The procedures in Section 3.6.1, Configuring a Reverse Proxy and Section 3.6.2, Configuring a Public Protected Resourceset up Access Gateway to protect your web server by hiding its IP address and DNS name from Internet users. The procedure does not require the user to log in before accessing resources on the web server. This section explains how to configure Access Gateway so that the users are required to provide login credentials before they access to a protected resource. This configuration consists of two parts:
The time must be synchronized between Identity Server and Access Gateway or set so the time difference is within one minute of each other for trusted authentication to work.
For Identity Server or Linux Access Gateway Service, use YaST to verify the time settings. For a Windows Access Gateway Service, use the Date and Time option in the Control Panel. If you have a Network Time Protocol server, configure the Access Manager machines to use it.
For an Access Gateway Appliance, complete the following steps:
Click Devices > Access Gateways> Edit > Date & Time.
Select a method you want to use for time:
Set Date & Time Manually: Allows you to select the current time. Click this option to select year, month, day, hour, and minute in your current time zone, then click OK.
Set Up NTP: Allows you to specify the IP address of an NTP server. Click Set Up NTP. Use the public pool.ntp.org server or click New, then specify the IP address of an NTP server. To accept the configuration, click OK.
If the time on the machine is wrong by more than an hour, use both methods to set the time. Set it manually first, and then configure it to use NTP.
In the Time Zone section, select your time zone, then click OK.
Regardless of the method you used to set the time, you must select a time zone.
Click OK.
Click Devices > Access Gateways > Update > OK.
Continue with Enabling Trusted Authentication.
Trusted authentication requires an authentication contract that specifies the type of authentication credentials. Identity Server and Access Gateway control these authentication requirements. You do not need to configure your web server to require authentication. Access Manager enforces the requirements for you.
In this example, you set up an authentication contract that requires a username and a password to access a directory on a web server.
Click Devices > Access Gateways, then click Edit > [Name of Reverse Proxy] > [Name of Proxy Service] > Protected Resources > New.
Specify a display name for the protected resource, then click OK.
Select one of the following in Authentication Procedure:
Name/Password - Basic: Basic authentication over HTTP using a standard login page provided by the web browser.
Name/Password - Form: Form-based authentication over HTTP.
Others are available, but for this basic setup, which does not enable SSL, select one of the above contracts. The contract needs to match the protocol.
If these default authentication contracts are not available, you have not configured a relationship between Access Gateway and Identity Server. See Section 3.6.1, Configuring a Reverse Proxy and select a value for the Identity Server Cluster field.
In URL Path List, configure the URL path to the page that this authentication contract will protect. For the web server configuration described in Prerequisites for Setup, click the /* path and modify it to specify the following path:
/protected/*
Click OK > OK.
Click Devices > Access Gateways > Update > OK.
(Optional) To test this configuration from a client browser, log in to Access Gateway:
Specify the published DNS name to this resource in the browser. For the example illustrated in Figure 3-2, you would specify the following URL:
http://www.mytest.com
Click the link to the protected page. This must be a link to the same page you configured in Step 4.
Your browser must prompt you with a login page. If you selected Name/Password - Basic as the contract, the standard login page issued by your browser is displayed. If you selected Name/Password - Form, the default Access Manager login page is displayed.
Log in to Identity Server with a username and password that is stored in your LDAP directory (Server 3 in Figure 3-2).
You must have access to the information you have placed in the protected directory on your web server.
If you have set up your web server to require basic authentication to access this directory, you are prompted again for login credentials.
If you receive an error, see Common Authentication Problems.
Continue with Setting Up Policies.