NetIQ Access ManagerTM can deploy standards-based web single sign-on (SSO), which means users only have to remember one password to access all the web-based applications they are authorized to use. That means far fewer helpdesk calls-and the reduced likelihood of users resorting to vulnerable written reminders.
In this article, I'll describe steps for implementing SSO for NetIQ Access Governance SuiteTM 6.0 using NetIQ Access ManagerTM 3.2.x. This article assumes that you are familiar with Access Manager and how to configure proxy services. For detailed administration configuration guidance, please refer to the NetIQ Access ManagerTM documentation located at - https://www.netiq.com/documentation/netiqaccessmanager32.
Prerequisites
Access Manager and AGS must be configured to use the same user store unless user credentials are synchronized between each system's user store. The methods described in this document will work regardless of the authentication method or the multi-homing option used by Access Manager.
SSO using Identity Injection
Whenever a user tries to access the Access Governance Suite application defined as a protected resource on the Access Gateway, the user will be redirected to the Identity Server for authentication to Access Manager. Once authenticated, the Access Gateway will invoke a specific Identity Injection policy before redirecting to the targeted application (i.e. AGS.) This policy is used for injecting the user's name and application reference in the authentication header of the AGS request.
On the AGS server, a special custom SSO Authentication Rule must configured to receive the custom header information. The custom rule is written in JAVA code and accepts interface arguments from the AGS rule engine. It reads the custom header information sent from Access Manager and returns an Identity object. If the code executes successfully, the rule returns the object to the authenticator service and then seamlessly authenticates the user allowing for a single sign-on user experience.
The following process flow illustrates the SSO process and shows the interaction between each of the services mentioned in this article.
SSO using Form-Fill
As an alternative, NetIQ Access ManagerTMhas a form-fill feature that provides a single sign-on cabability in situations where you do not wish to modify the targeted application. In this situation, we can avoid writing a custom SSO Authentication Rule in AGS and allow Access Manager to provide SSO via form-fill. A form-fill policy must be created which will post the user's credentials to the AGS login page. So whenever a user tries to access the AGS protected resource via the Access Gateway, the user is redirected to the Identity Server for authentication to Access Manager. Once authenticated, the Access Gateway will invoke the Form-Fill policy before redirecting to the targeted application (i.e. AGS.) The policy will automatically post the user's credentials to the AGS login form allowing a seamless SSO user experience.
To perform single sign-on (SSO) using this solution method, configurations are necessary in both NetIQ Access ManagerTM and NetIQ Access Governance SuiteTM. The following solution details will guide you through the configuration implementation steps.
Access Manager Configuration
Before Access Manager forwards a request to AGS, it will invoke a specific Identity Injection policy and store the following information into a custom header. Setup an Identity Injection policy to inject the following data into the Custom Header of the AGS request:
Note: If the user store for Access Manager is the same user store used by AGS, then you may want to send the full user DN. Otherwise, just send the CN and then specify the user container used by AGS in the SSO Authentication Rule.
Use the following steps to configure Access Manager.
The final Access Manager configuration should look like the following:
Access Governance Suite Configuration
The remaining configuration steps are for AGS. Here you will setup a custom SSO Authentication Rule in AGS. The rule is configured to retrieve the Custom Header data that was injected from Access Manager. If the rule executes successfully, it will return an Identity object used by the authenticator service to seamlessly authenticate the user. Use the following steps to configure the SSO Authentication Rule in AGS.
import sailpoint.object.Application;
import sailpoint.object.Identity;
import sailpoint.object.Link;
import sailpoint.tools.GeneralException;
import sailpoint.api.Correlator;
import sailpoint.api.SailPointContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
private String COOKIE = "cookie";
private String AUTHDIR_NAME = "ssoauthdirname";
// private String USER_DN = "ssouserdn";
private String USER_CN = "ssousercn";
private String[] HEADER_ATTRS = { AUTHDIR_NAME, USER_CN, COOKIE };
private String TEST_AUTHDIR ="idvault";
private String USER_CONTAINER = "ou=employee,ou=users,o=novell";
private String TEST_IIQ_APP ="NetIQ IDM Application";
/**
* Make sure the values are correct.. this may vary with
* various versions of Access Manager.
*/
private void validateHeader() {
for ( String header : HEADER_ATTRS ) {
String value = httpRequest.getHeader(header);
if ( value == null ) {
throw new GeneralException("Invalid Access Manager session."
