Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 35 / 374

Configuring an Identity Server 35
n
ov
do
cx (e
n)
16
Ap
ril 20
10
1.4.5 Configuring the Encryption Method for the SAML
Assertion
By default, AES128 (Advanced Standard Encryption, 128-bit) is used to encrypt SAML assertions.
If you require a different encryption method, such as TDES (Triple Data Encryption Algorithm) or
AES256 (Advanced Standard Encryption, 256-bit), you can modify the Tomcat
web.xml
file and
specify your required method.
1 Open the
web.xml
file.
Linux:
/var/opt/novell/tomcat5/webapps/nidp/WEB-INF/
Windows Server 2003:
\Program Files\Novell\Tomcat\webapps\nidp\WEB-INF/
Windows Server 2008:
\Program Files (x86)\Novell\Tomcat\webapps\nidp\WEB-
INF/
2 Add the following lines to the file:
<context-param>
<param-name>EncryptionMethod</param-name>
<param-value>TDES</param-value>
</context-param>
You can set the
<param-value>
element to TDES, AES128, or AES256. Because AES128 is
the default, specifying this value in the
web.xml
file does not change any behavior.
3 Save the file and copy it to each Identity Server in the cluster.
4
Restart Tomcat on each Identity Server in the cluster.
Linux: Enter the following command:
/etc/init.d/novell-tomcat5 restart
Windows: Enter the following commands:
net stop Tomcat5
net start Tomcat5
1.4.6 Configuring SAML 2.0 to Sign Messages
In conformance with the SAML 2.0 specification, the Identity Server does not require the signing
post messages. However, if you want this extra layer of security, you can configure the Identity
Server to sign SAML 2.0 post messages. This is a global option, and when enabled, all SAML 2.0
service providers sign post messages.
To enable the signing of post messages:
1 Open the
web.xml
file.
Linux:
/var/opt/novell/tomcat5/webapps/nidp/WEB-INF/
Windows Server 2003:
\Program Files\Novell\Tomcat\webapps\nidp\WEB-INF/
Windows Server 2008:
\Program Files (x86)\Novell\Tomcat\webapps\nidp\WEB-
INF/
2 Add the following lines to the file: