Cloud Access Manager 8.1.1 - Configuration Guide

Log in to the Administration Console using the desktop shortcut Cloud Access Manager Application Portal and select Add New from the Applications section on the home page.

Dell™ One Identity Cloud Access Manager provides a set of application templates to automatically configure common applications. The following example describes how to configure an application manually, rather than using a template.

Click Configure Manually.

Select SAML, then click Next.

If your service provider provides metadata for configuration, follow the instructions in this step to automatically configure the federation settings in Cloud Access Manager. Otherwise proceed to Step 5 to manually configure the federation settings.

In the Federation Metadata URL field enter the federation metadata URL provided by your service provider. Alternatively, click Browse to locate the file containing federation metadata. Please refer to your service provider’s configuration interface for assistance locating this information.

Enter the Recipient value for your SAML application, for example:

https://www.google.com/a/<your_google_domain>/acs for Google Apps service

If your service provider provides multiple Assertion Consumer Service (ACS) endpoints then you can add multiple entries by supplying an Index and Recipient for each entry. Click Add ACS Entry to add a new entry. Select the Default check box for the entry that will be the default if no Assertion Consumer Service URL or Index is specified in the SAML Authentication request.

Enter the Audience / SP Identity value for your SAML application, for example, google.com for Google Apps™ service.

If your service provider supports SAML logout enter the logout URL in the Application Logout URL field.


	NOTE: For logout requests to be sent to federated applications you must enable the Log out of federated applications on session termination option in Settings \| Configuration Settings.

Some service providers sign their SAML Authentication requests or require that SAML Authentication Responses are encrypted. Both of these scenarios require Cloud Access Manager to be configured with a public certificate supplied by the service provider. These certificates can be uploaded using the controls at the bottom of the Federation Settings page.

•

If your service provider signs their SAML Authentication requests, click the first Choose File button to upload the certificate used to sign the request. This certificate will then be used by Cloud Access Manager to verify the SAML Authentication requests have come from a trusted source.

•

If your service provider requires SAML Authentication responses to be encrypted, click the second Choose File button to upload the certificate used to encrypt the response. This certificate will be used by Cloud Access Manager to encrypt the assertion element of the SAML response. To proceed, click Next.


	NOTE: Consult your documentation, or application administrative interface for the values to enter.

Select Do not proxy this application, then click Next.

Select the Derive the username from an attribute option and enter an attribute name of mail, then click Next.


	NOTE: This option uses the user’s email address stored in Active Directory® as their application username, known as the user’s SAML subject. You can change the suffix if required to match your Google domain.


	NOTE: Cloud Access Manager allows users to request their own application accounts. If the user is in a group that is authorized to access a particular application, the user can have a user account automatically created for them as they select it from their application catalog and add it to their portal page. Cloud Access Manager includes directory connectors, which allow user accounts to be provisioned from Cloud Access Manager into Google Apps™ service, Salesforce.com® and Microsoft® Office 365™. When a user adds an application to their portal page by selecting it from their application catalog, Cloud Access Manager automatically checks whether they already have a user account in that application’s directory. If the user does not, then an account is created for him or her through one of its directory connectors. The following three steps are for just-in-time provisioning of users and will only be displayed for applications for which Cloud Access Manager can provision users, such as Google Apps and Salesforce.

Enter the credentials of a user account to provision new user accounts. Use the Test Connection button to validate the credentials before clicking Next.

Select who will receive an email when a new account is provisioned and enter the text to include in the email.

In order to provision a user, the application will typically require a number of provisioning parameters to be defined. For example, Google Apps requires the user’s first and last name. For each parameter, configure a claim rule to map the provisioning parameter to a user attribute containing the required value. For example, add a claim called Last Name, where its value is derived from the Active Directory user attribute sn.


	NOTE: There is an 8 character limit on the Alias provisioning parameter. However, there is no such limit on the sAMAccountName attribute that the Salesforce template maps Alias to by default. This results in a failure to provision any user who has a sAMAccountName of greater than 8 characters. We recommend that either your Salesforce users are limited to a sAMAccountName of 8 characters or less, or the mapping of the Alias field is changed to use a different attribute that does meet this criteria. This is not limited to Salesforce, and can occur for any application that uses the Alias parameter for provisioning. In addition, using mapped attributes with NULL values will also result in a provisioning failure.


