Integrating Access Manager with Google+
The following procedure enables you to generate API Key and API Secret with Twitter.
1
Create a Google+ application for community.
1a
Log in to Google+ API console. Sign in to Google Cloud Platform (https://code.google.com/ apis/console) using Google+ credentials.
1b
From
API Project
on the left select
Create
from the drop-down list.
1c
From Create project page, click
Create project
.
1d
On the All Services page, in the left pane, click
API Access
.
1e
To create an application, on the API Access page, click
Create an OAuth 2.0 client ID…
.
1f
In the Create Client ID page, in the
Product name
field, specify a valid name and click
Next
.
1g
On Client ID Settings page, for
Application type
, choose
Web application
, if it is not selected by default.
1h
In
Your site or hostname
, specify the URL of your production server. For example, example.namdemo.com:8443.
1i
Click
Create client ID
. To generate
Client ID
and
Client secret
for your application, click
Edit settings
.
1j
In the Edit client settings page, specify the authorized
Redirect URIs
, enter https:// example.namdemo.com:8443/nidp/jsp/socialauth_return.jsp.
1k
In the authorized
JavaScript origins
, enter: https://example.namdemo.com:8443 and click
Update
.
2
Configure Google+ application Configuration Setting in Access Manager. Access Manager uses the
Client ID
and
Client secret
to configure Google+.
Two-Factor Authentication Using Time-Based One-Time
Password (TOTP)
This section explains how to use Time-Based One-Time Password (TOTP) as a second authentication factor with Access Manager. TOTP uses a six-digit number (OTP) in addition to first authentication (for example: username, password) to log in to protected services.
The first step is to register the TOTP client with the secret key. This secret key is used for all future login to the website.
Typically, users download and install the TOTP app on their devices. To log in to a website or service that uses two-factor authentication, in addition to the user name and password, the users enter an
OTP generated by the TOTP app. Access Manager validates the OTP and authenticates the user.
“Why Two-Factor Authentication?” on page 306
“Prerequisite” on page 306
“Configuring TOTP Class, Method, and Contract” on page 306
“Registering with TOTP” on page 307
“Verifying TOTP Configuration” on page 307
304
Configuring Authentication
Why Two-Factor Authentication?
Two-factor authentication such as TOTP provides additional security for the systems. It works on the principle of granting access based on a knowledge factor (something the user has) and a possession factor (something the user knows). This helps organizations to implement a multi-factor authentication scheme to satisfy regulatory requirements or increase security.
Prerequisite
Download and install the TOTP app on your device. This app generates an OTP that is later used for authentication.
TOTP relies on the device time to generate an OTP. So, it is important that the time on your device is accurate.
Configuring TOTP Class, Method, and Contract
1
Log in to the Administration Console.
2
Click
Devices > Identity Servers > Edit > Local > Classes > New
to add a new class.
3
Specify a name to identify the class.
4
Select TOTPClass from the
Java Class
option. The
Java class path
is displayed as com.novell.nidp.authentication.local.TOTPAuthenticationClass
.
5
Click
Apply
. By default, the TOTP class stores the secret key in the Shared Secret store and no further configuration is required.
6
[Optional] You can also store the secret key in an LDAP attribute, file, or memory. Perform the following steps:
NOTE:
File and Memory class implementation are not recommended for production deployment and are only suitable for a single node Identity Server test environment.
LDAP user attribute:
This option stores the secret key on an LDAP attribute of the user object in the user store.
1. Select the
Properties
tab of the TOTP class configuration. Add a new property to indicate that the secret key must be stored in an LDAP attribute of the user object in the user store.
Specify the
Property Name
as SECRET_STORE_CLASS and
Property Value
as USERSTORE.
2. Add another property to indicate the attribute in which the secret key must be stored.
Specify the
Property Name
as SECRET_LDAP_ATTRIBUTE_NAME and specify the name of any single-valued attribute. For example, you can specify the
Property Value
as mobile, costcentre
etc.
The secret key is encrypted and stored in the LDAP attribute. If you do not specify any
Property Value
, the secret key is stored in the carLicense LDAP attribute.
NOTE:
Do not use a multi-valued LDAP attribute like email address as the
Property Value
as the user registration will fail. It is also important to ensure that the LDAP attribute you have specified as the
Property Value
is a non-operational attribute. For example, it is not recommended to use LDAP Attributes like groupmembership.
Configuring Authentication
305
File class:
The File class writes the secret key to a file on the Identity Server file system.
1. Select the
Properties
tab of the TOTP class configuration and add a new property to have the user's secret key stored in a file on the file system.
2. Specify the
Property Name
as SECRET_STORE_CLASS and
Property Value
as FILE.
Memory class:
The Memory based class writes the secret key into memory. This memory is transient in nature and therefore the secret key value is lost each time the Identity Server is restarted.
1. Select the
Properties
tab of the TOTP class configuration and add a new property to define the memory-based property where each user’s secret key is stored.
2. Specify the
Property Name
as SECRET_STORE_CLASS and
Property Value
as MEMORY.
7
Click
Devices > Identity Servers > Edit > Local > Methods
. Select
New
to add a new method.
8
Specify a name to identify the method. Select the TOTP class from the list. This links the TOTP class to the authentication method.
9
Deselect the
Identifies User option
. Click
Apply
to save the changes.
10
Select the user store from the
list of Available user stores
and move it to
User store
.
11
You can either use an existing authentication contract or create a new authentication contract.
For example, you can add the default Name/Password – Form method as the first method and
TOTP method as the second method. Click
Apply
to save the changes.
NOTE:
If you use TOTP as a post-authentication method in a federation setup, a JSP file not found
message is displayed and federation fails.
Registering with TOTP
1
Go to NetIQ Identity Server page http(s)://<idp server >:<port>/nidp
2
Select the contract where TOTP is configured as the second method for two-factor authentication.
3
Login with the first method.
4
Click the link beside
Please register for two factor authentication
to generate a OTP. Make a note of the secret key displayed.
If you have installed the TOTP client on your device, scan the code. You can also manually enter the secret key in the TOTP mobile client.
After the registration is complete on the TOTP client on your mobile, the OTP is displayed.
Verifying TOTP Configuration
1
Go to NetIQ Identity Server page: http(s)://<idp server >:<port>/nidp
2
Select the contract where TOTP is configured as the second method for two-factor authentication.
3
Login with the first method.
After successfully authenticating with the username and password, prompt is displayed to enter the TOTP OTP.
4
Use the TOTP app to generate the OTP and login by using this OTP.
306
Configuring Authentication
