Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 359 / 374

Troubleshooting the Identity Server and Authentication 359
n
ov
do
cx (e
n)
16
Ap
ril 20
10
15.3.4 Federation Errors
 Most errors that occur during federation occur because of time synchronization problems
between servers. Ensure that all of your servers involved with federation have their time
synchronized within one minute.
 When the user denies consent to federate after clicking a Liberty link and logging in at the
identity provider, the system displays an error page. The user should acknowledge that
federation consent was denied and return to the service provider login page. This is the
expected behavior when a user denies consent.
15.3.5 Mutual Authentication Troubleshooting Tips

LAN traces:

Check the SSL handshake and look at trusted root list that was returned.

The client certificate issuer must be in the identity provider certificate store and be applied
to all the devices in a cluster.

Ensure that the user exists and meets the authentication criteria. As the user store
administrator, you can search for a subject name (or certificate mapping attributes
defined) to locate a matching user.

Enable the Show Certificate Errors option on the Attributes page for the X.509 authentication
class. (Click Identity Servers > Servers > Edit > Local > Classes > [x.509] > Properties .)
Enabling this option provides detailed error messages on the login browser, rather than generic
messages.

Ensure that the certificate subject name matches the user you log in with, if you are chaining
methods.

Use NTRadPing to test installations.
 Verify that the correct UDP port 1812 is specified.

Verify that the RADIUS server can accept requests from the Identity Server. This might require
the NAS-IP-Address attribute along with credentials.

Verify that the user exists in the user store if multiple methods are added to a contract.

Verify that user authentication works independent of Access Manager.

Verify that the NMAS server is local and no tree walks are occurring across the directory.

Ensure that the NMAS_LOGIN_SEQUENCE property is defined correctly.
15.3.6 Browser Hangs in an Authentication Redirect
If the browser hangs when the user attempts to authenticate at an identity provider, determine
whether a new authentication contract was created and set as the default contract on the Identity
Server. If this is the case and you have an Access Gateway resource set to accept any contract from
the identity provider, you should navigate to the
Overview tab for the protected resource and specify
Any again in the Contract drop-down menu. Then click OK , then update the Access Gateway.