	NOTE: If the application you are provisioning provides a user provisioning API, please refer to Manual user provisioning.

Click Next to continue.

You will now see the Permissions page, which enables you to control the users who can access the application. By default, all Active Directory users have access to the application. You can restrict access to the application to users who belong to a specific Active Directory security group, but for this demonstration deployment, simply click Next to allow all Active Directory users access to the application.

Enter an Application Name, for example, Google Apps, then click Next.

You can now configure how the application is displayed on the Cloud Access Manager Portal. Enter the Title and Description you want to display on the Cloud Access Manager Portal.

Enter the URL that you want your users to be initially logged in to, for example https://mail.google.com/a/<your_google_domain>

Click Fetch icon from application to locate and display the icon of the application.

Click Finish to complete the configuration of the application.

Click Download Certificate to download the certificate created by Cloud Access Manager to import into your SAML application. In addition, make a note of the Issuer/IDP Service URL as this may be required by your SAML application. Click Close.


	NOTE: The Add application to application portal home and Allow user to remove application from application portal home options allow you to specify whether the application should appear automatically on each user’s portal page, and how the user can manage the application from the application portal. The options are shown in Table 4.

Table 4. Application portal options
Add application to application portal home	Allow user to remove application from application portal home	Functionality
		application is added to the portal and it cannot be removed by the user through the application catalog.
		application is added to the portal and it can be removed by the user through the application catalog.
		application is not automatically added to the portal. The user can add or remove the application to/from the portal through the application catalog.

To access the application catalog from the application portal, the user simply needs to click their username, then select Application Catalog. Depending on the settings in the Add application to application portal home and Allow user to remove application from application portal home options, the user can add or remove applications to/from the application portal.

Cloud Access Manager configuration is now complete.

To configure your Google Apps account to authenticate your users using SAML

Log in to your Google account using your Google administrator credentials. For example, log in using the following URL: https://www.google.com/a/<your_google_domain>

Click Advanced Tools.

Click Set up Single Sign-on (SSO).

Select Enable Single-Sign-on.

Enter the Cloud Access Manager Issuer/IDP Service URL that you noted in Step 21, into the Sign-in page URL and Change password URL fields. For example, enter:

https://CloudAccessManager.democorp.local/CloudAccessManager/RPSTS/Saml2/ Default.aspx

In the Sign-out page field, enter the URL:

https://CloudAccessManager.democorp.local/CloudAccessManager

From the Verification certificate section, click Browse. Navigate to the Cloud Access Manager certificate obtained in the previous section, then click Upload.

Click Save Change.

For information on how to use the user mapping tool, please refer to the guide entitled Dell™ One Identity Cloud Access Manager How To Configure User Mapping.

To verify that the application is configured correctly

Close Internet Explorer® to end your Cloud Access Manager session.

Use the desktop shortcut Cloud Access Manager Application Portal to open the Cloud Access Manager portal.

Browse to the Application Catalog and add the Google Apps application to the application portal.

Browse to the Application Portal and click the Google Apps application. You are signed in automatically.

Configuration of Google Apps for SSO is now complete.

Configuring advanced SAML token settings

In most situations the SAML token produced by Dell™ One Identity Cloud Access Manager in response to an authentication request is accepted by the service provider. If the service provider has special requirements for the way the token is configured then you may modify the token options on the SAML Token Settings tab for the application.

Any settings changed on this page will only affect the selected application.

NOTE: To change the settings for all SAML applications, follow these steps:

Navigate to the Settings page.

Click Show Advanced Settings.

Click Advanced Application Settings.

Modify the settings as required.

For a description of the available configuration options, please refer to Table 5.


	NOTE: The settings for an individual application take precedence over global settings.

Table 5. SAML token advanced configuration options

Name

Description

Default

samltoken.minutes_before

The number of minutes before the token IssueInstant to set the NotBefore attribute in the Conditions element.

