Novell ACCESS MANAGER 3.1 SP2 - README 2010, Руководство пользователя

Страница: 265 / 374

Configuring WS Federation 265
n
ov
do
cx (e
n)
16
Ap
ril 20
10
on the Access Gateway is satisfied with this identification. If a contract is not specified, the Access
Gateway resources must be configured to use the
Any Contract option, which is not a typical
configuration.
1 On the WS Federation page, click the name of the Adatum identity provider configuration.
2 Click User Identification .
3 For Satisfies contract , select Name/Password – Form .
4 Select Allow federation .
5 For the User Identification Method , select Authenticate .
6 Click OK twice.
7 Update the Identity Provider.
8 Continue with “Importing the ADFS Signing Certificate into the NIDP-Truststore” on
page 265 .
Importing the ADFS Signing Certificate into the NIDP-Truststore
The Identity Server must have the trusted root of the ADFS signing certificate (or the certificate
itself) listed in its trust store, as well as specified in the relationship. This is because most ADFS
signing certificates have a chain, and the certificate that goes into the metadata is not the same as the
trusted root of that certificate. However, because the Active Directory step-by-step guide uses self-
signed certificates for signing, it is the same certificate in both the trust store and in the relationship.
To import the ADFS signing certificate’s trusted root (or the certificate itself) into the NIDP-
Truststore:
1 On the Identity Servers page, click Edit > Security > NIDP Trust Store .
2 Click Add .
3 Next to the Trusted Root(s) field, click the Select Trusted Root(s) icon.
This adds the trusted root of the ADFS signing certificate to the Trust Store.
4 On the Select Trusted Roots page, select the trusted root or certificate that you want to import,
then click
Add Trusted Roots to Trust Stores .
If there is no trusted root or certificate in the list, click Import . This enables you to import a
trusted root or certificate.
5 Next to the Trust store(s) field, click the Select Keystore icon.
6 Select the trust stores where you want to add the trusted root or certificate, then click OK twice.
7 Update the Identity Server so that changes can take effect.
This ends the basic configuration that must be done to for the Identity Server to trust the ADFS
server as an identity provider. However, the ADFS server needs to be configured to act as an identity
server and to trust the Identity Server. Continue with
Section 10.2.2, “Configuring the ADFS Server
to Be an Identity Provider,” on page 266 .