . . . . 200
7.6.2 Configuring the Attributes Sent with Authentication. . . . . . . . . . . . . . . . . . . . . . . . . 201
7.6.3 Sending Attributes to the Embedded Service Provider . . . . . . . . . . . . . . . . . . . . . . 202
7.7 Managing Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
7.7.1 Viewing and Reimporting a Trusted Provider’s Metadata . . . . . . . . . . . . . . . . . . . . 203
7.7.2 Viewing Trusted Provider Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
7.7.3 Editing a SAML 1.1 Identity Provider’s Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . 204
7.7.4 Editing a SAML 1.1 Service Provider’s Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . 205
7.8 Configuring an Authentication Request for an Identity Provider . . . . . . . . . . . . . . . . . . . . . . 207
7.8.1 Configuring a Liberty Authentication Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
7.8.2 Configuring a SAML 2.0 Authentication Request . . . . . . . . . . . . . . . . . . . . . . . . . . 209
7.9 Configuring an Authentication Response for a Service Provider . . . . . . . . . . . . . . . . . . . . . . 212
7.9.1 Configuring the Liberty Authentication Response . . . . . . . . . . . . . . . . . . . . . . . . . . 212
7.9.2 Configuring the SAML 2.0 Authentication Response. . . . . . . . . . . . . . . . . . . . . . . . 213
7.9.3 Configuring the SAML 1.1 Authentication Response. . . . . . . . . . . . . . . . . . . . . . . . 215
7.10 Managing the Authentication Card of an Identity Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
7.10.1 Modifying the Authentication Card for Liberty or SAML 2.0. . . . . . . . . . . . . . . . . . . 216
7.10.2 Modifying the Authentication Card for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
7.11 Using the Intersite Transfer Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
7.11.1 Understanding the Intersite Transfer Service URL . . . . . . . . . . . . . . . . . . . . . . . . . 217

8Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
7.11.2 Specifying the Intersite Transfer Service URL for the Login URL Option . . . . . . . . 219
7.11.3 Using Intersite Transfer Service Links on Web Pages . . . . . . . . . . . . . . . . . . . . . . 220
7.11.4 Configuring an Intersite Transfer Service Target for a Service Provider . . . . . . . . . 221
8 Configuring CardSpace 223
8.1 Overview of the CardSpace Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
8.2 Prerequisites for CardSpace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
8.2.1 Enabling High Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
8.2.2 Configuring the Client Machines for CardSpace . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
8.3 CardSpace Configuration Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
8.3.1 Authenticating with a Personal Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
8.3.2 Authenticating with a Managed Card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
8.3.3 Authenticating with a Managed Card Backed by a Personal Card . . . . . . . . . . . . . 234
8.4 Configuring the Identity Server as a Relying Party . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
8.4.1 Defining an Authentication Card and Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
8.4.2 Defining a Trusted Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
8.4.3 Cleaning Up Identities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
8.4.4 Defederating after User Portal Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
8.5 Configuring the Identity Server as an Identity Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
8.5.1 Replacing the Signing Certificate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
8.5.2 Configuring STS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
8.5.3 Creating a Managed Card Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
8.6 Using CardSpace Cards for Authentication to Access Gateway Protected Resources . . . . . 242
8.7 Managing CardSpace Trusted Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
8.7.1 CardSpace Identity Provider Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
8.7.2 Renaming the CardSpace Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
8.7.3 Updating the Metadata of the CardSpace Provider . . . . . . . . . . . . . . . . . . . . . . . . . 243
8.8 Managing Card Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
8.8.1 General Template Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
8.8.2 Template Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
8.9 Configuring Authentication Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
8.9.1 Configuring the General Details of a Card Profile . . . . . . . . . . . . . . . . . . . . . . . . . . 246
8.9.2 Configuring Attribute Claims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
8.9.3 Configuring User Identification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
8.10 Cleaning Up Identities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
9 Configuring STS 249
9.1 Configuring STS Attribute Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
9.2 Configuring Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
9.3 Configuring the Authentication Request. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
10 Configuring WS Federation 251
10.1 Using the Identity Server as an Identity Provider for ADFS . . . . . . . . . . . . . . . . . . . . . . . . . . 251
10.1.1 Configuring the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
10.1.2 Configuring the ADFS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
10.1.3 Logging In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
10.1.4 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
10.2 Using the ADFS Server as an Identity Provider for an Access Manager Protected Resource262
10.2.1 Configuring the Identity Server as a Service Provider . . . . . . . . . . . . . . . . . . . . . . . 262
10.2.2 Configuring the ADFS Server to Be an Identity Provider. . . . . . . . . . . . . . . . . . . . . 266
10.2.3 Logging In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
10.2.4 Additional WS Federation Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . 267
10.3 Managing WS Federation Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Contents 9
novdocx (en) 16 April 2010
10.3.1 Creating an Identity Provider for WS Federation . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
10.3.2 Creating a Service Provider for WS Federation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
10.4 Modifying a WS Federation Identity Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
10.4.1 Renaming the Trusted Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
10.4.2 Configuring the Attributes Obtained at Authentication . . . . . . . . . . . . . . . . . . . . . . . 270
10.4.3 Modifying the User Identification Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
10.4.4 Viewing the WS Identity Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
10.4.5 Editing the WS Identity Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
10.4.6 Modifying the Authentication Card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
10.5 Modifying a WS Federation Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
10.5.1 Renaming the Service Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
10.5.2 Configuring the Attributes Sent with Authentication. . . . . . . . . . . . . . . . . . . . . . . . . 273
10.5.3 Modifying the Authentication Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
10.5.4 Viewing the WS Service Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
10.5.5 Editing the WS Service Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
11 Configuring User Identification Methods for Federation 277
11.1 Defining User Identification for Liberty and SAML 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
11.1.1 Selecting a User Identification Method for Liberty or SAML 2.0 . . . . . . . . . . . . . . . 277
11.1.2 Configuring the Attribute Matching Method for Liberty or SAML 2.0 . . . . . . . . . . . . 279
11.2 Defining User Identification for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
11.2.1 Selecting a User Identification Method for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . 280
11.2.2 Configuring the Attribute Matching Method for SAML 1.1 . . . . . . . . . . . . . . . . . . . . 281
11.3 Defining the User Provisioning Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
11.4 User Provisioning Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
12 Configuring Communication Profiles 287
12.1 Configuring a Liberty Profile. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
12.2 Configuring a SAML 1.1 Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
12.3 Configuring a SAML 2.0 Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
13 Configuring Liberty Web Services 291
13.1 Configuring the Web Services Framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
13.2 Managing Web Services and Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
1 3 . 2 . 1 M o d i f y i n g S e r v i c e a n d P r o f i l e D e t a i l s f o r E m p l o y e e , C u s t o m , a n d P e r s o n a l
Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
1 3 . 2 . 2 M o d i f y i n g D e t a i l s f o r A u t h e n t i c a t i o n , D i s c o v e r y , L D A P , a n d U s e r I n t e r a c t i o n
Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
13.2.3 Editing Web Service Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296
13.2.4 Editing Web Service Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
13.2.5 Create Web Service Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
13.3 Configuring Credential Profile Security and Display Settings. . . . . . . . . . . . . . . . . . . . . . . . . 300
13.4 Customizing Attribute Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
13.5 Configuring the Web Service Consumer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
13.6 Mapping LDAP and Liberty Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
13.6.1 Configuring One-to-One Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
13.6.2 Configuring Employee Type Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
13.6.3 Configuring Employee Status Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
13.6.4 Configuring Postal Address Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
13.6.5 Configuring Contact Method Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
13.6.6 Configuring Gender Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
13.6.7 Configuring Marital Status Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

