NetIQ Access Manager Appliance 3.2 SP2 Identity Server Guide

402 Pages·2015·6.26 MB·English

by  Novell Documentation

Identity Server Guide
Access Manager Appliance 3.2 SP3
August 2014
www.netiq.com/documentation
Legal Notice
THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE
SUBJECT TO THE TERMS OF A LICENSE AGREEMENT OR A NON-DISCLOSURE AGREEMENT. EXCEPT AS
EXPRESSLY SET FORTH IN SUCH LICENSE AGREEMENT OR NON-DISCLOSURE AGREEMENT, NETIQ
CORPORATION PROVIDES THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT "AS IS"
WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES DO NOT
ALLOW DISCLAIMERS OF EXPRESS OR IMPLIED WARRANTIES IN CERTAIN TRANSACTIONS; THEREFORE, THIS
STATEMENT MAY NOT APPLY TO YOU.
For purposes of clarity, any module, adapter or other similar material ("Module") is licensed under the terms and conditions of
the End User License Agreement for the applicable version of the NetIQ product or software to which it relates or interoperates
with, and by accessing, copying or using a Module you agree to be bound by such terms. If you do not agree to the terms of
the End User License Agreement you are not authorized to use, access or copy a Module and you must destroy all copies of
the Module and contact NetIQ for further instructions.
This document and the software described in this document may not be lent, sold, or given away without the prior written
permission of NetIQ Corporation, except as otherwise permitted by law. Except as expressly set forth in such license
agreement or non-disclosure agreement, no part of this document or the software described in this document may be
reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise,
without the prior written consent of NetIQ Corporation. Some companies, names, and data in this document are used for
illustration purposes and may not represent real companies, individuals, or data.
This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information
herein. These changes may be incorporated in new editions of this document. NetIQ Corporation may make improvements in
or changes to the software described in this document at any time.
U.S. Government Restricted Rights: If the software and documentation are being acquired by or on behalf of the U.S.
Government or by a U.S. Government prime contractor or subcontractor (at any tier), in accordance with 48 C.F.R. 227.7202-
4 (for Department of Defense (DOD) acquisitions) and 48 C.F.R. 2.101 and 12.212 (for non-DOD acquisitions), the
government’s rights in the software and documentation, including its rights to use, modify, reproduce, release, perform, display
or disclose the software or documentation, will be subject in all respects to the commercial license rights and restrictions
provided in the license agreement.
© 2014 NetIQ Corporation. All Rights Reserved.
For information about NetIQ trademarks, see https://www.netiq.com/company/legal/.
About This Guide
This guide is intended to help you understand and configure all of the features provided by the
Identity Server.
It is recommended that you first become familiar with the information in the NetIQ Access Manager
Appliance 3.2 SP3 Setup Guide, which helps you understand how to perform a basic Identity Server
configuration, set up a resource protected by an Access Gateway, and configure SSL.
The setup guide and this guide are designed to work together, and important information and setup
steps are not always repeated in both places.
Audience
This guide is intended for Access Manager administrators. It is assumed that you have knowledge of
evolving Internet protocols, such as:
(cid:138) Extensible Markup Language (XML)
(cid:138) Simple Object Access Protocol (SOAP)
(cid:138) Security Assertion Markup Language (SAML)
(cid:138) Public Key Infrastructure (PKI) digital signature concepts and Internet security
(cid:138) Secure Socket Layer/Transport Layer Security (SSL/TLS)
(cid:138) Hypertext Transfer Protocol (HTTP and HTTPS)
(cid:138) Uniform Resource Identifiers (URIs)
(cid:138) Domain Name System (DNS)
(cid:138) Web Services Description Language (WSDL)
Feedback
We want to hear your comments and suggestions about this guide and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation.
Documentation Updates
For the most recent version of the Access Manager Identity Server Guide, visit the NetIQ Access
Manager Documentation Web site (https://www.netiq.com/documentation/novellaccessmanager32/).
