NetIQ Access Manager - Advanced Authentication Plugin. Installation Guide. Version 5.1.0

Transcription

1 NetIQ Access Manager - Advanced Authentication Pugin Instaation Guide Version 5.1.0

2 Tabe of Contents 1 Tabe of Contents 2 Introduction 3 About This Document 3 Environment 4 NetIQ Access Manager Advanced Authentication Pugin Instaation 5 Automatic Mode 5 Manua Mode 6 JSP Fies 7 NetIQ Authentication Support Configuration 8 NetIQ EMai + LDAP Authentication Support Configuration 9 NetIQ HOTP + LDAP Authentication Support Configuration 10 NetIQ RADIUS + LDAP Authentication Support Configuration 11 NetIQ Security Question + LDAP Authentication Support Configuration 12 NetIQ Smartphone + LDAP Authentication Support Configuration 13 NetIQ SMS + LDAP Authentication Support Configuration 14 NetIQ TOTP + LDAP Authentication Support Configuration 15 NetIQ Voice Ca + LDAP Authentication Support Configuration 16 Debug Logging 17 Index 18 2

3 Introduction About This Document Purpose of the Document This Instaation Guide is intended for system administrators and describes how to insta NetIQ Access Manager Advanced Authentication Pugin. Document Conventions This document uses the foowing conventions: Warning. This sign indicates requirements or restrictions that shoud be observed to prevent undesirabe effects. Important notes. This sign indicates important information you need to know to use the product successfuy. Notes. This sign indicates suppementary information you may need in some cases. Tips. This sign indicates recommendations. Terms are itaicized, e.g.: Authenticator. Names of GUI eements such as diaogs, menu items, and buttons are put in bod type, e.g.: the Logon window. 3

4 Environment Components that are required for instaation: NetIQ Access Manager / User Store shoud be configured for the used repo in the NAM appiance. 4

5 NetIQ Access Manager Advanced Authentication Pugin Instaation Root permissions are required for the instaation of NetIQ Access Manager Advanced Authentication Pugin. NetIQ Access Manager can be instaed in 2 modes: Automatic Mode Manua Mode Automatic Mode To insta NetIQ Access Manager Advanced Authentication Pugin in the automatic mode: 1. Copy NetIQNAMAAPuginSetup.jar to the NAM instance. 2. Insta NetIQNAMAAPuginSetup.jar using the java -jar command. 3. Foow the steps required for NetIQ Access Manager Advanced Authentication Pugin instaation: After the instaation is started and the Wecome to the instaation of NetIQ Access Manager - Advanced Authentication Pugin" text is dispayed, press 1 to continue. After the Consider it as a icense... text, press 1 to accept. When you are suggested to seect target path, enter /opt/nove. If the directory aready exists and is not empty, press 1 to continue, if you confirm the instaation and remova of a existing fies. Seect the packs you want to insta. Press 1 to seect an appicabe pack, 0 to deseect a pack. After the pack seection is done, press 1 to continue. 4. Foow the steps required for configuration of connection to NetIQ Advanced Authentication Framework - Authenticore Server v5: Specify Server address: vaue:<serverip address>. Specify Server port: vaue: <server port> (for HTTPS - 443, for HTTP - 80). If server uses HTTPS protoco, press 1. If server uses HTTP protoco, press 0. Specify Administrator name: vaue:oca\<serverocaadmin>. Specify Administrator password: vaue <oca admin's password> Press 1 to finish NetIQ Access Manager Advanced Authentication Pugin configuration. 5. NetIQ Access Manager Advanced Authentication Pugin wi be successfuy instaed. 5

