IBM Security Access Manager for Enterprise Single Sign-On, Version 8.2

Creating authentication services

Use AccessStudio to create an authentication service for an application.

Procedure

  1. From AccessStudio, click the New icon and select New Authentication Service. A new authentication service is created (authenticator1), and the data is in the corresponding fields displayed on the Form Editor tab.
  2. Specify information for the new authentication service.
    Option Description
    Id Enter a unique name to identify the authentication service.

    This field is mandatory for creating a direct auth-info reference.

    Display name Specify a name for the authentication service to be displayed in the AccessAgent Wallet.

    This field is mandatory for creating a direct auth-info reference.

    Description (Optional) Enter a short description for this authentication service.
    Account data template id You can also specify the account data template to use for the authentication service.

    An account data template defines the structure of the account data or user credentials.

    The default account data template ID is adt_ciuser_cspwd. This setting indicates the nature of user credentials user name that is not case-sensitive and a case-sensitive password.

    Policies Expand this field group to define policy settings for an authentication service.

    These policies are the same policies that can be set in AccessAdmin.

    For enterprise authentication services, specify policy information. Mark the check box to enable the fields in this group.

    Set the default sign-on behavior for this authentication service by selecting from the drop-down list.

    The options are: Auto-logon, Always, Ask, and Never.

    Mark Require re-authentication before performing automatic sign-on if you want AccessStudio to authenticate the user for each automatic sign-on.

    Mark Prompt user on auto-capture of password to always ask the user whether to capture each password used for this authentication service.

    Specify restrictions for the password (such as minimum length, number of alphabetic characters, digits, and so on).

    Enter a number or use the arrow keys in each field.

    Mark Enforce mixed-case passwords to require users to enter a combination of uppercase and lowercase characters for their passwords.

    After setting and testing all the authentication service policies, click the Upload selected data to IMS icon so the policies takes effect in AccessAdmin.

    Dialog labels (Optional) These labels are used when AccessAgent displays a dialog box for the user to enter their credentials.

    Click the Add button to add custom labels for authentication credentials.

    Specify labels only for account data items that are defined in this account data template of the authentication service. For example, for the adt_ciuser_cspwd account data template, specify labels for aditi_ciuser and aditi_cspwd.

    If a dialog box label is not specified, default labels, such as Username (case-insensitive) are used.

    Localization support

    Specify the culture or language for which support must be added using the drop-down list.

    Specify the overriding name for this object if this culture is selected in AccessAgent or the IMS Server. This value is used for display purpose in the Wallet manager of the AccessAgent. The default value is used if no override is found for a particular culture.

    Specify the overriding description for this object if this culture is selected in AccessAgent or the IMS Server.

    Server Locators For using indirect auth-info references, expand the Server Locators twistie.

    Specify server locator information for the applications you want to associate with this authentication service in the text box beside the Add button.

    For example enter www.xyz.abcd.com.

    Click Add.

    You can add multiple server locators under one authentication service. This task is useful for multiple applications with the same authentication service, but with different server locators.

    For example, you can have a domain named abcd.com, and its subdomains use the same authentication.

    You can specify server locators for each of the services running on the subdomains (for example, http://123.abcd.com or http://456.abcd.com).

    You can also specify separate server locators for auto-fill of user credentials and that for credential capture. Clear the selection in the Use same server locators for injection and capture field to display separate server locator fields for auto-fill and capture.

    Note: Setting authentication service policies in AccessStudio lets you test the new policies you have created without affecting other AccessAdmin users.
  3. Click the Save icon to store the new authentication service in a .EAS file.


Feedback