Federation Manager Agent for Windows Authentication Guide › Configuration of the Federation Manager Windows Agent › Information Required by the Configuration Wizard

Information Required by the Configuration Wizard

After you install the Federation Manager Windows Agent, run the configuration wizard. On systems running Windows, you can select the authentication protocol (Kerberos or NTLM). Systems running Solaris only support the Kerberos protocol.

Note: The configuration executable and folder names include the string iwa, which references support for Integrated Windows Authentication technology.

The parameters listed following are required for NTLM and Kerberos configurations.

Important! The values specified for these parameters must match the values specified in the Deployment settings in the Federation Manager UI, which are communicated out of band.

• Cookie zone

  Specifies the single sign-on security zone name.

  Default: FED

  Limits: Alpha string

• Cookie name

  Specifies the name of the open format cookie.

  Default: ""

  Limits: Alpha string

• Encryption password

  Specifies the password used to derive a key to encrypt the cookie.

  Default: ""

  Limits: Alphanumeric string

• Encryption Transformation type

  Specifies the FIPS-compliant cryptographic transform.

  Default: AES128/CBC/PKCS5Padding

  Limits: AES128/CBC/PKCS5Padding, AES192/CBC/PKCS5Padding, AES256/CBC/PKCS5Padding, 3DES_EDE/CBC/PKCS5Padding

• UseHMAC

  Specifies whether to use a Hash Message Authentication Code (HMAC).

  Default: false

  Limits: true or false

Note: If you are on a system running Windows and you have selected the Kerberos authentication protocol, you can optionally select NTLM as the failover option.

When specifying the Kerberos protocol, provide values for the following parameters:

• KDC address

  Specifies the fully qualified domain name of the key distribution center (KDC).

• KDC realm

  Specifies the domain name of the system on which the KDC is located.

• Keytab location

  Specifies the path of the keytab file, which is created on the KDC system and moved to the system on which Federation Manager Windows Agent is located.

• Principal

  Specifies the service principal name (SPN), which uniquely identifies an instance of a service, for example, HTTP/host.abc.com. HTTP is the name of the service and host.abc.com is the name of the host on which the service resides.

Note: The last two parameters are written to the login.conf file. The other parameters are written to the IWAConnectorConfig.conf file.