6 Manua Mode To insta NetIQ Access Manager Advanced Authentication Pugin in the manua mode: 1. Copy fies from distributive content ocation aucorelib.jar, NAMPuginAuCore.jar, ib/gson jar, ib/commons-codec-1.9.jar to Linux: /opt/nove/nam/idp/webapps/nidp/web-inf/ib Windows: C:\Program Fies (x86)\nove\tomcat\webapps\nidp\web-inf\ib 2. Copy fies from distributive content ocation aucorelib.jar, ib/gson jar, ib/- commons-codec-1.9.jar to Linux: /opt/nove/nam/idp/endorsed Windows: C:\Program Fies (x86)\nove\tomcat\endorsed 3. Copy fies from jsp foder (see the JSP Fies chapter to view the ist of a jsp fies for each method) of distributive ocation to Linux: /opt/nove/nids/ib/webapp/jsp Windows: C:\Program Fies (x86)\nove\tomcat\webapps\nidp\jsp 4. Copy additiona assets from assets/images and assets/js foders in distributive ocation to Linux: /opt/nove/nids/ib/webapp/images Windows: C:\Program Fies (x86)\nove\tomcat\webapps\nidp\images 5. Foow the steps to configure the connection to NetIQ Advanced Authentication Framework - Authenticore Server v5: Create the config.xm fie in the /etc/authasas/ foder of the NAM instance (defaut ocation, can be changed manuay). Modify the config.xm fie: <configuration> <server> <ur>{server IP address or its domain name}</ur> <port>{serverport:forhttps-443,forhttp-80}</port> <https>{fag which determines the usage of an appicabe connection type: for HTTPS - 1, for HTTP - 0}</https> </server> <endpoint> <id>{endpoint id created by admin at the server, by defaut }</id> <secret>{secret endpoint specified by admin during the creation of endpoint at the server, by defaut }</secret> </endpoint> </configuration> 6

7 Save the modified fie. Whie configuring an appicabe authentication method, add the CONFIGFILE property with the specified path to the config.xm fie. The id and secret parameters shoud be updated in the config.xm fie (ocated in the /etc/authasas/ foder of the NAM instance) in accordance with every newy added endpoint at the NetIQ Advanced Authentication Framework - Authenticore Server v5. JSP Fies For Emai + LDAP Authentication Method Copy: EMaiAuthStep1.jsp EMaiAuthStep2.jsp For HOTP + LDAP Authentication Method Copy: HOTPAuthStep1.jsp HOTPAuthStep2.jsp For RADIUS + LDAP Authentication Method Copy: RadiusAuthStep1.jsp RadiusAuthStep2.jsp For Security Question+ LDAP Authentication Method Copy: SecQuestionAuthStep1.jsp SecQuestionAuthStep2.jsp For Smartphone + LDAP Authentication Method Copy: SmartphoneOTPAuthStep1.jsp SmartphoneOTPAuthStep2.jsp For SMS + LDAP Authentication Method Copy: SMSAuthStep1.jsp SMSAuthStep2.jsp For TOTP + LDAP Authentication Method Copy: TOTPAuthStep1.jsp TOTPAuthStep2.jsp For Voice Ca + LDAP Authentication Method Copy: VoiceCaAuthStep1.jsp VoiceCaAuthStep2.jsp 7

8 NetIQ Authentication Support Configuration In this chapter: NetIQ EMai + LDAP Authentication Support Configuration NetIQ HOTP + LDAP Authentication Support Configuration NetIQ RADIUS + LDAP Authentication Support Configuration NetIQ Security Question + LDAP Authentication Support Configuration NetIQ Smartphone + LDAP Authentication Support Configuration NetIQ SMS + LDAP Authentication Support Configuration NetIQ TOTP + LDAP Authentication Support Configuration NetIQ Voice Ca + LDAP Authentication Support Configuration 8

9 NetIQ EMai + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: EmaiCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.emai.emaicass 2. Create a new authentication method for the cass: a. Dispay Name: EMaiMethod b. Cass: EMaiCass c. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. d. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: EMaiContract; b. URI: emaianddap/uri; c. Methods: EMaiMethod; 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: _ID; b. Text: NetIQ Emai Authentication; c. Image: <Seect Loca Image>, then seect NAMAA_EMai.png. 6. Update NAM Server configuration. 9

10 NetIQ HOTP + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: HOTPCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.oauth.hotpcass 2. Create a new authentication method for the cass: a. Dispay Name: HOTPMethod b. Cass: HOTPCass c. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. d. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: HOTPContract b. URI: hotpanddap/uri c. Methods: HOTPMethod 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: HOTP_ID b. Text: NetIQ HOTP Authentication c. Image: <Seect Loca Image>, then seect NAMAA_HOTP.png 6. Update NAM Server configuration. 10

