Contents


About This Guide

About Identity Server 6.0
What You Are Expected to Know
Sun ONE Identity Server Documentation Set
Documentation Conventions Used in This Guide

Typographic Conventions
Terminology

Related Information

Part 1 Identity Server Console Guide

Chapter 1 Product Overview

Sun ONE Identity Server
Features of Identity Server

Service Configuration
Policy Management
SAML
Federation Management
Authentication
Single Sign-On
URL Policy Agents
Identity Management
Identity Server Console

Installing Identity Server
The Identity Server Console

Location Pane
Navigation Pane
Data Pane

Chapter 2 Identity Management

The Identity Management Interface

Identity Management View
User Profile View

Managing Identity Server Objects

Properties Function
Organizations

Create an Organization
Delete an Organization
Add an Organization to a Policy

Groups

Create a Managed Group
Delete a Managed Group
Add a Group to a Policy

Users

Create a User
Add a User to Services, Roles and Groups
Delete a User
Add a User to a Policy

Services

Register a Service
Create a Template for a Service
Unregister a Service

Roles

Create a Role
Delete a Role
Add Users to a Role
Remove Users from a Role
Add a Role to a Policy

Role Properties View

Customize Service Access
Customize Attribute Access

Policies
Containers

Create a Container
Delete a Container

People Containers

Create a People Container
Delete a People Container

Group Containers

Create a Group Container
Delete a Group Container

Chapter 3 Service Configuration

Definition of a Service
Identity Server Services Defined

Administration
Authentication

Anonymous
Certificate-based
Core
LDAP
Membership (Self-Registration)
NT
RADIUS
SafeWord
Unix

Authentication Configuration
Client Detection
Logging
Naming
Platform
Policy Configuration
SAML
Session
User
Identity Server Security Service

Attribute Types

Dynamic Attributes
User Attributes
Organization Attributes
Global Attributes
Policy Attributes

Service Configuration Interface

Chapter 4 Current Sessions

The Current Sessions Interface

Session Management Pane
Session Information Window
Terminating a Session

Chapter 5 Federation Management

Liberty Alliance and Federated Identity
Federation Management Concepts

The Liberty Alliance Project

Federation Management Process
Managing Authentication Domains and Providers

Authentication Domains

Creating An Authentication Domain
Modifying An Authentication Domain
Deleting An Authentication Domain

Providers

Creating Remote Providers
Modifying Remote Providers
Creating Hosted Providers
Modifying Hosted Providers
Deleting Providers

Chapter 6 Policy Management

What is a Policy?
Policy Types

Normal Policy
Referral Policy

Policy Management

Registering Policy Configuration Services
Creating Policies
Modifying Policies

Modify a Normal Policy
Modify a Referral Policy

Creating Policies for Peer and Suborganizations

Chapter 7 Authentication Options

Core Authentication

To Register and Enable the Core Service

Anonymous Authentication

To Register and Enable Anonymous Authentication
Logging In Using Anonymous Authentication

Certificate-based Authentication

To Register and Enable Certificate-based Authentication
Logging In Using Certificate-based Authentication

LDAP Directory Authentication

To Register and Enable LDAP Authentication
Logging In Using LDAP Authentication
Enabling LDAP Authentication Failover

Membership Authentication

To Register and Enable Membership Authentication
Logging In Using Membership Authentication

NT Authentication

To Register and Enable NT Authentication
Logging In Using NT Authentication

RADIUS Server Authentication

To Register and Enable RADIUS Authentication
Logging In Using RADIUS Authentication

SafeWord Authentication

To Register and Enable SafeWord Authentication
Logging In Using SafeWord Authentication

Unix Authentication

To Register and Enable Unix Authentication
Logging In Using Unix Authentication

Authentication Configuration

Authentication Configuration User Interface
Authentication Configuration for Organizations
Authentication Configuration for Roles
Authentication Configuration for Services
Authentication Configuration for Users

