Novell eBook Reader manuale d’uso

Novell www.novell.com Manual 3/17/03 103 Novell Confidential 00front.fm last saved 4/14/03 Liberty Identity Provider for Novell ® eDirectory TM ADMINISTRATION GUIDE[...]

Manual 3/17/03 103 Novell Confidential 00front.fm last saved 4/14/03 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifica lly disclaims any express or implied warranties of merchantability or fitness for any partic u lar purpose. Further, Novell, In c. reserve s t[...]

Manual 3/17/03 103 Novell Confidential 00front.fm last saved 4/14/03 Novell Trad emarks eDirectory is a trademark of Novell, Inc. Novell is a registered trademar k of Novell, Inc. in the Unit ed States and other countries. Third-Party Trad emarks All third-party trademarks are the property of their respective owners.[...]

Manual 3/17/03 103 Novell Confidential 00front.fm last saved 4/14/03[...]

Content s 1 Manual 3/17/03 103 Novell Confidential libertyTOC. fm last saved 4/14/03 Content s About This Guide 3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

2 Liberty Identity Prov ider for Novell eDirectory Novell Confidential libertyTOC. fm last saved 4/14/03 Manual Version: 3/17/03 103 B Modifying Ap ache 39 Modifying the Apache Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Importing Trusted Roots . . . . . . . . . . . . . . . . . . . . . . [...]

About This Guide 3 Manual (99a) 3/17/03 103 Novell Confidential 00prface .fm last saved 4/14/03 About This Guide Introduction The purpose of this documentation is to help you install, configure, and administ er the Liberty identity prov ider for Novell ® eDirectory TM infrastructure. The audience for this document ation is network administ rators.[...]

4 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 00prface .fm last saved 4/14/03 Manual Version: 3/17/03 103[...]

Overview 5 Manual (99a) 3/17/03 103 Novell Confidential 01overvw. fm last saved 4/14/03 1 Overview This section covers t he following topics:  Understandin g the Liberty Alliance  Liberty Allianc e Architectu re  Understandin g the V alue of the Novell Liberty Identity Pro vider  Benefits of the Liberty Identity Pro vider for Novell eDi[...]

6 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 01overvw. fm last saved 4/ 14/03 Manual Version: 3/17/03 103 The result of this link is realized on the use r 's next authen tication to the Liberty SP . If he or she is connected to his Liberty IDP , he or she will b e authenticated to the Liberty SP with no user interac t[...]

Overview 7 Manual 3/17/03 103 Novell Confidential 01overvw. fm last saved 4/ 14/03 Authenticatio n is performed using a lo gin form, which the use r completes a nd submits to the Liberty IDP . If the user ’ s credentials (username and password) are verified, t h e user is authenticated and is able to federate his or her identities with ch osen se[...]

8 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 01overvw. fm last saved 4/ 14/03 Manual Version: 3/17/03 103[...]

Installing the Libert y Identity Provider 9 Manual (99a) 3/17/03 103 Novell Confidential 02instal .fm last save d 4/14/03 2 Inst alling the Liberty Identity Provider This chapter provides in structions for installing Liberty identi ty provider for Novell ® eDirectory TM software and contai ns the follow ing topics:  Product Compo nents  Syst[...]

10 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 02instal .fm last save d 4/14 /03 Manual Version: 3/17/03 103 The Novell-suppo rted platform for installing the Liberty IDP is a W indows* 2000 server or workstation. T o run the Liberty IDP , you must have:  a static IP address  an iManager -compatible bro w ser: Interne[...]

Installing the Libert y Identity Provider 11 Manual 3/17/03 103 Novell Confidential 02instal .fm last save d 4/14 /03 Figure 1 Liberty Identity Provider Introduction 4 If you accept the License Agreement , sel ect the accept button, then click Next. Figure 2 License Agreement 5 The Liberty IDP creat ed by the in stallation is config ured to ru n in[...]

12 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 02instal .fm last save d 4/14 /03 Manual Version: 3/17/03 103 Figure 3 SSL W arning 6 The Liberty IDP requires N ovell iManager to be install ed. Even if you already have iManager installed on y our machine, click Next to proceed with the installat ion. Figure 4 Install iManage[...]

