Authentication Domains

An authentication domain is a federation of any number of service providers (and at least one identity provider) with whom principals can transact business in a secure and apparently seamless environment. (The members of the domain must have previously established a circle of trust based on the Liberty Alliance Project architecture and operational agreements.)

An authentication domain is not a domain in the domain name system (DNS) sense of the word.

The following procedures describe how to create, configure, and delete authentication domains using the Access Manager Console.

• To Create An Authentication Domain

• To Configure or Modify an Authentication Domain

• To Delete an Authentication Domain

To Create An Authentication Domain

1. In the Access Manager Console, click the Federation tab.

2. Under Federation, select the Authentication Domains tab.

3. Select New.

   The New Authentication Domain attributes are displayed.

4. Type a name for the authentication domain.

5. (Optional) Type a description of the authentication domain in the Description field.

6. (Optional) Type a value for the Writer Service URL.

   The Writer Service URL specifies the location of the service that writes the common domain cookie. Use the format http://common-domain-host:port/common/writer. For more information about the Common Domain Services, see Chapter 4, Common Domain Services for Federation Management.

7. (Optional) Type a value for the Reader Service URL.

   The Reader Service URL specifies the location of the service that reads the common domain cookie. Use the format http://common-domain-host:port/common/transfer. For more information about the Common Domain Services, see Chapter 4, Common Domain Services for Federation Management.

8. Select Active or Inactive.

   The default status is Active. Selecting Inactive disables communication within the authentication domain.

9. Click OK.

   The new authentication domain is now displayed in the list of configured Authentication Domains.

To Configure or Modify an Authentication Domain

1. In the Access Manager Console, click the Federation tab.

2. Under Federation, select the Authentication Domains tab.

   All created Authentication Domains are displayed.

3. Click the name of the authentication domain that you want to modify.

   The General and Providers properties for the authentication domain are displayed.

4. (Optional) Enter or modify a description of the authentication domain in the Description field.

5. (Optional) Enter or modify the value for the Writer Service URL.

   The Writer Service URL specifies the location of the service that writes the common domain cookie. Use the format http://common-domain-host:port/common/writer. For more information on the Common Domain Services, see Chapter 4, Common Domain Services for Federation Management.

6. (Optional) Enter or modify the value for the Reader Service URL.

   The Reader Service URL specifies the location of the service that reads the common domain cookie. Use the format http://common-domain-host:port/common/transfer. For more information on the Common Domain Services, see Chapter 4, Common Domain Services for Federation Management.

7. Select Active or Inactive.

   The default status is Active. Selecting Inactive disables communication within the authentication domain.

8. Click Add to populate the authentication domain with providers.

   The Trusted Providers page is displayed.

9. Choose from the list of Available Providers and click Add.

10. Click OK to save the providers to the authentication domain.

    The authentication domain's attribute page is displayed.

11. Click Save to complete the configuration.

To Delete an Authentication Domain

Deleting an authentication domain does not delete the providers that belong to it although it will impact the trusted relationship.

1. In the Access Manager Console, click the Federation tab.

2. Under Federation, select the Authentication Domains tab.

   All created Authentication Domains are displayed.

3. Select the check box next to the authentication domain that you want to delete.

4. Click Delete.