Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 129 / 374

Configuring Local Authentication 129
n
ov
do
cx (e
n)
16
Ap
ril 20
10
The Identity Server needs to read the value of the grace login attribute in order to properly redirect to
the password management servlet. If restricting grace logins is not important to your security model,
enable grace logins and set the maximum to 9999 (the equivalent of infinite in most environments).
For more information, see
TID 3465171 (http://www.novell.com/support/php/
search.do?cmd=displayKC&docType=kc&externalId=3465171&sliceId=2&docTypeID=DT_TID_
1_1&dialogID=131458644&stateId=0%200%20131454892)
.
Federated Accounts
A user’s password does not expire and grace logins are not decremented when you have the
following setup:

The Identity Server is configured to act as a service provider

User identification is configured to allow federation

Federation is set up with SAML 2.0, Liberty, WS Federation, or CardSpace protocols
The password expiration service is not called because the user is not using a password for
authentication. The service can only be called when the user’s account is defederated. After the user
has defederated the account, the next time the user logs in, a password is required and the service is
called.
3.4.2 Using Activity Realms
Activity realms are designed to be used with an Access Manager system that uses multiple contracts
to protect resources that require different activity timeouts. Activity realms allow you to define how
activity at one protected resource affects the activity timeout at another protected resource.
An activity realm essentially represents a time line that tracks the last activity for any resource that is
protected by a contract assigned to the activity realm. When a protected resource is accessed, the
activity realm associated with the contract is marked as having activity. The contract times out for a
protected resource when the elapsed time for activity on the activity realm is greater than the time
limit specified in the contract.
For example, suppose you create an activity realm called shared1 and assign it to contract C1 with a
timeout of 30 minutes and to contract C2 with a timeout of 15 minutes. Any activity at the resource
protected by C1 or C2 marks activity to the shared1 time line.
Figure 3-3 illustrates this scenario.
Figure 3-3
Two Contracts Sharing an Activity Realm
In Figure 3-3 , the user logs into PR1 at time 0, then logs into PR2 at time 6. During the next 30
minutes, the user is active on PR1. The time line for the shared1 activity realm is updated with the
user’s activity. The user then access PR2 at time 38. Even though no activity has taken place on PR2
for more than the 15-minute contract timeout, PR2 does not time out because activity has occurred
within this time at PR1 and because the resources share the same activity realm. Assigning two or
more contracts to the same activity realm allows the contracts to influence the timeouts of the other
contracts in the activity realm.
0 5 10 15 20 25 30 35 40 45
PR1,C1,30
PR2,C2,15
minutes
x
x
x x x x x x x
x
timeline
shared1