The first is to change the user’s password and second is to clear the stored cookie from the browser.
Only way to invalidate the cookie is to change the encryption key used. The cookie that is created can only be cleared by a request from the server which created it.
The following configurations are specific to the Novell service provider. If the users uses third party service provider, then the user must customize the logout pages.
In a federation scenario add the following to the logoutSuccess.jsp file at /opt/novell/nam/idp/ webapps/nidp/jsp/
of the service provider. You can have logout page redirect to this page, or have an <iframe> that references the page. You may also customize the /opt/novell/nam/mag/webapps/ nesp/jsplogoutSuccess.jsp
file to provide login links or instructions to your user.
<tr>
<td> <iframe src="https://idp.labs.com:8443/nidp/jsp/clearCookieAuth.jsp" width="0" height="0"> </td>
</tr> where idp.labs.com is the URL of the Identity Server.
Limitations
Following are the limitations with the Persistent Authentication Class:
User is authenticated even if the password is changed.
If the user is already logged in with
Remember Me
option enabled, you will be unable to stop the session until the cookie expires.
RADIUS Authentication
RADIUS enables communication between remote access servers and a central server. Secure token authentication through RADIUS is possible because Access Manager works with Novell Modular
Authentication Service (NMAS) RADIUS software that can run on an existing NetWare server. Access
Manager supports both PIN and challenge-and-response methods of token-based authentication. In other words, RADIUS represents token-based authentication methods used to authenticate a user, based on something the user possesses (for example, a token card). Token challenge-response is supported for two-step processes that are necessary to authenticate a user.
1
In the Administration Console, click
Devices > Identity Server > Edit > Local > Classes
.
2
Click
New
.
3
Specify a display name, then select
RadiusClass
or
ProtectedRadiusClass
from the drop-down menu.
4
Click
Next
.
5
Click
New
to add an IP address for the RADIUS server. You can add additional servers for failover purposes.
6
Click
OK
.
7
Fill in the following fields:
Port:
The port of the RADIUS server.
Shared Secret:
The RADIUS shared secret.
Reply Time:
The total time to wait for a reply in milliseconds
Resend Time:
The time to wait in milliseconds between requests.
Server Failure Retry:
The time in milliseconds that must elapse before a failed server is retried.
Configuring Authentication
309
