Dell One Identity Cloud Access Manager 7.1.0

Transcription

1 Dell One Identity Cloud Access Manager June 2014 These release notes provide information about the release. About Dell One Identity Cloud Access Manager New features Enhancements Resolved issues Known issues System requirements Product licensing Getting started with One Identity Cloud Access Manager Globalization About Dell About Dell One Identity Cloud Access Manager Cloud Access Manager delivers real productivity gains to your end users, while minimizing the effort needed to control access to your on-premise applications and cloud service accounts. Cloud Access Manager provides: Password wallet and identity federation functions provide your users with the convenience of single sign-on to all applications, whether they run on your private network or in the public cloud. Cloud Access Manager provides web access management functionality using its web proxy technology, allowing you to expose your internal web applications securely to external users. An easy-to-use customizable application portal provides your users with a convenient launchpad, allowing them to see and navigate to the applications they have access to. Identity federation with home realm discovery allows you to grant access to users in other forests within your own organization and in other external organizations. For extra security you can configure Cloud Access Manager to require two-factor authentication for external users, or to protect sensitive applications. Just-in-time provisioning means that your users get access to the applications they need when they need them and not before, giving you cost savings in license seats, while at the same time reducing the administrative burden of application account provisioning. 1

2 Dell vworkspace integration seamlessly brings application virtualization to the Cloud Access Manager environment, allowing vworkspace application links to be displayed in the application portal, along with other web applications. High availability deployment options provide continuity of service and scalability to millions of users. Cloud Access Manager is a minor release, with enhanced features and functionality. See New features and Enhancements. New features New features in Cloud Access Manager 7.1.0: Dell vworkspace integration - allows vworkspace resources to be hosted on Cloud Access Manager s application portal. Users will see app links on their application portal for each vworkspace resource they are authorized to access. Export application configuration as a template this feature enables you to create an application single sign-on configuration template file automatically, based on the information already supplied in the configuration for a given application. This allows an administrator, or a Dell professional services or presales engineer, having successfully set up and tested single sign-on to an application, to export the required information that would allow other customers to configure the same application quickly and easily in their own installation. Home realm discovery automation and privacy options - the default method used by Cloud Access Manager to determine which authentication realm a user belongs to, is to present a dropdown list of trusted identity providers to the end user. There are many instances where it is not desirable for users of one organization to view a list of other federated partners which the hosting organization may have an association with. Other methods are now available which do not divulge the associations established with other organizations. In the case where Cloud Access Manager federates with multiple partners, it is usual for users belonging to any particular partner site only to authenticate via the local identity provider, and so to present the user with a choice of identity providers is unnecessary and undesirable. A method of automating the selection of the identity provider (after having initially been manually selected by the user) has been introduced. Handle application password-change/password-expiry form - when a proxied application, configured for form-fill SSO, displays a password change or password expiry form, typically the user is prompted to enter his current password and a new password (usually the new password twice). Previously, when using Cloud Access Manager, the user was likely to forget his current application password (because it was being remembered by Cloud Access Manager), and so could not complete the password change form. Cloud Access Manager addresses this issue by automatically inserting the user s current application password into the old password field of the password change form. In addition, Cloud Access Manager captures the new password entered into the form, asks the user whether he wants Cloud Access Manager to save the new password, and if so, stores the new password in the user s password wallet. Adaptive authentication: strong authentication for external users - provides the option to require strong authentication (RADIUS) only when the user is located outside Cloud Access Manager s firewalled network. When the user is inside the network, password-based authentication is sufficient. Step-up authentication - Allow administrators to protect certain applications or groups of applications with strong authentication via a RADIUS authentication service, without requiring strong authentication for the Cloud Access Manager environment itself. A user authenticates to Cloud Access Manager using username and password (first factor). When a user accesses a non-sensitive application, he is able to access the application without further authentication. When a user accesses a sensitive application, he must enter an OTP in order to access the application. Support for applications which rely on SAML AssertionConsumerServiceIndex - some applications rely on the STS recognizing the optional AssertionConsumerServiceIndex. To support these applications, Cloud Access Manager will recognize this attribute in a SAML AuthnRequest, and convert it, using information obtained through the application s metadata, to the corresponding AssertionConsumerServiceURL. InTrust integration - Cloud Access Manager can output audit information to InTrust, to report on authentication, authorization, provisioning and administrative events. 2