Authentication By Authentication Level
Authentication By Module

Part 2 Command Line Reference Guide

Chapter 8 The amadmin Command Line Tool

The amadmin Command Line Executable

The amadmin Syntax

amadmin Options

Creating Policies with amadmin

Chapter 9 The amserver Command Line Tool

The amserver Command Line Executable

amserver Syntax

amserver Commands for Solaris
amserver Commands for Windows 2000

Using amserver for Multi-Server Installer Administration

Chapter 10 The ampassword Command Line Tool

The ampassword Command Line Executable

The ampassword Syntax

ampassword Options

Running ampassword on SSL

Chapter 11 The am2bak Command Line Tool

The am2bak Command Line Executable

The am2bak Syntax

am2bak Options
Backup Procedure

Chapter 12 The bak2am Command Line Tool

The bak2am Command Line Executable

The bak2am Syntax

bak2am Options

Chapter 13 The VerifyArchive Command Line Tool

The VerifyArchive Command Line Executable

VerifyArchive Syntax

VerifyArchive Options

Part 3 Attribute Reference Guide

Chapter 14 Administration Attributes

Global Attributes

Enable Federation Management
Enable User Management
Show People Containers
Display Containers In Menu
Show Group Containers
Managed Group Type
Default Role Permissions (ACIs)

No Permissions
Organization Admin
Organization Help Desk Admin
Organization Policy Admin

Domain Component Tree Enabled
Admin Groups Enabled
Compliance User Deletion Enabled
Dynamic Admin Roles ACIs

Container Help Desk Admin
Organization Help Desk Admin
Container Admin
Organization Policy Admin
People Container Admin
Group Admin
Top-level Admin
Organization Admin

User Profile Service Classes

Organization Attributes

Groups Default People Container
Groups People Container List
User Profile Display Class
Display User's Roles
Display User's Groups
User Group Self Subscription
User Profile Display Options
User Creation Default Roles
View Menu Entries
Maximum Results Returned From Search
Timeout For Search (sec.)
JSP Directory Name
Online Help Documents
Required Services
User Search Key
User Search Return Attribute
User Creation Notification List
User Deletion Notification List
User Modification Notification List
Maximum Entries Per Page

Chapter 15 Anonymous Authentication Attributes

Authentication Level
Valid Anonymous User List
Default Anonymous User Name

Chapter 16 Certificate Authentication Attributes

Match Certificate in LDAP
Attribute In Subject DN To Use To Search LDAP
Match Certificate to CRL
Attribute In Issuer DN To Use To Search CRL
Enable OCSP Validation
LDAP Server and Port
LDAP Start Search DN
LDAP Server Principal User
LDAP Server Principal Password
LDAP Attribute for Profile ID
SSL On For LDAP Access
Field in Cert to Use to Access User Profile
Other Field In Cert To Use To Access User Profile
Authentication Level

Chapter 17 Core Authentication Attributes

Global Attributes

Pluggable Auth Module Classes
Supported Auth Modules for Clients
LDAP Connection Pool Size
LDAP Connection Default Pool Size

Organization Attributes

Organization Authentication Modules
User Profile
Admin Authenticator
User Profile Dynamic Creation Default Roles
Persistent Cookie Mode
Persistent Cookie Max Time (seconds)
People Container For All Users
Alias Search Attribute Name
Default Auth Level
User Naming Attribute
Default Auth Locale
Organization Authentication Configuration
Login Failure Lockout Mode
Login Failure Lockout Count
Login Failure Lockout Interval (minutes)
Email Address to Send Lockout Notification
Warn User After N Failure
Login Failure Lockout Duration (minutes)
Lockout Attribute Name
Lockout Attribute Value
Default Success Login URL
Default Failure Login URL
Authentication PostProcessing Class
User Name Generator Mode
Pluggable User Name Generator Class

Chapter 18 LDAP Authentication Attributes

Primary LDAP Server and Port
Secondary LDAP Server and Port
DN to Start User Search
DN for Root User bind
Password for Root User Bind
Password For Root User Bind (Confirm)
User Naming Attribute
User Entry Search Attributes
User Search Filter
Search Scope
Enable SSL to LDAP Server
Return User DN To Auth
Authentication Level

