Version 9.5 SP1	SEARCH   CONTENTS   |   PDF BOOKS   |   HOME   UP   PREV   NEXT

Integrated Authentication Framework allows for flexible creation, configuration, and usage of different authentication scenarios (IAF services) using System Management Hub web interface or a console window. By default, the installation of IAF does not create default authentication scenarios (IAF services) that can be used directly after install. In general, the authentication scenarios are defined in separate directories (within the IAF service directory) that contain IAF attribute files. On the other hand, the IAF attribute files comprise sets of properties that control the specifics of a particular IAF service. You create IAF services by creating the separate directories and the corresponding attribute files manually on the file system or using SMH web interface.

For more information about the properties of the IAF attributes files, see the Integrated Authentication Framework Attributes section within this chapter. In addition, more information about some commonly used authentication scenarios and the corresponding attribute file settings is given in the Integrated Authentication Framework Samples section of the reference documentation.

This document covers the following topics that describe how you can create, configure and manage authentication scenarios:

• Creating IAF Services

• Creating IAF Services Using System Management Hub

• UNIX Environment Prerequisites and Settings

• Starting IAF Services Using a Console Window

• Starting IAF Services Using System Management Hub

• Displaying IAF Service Logging Information

• Integrated Authentication Framework Attributes

See also Integrated Authentication Framework Tools.

Creating IAF Services

If you did not install System Management Hub as an administration console of your Integrated Authentication Framework, you can create and configure an IAF service (authentication scenario) manually on the file system.

To create an IAF service manually

1. Open the IAF services directory on the file system.

   Software AG_directory\iaf\service

2. Create a directory in the service directory and provide a name in capital letters.

   For example: "IAFCUSTOM"

3. Copy the iafnnn.atr attribute file from the service directory into the new directory and change its name.

   Note:
   The attribute file name must be the same as the name of the directory in which it resides.

   For example: "IAFCUSTOM.atr"

4. Open the newly created file for editing and change the BROKER-ID = IAFnnn to BROKER-ID = <IAF_Service_Directory_Name>.

   For example: "BROKER-ID = IAFCUSTOM"

5. Configure the other settings in the attribute file depending on the authentication you want to perform.

   For more information about the IAF attributes, see Integrated Authentication Framework Attributes

6. Save your changes and close the file.

Creating IAF Services Using System Management Hub

If you installed System Management Hub as an administration console of your Integrated Authentication Framework, you can create and configure an IAF service (authentication scenario) on the SMH web interface.

To create an IAF service in SMH

1. Open a web browser and start SMH web interface.

   http://localhost:<port_number>/smh

   Note:
   The default SMH port number is 10010. If you specified an alternative SMH port number during the installation, use the alternative port number instead.

2. Log on using the account with which you installed IAF.

3. On the tree that opens on the left hand-side of the System Management panel, navigate to: Managed Hosts > <host_name> > Integrated Authentication Framework > Integrated Authentication Framework Service.

4. Right click Integrated Authentication Framework Service

5. From the context menu, choose Add Service.

6. On the Add Service window, enter the following information:

   • Service Name

     Enter an IAF service name using capital letters only.

   • TCP Service Port Number

     SSL Port Number

     Specify the SSL port and the TCP port that is used for administrative purposes. Security-related communication is only available via the SSL port (with the exception of a local NET communication on z/OS)

   As a result, System Management Hub creates a directory with the IAF service name in the Software AG_directory\iaf\service\ directory.

7. Right click the newly created IAF service in the tree view on the left pane.

8. From the context menu, choose Edit attribute file.

9. Complete the configuration of IAF, mainly to point to the user repository of your choice, which will be used for the authentication requests.

   Note:
   You can modify the attributes of the newly created IAF service by editing the corresponding attribute file on the local file system. You can find the file in the following directory: Software AG_directory\iaf\service\new_service_directory\new_service_directory.atr.

UNIX Environment Prerequisites and Settings

Before every manual start of Integrated Authentication Framework (without SMH) on UNIX based operating systems, you need to set some shell environment variables. The installation generates the Bourne shell script iaf_setenv.sh in the Software AG_directory/conf. Execute the shell script with the user with which you installed IAF.