Installing the Libert y Identity Provider 13 Manual 3/17/03 103 Novell Confidential 02instal .fm last save d 4/14 /03 Figure 5 iManager Installation 6b Read the In troduct ion screen, then click Next. Figure 6 iManage r Introducti on 6c Read the De tection Su mmary screen, which indicates the componen ts that will be installed with iManager , then [...]

14 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 02instal .fm last save d 4/14 /03 Manual Version: 3/17/03 103 Figure 7 Detection Summ ary 6d Select the dire ctory where iManager should be installed. Th e default is C:Program FilesNove ll. Figure 8 Choose Install Folder 6e Click Next. 6f Review the Pre- Installation Summar [...]

Installing the Libert y Identity Provider 15 Manual 3/17/03 103 Novell Confidential 02instal .fm last save d 4/14 /03 Figure 9 Pre-Installation Summary iManager is instal led on your machine. (This in stallation might take a few minu tes.) 6g If the iManager insta llation is successful, you will get an Install Complet e screen. Review this screen, [...]

16 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 02instal .fm last save d 4/14 /03 Manual Version: 3/17/03 103 be located in t he same container where you r server object i s located. Export the trusted root from the key material obje ct. For more information, see “Import ing Trusted Roots” on p age 42 . Figure 1 1 LDAP C[...]

Installing the Libert y Identity Provider 17 Manual 3/17/03 103 Novell Confidential 02instal .fm last save d 4/14 /03 Figure 12 Signing Certificate Info rmation: Site Information Page 10 Click Next. 11 Set up your key store informati on by entering a Keystore File Name, Keypair Alias, Key pair Password, and Key store Password. These files are used [...]

18 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 02instal .fm last save d 4/14 /03 Manual Version: 3/17/03 103 13 Enter an applica tion name. This name will be part of t he URL that will be used b y service providers to request authen tication servi ces from you. For example, if you use nidp, an nidp folde r will be created i[...]

Installing the Libert y Identity Provider 19 Manual 3/17/03 103 Novell Confidential 02instal .fm last save d 4/14 /03 Y ou will need to install the Liberty administratio n plug-ins in iM anager . An installation help screen for iManager laun ches. T o set up the Liberty Role s and T asks, follow the in structions in the help scree n to launch iMan [...]

20 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 02instal .fm last save d 4/14 /03 Manual Version: 3/17/03 103 1 Go to your Wi n dows Start menu, then clic k Settings > Control Panel > Add/Remove Programs. 2 From the list, re move all Apache, iManager , and T omcat components using the Remove button. 3 Remove the Novell[...]

Creating a Liberty IDP Site 21 Manual (99a) 3/17/03 103 Novell Confidential 03createidp.fm last saved 4/14/03 3 Creating a Liberty IDP Site After you have installed the Liberty identity provider for Novell ® eD irect ory TM software, your next step is to set up a Liber ty identity provider (Liberty IDP) sit e. Y ou cann ot run Liber ty unless you [...]

22 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 03createidp.fm last saved 4/14/03 Manual Version: 3/17/03 103 Figure 16 Manage Liberty Id entity Sites Page 3 Click the New Site li nk. The New Liberty I dentity Site p age appears on t he right-hand side.[...]

Creating a Liberty IDP Site 23 Manual 3/17/03 103 Novell Confidential 03createidp.fm last saved 4/14/03 Figure 17 New Liberty Iden tity Site Page 4 Enter a Descript ive Name for your site. (The name you choose is primarily for yo ur own reference .) 5 Enter the context fo r this site. The context identifies where you want to store this site object [...]

24 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 03createidp.fm last saved 4/14/03 Manual Version: 3/17/03 103 If you are ru nning on port 80 (HTTP) or port 443 (HTTPS), you do not need to specify the port value . 7 Click OK. 2. Define Site Properties Continuing from St e p 7 in the previou s section, you are now at th e Site[...]