0 minutes

samltoken.minutes_after

The number of minutes after the token IssueInstant to set the NotOnOrAfter attribute in the Conditions and SubjectConfirmationData elements.

30 minutes

samltoken.name_id

The value of the Format attribute of the NameID element in the Subject.

urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

samltoken.signature

How the SAML token is signed. There are three options:

•

MessageOnly - Sign the outer message

•

AssertionOnly - Sign the assertion element

•

MessageAndAssertion - Sign both the outer message and the assertion element.

MessageOnly

samltoken.multi_valued_attributes

How attributes with multiple values are output in the SAML token. There are two options:

•

OneValuePerAttribute - Each value for a claim type is output in its own attribute, for example

<AttributeValue>CN=Staff,CN=Users,DC=democorp,DC=co,DC=uk</AttributeValue>

</Attribute>

<AttributeValue>CN=Administrators,CN=Users,DC=democorp,DC=co,DC=uk</AttributeValue><AttributeValue>

</Attribute>

•

OneAttributeWithMultipleValues - All values for a claim type are output in one attribute, for example

<AttributeValue>CN=Staff,CN=Users,DC=democorp,DC=co,DC=uk</AttributeValue>

<AttributeValue>CN=Administrators,CN=Users,DC=democorp,DC=co,DC=uk</AttributeValue><AttributeValue>

</Attribute>

OneValuePerAttribute

samltoken.encryption

How the Assertion element is encrypted, there are two options:

•

AES256 - Encryption algorithm: AES256, encryption key: RSA-OAEP

•

AES128 - Encryption algorithm: AES128, encryption key: RSAES-PKCS1-v1_5, key length: 128

AES256

samltoken.authn_req_signature_required

When the authentication request is expected to be signed. There are two options:

•

WithSigningCertificateUploadedOnly - If the application has a signing certificate uploaded, the authentication request must be signed.

•

Never - The authentication request does not need to be signed. However, if the request is signed and the signing certificate is present, the signature will be checked and it must validate correctly to enable authentication.

WithSigningCertificateUploadedOnly

samltoken.logout_request_signature_required

When the logout request is expected to be signed. There are two options:

•

WithSigningCertificateUploadedOnly - If the application has a signing certificate uploaded, the logout request must be signed.

•

Never - The logout request does not need to be signed. However, if the request is signed and the signing certificate is present, the signature will be checked and it must validate correctly to enable logout.

WithSigningCertificateUploadedOnly

samltoken.logout_request_binding

The binding that will be used when sending logout requests to the application. Select Disabled to not send logout requests.

HttpPost

Configuring advanced WS-Federation token settings

In most situations the WS-Federation token produced by Dell™ One Identity Cloud Access Manager, in response to an authentication request is accepted by the service provider. However, if a service provider has special requirements for the way the token is configured, then you can modify the token options on the WS-Fed Token Settings tab for the application.

Any settings changed on this page will only affect the selected application.

NOTE: To change the setting for all WS-Federation applications, follow these steps:

Click Show Advanced Settings.

Click Advanced Application Settings.

Modify as required.

For a description of the available configuration options, please refer to Table 6.


	NOTE: The settings for an individual application take precedence over global settings.

Table 6. WS-Federation token advanced configuration options
Name	Description	Default
wsfedtoken.minutes_before	The number of minutes before the token IssueInstant to set the NotBefore attribute in the Conditions element.	0 minutes
wsfedtoken.minutes_after	The number of minutes after the token IssueInstant to set the NotOnOrAfter attribute in the Conditions element.	30 minutes
wsfedtoken.name_id	The value of the Format attribute of the NameIdentifier element in the Subject.	urn:oasis:names:tc:SAML:1.1:nameidformat:unspecified
wsfedtoken.logout_request_binding	If HttpRedirect is selected then logout requests will be sent to the application. If Disabled is selected then logout requests will not be sent.	HttpRedirect

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Cloud Access Manager 8.1.1 - Configuration Guide

Further considerations

SAML federation

Configuring advanced SAML token settings

Configuring advanced WS-Federation token settings