10 Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
14 Maintaining an Identity Server 317
14.1 Managing an Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
14.1.1 Updating an Identity Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
14.1.2 Restarting the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
14.2 Editing Server Details. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320
14.3 Configuring Component Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320
14.3.1 Enabling Component Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320
14.3.2 Managing Log File Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
14.4 Configuring Session-Based Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323
14.4.1 Creating the Administrator Class, Method, and Contract . . . . . . . . . . . . . . . . . . . . 323
14.4.2 Creating the Logging Session Class, Method, and Contract . . . . . . . . . . . . . . . . . . 325
14.4.3 Enabling Basic Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
14.4.4 Responding to an Incident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
14.5 Monitoring the Health of an Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
14.5.1 Health States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
14.5.2 Viewing the Health Details of an Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
14.5.3 Viewing the Health Details of a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
14.6 Monitoring Identity Server Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
14.6.1 Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
14.6.2 Authentications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
14.6.3 Incoming HTTP Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335
14.6.4 Outgoing HTTP Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335
14.6.5 Liberty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
14.6.6 SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
14.6.7 SAML 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
14.6.8 WSF (Web Services Framework) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
14.6.9 Clustering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
14.6.10 LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340
14.7 Enabling Identity Server Audit Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
14.8 Monitoring Identity Server Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
14.9 Viewing the Command Status of the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
14.9.1 Viewing the Status of Current Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
14.9.2 Viewing Detailed Command Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
14.10 Tuning the Identity Server for Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
15 Troubleshooting the Identity Server and Authentication 349
15.1 Useful Networking Tools for the Linux Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
15.2 Troubleshooting 100101043 and 100101044 Liberty Metadata Load Errors . . . . . . . . . . . . . 349
15.2.1 The Metadata. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
15.2.2 DNS Name Resolution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
15.2.3 Certificate Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
15.2.4 Certificates in the Required Trust Stores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
15.2.5 Enabling Debug Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
15.2.6 Testing Whether the Provider Can Access the Metadata . . . . . . . . . . . . . . . . . . . . 356
15.2.7 Manually Creating Any Auto-Generated Certificates . . . . . . . . . . . . . . . . . . . . . . . 357
15.3 Authentication Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
15.3.1 Authentication Classes and Duplicate Common Names . . . . . . . . . . . . . . . . . . . . . 357
15.3.2 General Authentication Troubleshooting Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
15.3.3 Slow Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
15.3.4 Federation Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
15.3.5 Mutual Authentication Troubleshooting Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
15.3.6 Browser Hangs in an Authentication Redirect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
15.3.7 Duplicate Set-Cookie Headers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360
15.4 Problems Reading Keystores after Identity Server Re-installation. . . . . . . . . . . . . . . . . . . . . 360

Contents 11
novdocx (en) 16 April 2010
A About Liberty 361
B Understanding How Access Manager Uses SAML 363
B.1 Attribute Mapping with Liberty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363
B.2 Trusted Provider Reference Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
B.3 Identity Federation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
B.4 Authorization Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
B.5 What's New in SAML 2.0? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
B.6 Identity Provider Process Flow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365
B.7 SAML Service Provider Process Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
C Data Model Extension XML 369
C.1 Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
C.2 Writing Data Model Extension XML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372

12 Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010

About This Guide 13
novdocx (en) 16 April 2010
About This Guide
This guide describes the following features of the Identity Server:
Chapter 1, “Configuring an Identity Server,” on page 15
Chapter 2, “Customizing Login Pages, Logout Pages, and Messages,” on page 59
Chapter 3, “Configuring Local Authentication,” on page 103
Chapter 4, “Configuring Advanced Local Authentication Procedures,” on page 139
Chapter 5, “Configuring for Kerberos Authentication,” on page 159
Chapter 6, “Defining Shared Settings,” on page 173
Chapter 7, “Configuring SAML and Liberty Trusted Providers,” on page 183
Chapter 8, “Configuring CardSpace,” on page 223
Chapter 9, “Configuring STS,” on page 249
Chapter 10, “Configuring WS Federation,” on page 251
Chapter 11, “Configuring User Identification Methods for Federation,” on page 277
Chapter 12, “Configuring Communication Profiles,” on page 287
Chapter 13, “Configuring Liberty Web Services,” on page 291
Chapter 14, “Maintaining an Identity Server,” on page 317
Chapter 15, “Troubleshooting the Identity Server and Authentication,” on page 349
Appendix A, “About Liberty,” on page 361
Appendix B, “Understanding How Access Manager Uses SAML,” on page 363
Appendix C, “Data Model Extension XML,” on page 369
This guide is intended to help you understand and configure all of the features provided by the
Identity Server.
It is recommended that you first become familiar with the information in the Novell Access Manager
3.1 SP2 Setup Guide, which helps you understand how to perform a basic Identity Server
configuration, set up a resource protected by an Access Gateway, and configure SSL.
The setup guide and this guide are designed to work together, and important information and setup
steps are not always repeated in both places.
Audience
This guide is intended for Access Manager administrators. It is assumed that you have knowledge of
evolving Internet protocols, such as:
Extensible Markup Language (XML)
Simple Object Access Protocol (SOAP)
Security Assertion Markup Language (SAML)
Public Key Infrastructure (PKI) digital signature concepts and Internet security
Secure Socket Layer/Transport Layer Security (SSL/TLS)

