About virgil.chereches

virgil.chereches · ‎12-28-2010

I found an easy way to implement this. All you must do is to extend the AD schema with some multi-valued attribute, AuthToken let's say and populate user entries in AD with the OTP corresponding users. Then change (if not already) AD authentication in JSA with a LDAP based auth server and add this attribute (AuthToken) to LDAP Server Catalog attributes. All you must do now is to change the default custom expression on Role mapping tab with: [email protected]{RadiusAuth} [email protected]{LDAPAuth}.AuthToken where RadiusAuth is OTP auth server and LDAPAuth is AD auth server. Quite simple, isn't it?

virgil.chereches · ‎12-17-2010

I have the following SA setup: a set of resources protected with AD credentials and with a second RADIUS auth server (OTP). I must add that one OTP token is shared by multiple users (so we do not have a one to one mapping of users and tokens). I need to control which users authenticate with some tokens (in the sense that a group of users must use only few tokens to log in). I thought about using custom expressions in order to achieve this but I have some difficulties in handling multivalued LDAP attributes, specifically with separator syntax (as can be read in Admin guide): <variable sep='str'>. Where must this be defined: in server catalog or in mapping rule? How I can use this to simply use a LDAP multi-valued attribute in building a string like 'string1' or 'string2' or 'string3' and compare with [email protected] auth server?

Re: Correlating two auth levels

Correlating two auth levels