Cloud Access Manager 8.1 - Configuration Guide


	NOTE: You cannot configure claim mappings when you create the application definition. The facility to configure claim mappings is only available in edit mode, after you have created the application definition.

From the Cloud Access Manager Administration Menu, under Applications, click View and Edit.

Click the edit icon

next to the application you want to send claims to.

In the navigation bar, click Claim Mapping.

To add a new claim mapping, click the add icon

in the top right hand corner of the claim list pane.

Complete the Name of the claim to send to the application. For OpenID Connect/OAuth 2.0 applications, you can select from a preset list of standard claims.

Rule Processing Mode: Mapping rules can be applied to users who have a certain role. You can use the Rules Processing Mode setting to determine whether only the first rule matching the user(s) should apply, or whether all rules should apply.

•

Use first rule matched - return the result of the first rule where the user is a member of the role set on the rule.

•

Use all rules matched - return the results of all rules where the user is a member of the role set on the rule.

In the Claim Rule box:

Select the roles that you want to apply the rule to.

Choose the Claim mapping mode:

•

If you want the claim to be derived from a claim from an identity provider, choose Map claim to user attribute.

•

If you want Cloud Access Manager to set the claim to a constant value, choose Map claim to static value.

If you have chosen Map claim to static value, enter that value in the box provided. If you have chosen Map claim to user attribute, choose the attribute holding the information you want to send as a claim from the dropdown. To add more attributes to the list displayed in the dropdown, click Manage User Attributes.

If the same claim can be derived from different attributes depending on the user's role, you can add another Claim Rule by clicking the Add New Claim Rule button. If you have defined multiple Claim Rules you can order them by dragging and dropping the rules into the correct position, so that the correct rule is processed for users in a given role.

If you want to configure Cloud Access Manager to send more claims, click the add icon

in the top right hand corner of the claim list pane.

You can send the names of the user's Cloud Access Manager roles to the application as claims. To do this, select the Send Cloud Access Manager role claim box at the bottom of the claim list panel.


	NOTE: If you select Group Memberships for a claim rule and you are using Active Directory the user's Primary Group is not returned. In default installations, the user's Primary Group is Domain Users. The Primary Group is not returned because the claim rule returns the values in the memberOf attribute and the Primary Group is determined using the primaryGroupID attribute.

Adding HTTP headers to proxy applications

If you are using Dell™ One Identity Cloud Access Manager to proxy an application and authenticate users to that application you have the option of configuring HTTP headers to be sent as part of the authentication. The following type of applications can be configured to send extra HTTP headers:

•

Form Fill

•

Integrated Windows Authentication

•

HTTP Basic Authentication

•

HTTP Header.

Headers are pieces of information about a user, which the application can use to tailor its interface or to make authorization decisions. The mechanism for configuring additional HTTP headers uses the same process of building information from claim rules that is used in claim mapping. For detailed instructions on how the mapping interface works please refer to Forwarding claims to federated applications, where you see Claim Mapping replace this with Header Mapping.

To configure an application to receive claims from Cloud Access Manager


	NOTE: You cannot configure header mappings when creating the application definition. The facility to configure header mappings is only available in edit mode, after the application definition has been created.

From the Cloud Access Manager Administration Menu, under Applications, click on View and Edit.

Click on the edit icon next to the application you want to send claims to.

In the navigation bar, click Header Mapping.

Follow the instructions in Forwarding claims to federated applications, where you see Claim Mapping replace this with Header Mapping.

Configuring step-up authentication

•

Configuring front-end authenticators

•

Configuring each application

•

Configuring for external users

•

Configuring Defender as a Service with Cloud Access Manager

•

Using Dell’s Security Analytics Engine

•

Enabling Dell’s Security Analytics Engine

•

Configuring Cloud Access Manager to use Dell’s Security Analytics Engine for access control

When you configure an Active Directory® or Lightweight Directory Access Protocol (LDAP) front-end authenticator you can also configure two-factor authentication. Configuring a front-end authentication method describes how to configure two-factor authentication for all users, for all applications.

This section describes how to modify the configuration in three ways:

•

Users are only prompted for two-factor authentication for some applications. This is known as step-up authentication as users will only be prompted for two-factor authentication when required.

•

Only external users are prompted for two-factor authentication.

•

Access control decisions are made based on the threat level determined by Dell's Security Analytics Engine.

Configuring front-end authenticators

If your users are authenticating using one of the Directory Authenticators (Active Directory or one of the LDAP type authenticators), you can configure Cloud Access Manager to use a second factor of authentication in addition to a password. The secondary authentication methods available are:

•

RADIUS server

•

Smart card

•

Defender as a Service

The configuration options for these methods are described in the following sections.