The iaf_setenv.sh script defines the following mandatory product-specific global shell environment variables:

In addition iaf_setenv.sh modifies the PATH environment variable.

• directory $IAFDIR/$IAFVERS/bin is added to the list of directories in the PATH environment variable

See iaf_setenv.sh for a complete set of environment settings.

Starting IAF Services Using a Console Window

You can start (or stop) an IAF service using any of the instructions sets below:

Note:
On UNIX based operating systems, you must start the iaf_setenv.sh shell script before you start the IAF service. For more information, see UNIX Environment Prerequisites and Settings.

To start (or stop) an IAF service from within the services directory

1. Start a console window and open the following directory:

   Software AG_directory\iaf\service\service_directory

2. Start the IAF service using the following commands depending on the operating system:

   • Windows

     ..\..\bin\iafnuc.exe -a <attribute_file_name>.atr

     For example: ..\..\bin\iafnuc.exe -a IAFCUSTOM.atr

   • UNIX

     ../../bin/iafnuc -a <attribute_file_name>.atr

     For example: ../../bin/iafnuc -a IAFCUSTOM.atr

3. To stop an IAF service, execute the following commands depending on the operating system:

   • Windows

     Close the console window or press CTRL+C.

   • UNIX

     kill -2 procID

To start (or stop) an IAF service from within the bin directory

1. Start a console window and open the following directory:

   Software AG_directory\iaf\bin

2. Start the IAF service using the following commands depending on the operating system:

   • Windows

     iafstart.bat <service_directory_name>

     For example: iafstart.bat IAFCUSTOM

   • UNIX

     sh iafstart <service_directory_name>

     For example: sh iafstart IAFCUSTOM

3. To stop an IAF service, execute the following commands depending on the operating system:

   • Windows

     iafstop.bat <service_directory_name>

     For example: iafstop.bat IAFCUSTOM

   • UNIX

     sh iafstop <service_directory_name>

     For example: sh iafstop IAFCUSTOM

Starting IAF Services Using System Management Hub

To start (or stop) the IAF service using SMH

1. Open a web browser and start SMH web interface.

   http://localhost:<port_number>/smh

   Note:
   The default SMH port number is 10010. If you specified an alternative SMH port number during the installation, use the alternative port number instead.

2. Log on using the account with which you installed IAF.

3. On the tree that opens on the left hand-side of the System Management panel, navigate to: Managed Hosts > <host_name> > Integrated Authentication Framework > Integrated Authentication Framework Service > <IAF_Service_Entry>.

4. Right click the <IAF_Service_Entry>.

5. From the context menu, choose Start Service (or Stop Service).

   Note:
   To enable automatic start of a configured IAF service when the Software AG Integrated Authentication Framework service is started, right click the <IAF_Service_Entry> and then choose Autostart On. That option is available on Windows operating systems only.

Displaying IAF Service Logging Information

View the log file in the IAF install directory under the subdirectory of the name of the IAF server.

To open the IAF service log file on the local file system

1. Open the following directory:

   Software AG_directory\iaf\service\IAF_service_directory

2. Open the log file:

   IAF_service.log

To inspect the IAF service log file using SMH

1. Open a web browser and start SMH web interface.

   http://localhost:<port_number>/smh

   Note:
   The default SMH port number is 10010. If you specified an alternative SMH port number during the installation, use the alternative port number instead.

2. Log on using the account with which you installed IAF.

3. On the tree that opens on the left hand-side of the System Management panel, navigate to: Managed Hosts > <host_name> > Integrated Authentication Framework > Integrated Authentication Framework Service > <IAF_Service_Entry>.

4. Right click the <IAF_Service_Entry>.

5. From the context menu, choose Show Log File.

Integrated Authentication Framework Attributes

The section DEFAULTS=IAF within the iafnnn.atr file contains the IAF related attributes to configure the specific behavior of the Authentication Service.

www.softwareag.com

Copyright © 2008-2013 Software AG, Darmstadt, Germany.

SEARCH   CONTENTS   |   PDF BOOKS   |   HOME   UP   PREV   NEXT