Access Manager Passwordless Authentication

1. Log in to Advanced Authentication as an administrator.

2. Verify that the NAM event is available in Events.

   NOTE:The NAM event is created by default when you install Advanced Authentication. In a rare scenario, the NAM event is not created by default. Re-installing Advanced Authentication resolves the issue.

3. Set up a central user store that both Advanced Authentication and Access Manager will use while authenticating a user. You can add a new repository in the Advanced Authentication server or configure details of an existing Access Manager user store.

   If you add a new repository in Advanced Authentication, configure the same repository when you Configure the Advanced Authentication Server Details in Access Manager.

   For more information about how to add a repository, see Adding a Repository.

4. Configure a method that supports passwordless authentication. For example, configure FIDO2.

   An Advanced Authentication method verifies the identity of a user who tries to access resources.

   For more information about how to configure a method, see Configuring Methods.

5. Create a chain.

   A chain is a combination of methods. A user must execute and succeed all methods in a chain to be authenticated. Add the FIDO2 method that you configured in the previous step. In Roles and Groups, assign the chain to the user group configured in the repository.

   For example, specify XYZ\Allowed RODC Password Replication Group, where XYZ is the repository name.

   For more information about configuring chains, see Creating a Chain.

6. (Required only for the OAuth-based approach) Configure an event.

   IMPORTANT:In the plug-in-based integration, Access Manager uses the default NAM event created during Advanced Authentication installation.

   Perform the following steps to configure an event:

   1. Click Events > Add.

   2. Specify a name for the event.

   3. Select OAuth2 from Event type.

   4. Select the chain you created in the previous step.

      NOTE:You need the Client ID and Client secret while configuring the Advanced Authentication server in Access Manager. You cannot view the Client secret later, so you must note the value.

   5. In Redirect URIs, specify https://<identity server-url>:<port>/nidp/oauth/nam/callback.

      For example, if the Identity Server URL is https://domain.example.com:8443/nidp, where domain.example.com is the domain name, and 8443 is the port, specify https://domain.example.com:8443/nidp/oauth/nam/callback.

      IMPORTANT:If your Identity Server base URL is on the standard SSL port 443, do not include the port number in the URI. For example, https://domain.example.com/nidp/oauth/nam/callback.

7. (Required only for the Plug-in-based approach) Assign the created chain to the NAM event in the Advanced Authentication server.

8. Continue with Configure the Advanced Authentication Server Details in Access Manager.

1. Click Devices > Identity Servers > Shared Settings > Advanced Authentication.

2. Specify the following details:

   Field	Description
   Server Domain	Specify the scheme, domain name, and port of the Advanced Authentication server.
   Tenant Name	Specify the name of the tenant that you want to use. This field populates the TOP tenant of Advanced Authentication by default. You can specify another tenant name that you want to use.

   NOTE:When using the Plug-in-based methods, skip to Step 5.

3. (Required only for OAuth-based approach) Select Integrate using OAuth under OAuth Event Configuration.

4. (Required only for OAuth-based approach) Specify the following details:

   Field	Description
   Event Name	Specify an event name. This event name must be identical to the event name specified in the Advanced Authentication administration portal.
   Client ID	Specify the client ID generated while creating the OAuth 2.0 event in the Advanced Authentication administration portal.
   Client Secret	Specify the client secret generated while creating the OAuth 2.0 event in the Advanced Authentication administration portal.

   Access Manager uses the endpoint links to retrieve token and user details from the Advanced Authentication server. These are default endpoint links. If the values of the URIs change because of modification of the Advanced Authentication authorization server, then you can change the same here.

   Field	Description
   Authorization URL	Access Manager uses this URL to retrieve the authorization code from the Advanced Authentication server.
   Token URL	Access Manager uses this URL to exchange the authorization code with the access token.
   User Info URL	Access Manager sends the access token to this URL to get the user details from the Advanced Authentication server.

   The fields under Integration URLs are auto-populated after you specify the server domain address.

   Field	Description
   Enrollment Page URL	If the user is not enrolled in the Advanced Authentication server, then Access Manager uses this URL to redirect the user to the enrollment page.
   Sign Data URL	Access Manager uses this URL to retrieve the signed data from the Advanced Authentication server.

5. Click Apply.

6. Log in to the Identity Server machine, go to /opt/novell/nam/idp/plugins/aa/, and verify that the config.xml file is available in this location. Perform this check on all Identity Server nodes.

7. Verify that the endpoint has been created in the Advanced Authentication server.

   Go to the Advanced Authentication administration portal and verify that the hostname or domain name of the Identity Server cluster is displayed as the endpoint under Endpoints.

8. In Access Manager, go to Dashboard and click Certificates > Trusted Roots to verify if the Advanced Authentication server certificate is available.