3 App catalog: Provisioning app owner notification workflow (non API) - to allow for scenarios where an application does not have a user account provisioning API, a new facility has been provided whereby a user provisions an application from his app catalog to his portal page, where that action causes a notification (via ) to be sent to the application owner. The application owner, having taken the required action to create the application account, clicks on a link which marks that provisioning task as complete. A function within the administration user interface allows an application owner to review outstanding requests, and mark as complete. Additional reporting: User report - a report showing all Cloud Access Manager users, with a summary showing total counts. The facility allows the administrator to filter on authenticator and date range. It also allows the administrator to search for a particular user name. Administration audit report - allows an administrator to view, filter, and export audit records which report administrative changes to Cloud Access Manager s configuration. Application license usage report a report that provides the usage data for a given application, including its current user count, so that it can be compared with license capacity. Form-fill without proxy - an option has been provided within the application configuration wizard that supports form-fill SSO by unsolicited HTTP POST. This is useful for certain web applications in scenarios where extranet access is not required. See also: Enhancements Resolved issues Enhancements The following is a list of enhancements implemented in Cloud Access Manager Table 1. General enhancements Enhancement Issue ID Cross-Site Request Forgery (CSRF) prevention 1709 Information leakage in login error message 1747 Kerberos support for Chrome browsers ( m+) 1905 Cloud Access Manager (satellite instance) SAML SSO template 6133 Improved logout experience from ServiceNow 6183 ServiceNow User account provisioning template 6207 Ability to create a configuration template from an existing application 6263 Allow one application to share the identity provider certificate of another application 6265 Allow multiple static fields to be added to form-fill configuration 6331 New SAML SSO templates - for ServiceNow and Canvas (Instructure) SAML SSO configuration Capture password entered at local STS enables Cloud Access Manager to use the password for single sign-on functions 6166, Log Failed Authentication Events Improvements to form credential capture Password expiry notification

4 Improve handling of sign out from Office 365 web client applications Create Negotiate endpoint for Office Templates to allow easier configuration of directory connections to Active Directory Lightweight Directory Services (AD-LDS), Novell edirectory, and 389 Directory Server Added option in login form inspection tool to create new app in case app is on same web server as existing form-fill app New form-fill template for Dell One Identity Manager If the submit button id/name/label is not specified, the default button for the form is used New proxy property cam.enablecookiedomainrewrite to allow apps to share their domain cookies with other CAM apps Users role description improved Allow form-fill apps with an invalid submit button id to fall back to submitting the form if available Upgraded connectors to Quick Connect for Cloud Services Support AssertionConsumerServiceIndex Support for signed SAML authentication requests Resolved issues The following is a list of issues addressed in this release. Table 3. General resolved issues Resolved issue Don t attempt Kerberos authentication in Safari 1908 Avoid loop when user submits bad form-fill credentials and 'auto-submit once per session' is off Issue ID Prevent editing of CSR fields after generating CSR License expiry time handling is inconsistent Server error when showing Home Realm Discovery page where SAML request carries large RelayState Home Realm Discovery fails when signed SAML authentication request is received Proxy reported down but still working - Illegal instant due to time zone offset transition Modified NotBefore and NotOnOrAfter values returned in SAML token to be issue instant and 30 minutes after the issue instant respectively Enforce unique Front End Authenticator and Application names Can't access metadata for Office365 application Login form inspection tool fails to load Remove leading and trailing spaces from property values Login form inspection tool not visible without scrolling No scroll bar is available to select applications at the bottom of a list of applications larger than the browser window Cannot authenticate after changing proxy host name

5 Can't pass through SAML attribute claims unless the incoming attribute name is of the form namespace/name Form-fill templates created as disabled by default Allow SAML tokens with no attributes Problems importing PEM certificate files for Front End Authenticators Auto submit fails for applications using the window.navigate function Passwords visible in logs Allow underscores in header name but show warning Duplicate claim returned to SAML application Salesforce template does not support SP initiated model Subject mapping not working from ADFS to federated application Header mapping from attribute does not work for forms apps Cloud Access Manager does not work as an IdP with Auth0.com Special character in application name breaks form-fill Can't connect to Google Apps when federation domain is not primary domain Can't authenticate with LDAP Front End Authenticator Prevent form-fill auto submit looping Cannot add a simple hostname that ends with a number into the application URL when creating a proxy mapping NTLM and Basic Auth SSO fail if credentials contain UTF-8 characters Can't export reports to PDF/XLS/DOC formats Using the back button to change application type in the new application wizard can result in a corrupt application configuration Issue Instant not updating in SAML tokens issued by Cloud Access Manager JavaScript error when clicking Next on Salesforce template provisioning settings page Exception when SAML ACS URL contains query parameters Unable to load PEM file Login form inspection bookmarklet hidden on SP2013 login form in Internet Explorer Known issues The following is a list of issues, including those attributed to third-party products, known to exist at the time of release. Table 5. General known issues Known issue Issue ID Not authorized for the requested content" after installing second STS Existing user fails to map when you try to add ServiceNow from user's App Catalog When attempting to access a header application where no subject mapping is defined the Not Authorized page is not seen

