Cloud Access Manager 8.1.2 - Configuration Guide

Proxy-less form fill authentication

In proxy-less form fill, Dell™ One Identity Cloud Access Manager attempts to emulate the application's login form with an unsolicited post to the action URL within the login form. Configuring an application in this way involves fewer steps than the form fill authentication method described in Form fill authentication. This example guides you through the steps required to configure single sign-on to an application using the proxy-less form fill authentication method.

Log in to the Administration Console using the desktop shortcut Cloud Access Manager Application Portal, and select Add New from the Applications section on the home page. Cloud Access Manager provides a set of application templates to automatically configure common applications. This example describes how to configure an application manually, rather than using a template.

6	Use the tool to obtain the field IDs for the login form. For example, click in the Username field, for example, Domain\user name, then click in the Password field, then finally, click the Submit button, for example, Sign in.

NOTE: Proxy-less form fill only emulates basic elements of login forms, it is therefore not compatible with login forms that rely on cookies, dynamic hidden variables, session handling functions or view states.

NOTE: Take care to ensure that the URL entered is unaltered, even down to subtle changes such as character case, in the example for Active Roles Server the URL must be ARServerAdmin.

NOTE: The Add application to application portal home and Allow user to remove application from application portal home options allow you to specify whether the application should appear automatically on each user's portal page, and how the user can manage the application from the application portal. The options are shown in Table 3.

NOTE: If the user enters invalid credentials, they must be edited in Cloud Access Manager's Password Wallet. The user can access the Password Wallet from the Application Portal with their user ID.

Configuration of an application for proxy-less form fill is now complete.

Further considerations

When you have added an application to Dell™ One Identity Cloud Access Manager, you may want to ensure that users only access the application using Cloud Access Manager. This may be required if you are using Cloud Access Manager to enforce strong authentication for the application, or want to use Cloud Access Manager’s auditing features to monitor application usage. For further information on how to ensure that users access the application using Cloud Access Manager, please refer to Preventing direct access to applications protected by Cloud Access Manager in the Dell™ One Identity Cloud Access Manager Security and Best Practice Guide.

SAML federation

This example will guide you through the steps required to configure single sign-on for Google Apps™ service which uses SAML Authentication.

NOTE: For logout requests to be sent to federated applications you must enable the Log out of federated applications on session termination option in Settings | Configuration Settings.

NOTE: Consult your documentation, or application administrative interface for the values to enter.

NOTE: This option uses the user’s email address stored in Active Directory® as their application username, known as the user’s SAML subject. You can change the suffix if required to match your Google domain.

NOTE: Cloud Access Manager allows users to request their own application accounts. If the user is in a group that is authorized to access a particular application, the user can have a user account automatically created for them as they select it from their application catalog and add it to their portal page. Cloud Access Manager includes directory connectors, which allow user accounts to be provisioned from Cloud Access Manager into Google Apps™ service, Salesforce.com® and Microsoft® Office 365™. When a user adds an application to their portal page by selecting it from their application catalog, Cloud Access Manager automatically checks whether they already have a user account in that application’s directory. If the user does not, then an account is created for him or her through one of its directory connectors. The following three steps are for just-in-time provisioning of users and will only be displayed for applications for which Cloud Access Manager can provision users, such as Google Apps and Salesforce.

11	Enter the credentials of a user account to provision new user accounts. Use the Test Connection button to validate the credentials before clicking Next.

12	Select who will receive an email when a new account is provisioned and enter the text to include in the email.

13

In order to provision a user, the application will typically require a number of provisioning parameters to be defined. For example, Google Apps requires the user’s first and last name. For each parameter, configure a claim rule to map the provisioning parameter to a user attribute containing the required value. For example, add a claim called Last Name, where its value is derived from the Active Directory user attribute sn.

NOTE: There is an 8 character limit on the Alias provisioning parameter. However, there is no such limit on the sAMAccountName attribute that the Salesforce template maps Alias to by default. This results in a failure to provision any user who has a sAMAccountName of greater than 8 characters. We recommend that either your Salesforce users are limited to a sAMAccountName of 8 characters or less, or the mapping of the Alias field is changed to use a different attribute that does meet this criteria. This is not limited to Salesforce, and can occur for any application that uses the Alias parameter for provisioning. In addition, using mapped attributes with NULL values will also result in a provisioning failure.

NOTE: If the application you are provisioning provides a user provisioning API, please refer to Manual user provisioning.

NOTE: The Add application to application portal home and Allow user to remove application from application portal home options allow you to specify whether the application should appear automatically on each user’s portal page, and how the user can manage the application from the application portal. The options are shown in Table 4.

For information on how to use the user mapping tool, please refer to the guide entitled Dell™ One Identity Cloud Access Manager How To Configure User Mapping.

Configuration of Google Apps for SSO is now complete.

Configuring advanced SAML token settings

In most situations the SAML token produced by Dell™ One Identity Cloud Access Manager in response to an authentication request is accepted by the service provider. If the service provider has special requirements for the way the token is configured then you may modify the token options on the SAML Token Settings tab for the application.

Any settings changed on this page will only affect the selected application.

NOTE: To change the settings for all SAML applications, follow these steps: 1 Navigate to the Settings page. 2 Click Show Advanced Settings. 3 Click Advanced Application Settings. 4 Modify the settings as required.

For a description of the available configuration options, please refer to Table 5.

NOTE: The settings for an individual application take precedence over global settings.