14 Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
Hypertext Transfer Protocol (HTTP and HTTPS)
Uniform Resource Identifiers (URIs)
Domain Name System (DNS)
Web Services Description Language (WSDL)
Feedback
We want to hear your comments and suggestions about this guide and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to Documentation Feedback (http://www.novell.com/documentation/
feedback.html) at www.novell.com/documentation/feedback.html and enter your comments there.
Documentation Updates
For the most recent version of the Access Manager Identity Server Guide, visit the Novell Access
Manager Documentation Web site (http://www.novell.com/documentation/novellaccessmanager31/
).
Additional Documentation
Before proceeding, you should be familiar with the Novell Access Manager 3.1 SP2 Installation
Guide and the Novell Access Manager 3.1 SP2 Setup Guide, which provide information about
installing and setting up the Access Manager system.
If you are unfamiliar with SAML 1.1, see “SAML Overview” (http://www.novell.com/
documentation/saml/saml/data/ag8qdk7.html) on the Documentation Web site (http://
www.novell.com/documentation/a-z.html).
For conceptual information about Liberty, and to learn about what is new for SAML 2.0, see
Appendix A, “About Liberty,” on page 361 and Appendix B, “Understanding How Access Manager
Uses SAML,” on page 363.
For information about the other Access Manager devices and features, see the following:
Novell Access Manager 3.1 SP2 Administration Console Guide
Novell Access Manager 3.1 SP2 Access Gateway Guide
Novell Access Manager 3.1 SP2 Policy Guide
Novell Access Manager 3.1 SP2 J2EE Agent Guide
Novell Access Manager 3.1 SP2 SSL VPN Server Guide
Novell Access Manager 3.1 SP2 Event Codes

Configuring an Identity Server
1
15
novdocx (en) 16 April 2010
1
Configuring an Identity Server
After you log in to the Administration Console, click Devices > Identity Servers. The system
displays the Identity Servers that can be managed from this Administration Console.
A newly installed Identity Server is in an unconfigured state and is halted. It remains in this state and
cannot function until you create a cluster configuration and assign the Identity Server to the new
configuration. The cluster configuration defines how the Identity Server functions in an Access
Manager configuration. You can assign multiple servers to use the same configuration, which
enables failover and load balancing services.
Section 1.1, “Managing a Cluster Configuration,” on page 15
Section 1.2, “Enabling Role-Based Access Control,” on page 27
Section 1.3, “Configuring Secure Communication on the Identity Server,” on page 27
Section 1.4, “Security Considerations,” on page 32
Section 1.5, “Translating the Identity Server Configuration Port,” on page 36
Section 1.6, “Using netHSM for the Signing Key Pair,” on page 41
For information on configuring local authentication options, see the following:
Chapter 3, “Configuring Local Authentication,” on page 103
Chapter 4, “Configuring Advanced Local Authentication Procedures,” on page 139
Chapter 6, “Defining Shared Settings,” on page 173
Chapter 13, “Configuring Liberty Web Services,” on page 291
1.1 Managing a Cluster Configuration
After you install an Identity Server, you must create a cluster configuration in order to configure the
Identity Server. Even if you have only one Identity Server, you must assign it to a cluster
configuration to configure it. If you have multiple Identity Servers, you can create multiple
configurations and assign different Identity Servers to them as shown in Figure 1-1.

16 Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
Figure 1-1 Identity Server Configurations
When you assign multiple Identity Servers to the same configuration, you need to install a load
balancer that supports either Layer 4 or Layer 7. This device is referred to as an L4 switch in this
manual. The L4 switch allows the work load to be balanced among the machines.
Whether you have one machine or multiple machines in a cluster, the Access Manager software
configuration process is the same. This section describes the following cluster management tasks:
Section 1.1.1, “Creating a Cluster Configuration,” on page 16
Section 1.1.2, “Assigning an Identity Server to a Cluster Configuration,” on page 21
Section 1.1.3, “Configuring a Cluster with Multiple Identity Servers,” on page 21
Section 1.1.4, “Configuring Session Failover,” on page 22
Section 1.1.5, “Editing Cluster Details,” on page 24
Section 1.1.6, “Removing a Server from a Cluster Configuration,” on page 25
Section 1.1.7, “Enabling and Disabling Protocols,” on page 25
Section 1.1.8, “Modifying the Base URL,” on page 26
1.1.1 Creating a Cluster Configuration
This section discusses all the settings available when creating an Identity Server configuration. If
you want a description of just the options required to get a functional configuration, see “Creating a
Basic Identity Server Configuration” in the Novell Access Manager 3.1 SP2 Setup Guide.
An Identity Server always operates as an identity provider and can optionally be configured to run as
an identity consumer (also known as a service provider), using Liberty, SAML 1.1, SAML 2.0,
CardSpace or WS Federation protocols. These topics are not described in this section.
In an Identity Server configuration, you specify the following information:
The DNS name for the Identity Server or clustered server site.
Certificates for the Identity Server.
Identity Server 1
Configuration A
Identity Server 2
Configuration A Configuration B
Identity Server 1
Identity Server 2