6 System requirements Before installing Cloud Access Manager 7.1.0, ensure that your system meets the following minimum hardware and software requirements. Hardware requirements Database requirements Hardware requirements Table 8. Hardware requirements Requirement Processor Memory Hard Disk Space Operating System Details Min. 2 multi-core processors Min. 4 GB Min. 200 GB Any of the following: Microsoft Windows Server 2008 R2 (with the latest updates applied) Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Database requirements Table 9. Database requirements Requirement Details Database Microsoft SQL Server 2012, 2008 R2 or

7 Product licensing To activate a trial license 1 Copy the license file to a machine where a Cloud Access Manager STS instance is installed. 2 On the same machine, click on the desktop shortcut Cloud Access Manager Administration (fallback login) to log into Cloud Access Manager as the fallback administrator. 3 Click the Licensing link. 4 Click the Upload License button. 5 Select the license file. To activate a purchased commercial license 1 Copy the license file to a machine where a Cloud Access Manager STS instance is installed. 2 On the same machine, click on the desktop shortcut Cloud Access Manager Administration (fallback login) to log into Cloud Access Manager as the fallback administrator. 3 Click on the Licensing link. 4 Click the Upload License button. 5 Select the license file. Getting started with One Identity Cloud Access Manager Upgrade/installation instructions Additional resources Upgrade/installation instructions To upgrade/install this release Before you install this release, ensure you have a current backup of Cloud Access Manager. This release is provided for all Cloud Access Manager hosts and it is recommended that it is applied to each host. For further information on how to backup Cloud Access Manager, refer to the backup and restore instructions in the Dell One Identity Cloud Access Manager Installation Guide. 1 On the STS Host, either mount the release ISO or extract the release ZIP file to a temporary location. 2 Start the Dell Autorun and navigate to the Install section. 3 Click Install on the Cloud Access Manager IIS Components. 4 Accept the license terms to start the upgrade. 5 Wait for the installation on the STS Host to complete and click Close. 6 On the Proxy Host, either mount the release ISO or extract the release ZIP file to a temporary location. 7 Start the Dell Autorun and navigate to the Install section. 8 Click Install on Cloud Access Manager Proxy. 9 Accept the license terms to start the installation. 7

8 10 Wait for the installation on the Proxy Host to complete and click Close. Determining if this release is installed To determine if this release is installed, log in to the Cloud Access Manager Administration Console, click the information icon in the top right corner and verify that the version number matches that of the release. Removing this release To remove this release, refer to the backup and restore instructions in the Dell One Identity Cloud Access Manager Installation Guide. NOTE: If you are uninstalling and reinstalling Cloud Access Manager, you should ensure that you delete the Cloud Access Manager SQL database before reinstalling the product. Additional resources Additional information is available from here: Dell One Identity Cloud Access Manager online product documentation Globalization This section contains information about installing and operating this product in non-english configurations, such as those needed by customers outside of North America. This section does not replace the materials about supported platforms and configurations found elsewhere in the product documentation. This release is Unicode-enabled and supports any character set. In this release, all product components should be configured to use the same or compatible character encodings and should be installed to use the same locale and regional options. This release is targeted to support operations in the following regions: North America, Western Europe and Latin America. 8

9 About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell Technical support: Online support Product questions and sales: (800) Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer 9

10 2014 Dell Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Dell Inc. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Dell Inc. Attn: LEGAL Dept 5 Polaris Way Aliso Viejo, CA Refer to our web site (software.dell.com) for regional and international office information. Trademarks Dell and the Dell logo are trademarks of Dell Inc. and/or its affiliates. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. 10