Novell ACCESS MANAGER 3.1 SP2 - README 2010, Руководство пользователя

Страница: 225 / 374

Configuring CardSpace 225
n
ov
do
cx (e
n)
16
Ap
ril 20
10
4. The CardSpace client software requests a security token from its configured trusted identity
provider, and the identity provider returns the security token.
5. The CardSpace client software presents the token to the relying party, and if it matches the
requirements, the user is granted access.
The Novell Identity Server can be configured to act as relying party or as an identity provider. It can
be configured to accept the following types of cards for authentication: personal cards, managed
cards, and managed cards backed by personal cards.
8.2 Prerequisites for CardSpace

Your Identity Server cluster configuration must be configured for HTTPS. For configuration
information, see “
Enabling SSL Communication ” in the Novell Access Manager 3.1 SP2 Setup
Guide .

CardSpace requires high encryption. However, export laws prevent Access Manager from
shipping with the high encryption library for JRE. To add this library, see
Section 8.2.1,
“Enabling High Encryption,” on page 225 .

Clients need to be configured with a CardSpace client. See Section 8.2.2, “Configuring the
Client Machines for CardSpace,” on page 226 .
 Enable the Liberty Personal Profile. The default attribute set created for CardSpace is
dependent upon this profile.
Click
Identity Servers > Edit > Liberty > Web Service Provider . Select the Personal Profile ,
then click Enable > Apply . Update the Identity Server.

(Recommended) Enable Identity Server logging while you are setting up CardSpace. Set the
Component File Logger Levels of STS and CardSpace to debug. For more information, see
Section 14.3, “Configuring Component Logging,” on page 320 .

(Optional) If you are configuring an Identity Server to be an identity provider with managed
cards, you need a second Identity Server configured to be a relying party.
8.2.1 Enabling High Encryption
To enable high encryption, you need to replace the
US_export_policy.jar
and
local_policy.jar
files. The Identity Server that is going to be the relying party and the Identity
Server that is going to be the identity provider need to be enabled for high encryption.
1 Download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files
6 (jce_policy-6.zip) (http://java.sun.com/javase/downloads/index.jsp) .
2 Extract the files.
3
Copy the
US_export_policy.jar
and
local_policy.jar
files to the security directory for
the JRE. They should replace the existing files:

Linux Identity Server:
/opt/novell/java/jre/lib/security

Windows Server 2003 Identity Server:
\Program Files\Novell\jre\lib
\security
 Windows Server 2008 Identity Server:
\Program Files (x86)\Novell\jre\lib
\security