The following prerequisites apply:

• Install Identity Manager
• You must have access to any required external systems, for example LDAP or SAML Identity provider (IDP).

• For client certificate authentication, a working HTTPS configuration with client authentication on the Tomcat is required. See Configure https for Tomcat.

• For SAML authentication, it is required to have an identity provider, such as Smart ID Digital Access component (Hybrid Access Gateway), with the correct configuration for Identity Manager authentication. For information and examples with Digital Access, see Enable two-factor authentication to Identity Manager clients via SAML federation.

1. Log in to Identity Manager Admin as an admin user.

To set up an authentication profile:

1. Go to Home > Authentication Profiles.
2. Click +New to add an authentication profile.

   1. Select a Profile type:
      Image Added

      Note
      The Internal profile is not available for selection, since it is created by default in any Identity Manager installation and only one internal profile is allowed.

      
      

   2. Enter a unique Priority number.
   3. Click Save + Edit.
      
      A new tab is displayed where the authentication profile is configured. See the following sections for how to configure the authentication profile you have selected.
3. To edit an existing identity template, double-click on its name.
   

No further configuration required.

1. In Certificate settings: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email

1. In Connection settings:

   1. In Connection string, enter the URL of the LDAP server and base address in the directory service, for example:

      Panel
      title Example: Connection string
      Connection string: ldap://localhost:389/ou=NexusEmployees,dc=nexus,dc=local

      where

      ou = organizationalUnitName
      dc = domainComponent
      
      For more information on LDAP string attributes, see RFC 2253, LDAP (v3): UTF-8 String Representation of Distinguished Names.

   2. In Username and Password, enter the Active Directory domain user name and password. 
2. In User search:
   1. Select Direct binding or With password comparison. Direct binding attempts to bind to the LDAP with the user entered. With password comparison the data of the LDAP entry is retrieved and the password is compared with the entered password.

   2. Enter a Search pattern. Here are two examples:

      Panel
      title Example: Search pattern
      Search pattern: (userPrincipalName={0})

      
      

      Panel
      title Example: Search pattern using Distinguished Name (DN) of user
      Search pattern: cn={0},ou=users

      
      

   3. If password comparison was selected, enter the Attribute for password used in LDAP and, if applicable, the mechanism that LDAP uses for Password encryption.
3. In Group search:

   1. In Basis for group search, enter the subpath to the group information in LDAP.
      For example, if you find the group information under ou = groups, dc = myCompany, dc = de, enter the following:

      Panel
      title Example: Basis for group search
      Basis for group search: ou=groups

      
      

   2. In Filter for group search, enter a filter expression, that defines the search starting with the subpath above.
      

      For example, if the group membership of users is stored in a multi-value attribute member (via the DN), enter the following:

      Panel
      title Example: Filter for group search
      Filter for group search: (member={0})

      
      

   3. In Attribute for group, enter an attribute with unique values to define the group belonging. The groups to which the user belongs are compared in the last step with the assignment to the roles in the system and access to the system is assigned based on the assigned roles.

      For example, enter the following:

      Panel
      title Example: Attribute for group
      Attribute for group: cn

      
      

4. Group Permissions
   1. Go to the LDAP Group Permissions tab to map the LDAP groups to internal Identity Manager roles.
   2. Click + to add an LDAP group to the Groups list
   3. Select the roles that should be assigned to that LDAP group in the Roles list.
      
      

1. In Connection settings:

   1. In Connection string, enter the URL of the LDAP server and base address in the directory service, for example:

      Panel
      title Example: Connection string
      Connection string: ldap://localhost:389/ou=NexusEmployees,dc=nexus,dc=local

      where

      ou = organizationalUnitName
      dc = domainComponent
      
      For more information on LDAP string attributes, see RFC 2253, LDAP (v3): UTF-8 String Representation of Distinguished Names.

   2. In Username and Password, enter the Active Directory domain user name and password. 
2. In User search:
   1. Select Direct binding or With password comparison. Direct binding attempts to bind to the LDAP with the user entered. With password comparison the data of the LDAP entry is retrieved and the password is compared with the entered password.

