Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 304 / 374

304 Novell Access Manager 3.1 SP2 Identity Server Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
Always Allow Interaction: Allows interaction to take place between users and service
providers.
Never Allow Interaction: Never allows interaction between users and service providers.
Always Allow Interaction for Permissions, Never for Data: Allows interaction for
permissions, never for data.
Maximum Allowed Interaction Time: Specifies the allowed time (in seconds).
3 To specify the allowable methods that a Web service provider can use for user interaction, click
one of the following options:
Redirect to a User Interaction Service: Allows the Web service consumer to redirect the user
agent to the Web service provider to ask questions. After the Web service provider has obtained
the information it needs, it can redirect the user back to the Web service consumer.
Call a Trusted User Interaction Service: Allows the Web service provider to trust the Web
service consumer to act as proxy for the resource owner.
4 Under Security Settings , fill in the following fields:
WSS Security Token Type: Instructs the Web service consumer/requestor how to place the
token in the security header as outlined in the Liberty ID-WSF Security Mechanisms.
Signature Algorithm: The signature algorithm to use for signing the payload.
5
Click OK , then update the Identity Server configuration as prompted.
13.6 Mapping LDAP and Liberty Attributes
You can create an LDAP attribute map or edit an existing one. To create an attribute map, you
specify how single-value and multi-value data items map to single-value and multi-value LDAP
attributes. A single-value attribute can contain no more than one value, and a multi-value attribute
can contain more than one. An example of a single-value attribute might be a person’s gender, and
an example of a multi-value attribute might be a person’s various e-mail addresses, phone numbers,
or titles.
1 In the Administration Console, click Devices > Identity Servers >> Edit > Liberty > LDAP
Attribute Mapping .
2 Select one of the following actions:
New: Allows you create an LDAP attribute mapping. Select from the following types:

One to One: Maps a single Liberty attribute to a single LDAP attribute. See
Section 13.6.1, “Configuring One-to-One Attribute Maps,” on page 305 .

Employee Type: Maps the Employee Type attribute to an LDAP attribute, then maps the
possible Liberty values to LDAP values. See Section 13.6.2, “Configuring Employee
Type Attribute Maps,” on page 308 .

Employee Status: Maps the Employee Status attribute to an LDAP attribute, then maps
the possible Liberty values to LDAP values. See Section 13.6.3, “Configuring Employee
Status Attribute Maps,” on page 309 .

Postal Address: Maps the Postal Address attribute to either multiple LDAP attributes or
a delimited LDAP attribute. See Section 13.6.4, “Configuring Postal Address Attribute
Maps,” on page 311 .

Contact Method: Maps the Contact Method attribute to multiple LDAP attributes. See
Section 13.6.5, “Configuring Contact Method Attribute Maps,” on page 312 .