CA API Gateway 9.1

9.4 9.1

Creating a Federated Virtual Group

Specific conditions must exist before you can create a federated virtual group:
gateway
Specific conditions must exist before you can create a federated virtual group:
  • The Federated Identity Provider (FIP) must contain a trusted certificate (In the X.509 certificate workflow, the trusted certificate is a CA root certificate attached to the FIP. As for the SAML workflow, the trusted certificate is an SSL server certificate attached to the FIP. These certificates are attached with the Create Federated Identity Provider Wizard).
  • Since the imported certificate will have been used to sign client certificates, the [
    Signing Client Certificates
    ] setting in Step 3 of the Add Certificate Wizard must also have been selected.
  • A virtual group cannot be created under the "Client Certificate Only" scenario in the X.509 certificate workflow, since trusted certificates do not exist in the FIP.
To add a new virtual group to the Federated Identity Provider (FIP)
:
  1. Right-click the FIP name in the [Identity Providers] tab and select Create Virtual Group. The Create Virtual Group dialog appears.
  2. Configure the dialog as follows:
    Setting
    Description
    Group Name
    Enter a name for the group.
    This name will appear in the Search Identity Provider dialog when searching and/or adding virtual groups to a policy. The name is a human readable value that does not impact the validity of the virtual group in an identity bridging configuration.
    Description
    Optionally, enter a description for the group.
    X509 Subject DN
    Enter the pattern that the subject DN values of signed client certificates must match in order to be authorized as a member of this virtual group.You may use a regular expression.
    The X509 Subject DN must at least partially match the "Issued to:" value in the CA root certificate attached to the Federated Identity Provider. Use the asterisk truncation operator (*) to retrieve DNs with a common initial spelling. The (*) substitutes a string of zero or more characters in a subject DN.
    For example, a virtual group could contain the partial DN "O=ACME Inc., OU=Anvils, CN=*." Request messages in which the Subject DN was "O=ACME Inc., OU=Anvils, CN=Name" or "O=ACME Inc., OU=Anvils, CN=Name2" would both pass the corresponding group assertion that is required to gain web service access. However, request messages carrying the Subject DN “O=ACME Inc., CN=Name” would not pass. Every attribute specified in the subject DN pattern of a virtual group must be present in incoming certificates in order to be authorized.
    Special Characters in the Subject DN
    Special care must be taken if the following special characters are used in the Subject DN name:
    , \ # + < > ; " =
    These characters, plus any leading or trailing spaces must escaped in order to be interpreted correctly.
    The DN value can be quoted with a quotation pair. This allows all special characters except the backslash to be treated as literal characters and does not require escaping. When quoted, the backslash still require escaping.
    Use Regular Expression
    Select this check box to evaluate the Subject DN as a regular expression. Clear this check box to employ a simple pattern match that uses the “*” character as a wildcard.
    Email
    Optionally, enter an email pattern.This authorizes incoming requests with incoming SAML tokens using the “emailAddress” NameIdentifier format with email addresses matching a regular expression pattern.
  3. Click [
    Create
    ]. The dialog closes and the virtual group is added to the Federated Identity Provider.
 

Content feedback and comments