   If the certificate is not available, then perform the following steps to import the certificate:

   1. Click Certificates > Trusted Roots > Auto-Import From Server.

   2. Specify the server IP/DNS, port, and certificate name.

   3. Click OK.

9. Configure the same user store or repository added in the Advanced Authentication server. See Step 3.

   1. Click Devices > Identity Servers > Servers > Edit > Local > User Stores > New.

   2. Specify the details and click Finish.

   3. Update Identity Server.

   Skip this step if you have configured an existing Access Manager user store in the Advanced Authentication server.

10. Continue with Section 3.2, Configuring Passwordless Authentication.

Perform the following steps in Access Manager:

1. Configure an Advanced Authentication Generic class.

   1. Click Devices > Identity Servers > Edit > Local > Classes.

   2. Click New and specify the following details:

      Display name: Specify a name for the class.

      Java class: Select Advanced Authentication Generic Class.

   3. Click Next > Finish.

2. Create a method for this class.

   1. Click Devices > Identity Server > Edit > Local > Methods > New.

   2. In Advanced Authentication Chains, select the chain you created for FIDO2.

      NOTE:If no chain is available in Advanced Authentication Chains, create a chain in the Advanced Authentication server. If a chain is available in the Advanced Authentication server and unavailable in Advanced Authentication Chains, then assign the chain to the configured Access Manager OAuth event in the Advanced Authentication administration portal.

3. Create a contract for the method.

   1. Click Devices > Identity Servers > Edit > Local > Contracts > New.

   2. In URI, specify a unique path value that identifies the contract. You can use URI to identify this contract for external providers. For example, specify /nam/AAgenericcontract or /mycompany/name/password/form.

   3. In Methods, add the Advanced Authentication method created in the preceding step.

   4. Click Apply > OK.

   5. Update Identity Server.

Perform the following steps in Access Manager:

1. Configure an Advanced Authentication class.

   1. Click Devices > Identity Servers > Edit > Local > Classes.

   2. Click New and specify the following details:

      Display name: Specify a name for the class.

      Java class: Select an Advanced Authentication class other than Advanced Authentication Generic Class. For example, select SMS Class.

   3. Click Next > Finish.

2. Create a method for this class.

   1. Click Devices > Identity Server > Edit > Local > Methods > New.

   2. Specify a name for this method.

   3. Select Identifies User.

   4. Under Properties, click New, and specify the following details:

      IMPORTANT:The name and the value of the property are case-sensitive.

      Field	Detail
      Property Name	Auth_Type
      Property Value	preAuth

      For more information about creating a method, see Configuring Authentication Methods in the NetIQ Access Manager 5.0 Administration Guide.

   IMPORTANT:FIDO U2F does not work if enrollment and authentication are performed on different domain names. With Access Manager and Advanced Authentication, you have two domain names: one for Identity Server and another for the Advanced Authentication server.

   To work around this, create proxy services for Identity Server and Advanced Authentication server under the same domain name. See Configuring a FIDO U2F Classin the NetIQ Access Manager 5.0 Administration Guide.

3. Create a contract for the method.

   1. Click Devices > Identity Servers > Edit > Local > Contracts > New.

   2. In URI, specify a unique path value that identifies the contract. You can use URI to identify this contract for external providers. For example, specify /nam/AAplugincontract or /mycompany/name/password/form.

   3. In Methods, add the Advanced Authentication method created in the preceding step.

   4. Click Apply > OK.

   5. Update Identity Server.

      For more information about creating a contract, see Configuring Authentication Contracts in the NetIQ Access Manager 5.0 Administration Guide.

Perform the following steps in Access Manager:

1. Create an Advanced Authentication class. You can use a Dynamic class or any other class except the Generic class.

2. Create a method and include the class created in the previous step, add a repository, and add the Advanced Authentication Enrollment URL property.

   Specify the URL of the Advanced Authentication portal for authenticator enrollments.

   For example:

   URL of the portal when not protected by Access Gateway: https://<Advanced Authentication hostname or IP address>/account

   URL of the portal when Access Gateway protects Identity Server and Advanced Authentication: https://<Access Gateway hostname>/account

3. Create a contract and add the Advanced Authentication method (FIDO2) created in the previous step.

4. Using the account of the dummy user, access Identity Server or a protected resource to which this contract has been assigned and execute this contract. (https://<identity server-url>:<port>/nidp)

   The user must be prompted to insert the security key into the USB-C port or NFC reader and confirm the identity.

   The user authenticates if the integration is successful.

Perform the following steps in Access Manager:

1. Create a class using the Advanced Authentication Generic class.

2. Create a method, add the class, and select the required chain in Advanced Authentication Chains. For example, select FIDO2.

3. Create a contract. Add the Advanced Authentication method created in the previous step.

4. Using the account of the dummy user, access Identity Server or a protected resource to which this contract has been assigned and execute this contract. (https://<identity server-url>:<port>/nidp)

   Identity Server redirects the login request to Advanced Authentication OSP for the chain execution.

   On the OSP page, select the chain you configured for FIDO2. The user must be prompted to insert the security key into the USB-C port or NFC reader and confirm the identity.

   Authentication succeeds on the OSP page, and the user is redirected to Identity Server or protected resource when integration is successful.