Additional Documentation
Before proceeding, you should be familiar with the NetIQ Access Manager 3.2 SP3 Installation Guide
and the NetIQ Access Manager Appliance 3.2 SP3 Setup Guide, which provide information about
installing and setting up the Access Manager system.
If you are unfamiliar with SAML 1.1, see “SAML Overview” (http://www.novell.com/documentation/
saml/saml/data/ag8qdk7.html) on the Documentation Web site (http://www.novell.com/
documentation/a-z.html).
About This Guide 3
For conceptual information about Liberty, and to learn about what is new for SAML 2.0, see
AppendixA, “About Liberty,” on page389 and AppendixB, “Understanding How Access Manager
Uses SAML,” on page391.
For information about other Access Manager devices and features, see the following:
(cid:138) NetIQ Access Manager Appliance 3.2 SP3 Administration Console Guide
(cid:138) NetIQ Access Manager Appliance 3.2 SP3 Access Gateway Guide
(cid:138) NetIQ Access Manager Appliance 3.2 SP3 Policy Guide
(cid:138) NetIQ Access Manager 3.2 SP2 J2EE Agent Guide
(cid:138) NetIQ Access Manager Appliance 3.2 SP3 SSL VPN Server Guide
(cid:138) NetIQ Access Manager Appliance 3.2 SP3 Event Codes
NOTE: Contact [email protected] for any query related to Access Manager SDK.
4 NetIQ Access Manager Appliance 3.2 SP3 Identity Server Guide
Contents
About This Guide 3
1 Configuring an Identity Server 13
1.1 Managing a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
1.1.1 Editing Cluster Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
1.1.2 Configuring a Cluster with Multiple Identity Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
1.1.3 Configuring Session Failover. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
1.1.4 Editing Cluster Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
1.1.5 Enabling and Disabling Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
1.2 Enabling Role-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
1.3 Enabling External Attributes Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
1.4 Configuring Secure Communication on the Identity Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
1.4.1 Viewing the Services That Use the Signing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
1.4.2 Viewing Services That Use the Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
2 Customizing Login Pages, Logout Pages, and Messages 23
2.1 Customizing the Identity Server Login Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
2.1.1 Selecting the Login Page and Modifying It . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
2.1.2 Configuring the Identity Server to Use Custom Login Pages . . . . . . . . . . . . . . . . . . . . . . .31
2.1.3 Troubleshooting Tips for Custom Login Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
2.2 Customizing the Identity Server Logout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
2.2.1 Rebranding the Logout Page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
2.2.2 Replacing the Logout Page with a Custom Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
2.2.3 Configuring for Local Rather Than Global Logout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
2.3 Customizing Identity Server Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
2.3.1 Customizing Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
2.3.2 Customizing the Branding of the Error Page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
2.3.3 Customizing Tooltip Text for Authentication Contracts. . . . . . . . . . . . . . . . . . . . . . . . . . . . .42
2.4 Sample Custom Login Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43
2.4.1 Modified login.jsp File for Credential Prompts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43
2.4.2 Custom nidp.jsp File with Custom Credentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
2.5 Preventing Cross-site Scripting Attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
2.5.1 Option 1: HTML Escaping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
2.5.2 Option 2: Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
3 Configuring Local Authentication 55
3.1 Configuring Identity User Stores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
3.1.1 Using More Than One LDAP User Store. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
3.1.2 Configuring the User Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
3.1.3 Configuring an Admin User for the User Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60
3.1.4 Configuring a User Store for Secrets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
3.2 Creating Authentication Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69
3.2.1 Creating Basic or Form-Based Authentication Classes. . . . . . . . . . . . . . . . . . . . . . . . . . . .71
3.2.2 Specifying Common Class Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72
3.3 Configuring Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
3.4 Configuring Authentication Contracts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76
3.4.1 Using a Password Expiration Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .81
3.4.2 Using Activity Realms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
Contents 5
3.5 Specifying Authentication Defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
3.5.1 Specifying Authentication Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85
3.5.2 Creating a Contract for a Specific Authentication Type. . . . . . . . . . . . . . . . . . . . . . . . . . . .86
3.6 Managing Direct Access to the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87
3.6.1 Logging In to User Portal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87
3.6.2 Specifying a Target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