" Missing variable [" header "]");
}
}
}
/**
* Use the authorization directory that Access Manager put in
* the header. Attempt to map the authdir to a SailPoint Application
* where accounts for the authdir have been aggregated.
*/
private Application mapAuthDirToApp(SailPointContext context,
String authDir)
throws GeneralException {
Application app = null;
if ( authDir.compareTo(TEST_AUTHDIR) == 0 ) {
app = context.getObject(Application.class,TEST_IIQ_APP);
} else {
throw new GeneralException("Unable to map [" authDir
"] to an application defined in IdentityIQ.");
}
return app;
}
/**
* For debug purposes.
*/
private void dumpHeader() {
Enumeration headerNames = httpRequest.getHeaderNames();
if ( headerNames != null ) {
while ( headerNames.hasMoreElements() ) {
String header = (String)headerNames.nextElement();
String value = httpRequest.getHeader(header);
System.out.println("HEADER[" header "] VALUE[" value "]");
}
}
}
dumpHeader();
// Make sure everything we need is there, along with a few
// other interesting values
// validateHeader();
String userDn = "cn=" httpRequest.getHeader(USER_CN) "," USER_CONTAINER;
String authServer = httpRequest.getHeader(AUTHDIR_NAME);
// Ask the correlator to find us the Link associated with the
// userDn we stripped from the header
Application app = mapAuthDirToApp(ctx,authServer);
Correlator correlator = new Correlator(ctx);
// second argument is instance which is not used in this example
Link link = correlator.findLinkByNativeIdentity(app, null, userDn);
Identity user = null;
if ( link != null ) {
// The Link object has a backref to its Identity
user = link.getIdentity();
} else {
throw new GeneralException("Unable to find Link associated with ["
userDn "] on application [" app.getName() "]");
}
return user;
Testing
To test SSO, be sure the user credentials are the same for both Access Manager and AGS. Try accessing the AGS dashboard from a browser: http://<AG Listening IP>:PORT/ags/dashboard.jsf. If configured correctly, Access Manager will prompt for user authentication via the Identity Server login page. After submitting, the user is seamless logged into AGS.
If SSO did not work, check the log file on the AGS server - /var/log/tomcat6/catalina.out. If you enabled "dumpHeader ()" in the SSO Authentication rule, you should see the headers received in the log, for example:
If you see any java exceptions related to the SSO Authentication Rule, you should see a stack trace like the following:
As an alternative for AGS Single Sign-on (SSO, setup a Form-Fill policy configured to post the user's CN and Password to the AGS login form. Use the following steps to configure Access Manager using Form-Fill:
Your final solution should look similar to the following screenshot showing all of the protected resources defined for AGS in Access Manager. The policies can be downloaded from the attachment list at the end of this article.
Testing
To test SSO using form-fill, be sure the user credentials are the same for both Access Manager and AGS. Try accessing the AGS dashboard from a browser - http://<AG Listening IP>:PORT/ags/login.jsf. If configured correctly, Access Manager will prompt for user authentication via the Identity Server login page. After submitting, the user is seamless logged into AGS.
This solution is only applicable for NetIQ User ApplicationTM 4.0.x and NetIQ Access ManagerTM 3.2.x, however may also work with past and future versions (not tested). Using the above methods for SSO should be thoroughly tested in your test environment prior to releasing into your production environment. The policies can be downloaded from the attachment list below.
NetIQ does not test or validate any software, code or other materials provided in, on or through NetIQ Cool Solutions (collectively, "Materials"), so please use caution when downloading or accessing any Materials from Cool Solutions and ensure that you have reasonable and current security, spyware and anti-virus measures in place on your computer and/or network prior to downloading. Additionally, do not use any Materials downloaded from Cool Solutions in any production environment without first testing the Materials to ensure they are compatible with your version of NetIQ software or any other hardware or software present in your network or environment. Cool Solutions is not a substitute for authorized NetIQ support and should not be used as such. NETIQ COOL SOLUTIONS AND ANY MATERIALS ARE PROVIDED ON AN AS-IS, AS-AVAILABLE BASIS WITHOUT ANY WARRANTY OF ANY KIND. By downloading this file, you are agreeing to these terms of use. To report a problem please contact: coolguys-netiq@netiq.com. Your use of Cool Solutions is governed by the Cool Solutions Terms and Conditions. https://www.netiq.com/communities/coolsolutions/terms-and-conditions/
Support
Documentation
Learning Services
Partner Programs