Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 32 / 374

32 Novell Access Manager 3.1 SP2 Identity Server Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10

To import the trusted root from the server, click Auto-Import From Server , specify
the server’s IP address or DNS name and port, then click OK . The auto-import
displays the certificate chain, which you can select for import.

To remove a trusted root, select the trusted root, then click Remove .
3c Click Close .
3d Update the Identity Server.
For more information about enabling security for a basic Access Manager configuration, see
“
Enabling SSL Communication ” in the Novell Access Manager 3.1 SP2 Setup Guide .
For additional information about managing certificates, see “ Security and Certificate Management ”
in the Novell Access Manager 3.1 SP2 Administration Console Guide .
1.4 Security Considerations
By default, all Access Manager components (Identity Server, Access Gateway, SSL VPN, and J2EE
Agents) trust the certificates signed by the local CA. We recommend that you configure the Identity
Server to use an SSL certificate signed externally, and that you configure the trusted store of the
Embedded Service Provider for each component to trust this new CA. See “
Assigning Certificates to
Access Manager Devices ” in the Novell Access Manager 3.1 SP2 Administration Console Guide .
Be aware of the following options that can increase security:

Section 1.4.1, “Federation Options,” on page 32

Section 1.4.2, “Authentication Contracts,” on page 33

Section 1.4.3, “Forcing 128-Bit Encryption,” on page 33

Section 1.4.4, “Securing the Identity Server Cookie,” on page 34

Section 1.4.5, “Configuring the Encryption Method for the SAML Assertion,” on page 35

Section 1.4.6, “Configuring SAML 2.0 to Sign Messages,” on page 35

Section 1.4.7, “Blocking Access to Identity Server Pages,” on page 36
1.4.1 Federation Options
When you set up federation between an identity provider and a service provider, you can select
either to exchange assertions with a post method or to exchange artifacts.

An assertion in a post method might contain the user’s password or other sensitive data, which
can make it less secure than an artifact when the assertion is sent to the browser. It is possible
for a virus on the browser machine to access the memory where the browser decrypts the
assertion.

An artifact is a randomly generated ID, it contains no sensitive data, and only the intended
receiver can use it to retrieve assertion data.
If both providers support artifacts, you should select this method because it is more secure. For more
details, see the
Response protocol binding option in Section 7.8, “Configuring an Authentication
Request for an Identity Provider,” on page 207 .