3.6.3 Blocking Access to the User Portal Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
3.6.4 Blocking Access to the WSDL Services Page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
4 Configuring Advanced Local Authentication Procedures 93
4.1 Configuring for RADIUS Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93
4.2 Configuring Client Integrity Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95
4.3 Configuring Mutual SSL (X.509) Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
4.3.1 Configuring Attribute Mappings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
4.3.2 Setting Up Mutual SSL Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100
4.4 Creating an ORed Credential Class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101
4.5 Configuring for OpenID Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102
4.6 Configuring Password Retrieval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104
4.7 Configuring Access Manager for NESCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106
4.7.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
4.7.2 Creating a User Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
4.7.3 Creating a Contract for the Smart Card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .109
4.7.4 Assigning the NESCM Contract to a Protected Resource. . . . . . . . . . . . . . . . . . . . . . . . .113
4.7.5 Verifying the User’s Experience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113
4.7.6 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
5 Configuring for Kerberos Authentication 115
5.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
5.2 Configuring Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
5.2.1 Installing the spn and the ktpass Utilities for Windows Server 2003 . . . . . . . . . . . . . . . . .117
5.2.2 Creating and Configuring the User Account for the Identity Server. . . . . . . . . . . . . . . . . .117
5.2.3 Configuring the Keytab File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
5.2.4 Adding the Identity Server to the Forward Lookup Zone. . . . . . . . . . . . . . . . . . . . . . . . . .118
5.3 Configuring the Identity Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
5.3.1 Enabling Logging for Kerberos Transactions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
5.3.2 Configuring the Identity Server for Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
5.3.3 Creating the Authentication Class, Method, and Contract. . . . . . . . . . . . . . . . . . . . . . . . .120
5.3.4 Creating the bcsLogin Configuration File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123
5.3.5 Verifying the Kerberos Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124
5.3.6 (Optional) Using the Name/Password Form Authentication . . . . . . . . . . . . . . . . . . . . . . .124
5.3.7 (Optional) Configuring the Fall Back Authentication Class . . . . . . . . . . . . . . . . . . . . . . . .125
5.4 Configuring the Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126
5.5 Configuring the Access Gateway for Kerberos Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
6 Defining Shared Settings 129
6.1 Configuring Attribute Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129
6.2 Editing Attribute Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132
6.3 Configuring User Matching Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132
6.4 Adding Custom Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134
6.4.1 Creating Shared Secret Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134
6.4.2 Creating LDAP Attribute Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135
6.5 Adding Authentication Card Images. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
6.6 Creating an Image Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
6.7 Metadata Repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
6 NetIQ Access Manager Appliance 3.2 SP3 Identity Server Guide
6.7.1 Creating Metadata Repositories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
6.7.2 Reimporting Metadata Repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139
7 Configuring SAML and Liberty Trusted Providers 141
7.1 Understanding the Trust Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142
7.1.1 Identity Providers and Consumers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142
7.1.2 Embedded Service Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .143
7.1.3 Configuration Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .143
7.2 Configuring General Provider Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
7.2.1 Configuring the General Identity Provider Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
7.2.2 Configuring the General Identity Consumer Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
7.2.3 Configuring the Introductions Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
7.2.4 Configuring the Trust Levels Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .146
7.3 Managing Trusted Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147
7.3.1 Creating a Trusted Provider for Liberty or SAML 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . .147
7.3.2 Creating a Trusted Service Provider for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
7.3.3 Creating a Trusted Identity Provider for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151
7.3.4 Creating Identity Providers and Service Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152
7.4 Modifying a Trusted Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153
7.5 Configuring Communication Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
7.5.1 Configuring Communication Security for Liberty and SAML 1.1 . . . . . . . . . . . . . . . . . . . .155
