Persistent Authentication
This authentication class stores user session on the browser after successful login. When the user is prompted for authentication subsequently, this class will reuse the saved authentication instead of prompting the user for credentials. The user will be prompted for credentials again only when the cookie lifetime expires. This type of authentication is used only for applications that do not require very high security. To configure persistent authentication, Access Manager provides a class called
PersistentAuthClass.
NOTE:
You can configure persistent authentication as a standalone method in a contract.
Configuring Persistent Authenticator Class
The following procedure allows you to configure the PersistentAuthClass. Persistent Authentication supports method properties described in the following section.
1
Login to the Administration Console.
2
Click
Devices > Identity Servers > Edit > Local > Classes
.
3
Click
New
, then specify a
Display name
for example, PersistentAuth.
4
Select
PersistentAuthClass
from the
Java Class
drop-down list.
5
Click
New
to create a new authentication class.
6
In the Add property window, specify the following values. Specifying these values are optional.
Property Name:
Specify the name of the property. For more information on the names you can specify here, see
“PersistentAuthClass Properties” on page 308
Property Value:
Specify the property value you would like to define here.
7
Click
OK
and
Finish
.
8
Continue with creating a contract and method for this class.
For configuration information, see “Configuring Authentication Methods” on page 287
and
“Configuring Authentication Contracts” on page 289
.
PersistentAuthClass Properties
You can set the following class properties in the configuration file.
CryptoKey
: This key is used to encrypt the user's information in the cookie. If this value is long and random, the user information will be secure. The value must be at least ten characters. The certificate private key will be used if you do not set this value. The certificate private key will be used if you do not set this value. If you change or update the certificate, the user is reauthenticated.
CookieSuffix
: The Cookie Name is derived using this suffix. PA_ is added as a prefix to the cookie name. By default, cookie name is PA_PERSISTENT_AUTH. For example, if you configure the CookieSuffix as PER_AUTH, the Identity server sends cookie with PA_PER_AUTH name at browser.
MaxAgeSeconds
: This property will decide the cookie lifetime. Default value is 86400 seconds
(1 day). Maximum value is 4294967295 seconds.
Configuring Authentication
307
ParamName
: The name of the HTTP parameter to enable this feature. The default value of the parameter is EnableCookieAuth. If you want to modify the default value of parameter name for example to TestCookieName, follow the procedure given below.
1. Login to the Identity Server.
2. Go to /opt/novell/nids/lib/webapp/jsp
3. Open login.jsp file using an editor.
4. Search for EnableCookieAuth parameter name and provide the new name as
TestCookieName
in the input tag.
5. Ensure that you select the
Remember Me
option.
6. Restart the Identity Server.
This value is used by the Identity Server to identify if user has enabled
Remember Me
option on the login page.
Customizing Login Page For Persistent Authentication
To enable
Remember Me
option on a custom login page, use the following custom code in the customized JSP file:
<td align=left>
<input type="checkbox" name="EnableCookieAuth" value="true" /> <label> Remember Me
</label>
</td>
</tr>
<tr></tr>
<tr> <td> <span class="instructions"> (Do not check this box if you are using public computer.)</span> </td></tr>
NOTE:
Ensure that you add the MainJSP and JSP in the method property. For more information, see
“Specifying Common Class Properties” on page 285
.
This class doesn't replace the form-based contract. For more information, see “Customizing the
Identity Server Login Page” on page 193 .
Logging Out of the Persistent Sessions
When a user performs an explicit logout, the Identity Server clears the persistent authentication cookie at browser if the logout request goes through the browser. If SOAP communication is used between the service provider and the Identity server, then the Identity server does not clear the cookie automatically. The cookie can only be cleared by sending a request to a page on the server that issued it. If the page is available on the Identity server, the clearCookieAuth.jsp file clears the page. You must customize the service provider’s logout page to run the Identity server’s clearCookieAuth.jsp
page.
The clearCookieAuth.jsp file clears it. The URL for this page will be https://idpserver.example.com/ nidp/clearCookieAuth.jsp
. Any request to that URL will clear the authentication cookie.
With this class in use, the user will be unable to logout of the system because re-accessing any protected page will simply re-authenticate the user using the user information stored in the browser stored. There are at least two ways to invalidate an outstanding browser stored authentication cookie.
308
Configuring Authentication
