Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 253 / 374

Configuring WS Federation 253
n
ov
do
cx (e
n)
16
Ap
ril 20
10
If the DNS name of your Identity Server is
idp-50.amlab.net
, the URI would have the following
format:
https://idp-50.amlab.net:8443/nidp/name/password/uri
This URL doesn't resolve to anything because the Identity Server interprets it as a contract URI and
not a URL.
To create a new authentication contract:
1
In the Administration Console, click Devices > Identity Servers > Edit > Local > Contracts .
2 Click New , then fill in the following fields:
Display name: Specify a name, for example WS-Fed Contract.
URI: Specify a URI, for example
https://idp-50.amlab.net:8443/nidp/name/
password/uri
.
Satisfiable by External Provider: Enable this option. The ADFS server needs to satisfy this
contract.
3 Move Name/Password – Form to the Methods list.
4 Click Next , then fill in the following fields:
ID: Leave this field blank. You only need to supply a value when you want a reference that you
can use externally.
Text: Specify a description that is available to the user when the user mouses over the card.
Image: Select an image, such as Form Auth Username Password . This is the default image for
the Name/Password - Form contract.
Show Card: Enable this option so that the card can be presented to the user as a login option.
5 Click Finish .
6 Continue with “Setting the WS-Fed Contract to Be the Default Contract” on page 253 .
Setting the WS-Fed Contract to Be the Default Contract
It is not possible to specify the contract to request from the ADFS service provider to the Identity
Server. You must either set the contract for WS-Fed to be the default, or have your users remember
to click that contract every time.
1
On the Local page of the Identity Server, click Defaults .
2 For the Authentication Contract option, select the WS-Fed Contract.
3
Click Apply .
4 Continue with “Enabling the STS and WS Federation Protocols” on page 253 .
Enabling the STS and WS Federation Protocols
Access Manager ships with only SAML 1.1, Liberty, and SAML 2.0 enabled by default. In order to
use the WS Federation protocol, you must enable it on the Identity Server. Because the WS
Federation Protocol uses the STS (Secure Token Service) protocol, STS must also be enabled.
1 Click the General tab.
2 In the Enabled Protocols section, select the STS and WS Federation protocols.
3 Click OK .