Configuring an Identity Server 17
novdocx (en) 16 April 2010
Organizational and contact information for the server, which is published in the metadata of the
Liberty and SAML protocols.
The LDAP directories (user stores) used to authenticate users, and the trusted root for secure
communication between the Identity Server and the user store.
To create an Identity Server configuration:
1In the Administration Console, click Devices > Identity Servers.
2Select the Identity Server’s check box, then click New Cluster.
Selecting the server is one way to assign it to the cluster configuration.
3In the New Cluster dialog box, specify a name for the cluster configuration.
If you did not select the server in the previous step, you can now select the server or servers that
you want to assign to this configuration.
For more information about assigning servers to a configuration, see Section 1.1.2, “Assigning
an Identity Server to a Cluster Configuration,” on page 21.
4Click OK.

18 Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
5Fill in the following fields to specify the Base URL for your Identity Server configuration:
Name: Specify a name by which you want to refer to the configuration. This field is populated
with the name you provided in the New Cluster dialog box. You can change this name here, if
necessary.
IMPORTANT: Carefully determine your settings for the base URL, protocol, and domain.
After you have configured trust relationships between providers, changing these settings
invalidates the trust model and requires a reimport of the provider’s metadata.
Modifying the base URL also invalidates the trust between the Embedded Service Provider of
Access Manager devices. To re-establish the trust after modifying the base URL, you must
restart the Embedded Service Provider on each device.
Base URL: Specify the application path for the Identity Server. The Identity Server protocols
rely on this base URL to generate URL endpoints for each protocol.
Protocol: Select the communication protocol. Specify HTTPS in order to run securely (in
SSL mode) and for provisioning. Use HTTP only if you do not require security or have
installed an SSL terminator in front of the Identity Server.
Domain: Specify the DNS name assigned to the Identity Server. When you are using an
L4 switch, this DNS name should resolve to the virtual IP address set up on the L4 switch
for the Identity Servers. Using an IP address is not recommended.
Port: Specify the port value for the protocol. Default ports are 8080 for HTTP or 8443 for
HTTPS. If you want to use port 80 or 443, specify the port here.
If you are configuring a Linux Identity Server, you must also configure the operating
system to translate the port. See Section 1.5, “Translating the Identity Server
Configuration Port,” on page 36.
If you are configuring a Windows Identity Server, you must also modify the Tomcat
server.xml file located in the \Program Files\Novell\Tomcat\conf directory
for Windows Server 2003 or the
\Program Files (x86)\Novell\Tomcat\conf
directory for Windows Server 2008. Change the ports from 8080 and 8443 to 80 and
443, then restart the Tomcat service.
Application: Specify the Identity Server application. Leave the default value nidp.
SSL Certificate: Displays the currently assigned SSL certificate.
The Identity Server comes with a test-connector certificate that you must replace to use
SSL in your production environment. You can replace the test certificate now or after you
configure the Identity Server. If you create the certificate and replace the
test-connector
certificate now, you can save some time by restarting Tomcat only once. Tomcat must be
restarted whenever you assign an Identity Server to a configuration and whenever you update a
certificate key store. See Section 1.3.3, “Managing the Keys, Certificates, and Trust Stores,” on
page 29.
For information on how to replace the
test-connector certificate, see “Enabling SSL
Communication” in the Novell Access Manager 3.1 SP2 Setup Guide.
6To configure session limits, fill in the following fields:
LDAP Access: Specify the maximum number of LDAP connections the Identity Server can
create to access the configuration store. You can adjust this amount for system performance.