Creating a Liberty IDP Site 25 Manual 3/17/03 103 Novell Confidential 03createidp.fm last saved 4/14/03 The Applicatio n Domain is an application/co mpany extension to the Common Do main name that the I DP will use for in troducti ons. The Applicatio n Domain and the Common Domain comb ine together to form a DNS name that resolves to the same IP ad[...]

26 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 03createidp.fm last saved 4/14/03 Manual Version: 3/17/03 103 Figure 19 Affiliate Service Providers Page 2 The Af filiate Service Providers table lists th e SPs you have defined and whether they are enabled, and whet her the information you have provi ded for them is complete. [...]

Creating a Liberty IDP Site 27 Manual 3/17/03 103 Novell Confidential 03createidp.fm last saved 4/14/03 4 Enter the Descriptiv e Name and URL for the service pro v ider ’ s definition you want to i m port. For example, if your IP address is 1.1.1.1, you would sp ecify the URL as http://1.1.1.1/nwc/ metadata . 5 Click OK. 4. Set Up Y our Liberty I[...]

28 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 03createidp.fm last saved 4/14/03 Manual Version: 3/17/03 103 Figure 22 Manage Fe derations 3 Click OK. 4 V iew the User Federatio n you create d. If you need to delete it, select Delete. 5 Click Done. If you deleted any federations, those del etions will occur when th e user c[...]

Configuring Y our Liberty Identity Provider to Run in SSL Mode 29 Manual (99a) 3/17/03 103 Novell Confidential 04secure .fm last saved 4/14/03 4 Configuring Y our Liberty Identity Provider to Run in SSL Mode This chapter contains information on the following topics:  Converting to Secure Mod e  Customizing Y our Liberty IDP User Int erface In[...]

30 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 04secure .fm last saved 4/14/03 Manual Version: 3/17/03 103 3b Select the Ma nage Sites task, then select your si te’ s link. 3c Change the Base URL Protocol from http to ht tps. 4 Restart T omcat and Apache for the changes to take effect. Creating Certificates for Ap ache Th[...]

Configuring Y our Liberty Identity Provider to Run in SSL Mode 31 Manual 3/17/03 103 Novell Confidential 04secure .fm last saved 4/14/03 For a list of the .j sp files for the service provider , see “Custo mizing Y our Li berty SP User Interface” on page 38 . main.jsp Displays the ma in page. err .jsp Reports an error . postit.jsp Sends an autom[...]

32 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 04secure .fm last saved 4/14/03 Manual Version: 3/17/03 103[...]

Installing and Configuring a Sample Service Provider 33 Manual (99a) 3/17/03 103 Novell Confidential 05appa.fm last saved 4/14/03 A Inst alling and Configuring a Sample Service Provider Novell provides samp le code for you to use as p art of the Liberty ident ity provider for Nove ll ® eDirectory TM download. Th is sample service provider is prov [...]

34 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 05appa .fm last saved 4/14/03 Manual Version: 3/17/03 103 InstallAnywhere wi ll guide you through the installatio n process. 3 After you have read the introductory scre en, click Next. Figure 23 Liberty Service Provider Introduction 4 If you accept the License Agreement , sel e[...]

Installing and Configuring a Sample Service Provider 35 Manual 3/17/03 103 Novell Confidential 05appa .fm last saved 4/14/03 Figure 25 Examp l e Code S tipulation 6 The Liberty SP inst allation creates a fictitious SP cal led W orld Financial. Rea d the information abo ut the SP , note the URL, and then click Next. Figure 26 World Financial Informa[...]

36 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 05appa .fm last saved 4/14/03 Manual Version: 3/17/03 103 Figure 27 Common Dom ain 8 Click Next. 9 Enter a user name and password for your t est user , then click Next . Figure 28 Service Provider T est User 10 Set up your keys tore information by entering a Keystore File Name,[...]

Installing and Configuring a Sample Service Provider 37 Manual 3/17/03 103 Novell Confidential 05appa .fm last saved 4/14/03 Figure 29 Signing Certificate Inform ation: Keystore 11 Click Next. 12 Review the Pre-Installation Summary . If you need to make changes to your configuratio n, click Previous t o go back to previous sc reen s. If you accept [...]