7.5.2 Configuring Communication Security for a SAML 2.0 Identity Provider . . . . . . . . . . . . . .156
7.5.3 Configuring Communication Security for a SAML 2.0 Service Provider . . . . . . . . . . . . . .157
7.6 Selecting Attributes for a Trusted Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
7.6.1 Configuring the Attributes Obtained at Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . .158
7.6.2 Configuring the Attributes Sent with Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
7.6.3 Sending Attributes to the Embedded Service Provider . . . . . . . . . . . . . . . . . . . . . . . . . . .160
7.7 Managing Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161
7.7.1 Viewing and Reimporting a Trusted Provider’s Metadata . . . . . . . . . . . . . . . . . . . . . . . . .161
7.7.2 Viewing Trusted Provider Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
7.7.3 Editing a SAML 1.1 Identity Provider’s Metadata. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
7.7.4 Editing a SAML 1.1 Service Provider’s Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163
7.7.5 Editing a SAML 2.0 Service Provider’s Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
7.8 Configuring an Authentication Request for an Identity Provider . . . . . . . . . . . . . . . . . . . . . . . . . . .166
7.8.1 Configuring a Liberty Authentication Request. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
7.8.2 Configuring a SAML 2.0 Authentication Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168
7.9 Configuring an Authentication Response for a Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . .171
7.9.1 Configuring the Liberty Authentication Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171
7.9.2 Configuring the SAML 2.0 Authentication Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . .173
7.9.3 Configuring the SAML 1.1 Authentication Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . .174
7.10 Routing to an External Identity Provider Automatically . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
7.11 Configuring Options for Trusted Service Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .176
7.12 Defining Options for Liberty or SAML 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177
7.12.1 Defining Options for SAML 2.0 Identity Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177
7.12.2 Defining Options for Liberty or SAML 2.0 Service Provider. . . . . . . . . . . . . . . . . . . . . . . .177
7.12.3 Defining Options for Liberty Identity Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179
7.13 Defining Options for SAML 1.1 Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179
7.14 Defining Session Synchronization for the A-Select SAML 2.0 Identity Provider . . . . . . . . . . . . . . .180
7.15 Configuring the Liberty or SAML 2.0 Session Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181
7.15.1 Session Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181
7.16 Managing the Authentication Card of an Identity Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181
7.16.1 Modifying the Authentication Card for Liberty or SAML 2.0. . . . . . . . . . . . . . . . . . . . . . . .181
7.16.2 Modifying the Authentication Card for SAML 1.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
7.17 Using the Intersite Transfer Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
7.17.1 Understanding the Intersite Transfer Service URL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
7.17.2 Specifying the Intersite Transfer Service URL for the Login URL Option . . . . . . . . . . . . .185
7.17.3 Using Intersite Transfer Service Links on Web Pages . . . . . . . . . . . . . . . . . . . . . . . . . . .186
Contents 7
7.17.4 Configuring an Intersite Transfer Service Target for a Service Provider . . . . . . . . . . . . . .188
7.17.5 Configuring Whitelist of Target URLs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189
7.17.6 Federation Entries Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189
7.18 Enabling or Disabling SAML Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189
7.19 Sample Configurations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
7.19.1 Setting Up Google Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
7.19.2 Configuring Single Sign-On For Office 365 Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
7.19.3 Integrating Salesforce With Access Manager By Using SAML 2. . . . . . . . . . . . . . . . . . . .192
7.19.4 Integrating Shibboleth Identity Provider With Access Manager. . . . . . . . . . . . . . . . . . . . .192
8 Configuring CardSpace 193
8.1 Overview of the CardSpace Authentication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
8.2 Prerequisites for CardSpace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
8.2.1 Enabling High Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
8.2.2 Configuring the Client Machines for CardSpace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
8.3 CardSpace Configuration Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
8.3.1 Authenticating with a Personal Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
8.3.2 Authenticating with a Managed Card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
8.3.3 Authenticating with a Managed Card Backed by a Personal Card . . . . . . . . . . . . . . . . . .204
8.4 Configuring the Identity Server as a Relying Party . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205
8.4.1 Defining an Authentication Card and Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205
8.4.2 Defining a Trusted Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .207
8.4.3 Cleaning Up Identities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .208
8.4.4 Defederating after User Portal Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209