Configuring an Identity Server 19
novdocx (en) 16 April 2010
Default Timeout: Specify the session timeout you want assigned as a default value when you
create a contract. This value is also assigned to a session when the Identity Server cannot
associate a contract with the authenticated session. During federation, if the authentication
request uses a type rather than a contract, the Identity Server cannot always associate a contract
with the request.
The traditional SSL VPN server uses the Any Contract option for authentication. The user is
assigned the timeout value of the contract used for authentication, and not this default timeout
value.
If you want to know what timeout value the SSL VPN user is assigned, you need to select a
contract with the appropriate timeout value. Click Devices > Access Gateways > [Name of
Reverse Proxy] > [Name of Proxy Service] > SSLVPN_Default. The SSLVPN_Default name is
the default name for the SSL VPN protected resource. If you have modified this name, select
that protected resource. In the Authentication Procedure option, select a name/password
contract with the appropriate timeout value.
Limit User Sessions: Specify whether user sessions are limited. If selected, you can specify
the maximum number of concurrent sessions a user is allowed to authenticate.
If you decide to limit user sessions, you should also give close consideration to the session
timeout value (the default is 60 minutes). If the user closes the browser without logging out (or
an error causes the browser to close), the session is not cleared until the session timeout
expires. If the user session limit is reached and those sessions have not been cleared with a
logout, the user cannot log in again until the session timeout expires for one of the sessions.
When enabled, this option affects performance in a cluster with multiple Identity Servers.
When a user is limited to a specific number of sessions, the Identity Servers must check with
the other servers before establishing a new session.
Allow multiple browser session logout: Specify whether a user with more than one session to
the server is presented with an option to log out of all sessions. If you do not select this option,
only the current session can be logged out. Deselect this option in instances where multiple
users log in as guests. Then, when one user logs out, none of the other guests are logged out.
When you enable this option, you must also restart any Embedded Service Providers that use
this Identity Server configuration.
7To configure TCP timeouts, fill in the following fields:
LDAP: Specify how long an LDAP request to the user store can take before timing out.
Proxy: Specify how long a request to another cluster member can take before timing out.
When a member of a cluster receives a request from a user who has authenticated with another
cluster member, the member sends a request to the authenticating member for information
about the user.
Request: Specify how long an HTTP request to another device can take before timing out.
8To control which protocols can be used for authentication, select one or more of the following
protocols.
IMPORTANT: Enable only the protocols that you are using.
If you are using other Access Manager devices such as the Access Gateway, SSL VPN, or the
J2EE Agents, you need to enable the Liberty protocol. The Access Manager devices use an
Embedded Service Provider. If you disable the Liberty protocol, you disable the trusted
relationships these devices have with the Identity Server, and authentication fails.

20 Novell Access Manager 3.1 SP2 Identity Server Guide
novdocx (en) 16 April 2010
Liberty: Uses a structured version of SAML to exchange authentication and authorization data
between trusted identity providers and service providers and provides the framework for user
federation.
SAML 1.1: Uses XML for exchanging authentication and authorization data between trusted
identity providers and service providers.
SAML 2.0: Uses XML for exchanging encrypted authentication and authorization data
between trusted identity providers and service providers and provides the framework for user
federation.
STS: A security token service that creates digital identities from claims, which can then be
used as a card or a token for authentication.
CardSpace: Uses Microsoft client software that stores a user’s information in a digital identity
or information card, which can then be presented and used as authentication credentials.
WS Federation: Allows disparate security mechanisms to exchange information about
identities, attributes, and authentication.
9To continue creating the Identity Server configuration, click Next.
The system displays the Organization page.
Use this page to specify organization information for the Identity Server configuration. The
information you specify on this page is published in the metadata for the Liberty 1.2 and
SAML protocols. The metadata is traded with federation partners and supplies various
information regarding contact and organization information located at the Identity Server.
The following fields require information:
Name: The name of the organization.
Display Name: The display name for the organization.
URL: The organization’s URL for contact purposes.
Optional fields include Company, First Name, Last Name, Email, Telephone, and Contact
Type.
10 Click Next to configure the user store.
You must reference your own user store and auto-import the SSL certificate. See Section 3.1,
“Configuring Identity User Stores,” on page 104 for information about this procedure.