User manual NOVELL ACCESS MANAGER 3.1 SP3 GATEWAY GUIDE

[. . . ] novdocx (en) 16 April 2010 AUTHORIZED DOCUMENTATION Access Gateway Guide Novell® 3. 1 SP3 February 02, 2011 Access Manager www. novell. com Novell Access Manager 3. 1 SP3 Access Gateway Guide novdocx (en) 16 April 2010 Legal Notices Novell, Inc. , makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc. , makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. [. . . ] If the browser can establish an SSL connection, the session continues on the secure port. If the browser cannot establish an SSL connection, the session is terminated. If you do not select the Redirect Requests from Non-Secure Port to Secure Port option, this port is not used when SSL is enabled. IMPORTANT: If you select not to redirect HTTP requests (port 80) and your Access Gateway has only one IP address, do not use port 80 to configure another reverse proxy. Although it is not used, it is reserved for this reverse proxy. Secure Port: Specifies the port on which to listen for HTTPS requests (usually 443). This port needs to match the configuration for SSL. If SSL is enabled, this port is used for all communication with the browsers. The listening address and port combination must not match any combination you have configured for another reverse proxy or tunnel. 7 On the Configuration page, click Reverse Proxy / Authentication. 8 (Conditional) If you are using an externally signed certificate for the Identity Server cluster, you need to import the public key of the CA: 8a In the Embedded Service Provider section, click Auto-Import Identity Server Trusted Root, then click OK. Configuring the Access Gateway for SSL and Other Security Features 123 novdocx (en) 16 April 2010 8b Specify an alias, click OK twice, then click Close. This option imports the public key of the Identity Server into the trust store of the Embedded Service Provider. This sets up a trusted SSL relationship between the Embedded Service Provider and the Identity Server. The configCA public key certificate of the Access Manager CA is automatically added to the ESP Trust Store. If you are using Access Manager CA certificates for the Identity Server, you do not need to import the configCA certificate unless someone has deleted it from this trust store. 10 On the Server Configuration page, click OK. 11 On the Access Gateways page, click Update > OK. The Embedded Service Provider is restarted during the update. 12 Update the Identity Server so that it uses the new SSL configuration. 13 Verify that the trusted relationship between the Identity Server and the Access Gateway has been reestablished. 13a Enter the URL to a protected resource on the Access Gateway. 13b Complete one of the following: If you are prompted for login credentials, enter them. [. . . ] If the resource has not been configured for non-redirected login, the Access Gateway continues with the tasks outlined in Figure 8-7 on page 279. If the resource has been configured for non-redirected login, the Access Gateway needs to examine the request for an authentication header and determine whether the header is valid. Processing continues with the tasks outlined in decision points 9a, 9b, and 9c. If the request does not contain an authentication header, the Access Gateway needs to determine how non-redirected login has been configured. [. . . ]