Chapter 19 Membership Authentication Attributes

Minimum Password Length
Default User Roles
User Status After Registration
Primary LDAP Server and Port
Secondary LDAP Server and Port
DN to Start User Search
DN for Root User bind
Password for Root User Bind
Password for Root User Bind (Confirm)
User Naming Attribute
User Entry Search Attributes
User Search Filter
Search Scope
Enable SSL to LDAP Server
Return User DN To Auth
Authentication Level

Chapter 20 NT Authentication Attributes

NT Authentication Domain
NT Authentication Host
NT Module Authentication Level

Chapter 21 RADIUS Authentication Attributes

RADIUS Server 1
RADIUS Server 2
RADIUS Shared Secret
RADIUS Shared Secret (Confirm)
RADIUS Server's Port
Authentication Level
Timeout (Seconds)

Chapter 22 SafeWord Authentication Attributes

SafeWord Server Specification
SafeWord System Name
SafeWord Server Verification Files Path
SafeWord Logging Level
SafeWord Log Path
SafeWord Module Authentication Level

Chapter 23 Unix Authentication Attributes

Global Attributes

Unix Helper Configuration Port
Unix Helper Authentication Port
Unix Helper Timeout (Minutes)
Unix Helper Threads

Organization Attribute

Unix Module Authentication Level

Chapter 24 Authentication Configuration Attributes

Authentication Configuration
Login Success URL
Login Failure URL
Authentication Post Processing Class
Conflict Resolution Level

Chapter 25 Client Detection Attributes

Client Types
Default Client Type
Client Detection Class
Client Detection Enabled

Chapter 26 Logging Attributes

Max Log Size
Number of History Files
Log Location
Logging Type
Database User Name
Database User Password
Database User Password (Confirm)
Database Driver Name
Configurable Log Fields
Log Verification Time
Log Signature Time
Secure Logging
Maximum Number of Records
Remote Buffer Size
Number Of Files Per Archive

Chapter 27 Naming Attributes

Profile Service URL
Session Service URL
Logging Service URL
Policy Service URL
Auth Service URL
SAML Web Profile/Artifact Service URL
SAML SOAP Service URL
SAML Web Profile/POST Service URL
SAML Assertion Manager Service URL

Chapter 28 Platform Attributes

Server List
Platform Locale
Cookie Domains
Login Service URL
Logout Service URL
Available Locales
Client Char Sets

Chapter 29 Policy Configuration Attributes

Global Attribute

Resource Comparator

Organization Attributes

LDAP Server and Port
LDAP Base DN
LDAP Bind DN
LDAP Bind Password
LDAP Bind Password (Confirm)
LDAP Org Search Filter
LDAP Org Search Scope
LDAP Groups Search Filter
LDAP Groups Search Scope
LDAP Users Search Filter
LDAP Users Search Scope
LDAP Roles Search Filter
LDAP Roles Search Scope
LDAP Organization Search Attribute
LDAP Groups Search Attribute
LDAP Users Search Attribute
LDAP Roles Search Attribute
Maximum Results Returned From Search
Timeout For Search (seconds)
LDAP SSL Enabled
LDAP Connection Pool Minimal Size
LDAP Connection Pool Maximum Size
Selected Policy Subjects
Selected Policy Conditions
Selected Policy Referrals
Subjects Result Time To Live

Chapter 30 SAML Attributes

Site ID And Site Issuer Name
Sign Request
Sign Response
Sign Assertion
Artifact Name
Target Specifier
Artifact Timeout (seconds)
Assertion Skew Factor For notBefore Time
Assertion Timeout (seconds)
Trusted Partner Sites
POST To Target URLs

Chapter 31 Session Attributes

Max Session Time (Minutes)
Max Idle Time (Minutes)
Max Caching Time (Minutes)

Chapter 32 User Attributes

User Attributes

User Preferred Language
User Preferred Timezone
Inherited Locale
Admin DN Starting View
Default User Status

User Profile Attributes

First Name
Last Name
Full Name
Password
Password (Confirm)
Email Address
Employee Number
Telephone Number
Home Address
User Status
Account Expiration Date
User Authentication Configuration
User Alias List
Preferred Locale
Success URL
Failure URL

Unique User IDs

Chapter 33 Identity Server Security Service Attributes

Enrollment URL
Inherited Country

Appendix A Configuring Identity Server in SSL Mode Index