Product Guide McAfee Cloud Identity Manager version 3.5 COPYRIGHT Copyright © 2013 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS McAfee®, the McAfee logo, Avert, ePO, ePolicy Orchestrator, Foundstone, GroupShield, IntruShield, LinuxShield, MAX (McAfee SecurityAlliance Exchange), NetShield, PortalShield, Preventsys, SecureOS, SecurityAlliance, SiteAdvisor, SmartFilter, Total Protection, TrustedSource, Type Enforcement, VirusScan, and WebShield are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANTOR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Cloud Identity Manager 3.5 Product Guide Contents 1.0 Introduction to McAfee Cloud Identity Manager ........................................................ 9 1.1 Extensible Framework ......................................................................................... 9 1.2 Web Single Sign On (SSO) ..................................................................................10 1.3 Multiple Authentication Methods...........................................................................11 1.4 Credential Mapping and User Provisioning .............................................................12 1.5 Authorization Policies and Access Control Enforcement............................................12 1.6 Event Auditing and Monitoring .............................................................................13 1.7 Cloud Connector Options ....................................................................................14 1.8 Web-based Management Console.........................................................................14 1.9 Supported Environments ....................................................................................15 1.10 Supported Browsers...........................................................................................15 1.11 Available Documentation ....................................................................................16 1.12 Technical Support ..............................................................................................16 2.0 Getting Started with the Management Console.........................................................17 2.1 The Login Page..................................................................................................17 2.2 Cloud Identity Manager Version Information ..........................................................18 2.3 The Management Console Dashboard ...................................................................19 2.4 Management Console — Configuration Tabs (A) .....................................................20 2.4.1 Cloud Connectors Tab .............................................................................20 2.4.2 Application Adapters Tab .........................................................................22 2.4.3 Logs Tab ...............................................................................................22 2.4.4 Monitoring Tab .......................................................................................23 2.4.5 Addons Tab............................................................................................23 2.4.6 Admin Tab .............................................................................................24 2.5 Management Console — Cloud Connectors (B) .......................................................26 2.5.1 Cloud Connectors — Carousel View ...........................................................27 2.5.2 Cloud Connectors — List View...................................................................28 2.5.3 Cloud Connectors — Management Options .................................................28 2.6 Management Console — System Snapshots (C) .....................................................32 2.7 Management Console — Quick Access (D) .............................................................33 2.8 Configuration Wizards ........................................................................................36 3.0 Cloud Connectors .....................................................................................................37 3.1 Understanding the Cloud Connector Types ............................................................38 3.1.1 Built-in and Plug-in Cloud Connectors ........................................................38 3.2 Viewing the Built-in Cloud Connector Types...........................................................39 3.3 Viewing the Plug-in Cloud Connector Types ...........................................................40 3.4 Cloud Connector Reference .................................................................................41 4.0 Identity Connectors .................................................................................................53 4.1 Authentication Types..........................................................................................53 4.2 Authentication Chain Identity Connector ...............................................................54 4.3 External Configuration and Additional Considerations..............................................55 4.4 View All Configured Identity Stores ......................................................................55 4.5 View All Configured Identity Connectors................................................................56 4.6 How to Select the Identity Connector Type............................................................57 4.7 Create an LDAP Identity Store .............................................................................58 4.8 Create an Active Directory Identity Store ..............................................................59 4.9 Create an Identity Connector...............................................................................63 4.9.1 Configure an Authentication Chain Identity Connector..................................64 4.9.2 Configure a CAS Identity Connector ..........................................................65 4.9.3 Configure an ECA360 Token Identity Connector ..........................................66 4.9.4 Configure an IWA-AD Identity Connector ...................................................69 4.9.5 Configure an LDAP Identity Connector .......................................................71 4.9.6 Configure a SAML2 Proxy Identity Connector ..............................................72 4.10 User Provisioning...............................................................................................74 McAfee Cloud Identity Manager 3.5 Product Guide 3 5.0 Authentication Chains ..............................................................................................75 5.1 Creating Authentication Chains in the Management Console ....................................75 5.2 Authentication Modules.......................................................................................76 5.3 Select the Authentication Module Type..................................................................77 5.3.1 Authentication Methods Available for Primary Authentication ........................78 5.3.2 Authentication Methods Available for Secondary Authentication.....................80 5.4 Customizing the Authentication Module Login Page.................................................80 5.4.1 Customize a JDBC or LDAP Login Page.......................................................81 5.4.2 Customize an OTP or OTP Self-service Login Page .......................................82 5.4.3 Customize a Combined LDAP and OTP Login Page .......................................84 5.5 Configuring the Authentication Module Options ......................................................86 5.5.1 Configure a JDBC Authentication Module ....................................................87 5.5.2 Configure an OpenID Authentication Module ...............................................88 5.5.3 Configure a Facebook Authentication Module ..............................................91 5.5.4 Configure a LinkedIn Authentication Module ...............................................92 5.5.5 Configure a Twitter Authentication Module .................................................93 5.5.6 Configure an ECA360 Token Authentication Module .....................................94 5.5.7 Configuring a SAML2 Authentication Module ...............................................95 5.5.8 Configure a Salesforce Authentication Module ........................................... 102 5.5.9 Configure an IWA Authentication