11 NetIQ RADIUS + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: RADIUSCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.radius.radiuscass 2. Create a new authentication method for the cass: a. Dispay Name: RADIUSMethod b. Cass: RADIUSCass c. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. d. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: RADIUSContract b. URI: radiusanddap/uri c. Methods: RADIUSMethod 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: RADIUS_ID b. Text: NetIQ RADIUS Authentication c. Image: <Seect Loca Image>, then seect NAMAA_RADIUS.png 6. Update NAM Server configuration. 11

12 NetIQ Security Question + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: SecurityQuestion Cass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.securityquestion.securityquestioncass 2. Create a new authentication method for the cass: a. Dispay Name: SecurityQuestion Method b. Cass: SecurityQuestion Cass a. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. b. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: SecurityQuestio Contract b. URI: securityquestionanddap/uri c. Methods: SecurityQuestion Method 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: SECURITYQUESTION_ID b. Text: NetIQ Security Question Authentication c. Image: <Seect Loca Image>, then seect NAMAA_SecurityQuestions.png 6. Update NAM Server configuration. 12

13 NetIQ Smartphone + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: SmartphoneCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.smartphone.smartphonecass 2. Create a new authentication method for the cass: a. Dispay Name: SmartphoneMethod b. Cass: SmartphoneCass c. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. d. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: Smartphone Contract b. URI: smartphoneanddap/uri c. Methods: SmartphoneMethod 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: SMARTPHONE_ID b. Text: NetIQ Smartphone Authentication c. Image: <Seect Loca Image>, then seect NAMAA_Smartphone.png 6. Update NAM Server configuration. 13

14 NetIQ SMS + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: SMSCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.sms.smscass 2. Create a new authentication method for the cass: a. Dispay Name: SMS Method b. Cass: SMSCass c. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. d. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: SMSContract b. URI: smsanddap/uri c. Methods: SMS Method 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: SMS_ID b. Text: NetIQ SMS Authentication c. Image: <Seect Loca Image>, then seect NAMAA_SMS.png 6. Update NAM Server configuration. 14

15 NetIQ TOTP + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: TOTPCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.oauth.totpcass 2. Create a new authentication method for the cass: a. Dispay Name: TOTPMethod b. Cass: TOTPCass c. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. d. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: TOTPContract b. URI: totpanddap/uri c. Methods: TOTPMethod 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: TOTP_ID b. Text: NetIQ TOTP Authentication c. Image: <Seect Loca Image>, then seect NAMAA_TOTP.png 6. Update NAM Server configuration. 15

16 NetIQ Voice Ca + LDAP Authentication Support Configuration 1. Create a new authentication cass with the foowing parameters: a. Dispay name: VoicecaCass b. Java cass: Other c. Java cass path: com.authasas.aucore.nam.method.voiceca.voicecacass 2. Create a new authentication method for the cass: a. Dispay Name: Voice ca Method b. Cass: Voice ca Cass a. Keep the Identifies User checkbox seected. Seect the Overwrite Temporary User and Overwrite Rea User checkboxes. b. Add the used user store to User Stores. 3. Add the foowing property (KEY/Vaue): CONFIGFILE: path to configuration fie (this parameter is used ony if configuration fie has different ocation, the defaut ocation is /etc/authasas/config.xm) 4. Create a new authentication contract for the method in the Configuration tab: a. Dispay name: Voice ca Contract b. URI: voicecaanddap/uri c. Methods: Voice ca Method 5. Specify appicabe vaues for the new authentication card in the Authentication Card tab: a. ID: VOICECALL_ID b. Text: NetIQ Voice ca Authentication c. Image: <Seect Loca Image>, then seect NAMAA_VoiceCa.png 6. Update NAM Server configuration. 16

17 Debug Logging The ogs are stored in /var/opt/nove/nam/ogs/idp/tomcat/cataina.out. Pease check the fie in case of any probems with authentication. 17

18 Index A Administrator 5 Authentication 1, 3, 5-16 Authenticator 3 C Card 9-10, 13-14, 16 Create 6, 9-16 L Loca 9-16 Logon 3 R RADIUS 7-8, 11 S Security 7-8, 12 Server 5-6, 9-16 Support 8 T TOTP 7-8, 15 U User 4, 9-16 W Windows 6 18