Novell ACCESS MANAGER 3.1 SP1 - IDENTITY SERVER Manual

Also see for ACCESS MANAGER 3.1 SP1 - ADMINISTRATION: Manual Manual Quick start guide Installation guide Manual

Contents

Novell ACCESS MANAGER 3.1 SP1 - IDENTITY SERVER Manual Manual pdf 71 page image

Configuring an Identity Server 71novdocx (en) 19 February 20103b Specify the server IP address and port.The auto-import displays the certificate chain, which you can select for import.3c Click OK, then click Close.4 Restart Tomcat.The system prompts you with a dialog box to restart Tomcat. This is necessary wheneversecurity changes are made to the Identity Server.For more information about enabling security for a basic Access Manager configuration, see“Enabling SSL Communication” in the Novell Access Manager 3.1 SP1 Setup Guide.For additional information about managing certificates, see “Security and Certificate Management”in the Novell Access Manager 3.1 SP1 Administration Console Guide.1.8 Security ConsiderationsBy default, all Access Manager components (Identity Server, Access Gateway, SSL VPN, andJ2EE* Agents) trust the certificates signed by the local CA. We recommend that you configure theIdentity Server to use an SSL certificate signed externally, and that you configure the trusted store ofthe service provider for each component to trust this new CA. See “Assigning Certificates to AccessManager Devices” in the Novell Access Manager 3.1 SP1 Administration Console Guide.Be aware of the following security issues: Section 1.8.1, “Federation Options,” on page 71 Section 1.8.2, “Authentication Contracts,” on page 72 Section 1.8.3, “Forcing 128-Bit Encryption,” on page 721.8.1 Federation OptionsWhen you set up federation between an identity provider and a service provider, you can selecteither to exchange assertions with a post method or to exchange artifacts. An artifact is a randomlygenerated ID, it contains no sensitive data, and only the intended receiver can use it to retrieve