- Book Information
- Preface
- Part I Planning the Overall Deployment
- Chapter 1 Seeing the Big Picture
- Chapter 2 Building the Deployment Architecture
- Chapter 3 Building the Implementation Plan
- Part II Determining Which Features to Deploy
- Chapter 4 Using a Policy Agent and the Client SDK
to Integrate Applications with OpenSSO Enterprise
- About the OpenSSO Enterprise Client SDK
- About the Centralized Policy Agent Configuration
- Analyzing the Deployment
- Considering Assumptions, Dependencies, and Constraints
- Understanding Typical Business Use Cases
- Setting Up and Configuring the Integrated Environment
- Evaluating Benefits and Tradeoffs
- Finding More Information
- Chapter 5 Using the OpenSSO Enterprise Fedlet to Enable
Identity Federation
- About the OpenSSO Enterprise Fedlet
- Analyzing the Deployment Architecture
- Considering Deployment Assumptions, Dependencies, and Constraints
- Understanding Typical Business Use Cases
- Setting Up and Configuring the Fedlet
- Evaluating Benefits and Tradeoffs
- Finding More Information
- Chapter 6 Implementing a Virtual Federation Proxy
(Secure Attributes Exchange)
- About Virtual Federation Proxy (Secure Attributes Exchange)
- Analyzing the Deployment
- Considering Assumptions, Dependencies, and Constraints
- Secure Attributes Exchange Client APIs
- Understanding Typical Business Use Cases
- Setting Up and Configuring Secure Attributes Exchange
- Configuring Secure Attributes Exchange
- Evaluating Benefits and Tradeoffs
- Chapter 7 Implementing a SAMLv2 Identity Provider
Proxy
- About the SAMLv2 Identity Provider Proxy Specification
- About the OpenSSO Enterprise Identity Provider Proxy
- Analyzing the Deployment Architecture
- Considering Assumptions, Dependencies, and Constraints
- Understanding Typical Business Cases
- Setting Up and Configuring SAMLv2 Identity Provider Proxy
- Evaluating Benefits and Tradeoffs
- Chapter 8 Using a Multi-Federation Protocol Hub
- Chapter 9 Enabling Web Services Federation Between Active Directory Federation Service and OpenSSO Enterprise
- Chapter 10 Securing Web Services Using ID-WSF (Liberty Alliance Specifications)
- Chapter 11 Securing Web Services Using the Security
Token Service (WS-* Specifications)
- About Web Services Security Models
- About OpenSSO Enterprise Web Services Security
- Analyzing the Deployment Architecture
- Understanding Typical Business Use Cases
- Considering Assumptions, Dependencies, and Constraints
- Setting Up and Configuring Web Services Security Using Security Token Service
- Evaluating Benefits and Tradeoffs
- Chapter 12 Enabling Single Sign-On Between Sun Identity
Manager and OpenSSO Enterprise
- About Sun Identity Manager
- Analyzing the Deployment Architecture
- Considering the Deployment Assumptions, Dependencies, and Constraints
- Understanding Typical Business Use Cases
- Setting Up and Configuring Single Sign-On Between Identity Manager and OpenSSO Enterprise
- Evaluating Benefits and Tradeoffs
- Finding More Information
- Chapter 13 Enabling Single Sign-On Using CA SiteMinder and OpenSSO Enterprise
- Chapter 14 Enabling Single Sign-On Using Oracle Access Manager and OpenSSO Enterprise
- Chapter 15 Using the Embedded Configuration Data Store for OpenSSO Enterprise
- Chapter 16 Implementing Cross-Domain Single Sign-On
with Cookie Hijacking Prevention
- About Cross-Domain Single Sign-On
- The Policy Agent's Role in CDSSO
- About Cookie Hijacking Prevention
- Analyzing the Deployment Architecture
- Considering Assumptions, Dependencies, and Constraints
- Understanding Typical Business Use Cases
- Java EE Policy Agent Use Case 1: Accessing a Protected Resource in the Primary Domain First
- Java EE Policy Agent Use Case 2: Accessing a Protected Resource in a Non-Primary Domain First
- Web Policy Agent Use Case 1: Accessing a Protected Resource in the Primary Domain First
- Web Policy Agent Use Case 2: Accessing a Protected Resource in the Non-Primary Domain First
- Configuring CDSSO and Cookie Hijacking Prevention
- Evaluating Benefits and Trade-offs
- Chapter 17 Configuring System Failover and Session
Failover for High Availability
- About High Availability
- Analyzing the Deployment Architecture
- Understanding High Availability Configuration
Examples
- Single OpenSSO Enterprise Server Load Balancer in Single Site, No Session Failover
- Multiple OpenSSO Enterprise Server Load Balancers in a Single Site, No Session Failover
- Multiple OpenSSO Enterprise Server Load Balancers in Multiple Sites, No Session Failover
- Single OpenSSO Enterprise Server Load Balancer in a Single Site with Session Failover
- Multiple OpenSSO Enterprise Server Load Balancers in a Single Site with Session Failover
- Multiple OpenSSO Enterprise Server Load Balancers in Multiple Sites with Session Failover
- Considering Assumptions and Dependencies
- Configuring OpenSSO Enterprise for High Availability
- Evaluating Benefits and Trade-Offs
- Chapter 18 Using the Windows Desktop Single Sign-On
Authentication Module
- About Kerberos Authentication and the SPNEGO Protocol
- About the OpenSSO Windows Desktop SSO Authentication Module
- Analyzing the Deployment Architecture
- Considering Dependencies and Constraints
- Understanding Typical Business Use Cases
- Evaluating Benefits and Tradeoffs
- Configuring Basic Windows Desktop SSO Authentication
- Configuring a Kerberos Domain Controller on Windows or UNIX
- To Configure a UNIX Kerberos Domain Controller
- To Configure Windows Active Directory and Domain Controller
- To Synchronize the OpenSSO Enterprise and Kerberos Domain Controller Clocks
- Configuring the Domain Controller
- To Configure an Windows XP Workstation to Join an Active Directory Domain Controller During Installation
- To Create the Windows XP User's Local Account
- To Configure an Existing Windows XP Workstation to Join an Active Directory Controller
- To Configure an Existing Window XP Workstation to Join a UNIX Kerberos Domain
- Configuring the Browser
- To Configure the OpenSSO Enterprise Windows Desktop SSO Authentication Module
- Complex Configurations
- Using the Debugging Tools
- Troubleshooting Windows Desktop SSO Authentication
Issues
- Error Message: Unauthorized Access
- Error Message: Service Login Error
- LoginException: Clock skew too great
- LoginException: kdc.example.com
- LoginException: Client not found in Kerberos database
- GSSException: Failure unspecified at GSS-API level
- Exception: Pre-authentication information was invalid
- Error Message: Cannot establish context
- Error Message: Authentication failed
- Error Message: User has no profile in this organization
- Authentication Doesn't Work with Load Balancer
- Chapter 19 Accessing OpenSSO from Outside a Secure Intranet
- Chapter 4 Using a Policy Agent and the Client SDK
to Integrate Applications with OpenSSO Enterprise