4
Click the
Add Attributes
icon (plus sign), then select attributes to add to the logic group. (Use the
Shift key to select several attributes.)
5
Click
OK
.
6
To add logic groups, click
New Logic Group
.
The
Type
drop-down (AND or OR) applies only between groups. Attributes within a group are always the opposite of the type selection. For example, if the
Type
value is AND, the attributes within the group are OR.
7
Click the
Add Attributes
icon (plus sign) to add attributes to the next logic group, then click
OK
.
8
Click
Finish
.
9
(Conditional) If you selected attributes from the Custom, Employee, or Personal profile, you need to enable the profile so that the attribute can be shared:
9a
Click
Servers
>
Edit
>
Liberty
>
Web Service Provider
.
9b
Select the profiles that need to be enabled, then click
Enable
.
9c
Click
OK
, then update the Identity Server.
Adding Custom Attributes
You can add custom shared secret names or LDAP attribute names that you want to make available for selection when setting up policies.
“Creating Shared Secret Names” on page 64
“Creating LDAP Attribute Names” on page 65
Creating Shared Secret Names
The shared secret consists of a secret name and one or more secret entry names. You can create a secret name only, or a secret name and an entry name. For ease of use, the entry name must match the policy that uses it:
For a Form Fill policy, the entry name must match a form field name.
For an Identity Injection policy, the entry name must match the Custom Header Name.
For an External Attributes policy,
Secret Name
must match the policy name and
Secret Entry
Name
must match the attribute name configured while creating the policy.
For example, if the policy name is fetchattr and attribute name configured in the policy is address, then
Secret Name
must be fetchattr and
Secret Entry Name
must be address.
For more information about how to use shared secrets with policies, see
“Creating and Managing
Shared Secrets” on page 732 .
The Identity Server needs to be configured to use shared secrets. For information about this process,
see “Configuring a User Store for Secrets” on page 276 .
Shared secret names can be created either on the Custom Attributes page or in the associated policy that consumes them.
1
In the Administration Console, click
Devices > Identity Servers > Shared Settings > Custom
Attributes
.
2
To create shared secret names, click
New
.
3
Enter a new shared secret name and, optionally, a secret entry name.
64
Setting Up a Basic Access Manager Appliance Configuration
4
Click
OK
.
5
(Optional) To create additional entries for the secret, click the name of the secret, click
New
, specify an entry name, then click
OK
.
WARNING:
The Identity Server currently has no mechanism to determine whether a secret is being used by a policy. Before you delete a shared secret, you must ensure that it is not being used.
Creating LDAP Attribute Names
LDAP attributes are available for all policies. LDAP attribute names can be created either on the
Custom Attributes page or in the associated policy that consumes them. The attribute names that you specify must match the name of an attribute of the user class in your LDAP user store.
1
In the Administration Console, click
Devices > Identity Servers > Shared Settings > Custom
Attributes
.
This list contains the attributes for the inetOrgPerson class. It is customizable.
audio:
Uses a u-law encoded sound file that is stored in the directory.
businessCategory:
Describes the kind of business performed by an organization.
carLicense:
Vehicle license or registration plate.
cn:
The X.500 commonName attribute, which contains a name of an object. If the object corresponds to a person, it is typically the person’s full name.
departmentNumber:
Identifies a department within an organization.
displayName:
The preferred name of a person to be used when displaying entries. When displaying an entry, especially within a one-line summary list, it is useful to use this value.
Because other attribute types such as cn are multivalued, an additional attribute type is needed.
employeeNumber:
Numerically identifies a person within an organization.
employeeType:
Identifies the type of employee.
givenName:
Identifies the person’s name that is not his or her surname or middle name.
homePhone:
Identifies a person by home phone.
homePostalAddress:
Identifies a person by home address.
initials:
Identifies a person by his or her initials. This attribute contains the initials of an individual, but not the surname.
jpegPhoto:
Stores one or more images of a person, in JPEG format.
labeledURI:
Uniform Resource Identifier with an optional label. The label describes the resource to which the URI points.
mail:
A user’s e-mail address.
manager:
Identifies a person as a manager.
mobile:
Specifies a mobile telephone number associated with a person.
o:
The name of an organization.
pager:
The pager telephone number for an object.
photo:
Specifies a photograph for an object.
preferredLanguage:
Indicates an individual’s preferred written or spoken language.
roomNumber:
The room number of an object.
secretary:
Specifies the secretary of a person.
Setting Up a Basic Access Manager Appliance Configuration
65
