Novell ACCESS MANAGER 3.1 SP2 - README 2010, Руководство пользователя

Страница: 126 / 374

126 Novell Access Manager 3.1 SP2 Identity Server Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
Authentication Timeout: Specify how long the session can be inactive before the user is
prompted to log in again. The value can be from 5 minutes to 66535 minutes and must be
divisible by 5.
If you modify the timeout value for a contract, the newly assigned value is given to users as
they log in. Currently logged in users retain the old value until they re-authenticate.
You need to experiment to discover what values are best for your network configuration, your
security requirements, and your users.

Shorter timeouts increase back-channel traffic and require more threads for authentication
checks, but quickly free resources that are being used by inactive users. If you have slow
back-end services, users could get disconnected waiting for a response, and these
disconnects can generate more authentication traffic.
 Longer timeouts, which allow inactive users to remain connected, increase memory
requirements to store session information, but require fewer threads and don't generate as
much back-channel traffic.
For example, if you set the timeout to 5 minutes, an authentication check needs to be done 12
times each hour for each user authenticating with this contract. If the timeout is set to 60
minutes, an authentication check is done only one time each hour for each user. However, for
the 5 minute timeout, resources can be freed within 5 minutes of inactivity by the user. For the
60-minute timeout, resources can take as long as 60 minutes to be freed, depending upon when
the user goes inactive.
For information on how to use this feature with the Access Gateway, see “
Assigning a Timeout
Per Protected Resource ” in the Novell Access Manager 3.1 SP2 Access Gateway Guide
Activity Realm(s): Specify the name of the realm that can be used to indicate activity. Use a
comma-separated list to specify multiple realms. This allows a user’s session to be kept alive
when the user is accessing resources that are protected by different contracts. If both contracts
belong to the same realm, activity on either resource keeps the session alive on the other
resource. For more information about this feature, see
Section 3.4.2, “Using Activity Realms,”
on page 129 .
Satisfiable by a contract of equal or higher level: Allows the system to satisfy this
authentication contract if a user has logged in using another contract of an equal or higher
authentication level, as specified in the
Authentication Level field of an authentication contract.
When you enable this option, you need to be aware of the authentication levels you have set for
other contracts and the level that has been assigned to the default contract.
Satisfiable by External Provider: Allows this contract to be selected when configuring an
identity provider for Liberty or SAML 2.0. When you configure the authentication request, you
can select a contract that has this option enabled and require the identity provider to use this
contract in order for authentication to succeed.
Methods and Available Methods: Specifies the authentication method to use for the contract.
You can specify the order in which the methods are executed for login; however, this is not a
graded list, so all the methods you specify are required.
Available methods are the
authentication methods you have set up.
If you add more than one X.509 method, only the first one is used and it is automatically moved
to the top of the list.
When you choose a secure method, such as Secure Name/Password, ensure that you have
enabled security for the Identity Server configuration by setting the protocol to HTTPS. See
“
Configuring Secure Communication on the Identity Server ” in the Novell Access Manager 3.1
SP2 Setup Guide .