8.5 Configuring the Identity Server as an Identity Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209
8.5.1 Replacing the Signing Certificate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209
8.5.2 Configuring STS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .210
8.5.3 Creating a Managed Card Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
8.6 Using CardSpace Cards for Authentication to Access Gateway Protected Resources. . . . . . . . . .211
8.7 Managing CardSpace Trusted Providers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212
8.7.1 CardSpace Identity Provider Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212
8.7.2 Renaming the CardSpace Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213
8.7.3 Updating the Metadata of the CardSpace Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213
8.8 Managing Card Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213
8.8.1 General Template Details. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
8.8.2 Template Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
8.9 Configuring Authentication Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
8.9.1 Configuring the General Details of a Card Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
8.9.2 Configuring Attribute Claims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .216
8.9.3 Configuring User Identification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .217
8.10 Cleaning Up Identities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .218
9 Configuring STS 219
9.1 Configuring STS Attribute Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219
9.2 Configuring Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219
9.3 Configuring the Authentication Request. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .220
10 Configuring WS Federation 221
10.1 Using the Identity Server as an Identity Provider for ADFS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221
10.1.1 Configuring the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
10.1.2 Configuring the ADFS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .227
10.1.3 Logging In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .229
10.1.4 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .230
10.2 Using the ADFS Server as an Identity Provider for an Access Manager Protected Resource . . . .231
8 NetIQ Access Manager Appliance 3.2 SP3 Identity Server Guide
10.2.1 Configuring the Identity Server as a Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . .232
10.2.2 Configuring the ADFS Server to Be an Identity Provider. . . . . . . . . . . . . . . . . . . . . . . . . .235
10.2.3 Logging In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .236
10.2.4 Additional WS Federation Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .236
10.3 Managing WS Federation Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .237
10.3.1 Creating an Identity Provider for WS Federation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .237
10.3.2 Creating a Service Provider for WS Federation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238
10.4 Modifying a WS Federation Identity Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238
10.4.1 Renaming the Trusted Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238
10.4.2 Configuring the Attributes Obtained at Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . .239
10.4.3 Modifying the User Identification Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
10.4.4 Viewing the WS Identity Provider Metadata. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .240
10.4.5 Editing the WS Identity Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .241
10.4.6 Modifying the Authentication Card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .241
10.4.7 Assertion Validity Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242
10.5 Modifying a WS Federation Service Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242
10.5.1 Renaming the Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242
10.5.2 Configuring the Attributes Sent with Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242
10.5.3 Modifying the Authentication Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .243
10.5.4 Viewing the WS Service Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .244
10.5.5 Editing the WS Service Provider Metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .244
11 Configuring Active Directory Federation Services with SAML 2.0 247
11.1 Prerequisites and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247
11.1.1 Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248
11.1.2 IP Connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248
11.1.3 Name Resolution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248
11.1.4 Clock Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248
11.2 Configuring Access Manager as a Claims or Identity Provider and AD FS 2.0 as Relying
Party or Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .249
11.2.1 Configuring Access Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .249
11.2.2 Configuring AD FS 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .251
11.2.3 Example Scenario: Access Manager as the Claims Provider and AD FS 2.0 as the
Relying Party. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .255
11.3 Configuring AD FS 2.0 as the Claims or Identity Provider and Access Manager as the Relying
Party or Service Provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .256
11.3.1 Configuring Access Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .257
11.3.2 Configuring AD FS 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .258
11.4 AD FS 2.0 Basics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260