   2. Enter a Search pattern. Here are two examples:

      Panel
      title Example: Search pattern
      Search pattern: (userPrincipalName={0})

      
      

      Panel
      title Example: Search pattern using Distinguished Name (DN) of user
      Search pattern: cn={0},ou=users

      
      

   3. If password comparison was selected, enter the Attribute for password used in LDAP and, if applicable, the mechanism that LDAP uses for Password encryption.
3. In User identification: enter details to map the userPrincipalName to a core object. 
   
   1. In Identity template, select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used.
      
   2. In User name field, select the core object field to match the user principal, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
      
   3. In User display, enter fields in a comma separated list, for example FirstName, LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. In Certificate settings: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email
2. In User identification: enter details to map the userPrincipalName to a core object.
   
   1. In Identity template, select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used.
      
   2. In User name field, select the core object field to match the user, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
      
   3. In User display, enter fields in a comma separated list, for example FirstName,LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. In Certificate settings: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email
2. In User identification: enter details to map the userPrincipalName to a core object.
   

1. In Certificate settings: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email
2. In User identification:
   1. In Identity template,  select select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used.
      
   2. In User name field, select the core object field to match the user, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
      
   3. In User display, enter fields in a comma separated list, for example FirstName,LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. 1. .
      
   2. In User name field, select the core object field to match the user, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
      
   3. In User display, enter fields in a comma separated list, for example FirstName,LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. In User identification: enter details to map the userPrincipalName to a core object.In User identification: enter details to map the userPrincipalName to a core object
   1. In Identity template, select  select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used.
      
   2. In User name field, select the core object field to match the username, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
   3. In Password field, select the core object field to match the user, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
      
   4. In User display, enter fields in a comma separated list, for example FirstName,LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. 1. the core object field holding the password, for example PasswordHash.
      
   2. In User display, enter fields in a comma separated list, for example FirstName,LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. Prepare the required SAML configuration files. For file examples, refer to Enable two-factor authentication to Identity Manager clients via SAML federation.
   1. You need one metadata file for each Service Provider, that is, one file for Identity Manager operator UI, one file for Smart ID Self-Service and one file for other Service Providers that you configure.
   2. You also need the metadata file of your Identity Provider and a keystore containing all the keys you would like to use for encryption or signing.

2. 
   

   Excerpt
   Go to the General tab and do the following settings: In User identification, select SAML SSO Core Object. In Identity template, select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used. In User name field,

    

   select

   the

   the core object field to match the

   username

   user principal, for example UPN or Email. Identity Manager will use it to search

   the core object in the selected identity template.In Password field, select

   the core object

   field holding the password, for example PasswordHash

   in the selected identity template. In User display, enter fields in a comma separated list, for example FirstName, LastName. These fields are used to display the logged in user in Identity Manager operator UI or Smart ID Self-Service.

1. Go to the General tab.
   1. Check Activate SAML Authentication.
      With this switch you decide if SAML authentication should be used or not. This switch is disabled by default.
   2. In User identification, select SAML SSO LDAP.
2. Go to the SAML Configuration tab.
   1. Do the same settings as described above under heading "Configure SAML SSO Core Object profile".
3. Go to the LDAP Configuration tab.

   1. If you have already a configured LDAP profile, copy the information to here. See heading "Configure LDAP profile" above.
      

      Note
      The Direct binding and With password comparison selection are NOT used for the SAML SSO LDAP profile.

      
      

4. Go to the LDAP Group Permissions tab.
   1. See under heading "Configure LDAP profile" above.

Using the correct URL, the desired authentication method can be called directly. You need to give a valid tenant ID (language will depend on browser language).

Read more under headings "Login" and "Admin page" in Identity Manager Operator.

Authentication method Certificate

Use this URL: https://<idmhost>:<idmPort>/<idmApplicationName>/cert/login?tenantId=X  (Example: https://localhost:8444/idm-admin/cert/login?tenantId=32768)

The port (default is 8444) must be configured in system.properties.

Authentication method SAML

Use this URL: https://<idmhost>:<idmPort>/<idmApplicationName>/saml/login?tenantId=X (Example: http://localhost:8080/idm/saml/login?tenantId=1)

Validate tenant id

You can use the flag "tenantContextFilter.shouldValidateTenant" in system.properties of Identity Manager for validation of the tenant id:

• If set to true, an error page is shown when selected tenant (passed in the URL) does not exist.
• If set to false, the user will be redirected to the login page.
• Default: tenantContextFilter.shouldValidateTenant=false