Download NAM

• • Go to http://dl.netiq.com

• • Choose Access Manager

• • Select the latest version of Access Manager

• • Press 'Submit Query'

• • Choose to download the latest version of ‘AccessManagerAppliance’

Setup your VMware workstation

• • Select your VM to boot from the ISO that you downloaded in Step 2

• • Choose the Operating System as SUSE Linux Enterprise 11 64-bit

• • Note that later versions of NAM could be based on SUSE Linux Enterprise 12 64-bit

• • You can call the VM whatever name that you want. I call it ‘NAM401’

• • Choose 1 Processor but 2 Core per processor

• • Choose 7640 MB memory.

• • Note that even though NAM requires 8GB of RAM, it can still work with 7640MB memory

• • In this example, I choose Bridge Networking. It is important that whatever you choose, both the NAM VM and the host machine have to have access to the Internet.

• • Alternatively, you can also choose NAT

• • Create a new virtual Disk

• • Select the disk size to be 100GB.

• • However, unselect "Allocate all disk space now" in order conserve space. The whole setup should not take more than 20GB.

• • Take the default VMDK file name

• • Click 'Finish' to complete the creation of the VM.

Installation of NAM

• • Choose 'Install Appliance'

• • Agee to the license Agreement and click Next

• • Choose your time zone

• • The warning message appears because the memory is less than 8GB

• • Press 'Continue'

You can key in any values that you want. In this example, I used the following values:

• • Hostname: nam

• • Domain Name: external.com

• • IP address: 192 168.1.30

• • Subnet Mask: 255.255.255.0

• • Default Gateway: 192.168.1.1

• • DNS Servers: 8.8.8.8, 8.8.4.4

• • Enter your root password

• • Enter your admin password

• • Note that admin password is for your NAM application. Root password is the previous screen is for the Operating System

• • Press 'Continue'

• • Press 'Install'

• • Press 'Install'

• • Once the installation is done, you should see the above screen

• • Login to NAM application using the 'root' account and password

• • Test the connectivity to the Internet from NAM by pinging 'www.facebook.com'

• • Add the following entry into host windows machine of C:\windows\system32\drivers\etc\hosts file

• • To test the following entry, ping www.external.com and nam.external.com from your host windows machine

Configure NAM for Reverse Proxy

• • Open a browser and go to URL => https://nam.external.com:8443/nps

• • Login with admin and the password

• • In the tab above, click 'Devices > Access Gateways > AG-Cluster'

• • Click on 'Adapter_List'

• • Click on 192.168.1.0

• • Click on 'New'

• • Add in the secondary IP address "192.168.1.31"

• • When the secondary IP address is added, the secondary IP address is shown above

• • Click 'Ok'

• • Click 'Ok'

• • Click 'Update All'

• • Note that in order for any changes to take effect, you need to come to this screen to update all.

• • Press Ok to update all

• • In the tab above, click 'Devices > Access Gateways > AG-Cluster'

• • Click on 'Reverse Proxy/Authentication'

• • Click on 'New' to create a new Reverse Proxy List

• • Type in the name of the Reverse Proxy. In this example, I used "FB-RP"

• • Make sure that the FB-RP is listening on the secondary IP address: 192.168.1.31

• • Make sure that 'Enable SSL between Browser and Access Gateway' and 'Redirect request from Non-Secure Port to Secure Port' is checked

• • Click on the Certificate Icon besides the 'Server Certificate' Field.

• • Click on 'New' to create a new certificate

• • Select 'User local certificate authority'

• • Key in the Certificate name. In this example, I used 'FB-RP-Certificate'

• • Click on the icon next to the subject field.

• • The Edit Subject text box will appear.

• • Key in the common name as "www.external.com"

• • You should see that the Server Certificate is the one that was created in the previous step

• • At the bottom of the page, click 'New' to create a new Proxy Service List

For the new Proxy Service, I keyed in the following values:

• • Proxy Service Name: FB-Proxy

• • Published DNS Name: www.external.com

• • Web Server IP address: 31.13.79.96 (this is public IP address of Facebook)

• • Web Server Host Name: www.facebook.com

• • Enable the FB-Proxy

• • Click on 'FB-Proxy'

• • Go to the 'Web Servers' tab

• • Check 'Connect using SSL'

• • Go to 'Protected Resources' tab

• • Click on 'New'

• • Key in the name of the Protected Resource List. I call this "FB-RL"

• • In the Authentication Procedure, choose “Name/Password - Form (60)”

Click ‘Ok’ until you see the following page:

• • Click 'Update all'

At this point, you can test whether your reverse proxy works.

• • On your windows host, open a web browser.

• • Type in the URL => www.external.com

• • You should be prompted with a login prompt. Key in the Admin and password

• • NAM should redirect you to www.facebook.com

Configure NAM for Single Sign-on

When Facebook website comes up, right click on the website and view source. Look for the following information:

• • Title id
    

• • Form id
    

• • Id for email and id for pass
    

• • Go to Devices > AG-Cluster > FB-RP > FB-Proxy

• • Click on "Protected Resources" Tab

• • Click on 'Form Fill'

• • Click on 'Manage polices'

• • Check on 'fill_allowance' and click on 'Copy'

• • Click 'ok'

• • Check on 'fill_allowance-Copy_1' and click on Rename

• • Choose the new name to be 'fill_FB'

• • Click on 'fill_FB' to edit this form fill

Fill in the following for this page with the information that we found in Step 50:

• • Page Matching Criteria: <title id="pageTitle">Welcome to Facebook - Log In, Sign Up or Learn More</title>

• • Form ID: login_form

• • email: LDAP Attribute: mail

• • pass: Credential Profile: LDAP Credentials:LDAP Password

• • Under the Submit Options, check "Auto Submit"

• • Click 'Apply Changes'

• • Click on fill_FB and Enable this policy

Click ‘Ok’ until you see the following page:

• • Click 'Update all'

• • At the top of iManager, click on the 'Magnifying Glass' icon

• • On the Tree tab, go to the "Novell" container

• • On the Right Panel, click on 'Alice'

• • In the Internet E-mail address field, add the email that facebook requires to login with

• • Go to the "Restriction" Tab

• • Set the password

• • Set the same password as your Facebook account

At this point, you can test whether your Single Sign-on works.

• • On your windows host, open a web browser.

• • Type in the URL => www.external.com

• • You should be prompted with a login prompt. Key in the Alice username and password that you sent in Step 63.

• • NAM should redirect you www.facebook.com and single sign-on into Facebook.