11.4.1 Configuring the Token-Decrypting Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260
11.4.2 Adding CA Certificates to AD FS 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .261
11.4.3 Debugging AD FS 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .261
11.5 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .261
12 SP Brokering 263
12.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
12.2 Functionalities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
12.3 Brokering Flow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264
12.4 Deployment Scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .266
12.4.1 Configuring Trusted Providers at One Broker Identity Server . . . . . . . . . . . . . . . . . . . . . .267
12.4.2 Brokering Across Group is not Allowed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .268
12.4.3 Brokering Within Group is Allowed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .268
12.4.4 Brokering Within a Group Based On Groups and Members . . . . . . . . . . . . . . . . . . . . . . .268
12.5 Creating and Viewing Brokering Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .268
12.5.1 Creating a Brokering Group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .269
12.5.2 Configuring Trusted Identity Providers and Service Providers . . . . . . . . . . . . . . . . . . . . .270
Contents 9
12.5.3 Configuring Brokering Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .271
12.5.4 Constructing Brokering URLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274
12.5.5 Validating Brokering Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275
12.6 Generating the Brokering URLs by Using an ID and Target in the Intersite Transfer Service . . . . .277
12.7 Transient Federation within SAML 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .277
12.8 Assigning the Roles for the Origin IDP users in SP Broker Using the Transient Federation
Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .278
12.9 Assigning The Local Roles Based On Remote Roles And Attributes . . . . . . . . . . . . . . . . . . . . . . .280
13 Configuring User Identification Methods for Federation 283
13.1 Defining User Identification for Liberty and SAML 2.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .283
13.1.1 Selecting a User Identification Method for Liberty or SAML 2.0 . . . . . . . . . . . . . . . . . . . .283
13.1.2 Configuring the Attribute Matching Method for Liberty or SAML 2.0. . . . . . . . . . . . . . . . .286
13.2 Defining User Identification for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287
13.2.1 Selecting a User Identification Method for SAML 1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . .287
13.2.2 Configuring the Attribute Matching Method for SAML 1.1. . . . . . . . . . . . . . . . . . . . . . . . .288
13.3 Defining the User Provisioning Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289
13.4 User Provisioning Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
14 Configuring Communication Profiles 295
14.1 Configuring a Liberty Profile. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .295
14.2 Configuring a SAML 1.1 Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .296
14.3 Configuring a SAML 2.0 Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .296
15 Configuring Liberty Web Services 299
15.1 Configuring the Web Services Framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299
15.2 Managing Web Services and Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .300
15.2.1 Modifying Service and Profile Details for Employee, Custom, and Personal Profiles . . . .301
15.2.2 Modifying Details for Authentication, Discovery, LDAP, and User Interaction Profiles. . . .303
15.2.3 Editing Web Service Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .304
15.2.4 Editing Web Service Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .305
15.2.5 Create Web Service Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .307
15.3 Configuring Credential Profile Security and Display Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .308
15.4 Customizing Attribute Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .310
15.5 Configuring the Web Service Consumer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .310
15.6 Mapping LDAP and Liberty Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .311
15.6.1 Configuring One-to-One Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .312
15.6.2 Configuring Employee Type Attribute Maps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315
15.6.3 Configuring Employee Status Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .316
15.6.4 Configuring Postal Address Attribute Maps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .318
15.6.5 Configuring Contact Method Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .319
15.6.6 Configuring Gender Attribute Maps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .321
15.6.7 Configuring Marital Status Attribute Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322
16 Maintaining an Identity Server 325
16.1 Managing an Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .325
16.1.1 Updating an Identity Server Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .326
16.1.2 Restarting the Identity Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .327
16.2 Editing Server Details. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .327
16.3 Configuring Component Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .328
16.3.1 Enabling Component Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .328
16.3.2 Managing Log File Size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .330
10 NetIQ Access Manager Appliance 3.2 SP3 Identity Server Guide