5.16.2 ORed Credential Class

Access Manager includes a class that can be configured to accept any combination of name/password, X.509, or RADIUS credentials. When this class executes as part of a contract, users can select and enter their preferred type of credential.

For example, if a name/password credential is ORed with an X.509 credential, the user can select to use a certificate or to enter a name and password. As an administrator, you have decided that both credentials are equally secure for the protected resource the contract is protecting.

To create an ORed credential class:

  1. Click Devices > Identity Servers > Edit > Local > Classes > New.

  2. Specify the following details:

    Display name: Specify a name for the class.

    Java class: Select NPOrRadiusOrX509Class.

  3. Click Next

  4. Select at least one of the following options:

    Use Name/Password: Select this option if you want the PasswordClass to be one of the authentication options available to the user.

    Use Radius: Select this option if you want the RadiusClass to be one of the authentication options available to the user.

    Use X509: Select this option if you want the X509Class to be one of the authentication options available to the user.

  5. (Conditional) If you want to use the protected version of the PasswordClass or RadiusClass, select the Enforce use of HTTPS option.

  6. (Conditional) If you selected the Use Name/Password option, configure the properties:

    1. In the Name/Password Properties section, click New.

    2. Specify a property name and property value.

      For information about the properties that PasswordClass and ProtectedPasswordClass support, see Specifying Common Class Properties.

    3. Click OK.

    4. Repeat Step 6.a through Step 6.c to add another property.

  7. Click Next.

  8. (Conditional) If you selected the Use Radius option, configure the Radius properties.

    For information about the configuration options, see RADIUS Authentication.

  9. (Conditional) If you selected the Use X509 option, configure how the certificate is validated.

    For information about the configuration options, see Mutual SSL (X.509) Authentication.

  10. Click Next.

  11. (Conditional) If you selected the Use X509 option, configure the attribute mappings.

    For information about the configuration options, see Mutual SSL (X.509) Authentication.

  12. Click Next.

  13. Click Finish.

  14. Continue with creating a method and a contract for this class.

    See Configuring Authentication Methods and Configuring Authentication Contracts.

    The RADIUS class prompts the user for a token instead of a password. The user can use the drop-down menu to select between the password and the token. If the user selects to send a certificate, the username and password/token options become unavailable.