Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 215 / 374

Configuring SAML and Liberty Trusted Providers 215
n
ov
do
cx (e
n)
16
Ap
ril 20
10
The persistent and transient formats are generated automatically. For the others, you can select
an attribute. The available attributes depend upon the attributes that you have selected to send
with authentication (see
Section 7.6.1, “Configuring the Attributes Obtained at
Authentication,” on page 200 ). If you do not select a value for the E-mail, Kerberos, X509, or
Unspecified format, a unique value is automatically generated.
6 To specify that this Identity Server must authenticate the user, disable the Use proxied requests
option. When the option is disabled and the Identity Server cannot authenticate the user, the
user is denied access.
When this option is enabled, the Identity Server checks to see if other identity providers can
satisfy the request. If one or more can, the user is allowed to select which identity provider
performs the authentication. If a proxied identity provider performs the authentication, it sends
the response to the Identity Server. The Identity Server then sends the response to the service
provider.
7 Click OK twice, then update the Identity Server.
7.9.3 Configuring the SAML 1.1 Authentication Response
You can specify the name identifier and its format when the Identity Server sends an authentication
response. You can also restrict the use of the assertion.
When an identity provider sends an assertion, the assertion can be restricted to an intended audience.
The intended audience is defined to be any abstract URI in SAML 1.1. The URL reference can also
identify a document that describes the terms and conditions of audience membership.
1
In the Administration Console, click Devices > Identity Servers > Edit > SAML 1.1 > [Service
Provider] > Authentication Response .
2 To specify a name identifier format, select one of the following:
 E-mail: Specifies that an e-mail attribute can be used as the identifier.

X509: Specifies that an X.509 certificate can be used as the identifier.
 Unspecified: Specifies that an unspecified format can be used and any value can be used.
The service provider and the identity provider need to agree on what value is placed in this
identifier.
3
To specify the format of the name identifier, select an attribute.