The EmpowerID SSO framework allows you to configure a Smart Card connection as an identity provider (IDP) for EmpowerID.
| Info | |||||
|---|---|---|---|---|---|
|
| Tip | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
Once the IDP Connection has been set up for smart cards, you can create a link similar to the one below to allow users to login to EmpowerID using their smart cards.
|
To configure an IDP connection for a smart card
- From the navigation sidebar, expand Admin > Applications and Directories > SSO Connections and click SAML.
- From the SAML Connections tab of the SAML Connections management page, search for Smart, click the drop-dwon arrow for Login using Smart Card and then click the Edit link.
- From the Actions pane of Application Manager, click the Create SAML Connection action link.
From the General tab of the Connection Details form, scroll to the Account Information section and select the appropriate account store from the Account Directory drop-down.
Info The FQN of the Account Directory must match the Root CA CN of the smart card certificate issuer for EmpowerID to authenticate the smart card user.
- In the Certificates section, select the signing and verifying certificates for your environment from theSigning Certificate and Verifying Certificate drop-downs.
- Leave all other fields as is.
- Click the Domains tab and then click the Add (+) button in the Assigned Domains section.
- In the Add Domain dialog that appears, type the name of the existing EmpowerID domain for which you want a SmartCard login tile to appear on the Login page and then click the tile for that domain.
- Click Add to close the Add Domain dialog.
- Back in the Connections Details page, click Save to save your changes.
Now that the IDP Connection is configured, you can test it by following the procedure outlined below.
To test the Smart Card connection
- Insert your Smart Card reader on a machine and then launch your web browser, pointing it to the domain name you configured for the Smart Card ID Connection.
- Click the Login using your SmartCard button.
- In the Select a certificate dialog that appears, select the appropriate authenticating certificate and then click OK.
In the Check for EmpowerID Login page the appears, click Yes if you wish to link the smart card to an existing user or No if you wish to link the smart card to a new user.
Info Users without an EmpowerID Person can request EmpowerID accounts by clickingNo. This initiates theCreate User Accountworkflow, which displays a form in the browser to allow the user to fill in the appropriate information. If a user submits the request, EmpowerID routes that request to those individuals in your environment with the ability to approve or deny the request and returns the user to the EmpowerID web login.
Tip icon false The Check for EmpowerID Login page only appears the first time you log in to EmpowerID with your smart card.
- Type your EmpowerID Login or Email in the form and click Submit. The EmpowerID Person must have a valid email address as EmpowerID sends a one-time password to that address.
- Check your email for the one-time password.
Back in the EmpowerID Web application, type the one-time password into the Password form and click Submit.
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
| Div | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| |||||||||||
|