38 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 05appa .fm last saved 4/14/03 Manual Version: 3/17/03 103 Adding Additional Users As part of your i nstallation, one user is crea ted. Addi ng additio nal users t o your co nfigurat ion is optional. If you want to add more users, before federating your first user , locate the L[...]

Modifying Apache 39 Manual (99a) 3/17/03 103 Novell Confidential 06appb.fm last saved 4/14/03 B Modifying Ap ache This appendix p rovides information on th e following topics:  Modifying the Apache Configuratio n Files  Importing T rusted Roots Modifying the Ap ache Configuration Files 1 Go to your Apache httpd.conf file, located in yo ur Apa[...]

40 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 06appb .fm last saved 4/14/03 Manual Version: 3/17/03 103 JkMount /nidp/slo ajp13 JkMount /nidp/*.css ajp13 JkMount /nidp/slo_return ajp 13 JkMount /nidp/term ajp13 JkMount /nidp/soap ajp13 JkMount /nidp/setintro ajp13 JkMount /nidp/rni ajp13 JkMount /nidp/sso ajp13 JkMount /ni[...]

Modifying Apache 41 Manual 3/17/03 103 Novell Confidential 06appb .fm last saved 4/14/03 <Directory "C:/PROGRA~1/Novel l/Tomcat/webapps/eMFrame/META-INF /"> AllowOverride None deny from all </Directory> JkMount /eMFrame/webacc ajp1 3 JkMount /eMFrame/webacc/* aj p13 JkMount /eMFrame/*.jsp ajp13 8 In this same Apache ssl.conf f[...]

42 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 06appb .fm last saved 4/14/03 Manual Version: 3/17/03 103 11 In this same file, ma ke the following changes (b olded as shown) to the seco nd virtual host section for the common domain virtual host: <VirtualHost nidp.commond omain.com:444 > # General setup for the virtual[...]

T roubleshooting Y our Liberty ID P Install a tion and Configuration 43 Manual (99a) 3/17/03 103 Novell Confidential 07appc.fm last saved 4/14/03 C T roubleshooting Y our Liberty IDP Inst allation and Configuration This section provid es information on the following topics:  T roub leshootin g In stallation Issues  T roub leshootin g Post-Ins[...]

44 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 07appc.fm last saved 4/14 /03 Manual Version: 3/17/03 103 Summary ------- Installation: Successful. 1408 SUCCESSES 0 WARNINGS 0 NONFATAL ERRORS 0 FATAL ERRORS 3. Novell_i Manager_1.5.1_ InstallLog: This log file, loc ated by default at C:Program FilesNovellT omcatwebappseM[...]

T roubleshooting Y our Liberty ID P Install a tion and Configuration 45 Manual 3/17/03 103 Novell Confidential 07appc.fm last saved 4/14 /03 on> at org.apache.jasper.compiler.D elegatingListener.handleDirective <and so on> . . . T omcat's error logs are excellent resources for troubleshooting t hese types of errors. The logs provide a[...]

46 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 07appc.fm last saved 4/14 /03 Manual Version: 3/17/03 103 Y ou should check t o make sure that no errors are reported. The Lib erty NIDP an d NWT W eb-based applicatio ns should load without erro rs or except ions. Enabling Advanced Logging Y ou can enab le Advanced Logging on [...]

T roubleshooting Y our Liberty ID P Install a tion and Configuration 47 Manual 3/17/03 103 Novell Confidential 07appc.fm last saved 4/14 /03 Figure 30 Filter Options and Log File En tries Basic T roubleshooting Tip s This section in cludes troubleshooting info rmation for Apache, T omcat, and iManager . T roubleshooting Ap ache The following are si[...]

48 Liberty Identity Prov ider for Novell eDirectory Novell Confidential 07appc.fm last saved 4/14 /03 Manual Version: 3/17/03 103 [Wed Apr 02 14:26:58 2003] [notic e] Parent: Created child process 3740 [Wed Apr 02 14:27:01 2003] [notic e] Child 3740: Child process is r unning [Wed Apr 02 14:27:01 2003] [not ice] Child 3740: Acquired the start mutex[...]