Chat now with support
Chat with Support

Cloud Access Manager 8.1.2 - Overview

Two-factor authentication

You can configure Dell™ One Identity Cloud Access Manager to enforce two-factor authentication. When the user attempts to access a Cloud Access Manager resource after entering their username and password, Cloud Access Manager makes a program call to an authentication service such as that provided by Dell™ One Identity Defender. Cloud Access Manager will broker the authentication request between the user and the authentication service. The user will be asked for additional credentials according to the policy defined at the authentication service. For instance, the authentication service may require the user to enter a one-time password as generated by a handheld authentication device, usually referred to as an authentication token.

If you only want users to be prompted for two-factor authentication when they are accessing Cloud Access Manager at places or times that are atypical, you can use the integration with Dell's Security Analytics Engine to implement this. The Security Analytics Engine takes input from the current user session as well as historical information about the user, and can potentially accept input from other sources, such as Dell™ SonicWall devices, to determine a threat level for the user. Cloud Access Manager then takes this threat level and uses it to determine whether the user is allowed immediate access, requires two-factor authentication, or is denied access.

* 
NOTE: This feature requires authentication software, for example Dell™ One Identity Defender, which is compliant with the Remote Authentication Dial-In User Service (RADIUS) protocol.

Web proxy and password wallet

Dell™ One Identity Cloud Access Manager’s web proxy component runs on a network perimeter and acts as a security gateway between users located on an untrusted network and applications running on a trusted network. It acts as a Secure Sockets Layer (SSL) endpoint relaying Secure HTTP (HTTPS) packets between the user’s browser and the web application.

In addition to providing URL-based access control to firewalled applications, the web proxy also protects Cloud Access Manager web components such as the Security Token Service (STS) login pages, application portal and administration interface. The web proxy enforces authentication and authorization policies to applications running on the trusted network.

Because the web proxy stands between the user’s browser and the web application, it can automatically log the user onto their applications by learning the user’s application credentials, and inserting them when the user launches the application. When you configure an application, you can associate a login page URL with that application.

When the user attempts to access that URL, Cloud Access Manager automatically inserts the stored application user name and password into the appropriate form controls and posts the completed form back to the server. If Cloud Access Manager does not know the user’s application credentials it prompts the user for them. The user’s application credentials are encrypted in a Password Wallet within Cloud Access Manager’s configuration database, the user can view and update the Password Wallet from the Application Portal.

Form-fill single sign-on without a proxy

While the use of a reverse HTTP proxy is effective as a method of exposing internal applications to external users, it also carries with it an associated cost, such as hardware deployment and maintenance and implies a performance degradation. For this reason if alternatives are available, the use of a reverse proxy solely to effect automated sign on to a web application is not the preferred method.

Dell™ One Identity Cloud Access Manager makes it possible to launch certain web applications directly from the application portal, without the need to proxy the application. This can be useful in scenarios where extranet access to the application is not required.

Application coverage and support

Dell™ One Identity Cloud Access Manager offers a number of options for implementing Single Sign-On (SS0) to applications, as well as the ability to expose applications to users using a reverse HTTP proxy.

While the majority of applications are supported using the technologies delivered by Cloud Access Manager, there may be certain applications that are not supported. Please contact Dell Software Technical Support if you have questions regarding support for any specific application.

* 
NOTE: Public multi-tenant, cloud based applications are subject to change, possibly without warning, and usually beyond the control of the subscribing organization. Since form fill SSO methods can be adversely affected by such changes, we recommended that federated authentication is used in preference, where available.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating