Tag: Identity management systems

IDM 4.6 Engine & Remote Loader Service Pack 3 4.6.3.0

Novell Leave a comment
Abstract: This is an Engine and Remote Loader Service Pack for Identity Manager 4.6. It will take the IDM Engine to version 4.6.3.0 and should only be applied on top of IDM 4.6. This patch is for both the IDM 4.6 engine and the remote loader.

Document ID: 5393130
Security Alert: No
Distribution Type: Field Test File
Entitlement Required: Yes
Files:

  • IDM_engine_rl_IDM4.6.3.zip (547.57 MB)

Products:

  • Identity Manager 4.6

Superceded Patches:

Related:

  • No Related Posts

7016262: IDM Patch instructions for non-root install

Novell Leave a comment
Steps to install IDM patches (Engine, Remote Loader, drivers) on Linux when IDM has been installed with the non-root install instructions.

IDM Patch instructions for non-root installs

1) ROOTDIR=<non-root eDirectory location>

2) rpm –dbpath $ROOTDIR/rpm -Uvh –relocate=/usr=$ROOTDIR/opt/novell/eDirectory –relocate=/etc=$ROOTDIR/etc –relocate=/opt/novell/eDirectory=$ROOTDIR/opt/novell/eDirectory –relocate=/opt/novell/dirxml=$ROOTDIR/opt/novell/dirxml –relocate=/var=$ROOTDIR/var –badreloc –nodeps –replacefiles <rpm-location>

===

Usage example: We have installed ssop rpm as a user other than root

1) Assuming the <non-root eDirectory location> is /home/user/eDirectory

Under this Directory you should find the following directories and files:

Copyright license nmas opt readme.txt var etc license.txt Packages rpm

the 1st command would be:

ROOTDIR=/home/user/eDirectory

2) With the above in mind the second command would be:

rpm –dbpath $ROOTDIR/rpm -Uvh –relocate=/usr=$ROOTDIR/opt/novell/eDirectory –relocate=/etc=$ROOTDIR/etc –relocate=/opt/novell/eDirectory=$ROOTDIR/opt/novell/eDirectory –relocate=/opt/novell/dirxml=$ROOTDIR/opt/novell/dirxml –relocate=/var=$ROOTDIR/var –badreloc –nodeps –replacefiles /home/user/novell-DXMLssop.rpm

Important Note : All the commands provided are meant to be a single line. The commands may not work if you don’t have the folder <non-root eDirectory location>/rpm and the file named “__db.000” under that folder. This would mean that the base non-root IDM installation has been corrupted. You may want to re-install the base IDM system again to correct this issue.

Related:

  • No Related Posts

LinkedIn refers to pointdrive.com

Symantec Community Leave a comment
I need a solution

LinkedIn uses Pointdrive to store and display documents on the LinkedIn site. We’ve just implemented FireGlass; cloud service using SAML authentication. The problem I’m having here is that LinkedIn refers to a URL which looks like LinkedIn but is not. The URL is https://view.pointdrive.linkedin.com/presentations/057b7bbb-c126-4096-89d3-376181b4d8f9/preview/e29f523b-134b-43eb-b67e-db1004d84554?auth=a68159e0-1b6d-4da0-b0b8-434a075ce1dc but in the .har you’ll see that the content is coming from viewer.pointdrive.com or pointdrive-il-prod-us-assets.s3.amazonaws.com (see screenshots of .har)

What happens is that the content never loads. It is just a blank screen. In our FG configuration, when a user goes from an unauthenticated site (bypassed LinkedIn) to a site which requires authentication (pointdrive.com) FG does not pass the traffic well. I will have to put in a pass rule for pointdrive.com to allow the content to load. Does anyone have a way to pass referred traffic from an unauthenticated site?

Thanks, AR

0

Related:

  • No Related Posts

7018114: SSPR Users locked after Grace Logins Expire

Novell Leave a comment

This document (7018114) is provided subject to the disclaimer at the end of this document.

Environment

Self Service Password Reset
SSPR 3.x
SSPR 4.x
eDirectory grace logins configured

Situation

SSPR consumes eDir grace logins
Users can’t log in to SSPR
eDirectory account is locked; no grace logins remain

Resolution

At least two options are available to avoid this situation:
1) If possible, disable grace logins on the eDirectory password policy. When configured this way, eDirectory itself won’t force users to change an expired password during authentication, but applications such as SSPR can still do so.
2) Increment the allowed grace login value to account for a typical user authentication operation happening multiple times. This won’t resolve the problem exactly but it can decrease the amount of users that will hit the limit.
In either case, consider the following settings in SSPR config manager, under Modules, Change Password:
Password Pre-Expire Time
Password Expire Warn Time
Check Expire During Authentication
With these settings in place users will:
1. If they are within the “Password Expire Warn Time,” see a warning when logging in to SSPR telling them their password will expire in x number of days.
2. Be forced to change their password if they are within the “Password Pre-Expire Time.” This helps prevent users from experiencing password expiration during the middle of a session.
3. Be forced to change their password if it has expired.
NOTE: The above settings are enforced when the user attaches to SSPR, not when a user logs in to eDirectory or other applications and systems that use eDirectory. However, it is possible to direct users to pass through SSPR during their login process, thus allowing SSPR to enforce the above password expiration settings. This can be accomplished as follows:
1. Use the Client Login Extension (CLE) to force users to change expired passwords when logging into windows desktop. CLE can also be used to force Challenge/Response enrollment and other SSPR operations.
2. Integrate SSPR with Access Manager or other web SSO technologies to force users to pass through SSPR during authentication. This approach can force web users to reset expired password during authentication

Cause

SSPR makes LDAP binds, and each LDAP bind operation decrements the grace login count.

Additional Information

Attempting to integrate SSPR with an SSO provider like Access Manager or other login provider can lead to confusing results in regards to eDirectory grace logins. While you may expect that grace logins will decrement in a predictable way when a user logs into your system, you will find that grace logins are consumed unexpectedly and sometimes unpredictably. This is because when multiple components of your authentication system are configured to use LDAP, grace logins can be consumed by each component.
The core issue is that when using LDAP, each LDAP bind operation which happens at the beginning of a connection will decrement the grace login count. Applications can use connection management techniques that disable idle connections and reconnect when needed, or use connection pools to limit the total connection count. Both of these techniques can lead to additional unexpected LDAP binds. Further, load balancing and high-availability architectures can result in additional connections. The end result is that a single user’s login process can execute multiple LDAP binds that cause multiple grace login decrements.
When these systems exhaust the grace logins remaining, failure can happen in odd ways such as the authentication gateway allowing login but an application failure happening during the session, or an application may return an error trying to read data from the directory.
SSPR itself will perform at least one, and sometimes more LDAP binds when a user attaches. SSPR tries to limit bind operations when a grace limit state is detected, but it is not always possible to limit the connections.

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented “AS IS” WITHOUT WARRANTY OF ANY KIND.

Related:

  • No Related Posts

7022949: LDAP based Designer sets remote loader password incorrectly for 4.5.x systems

Novell Leave a comment

This document (7022949) is provided subject to the disclaimer at the end of this document.

Environment


Identity Manager 4.5.x

Identity Manager Designer version 4.6.x (LDAP)
Identity Manager Designer version 4.7

Situation

LDAP Designer sets an incorrect value for the remote loader password and sometimes also for a connected system’s application password when deploying a driver to an IDM 4.5.x server. As a result the driver fails to start, indicating that the credentials are invalid.

This works correctly when deploying drivers to servers running IDM 4.6.x or 4.7.x.

Resolution

In order to fix this issue permanently, the best approach is to upgrade the IDM engine version to 4.6.x or 4.7.x.

It is also possible to work around the problem by setting the password with iManager and the corresponding IDM plugins or by using NCP based Designer instead.

Cause

Both the remote loader and the application password are stored in eDirectory as an AES encrypted hash in the attribute DirXML-ShimAuthPassword. During initialization it’s possible to add a policy that will display the policy being sent. Once this policy is in place, it’s possible to see that when the Remote Loader password is set with LDAP Designer against a 4.5.x system, the password field is sent incorrectly as:

<password>REMOTE(remotepwd)REMOTE(remotepwd)thisIsTheAppPassword</password>`
instead of:
<password>REMOTE(remotepwd)thisIsTheAppPassword</password>

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented “AS IS” WITHOUT WARRANTY OF ANY KIND.

Related:

  • No Related Posts

How to Deploy and Troubleshoot NetScaler as a SAML IdP or SP

Citrix Leave a comment
NetScaler as a Service Provider (SP):

To setup the NetScaler as a Service Provider, create a SAML Policy and Profile under:

Security -> AAA – Application Traffic -> Policies -> Authentication -> Basic Policies -> SAML-> Servers and click Add:

The IdP Certificate Name is the Certificate that is bound to the IdP’s authentication page. Just the certificate is needed, not the key/

Redirect URL is the URL that users will authenticate against. Some IdP’s have special URLs that are not reachable unless under SAML setup.

Single Logout URL is a URL that is specified so that the NetScaler can recognize when to send the client back to the IdP to complete the Sign out process. We will not use it in this simple deployment.

User Field is the section of the IdP’s SAML authentication Form that contains the Username, so the SP can extract it is required.

Signing Certificate Name is a Certificate-Key pair that can be used to sign the SP assertion that the NetScaler will generate. Some SAML setups require signed assertions to improve security . WE will see what a signed and unsigned SP assertion will look like.

Issue Name is a Unique ID that will be specified on both the SP and IdP to help identify the Service Provider to each other. This can be anything and does not need to be the URL as specified below.

Reject Unsigned Assertion is an option that you can specify if you require the Assertions from the IdP to be signed. You can ensure that only the Assertion needs to be signed (ON) or both the Assertion and Response from the IdP need to be signed (STRICT)

SAML Binding is the method that will be used to move the client from the SP to the IdP. This will need to be the same on the IdP so it understands how the client will connect to it.

When the NetScaler is an SP, it supported POST, REDIRECT and ARTIFACT bindings.

POST will respond to the unauthenticated client with a 200 OK and form data so the Client will connect to the IdP with a POST request.

REDIRECT will respond to the unauthenticated client with a 302 Redirect which will have the Redirect URL and the SP assertion in the URL. The client will then connect to the IdP with a GET request, which will contain the Assertion in the URL.

Under More

———————-

Audience is an identifier, typically a URL, to identify the SP in the scenario

Skew Time, is the amount of time that the Assertion from the IdP is valid for.

This stops re-use and storage of SAML assertions

Name ID Format, is the format that the Username is tranmistted and expected between the IdP and SP. This option must match between IdP and SP

User-added image
User-added image

Then create a SAML policy and bind it to a Gateway or AAA vServer:

Example Config:

add authentication samlPolicy saml_sp_pol ns_true saml_sp_prof

bind authentication vserver sp.franklab.com -policy saml_sp_pol -priority 100 -gotoPriorityExpression END

add cs vserver http_cs_vserver HTTP 10.90.47.223 80 -cltTimeout 180 -AuthenticationHost sp.franklab.com -Authentication ON -authnVsName sp.franklab.com

If you are protecting a Content Switch or Load Balancer with SAML, bind the AAA/NSG vServer as a Forms based authentication to the protected VIP.

Note: If the NetScaler is acting as a Service Provider, the Consumer Assertion URL will be http(s)://fqdn.of.vserver/cgi/samlauth

The fqdn.of.vserver is the FQDN of the LB or CS that is being protected, not the AAA or NSG vServer.


NetScaler as an Identity Provider (IdP):

To setup the NetScaler as a. Identity Provider, create a SAML IdP Policy and Profile under:

Security -> AAA – Application Traffic -> Policies -> Authentication -> Advanced Policies -> SAML IdP-> Servers and click Add:

The Assertion Consumer Service URL is the URL that the authenticated user will be redirected to.

IdP Certificate Name is the Certificate-Key pair used for the authentication page.

SP Certificate Name is the Certificate of the Service Provider in this scenario, the key is not required for this.

Sign Assertion is the option to Sign the Assertion and Response when redirecting the Client back to the Service Provider.

Issue Name is an ID that some Service Providers require. This does not need to be the FQDN or URL of the IdP, but it has to be the same on both the IdP and SP profiles if used.

Service Provider ID is a Unique ID that will be specified on both the SP and IdP to help identify the Service Provider to each other. This can be anything and does not need to be the URL as specified below, but needs to be the same on both the SP and IdP profiles.

Reject Unsigned Requests is an option you can specify to ensure only Assertions signed with the SP Certificate are accepted.

Signature Algorithm is the Algorithm used to sign and verify the Assertions between the IdP and SP, this needs to be the same on both the IdP and SP profiles.

Digest Method is the Algorithm used to verify the integrity of the Assertions between the IdP and SP, this needs to be the same on both the IdP and SP profiles.

SAML Binding is the same as described in the SP profile, it needs to be the same on both the SP and IdP.

NetScaler as a SAML IdP only supported POST and REDIRECT bindings, not ARTIFACT as of NS11.1 52.13

User-added image

Note: When the NetScaler acts as an IdP, it uses an AuthnContextClassRef of urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

Some Service Provider Profiles require this information.

After creating this Profile, create a policy which will only be hit for SAML requests and bind it to a AAA or NSG vServer which has authentication policies bound to it, such as LDAP or RADIUS.

SAML IdP policies are considered Advanced Authentication policies which are processed first, so the priority does not need to be higher that Based Authentication Policies.

From there, the user will authenticate against the LDAP or RADIUS etc, and then be directed to the Assertion Consumer Service URL with the IdP assertion.

Note: In IDP initiated, User will get authenticated 1st and SAML Response is posted to the SP/ACS.

Example Config with LB Vserver:

add tm samlSSOProfileSAML_IDP_Initiated -samlSigningCertName Wildcard_new_repro.cer -assertionConsumerServiceURL “https://test.repro.lab/cgi/samlauth” -relaystateRule “”https://test.repro.lab/customer1″” -sendPassword ON -samlIssuerName saml-sp.repro.lab -audience “https://test.repro.lab/cgi/samlauth” -samlSPCertName Wildcard_new_repro.cer -skewTime 50

add tm trafficAction SAML_IDP_Initiated_Proile -SSO ON -persistentCookie OFF -InitiateLogout OFF -kcdAccount NONE –samlSSOProfileSAML_IDP_Initiated

add tm trafficPolicy SAML_IDP_Initiated “HTTP.REQ.URL.EQ(“/customer1″)” SAML_IDP_Initiated_Proile

bind lb vserver SAML -policyName SAML_IDP_Initiated -priority 110 -gotoPriorityExpression END -type REQUEST

Example Config with VPN Vserver:

add vpn samlSSOProfileSAML_IDP_Initiated_VPN -samlSigningCertName Wildcard_new_repro.cer -assertionConsumerServiceURL “https://saml-sp.repro.lab/cgi/samlauth” -relaystateRule “”https://saml-sp.repro.lab/index.html”” -sendPassword ON -samlIssuerName test.repro.lab -audience “https://saml-sp.repro.lab/cgi/samlauth” -samlSPCertName Wildcard_new_repro.cer -skewTime 50

add vpn trafficAction SAML_IDP_VPN_Traffic_Profile http -SSO ON –samlSSOProfile SAML_IDP_Initiated_VPN

add vpn trafficPolicy SAML_IDP_VPN_TPol ns_true SAML_IDP_VPN_Traffic_Profile

bind vpn vserver Gateway_SAML -policy SAML_IDP_VPN_TPol -priority 100

Troubleshooting SAML on the NetScaler:

When troubleshooting SAML, the best way is to use Browser Debug tools such as the below and actively capture the Assertions from the IdP and SP:

https://chrome.google.com/webstore/detail/saml-message-decoder/mpabchoaimgbdbbjjieoaeiibojelbhm?hl=en

Or

https://addons.mozilla.org/en-GB/firefox/addon/saml-tracer/

A set of Signed and Unsigned SP and IdP assertions are attached to this article

Common Issues with SAML:

User-added image

When accessing the SP, you are presented with the above page.

This tells you that the Signature Algorithm for the SP and IdP do not match or the signing certificate from the Service Provider does not match the Certificate specified on the IdP profile.

User-added image

If you are presented with this error, this means that the NetScaler is not able to identify the SAML request that it is sent.

This usually occurs when the SAML binding on the SP and IdP profiles do not match.

User-added image

After authentication to the IdP, the NetScaler (SP) presents the above.

This occurs when the assertion from the IdP is missing certain parameters that the NetScaler is looking for, such as a Signature.

User-added image
If you see the above message from the NetScaler, upgrade to the latest firmware of your current version and contact Citrix Technical Support, as the NetScaler is having issues interpreting the Assertion from a Third Party IdP or SP

Related:

  • No Related Posts

MS ADFS – Origin – infinite loop

Symantec Community Leave a comment
I need a solution

When we select „Origin“ in auth, then we get infinite loop and error:

Appliance Error (configuration_error)

Your request could not be processed because of a configuration error: “The remote SAML IDP reported an error and was unable to process the authentication request.”

At ADFS we get Error: 364

Basically what we want is ADFS as IdP and BC as SP for multiple reverse Proxy sites but client need’s to authentication only one time. While Token and Sessions are alive, they have access to services without need to login again.

Problem is that we got redirection loop and ProxyASG is always asking to authantice (we see that first authatnication passed, we have user, etc…. But it’s just redirecting). At one client only SG 2.0 is working but we got to many redirections (then browser finally fail and sait too many redirection), to me all is working except „Origin“ o.O???

Do you have any idea, or good setup for MS ADFS and ProxyASG. v6.6 and 6.7 are available. MS 2012 R2

I followed this post also and he is using origin? https://support.symantec.com/en_US/article.HOWTO12…

0

Related:

  • No Related Posts

IDM 4.5 REST Driver 1.0.1.0

Novell Leave a comment
Abstract: Patch update for the NetIQ Identity Manager Rest driver. This patch will take the driver version to 1.0.1.0.

Document ID: 5370351
Security Alert: No
Distribution Type: Field Test File
Entitlement Required: Yes
Files:

  • IDM45_REST_1010.zip (424.62 kB)

Products:

  • Identity Manager 4.5
  • Identity Manager 4.6
  • Identity Manager 4.7

Superceded Patches:

Related:

  • No Related Posts