Chat now with support
Chat with Support

Cloud Access Manager 8.1.1 - Configuration Guide

Configuring a front-end authentication method Adding a web application Configuring step-up authentication Managing your SSL certificate Changing the Cloud Access Manager service account password Reporting Customizing Dell™ One Identity Cloud Access Manager

RADIUS server

Complete the RADIUS Connection Settings to allow Cloud Access Manager to connect to an authentication service using the Remote Authentication Dial-In User Service (RADIUS) protocol. Please refer to Table 1 for a detailed explanation of each feature.
Table 1. RADIUS connection settings
Field
Functionality
Hostname/IP Address (including port)
Enter the fully-qualified domain name or the IP address of your authentication service host and the UDP port number on which the authentication service is listening. The IANA-registered port number for RADIUS is 1812.
For example radius.example.com:1812
Shared Secret
Enter the password or passphrase used to encrypt sensitive information in the RADIUS traffic sent to the authentication service. The authentication service must be configured with the same shared secret.
Challenge/Response Server
Many RADIUS authentication services are capable of maintaining an authentication session with multiple requests and responses. This allows challenge-response authentication tokens to be used, as well as other features like password expiry and token time window resynchronization. If your authentication service supports challenge/response mode, then select the Challenge/Response Server box.
Attribute to use for RADIUS username
Enter the name of the Active Directory attribute whose value is to be relayed to the RADIUS authentication service to identify the user. The default, sAMAccountName, contains the login username.
Test Connection
To determine whether Cloud Access Manager has connectivity to the RADIUS authentication service.

Smart card

The configuration procedure is similar whether you are using smart card as a primary or secondary factor authentication method. The following steps describe how to configure Cloud Access Manager for smart card authentication:
1
Select the Enable certificate revocation list checking box. This will prompt Cloud Access Manager to check the Certificate Authority's Certificate Revocation List (CRL) to ensure the user's certificate has not been revoked. If the user's certificate has been revoked, the login request will be denied.
2
Cloud Access Manager must redirect the user's browser to another port in order to perform an X.509 certificate authentication. The default port is 8443. If port 8443 is already in use by another service on the Cloud Access Manager host, you can choose a different port number.
3
Export the certificate from your Certificate Authority in .pem or base-64 encoded format, then copy it to the Cloud Access Manager Secure Token Server (STS) host and upload it using the Browse... control.
For detailed instructions on smart card configuration, please refer to Configuring smart card authentication.

Defender as a Service

Defender as a Service is a cloud based authentication service that allows users to self-register and then access their one time passwords on both mobile and desktop devices. For further information on accessing Defender as a Service and using Cloud Access Manager to authenticate Defender as a Service users, please refer to Configuring each application.
When you have obtained a Defender as a Service subscription, you must complete the following fields to allow Cloud Access Manager to connect to the service:
Table 2. Defender as a Service
Field
Functionality
Defender as a Service subscription key
Enter the subscription key that was supplied when you registered for Defender as a Service. You can also obtain this key from the dashboard of your Defender as a Service instance administration portal.
Attribute to use for mobile phone number
Enter the name of the attribute from the primary directory (Active Directory / LDAP) whose value is to be relayed to the Defender as a Service authentication service to identify the user. The default attribute is mobile, this usually contains the user's mobile telephone number.
Default country code for phone numbers
Select the country for which mobile telephone numbers can be specified without the country code prefix. If you have telephone numbers in your directory that are not in the default region they must begin with a plus sign followed by the numeric region code.

Configuring each application

Configuring step-up authentication for an application is a two stage procedure. The:
•
Front-end authenticator must be configured to support two factor authentication
•
Application must be configured for step-up authentication.
* 
NOTE: If multiple front-end authenticators are configured, step-up authentication is only available for users who authenticate with front-end authenticators that have two-factor authentication configured.
To configure the front-end authenticator for step-up authentication
1
Navigate to the Front-end Authentication page and click the name of the authenticator that you want to configure.
2
Click the Two Factor Authentication tab.
3
Select Use two factor authentication for specific applications.
4
Configure the RADIUS connection settings if not already configured, please refer to Configuring a front-end authentication method for further information.
To configure the application for step-up authentication
1
Navigate to the Applications page and click the name of the application that you want to configure.
2
Click the Two Factor Authentication tab.
3
From the list, select the users who will require two factor authentication to access the application. This will be either:
•
All users of this application require two factor authentication, or
•
Roles determine which users require two factor authentication.
4
If you are configuring role based access, select the required roles from the Standard authentication roles list and click Add Role to add the role to the list of Two factor authentication roles.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating