立即与支持人员聊天
与支持团队交流

Identity Manager 9.1 - Web Application Configuration Guide

Configuring authentication

User authentication is carried out on the API Server for each API project.

Authentication has two steps:

  1. Required primary authentication: Default authentication through an authentication module

  2. Optional secondary authentication: Multi-factor authentication (by OneLogin)

For more information about authentication, see the One Identity Manager API Development Guide and the One Identity Manager Authorization and Authentication Guide.

Detailed information about this topic

Configuring primary authentication with single sign-on

You can configure single sign-on authentication for API projects with the Administration Portal. In this case, a separate request to the imx/login method is not required.

Required configuration key:

  • Single sign-on authentication modules (SsoAuthentifiers): Specifies which authentication modules are used for single sign-on.

TO configure primary authentication with single sign-on

  1. Log in to the Administration Portal (see Logging in to the Administration Portal).

  2. In the navigation, click Configuration.

  3. On the Configuration page, in the Show configuration for the following API project menu, select the API project that you want configure with single sign-on authentication.

  4. Expand the Single sign-on authentication modules configuration key.

  5. Click New.

  6. In the menu, select the authentication module you want to use.

    TIP: You can specify additional authentication modules. To do this, click New.

  7. Click Apply.

  8. Perform one of the following actions:

    • If you want to apply the changes locally only, click Apply locally.

    • If you want to apply the changes globally, click Apply globally.

  9. Click Apply.

Configuring multi-factor authentication

You can set up multi-factor authentication with OneLogin for attestations and request approvals.

Prerequisite

  • The OneLogin Module is installed and synchronization is set up.

For more information about setting up multi-factor authentication, see the One Identity Manager Authorization and Authentication Guide.

To configure multi-factor authentication with OneLogin

  1. In the administration portal, set the ServerConfig/ITShopConfig/StepUpAuthenticationProvider configuration key to OneLogin MFA.

    1. Log in to the Administration Portal (see Logging in to the Administration Portal).

    2. In the navigation, click Configuration.

    3. On the Configuration page, in the Show configuration for the following API project menu, select the API project for which you want to configure multi-factor authentication.

    4. Expand the Request configuration / Step-up authentication provider for terms of use agreement and workflow approval configuration key.

    5. In the menu, select OneLogin MFA.

    6. Click Apply.

    7. Perform one of the following actions:

      • If you want to apply the changes locally only, click Apply locally.

      • If you want to apply the changes globally, click Apply globally.

    8. Click Apply.

  2. In the API Server's configuration file, add the connection parameters to your OneLogin domain.

    1. In the API Server's installation directory, open the web.config file.

      NOTE: If the file is encrypted, decrypt it first.

    2. In the <connectionStrings> section, add the following entry:

      <add name="OneLogin" connectionString="Domain=<domain>;ClientId=<clientid>;ClientSecret=<clientSecret>" />

      • <domain> stands for the DNS name of the synchronized OneLogin domain (OLGAPIDomain.DNSName).

      • <clientid> stands for the client ID of the OneLogin application.

      • <clientSecret> stands for the OneLogin application's security token.

    3. Save your changes to the file.

      NOTE: If the file was encrypted beforehand, encrypt it again.

Configuring authentication tokens

Users receive an authentication token after they have been successfully authenticated on a web application. User do not have to repeat the authentication as long as this token is valid.

Required configuration key:

  • Persistent authentication tokens (AuthTokensEnabled): Specifies whether to use persistent authentication tokens that are stored between sessions.

  • Persistent authentication token lifetime (in minutes) (AuthTokensLifetimeMinutes): Specifies how long persistent authentication tokens are valid.

To configure the use of authentication tokens.

  1. Log in to the Administration Portal (see Logging in to the Administration Portal).

  2. In the navigation, click Configuration.

  3. On the Configuration page, in the Show configuration for the following API project menu, select the imx API project.

  4. Configure the following configuration keys:

    • Persistent authentication tokens: Specify whether to use persistent authentication tokens. To do this, activate or deactivate the corresponding check box.

    • Persistent authentication token lifetime (in minutes): Specify how long persistent authentication tokens are valid. Once the token lifetime has expired, the user must authenticate again.

  5. Click Apply.

  6. Perform one of the following actions:

    • If you want to apply the changes locally only, click Apply locally.

    • If you want to apply the changes globally, click Apply globally.

  7. Click Apply.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级