1. Implementing iChain ® in the Wild: Life beyond the lab Rich Roberts Senior Architect – Novell Consulting Novell Inc. Jim Short iChain Guru – Novell Consulting Resolution Team Novell Inc.

2. © March 9, 2004 Novell Inc. 2 one Net: Information without boundaries…where the right people are connected with the right information at the right time to make the right decisions. The one Net vision Novell exteNd ™ Novell Nsure ™ Novell Nterprise ™ Novell Ngage SM : : : :

3. © March 9, 2004 Novell Inc. 3 The one Net vision Novell Nsure solutions take identity management to a whole new level. Novell Nsure gives you the power to control access so you can confidently deliver the right resources to the right people — securely, efficiently, and best of all, affordably. Novell Nsure ™ Novell exteNd ™ Novell Nsure ™ Novell Nterprise ™ Novell Ngage SM : : : :

4. © January 27, 2004 Novell Inc. 4 The Speakers Jim Short With Novell Support for over 10 years iChain guru since the product was created Border Manager ® and NMAS TM Rich Roberts With Novell Consulting for over 5 years Implenting iChain for customers since 2000 Developer for iChain for over 3 years

5. © January 27, 2004 Novell Inc. 5 Agenda Feature Overview Accelerators Rewriter SSL / SLDAP Authentication Architecture Where do I stick it? Working Examples Secure a web site

6. © January 27, 2004 Novell Inc. 6 What is iChain? Web application single sign on SSLizer Reverse Proxy Load Balancer Authenticator

7. © January 27, 2004 Novell Inc. 7 iChain Schema

8. © January 27, 2004 Novell Inc. 8 The ISO Object

9. © January 27, 2004 Novell Inc. 9 Skill sets required What Skill sets do you need to successfully implement iChain Web Site Development – HTML – Javascript – JSP

10. Architecture

11. © January 27, 2004 Novell Inc. 11 Where to stick it... Well now... What does your DMZ look like? Where do your webbies and security folks say it should go? There are several options and all our valid.

12. © January 27, 2004 Novell Inc. 12 Outside The DMZ

13. © January 27, 2004 Novell Inc. 13 In the DMZ

14. © January 27, 2004 Novell Inc. 14 Inside of the firewall

15. © January 27, 2004 Novell Inc. 15 Your Site Content How to optimize your site to work better with iChain

16. © January 27, 2004 Novell Inc. 16 The PIN List

17. © January 27, 2004 Novell Inc. 17 Sample PIN List Byp a s s Oracle Portal v9 /mail/* /webmail.nsf* Byp a s s Lotus Notes Mail v5 /SAPPortal/* /sapportal/* /sap/* /irj/* /hrnp$30001/* Byp a s s SAP Portal v5 /servlets/psportal/* /servlets/iclientservlet/* /servlets/cs/P8ESS/cache/* *.gif *.jpg *.pdf Byp a s s Mem o r y Peoplesoft Portal /nps/servlet/* Byp a s s NPS /iFolder/* Byp a s s iFolder /*.jsp Byp a s s JSPs /servlet/*Byp a s s iChain Servlets /eMFrame/*Byp a s s iManager /eGuide/*Byp a s s Everyone’s searching rights are differenteGuide URL MaskPIN T y p e Issue with cachingApplication

18. © January 27, 2004 Novell Inc. 18 eDirectory Design

19. Support

20. © January 27, 2004 Novell Inc. 20 Top 10 Support Issues

21. © January 27, 2004 Novell Inc. 21 How to debug problems when Secure Exchange is enabled

22. © January 27, 2004 Novell Inc. 22 Taking Packet Traces from iChain

23. © January 27, 2004 Novell Inc. 23 Exporting a NAS File

24. Demonstrations

25. © January 27, 2004 Novell Inc. 25 Basic Configurations

26. © January 27, 2004 Novell Inc. 26 Load Balancing Web Servers

27. © January 27, 2004 Novell Inc. 27 Access Control Methods LDAP Authentication Radius Authentication SSL Certificate Mutual Authentication

28. © January 27, 2004 Novell Inc. 28 How To Determine which SSO Method to use

29. © January 27, 2004 Novell Inc. 29 iChain and your portal

30. © January 27, 2004 Novell Inc. 30 Secure LDAP

31. © January 27, 2004 Novell Inc. 31 HTTPS between iChain and the web server

32. © January 27, 2004 Novell Inc. 32 Creating a form fill script

33. © January 27, 2004 Novell Inc. 33 Interacting with iChain Telnet Putty FTP X-Session NCP – Drive Mappings

34. © January 27, 2004 Novell Inc. 34 Taking Packet Traces from iChain

35. © January 27, 2004 Novell Inc. 35 Custom Login Pages

36. © January 27, 2004 Novell Inc. 36 Custom Error Messages

37. © January 27, 2004 Novell Inc. 37 Using 3 rd Party Certs Wild Cards Are there any others?

38. User Account Management Modules

39. © January 27, 2004 Novell Inc. 39 Password Management Password Expiration Handling Password Change Handling Password Reset Self Service

40. © January 27, 2004 Novell Inc. 40 Help Desk Modules Helpdesk Account Reset Helpdesk Change Password Helpdesk Check User Status

41. © January 27, 2004 Novell Inc. 41 Self Registration

42. © January 27, 2004 Novell Inc. 42 Configuring the modules

43. © January 27, 2004 Novell Inc. 43 Customizing the Modules

44. Liberty Alliance

45. © January 27, 2004 Novell Inc. 45 SAML and Liberty Services

46. Open Source and Novell Forge

47. © January 27, 2004 Novell Inc. 47 Forge Resources

48. © January 27, 2004 Novell Inc. 48 Novell Cool Solutions

49. iChain FAQ

50. © January 27, 2004 Novell Inc. 50 iChain FAQ Is user name and password in the authentication header from iChain to target servers (IIS/Domino, etc) encrypted? Is the authentication header passed with every page request? Can iChain be configured to force users to authenticate through the iChain proxy server? Is there any way to restrict users from directly accessing web servers that are protected by iChain? Does iChain provide an alternative method of forcing users to authenticate (i.e., web agents loaded on target web servers)? Can iChain be configured to not display the address bar/URL of the application that is being accessed? Is there a configurable item in SAP portal that can hide the address bar/URL from being viewed by the user? Can I turn on Auto Restart After Abend?

51. © January 27, 2004 Novell Inc. 51 iChain Ports

53. © January 27, 2004 Novell Inc. 53 General Disclaimer This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners. No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.