Novell ACCESS MANAGER 3.1 SP2 - README 2010, Руководство пользователя

Страница: 156 / 374

156 Novell Access Manager 3.1 SP2 Identity Server Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
4.6.4 Assigning the NESCM Contract to a Protected Resource
Contracts must be created before they can be assigned to protected resources. The following steps
explain how to assign the NESCM contract to an existing protected resource. If you have not created
a protected resource, see “
Configuring Protected Resources ”in the Novell Access Manager 3.1 SP2
Access Gateway Guide .
1 In the Administration Console, click Devices > Access Gateways > Edit > [Name of Reverse
Proxy] .
The reverse proxy should be configured with a resource that you want to protect with the smart
card.
2 Click the Protected Resource link for the proxy service where you want to assign the NESCM
contract.
3 To enable the NESCM contract on an existing protected resource, click the Authentication
Procedure link for that resource, then select the NESCM contract created in “Creating an
Authentication Contract to Use the Method” on page 154 .
If the contract is not listed, make sure you have updated the changes to the servers, first to the
Identity Server and then the Access Gateway. If you have multiple Identity Server
configurations, make sure that the Access Gateway is assigned to the Identity Server
configuration that contains the NESCM contract (click
Access Gateways > Edit > Reverse
Proxy / Authentication ).
4
Click OK .
5 Click the Access Gateways task, then update the Access Gateway.
6 Continue with Section 4.6.5, “Verifying the User’s Experience,” on page 156 .
4.6.5 Verifying the User’s Experience
1
From the smart-card-equipped workstation, browse to and select the URL of the proxy service
where the protected resource requiring NESCM type authentication is enabled.
2 When prompted by Access Manager, enter a username .
3 When prompted for the smart card password, enter a password (the smart card PIN).
If the Smart Card contains a certificate that meets the defined criteria (in this example, a matching
Subject name and trusted signing CA), the user is now successfully authenticated to the IDP and is
connected through the Access Gateway to the protected resource.