Page Comparison

To enable the EmpowerID Agent to protect the Andy's Beans Web site, you neet to create an application for it with URL subcomponents for each URL or group of URLs on the site you want to protect in EmpowerID and link that application to a SAML SSO Connection to provide single sign-on capabilities to all authorized users.

For the AndysBeans Andy's Beans Web site, there are a number of URLs that need to be restricted. These include the following:

There are a number of ways in which these URLs can be protected, depending on the granularity of your security policy: You can add

• Add a URL subcomponent that is an exact match for a specific URL, limiting the scope of the subcomponent to that one URL

• .
• Create a URL subcomponent that uses a

• JavaScript regular expression to block access to all URLs meeting the condition (pattern match) of the expression

• .
• Create a path-specific URL subcomponent that restricts access to any URL with a matching beginning path.

This example uses a combination of the second two,  pattern matches and beginning paths, to protect the URLs on the AndysBeans Web siteAndy's Beans URLs.

This topic demonstrates how to create an application for AndysBeans and add to it URL subcomponents for each path that needs to be protected from unauthorized access.

To create a WAM SSO application for AndysBeans

Now that the WAM application has been created, the next step is to add protected application subcomponents for each of the URLs that need to be protected for unauthorized access.

To add protected application subcomponents (URLs)

1. From the Navigation Sidebar of the EmpowerID Web interface, navigate to the Application page by expanding , expand Applications and clicking click Manage Applications.
2. Search for Andy's Beans Web Site and then click the Display Name link for it.
   
   Image Added
   
   This directs you to the View One page for the application. View One pages allow you to view information about an object in EmpowerID and manage it as needed. 
   
   Image Added
   
   
3. From the View One page, expand the Protected Application Components accordion and then click the Add Protected Application Subcomponent (+) button.
4. In the dialog that appears do the following to protect all pages of Andy's Beans that start with productmanager:
   1. Select URL from From the Type drop-down, select URL.
   2. Enter AB Product Manager Pages in In the Name, Display Name and Description fields, enter AB Product Manager Pages.
   3. Leave the Icon field as is.
   4. Check Select Allow Access Requests. This allows  to let users to request access to the page from the IT Shop.
   5. Enter andysbeans/productmanager in In the Starts With with Path field, enter andysbeans/productmanager.
   6. Leave ABAC Check deselected cleared.
      
      The Protected Application Subcomponent dialog looks like this:
      
      Image Added
      
      
   7. Click Save.
5. From Expand the Protected Application Components accordion and click the Add Protected Application Subcomponent (+) button.
6. In the dialog that appears do the following to protect the all pages in Andy's Beans beginning with employees:
   1. Select URL from From the Type drop-down, select URL.
   2. Enter AB Employee Pages in In the Name, Display Name and  and Description fields, enter AB Employee Pages.
   3. Leave the Icon field as is.
   4. Check Select Allow Access Requests. This allows  to let users to request access to the page from the IT Shop.
   5. Enter andysbeans/employees in In the Starts With with Path field, enter andysbeans/employees.
   6. Leave ABAC Check deselected cleared.
      
      The Protected Application Subcomponent dialog looks like this:
      
      Image Added
      
      
   7. Click Save.
7. From Expand the Protected Application Components accordion then and click the Add Protected Application Subcomponent (+) button.
8. In the dialog that appears do the following to protect the all pages in Andy's Beans beginning with employeemanager:
   1. Select URL from From the Type drop-down, select URL.
   2. Enter AB Employee Manager Pages in In the Name, Display Name and Description fields, enter AB Employee Manager Pages.
   3. Leave the Icon field as is.
   4. Check Select Allow Access Requests. This allows  to let users to request access to the page from the IT Shop.
   5. Enter andysbeans/employeemanager in In the Starts With with Path field, enter andysbeans/employeemanager.
   6. Leave ABAC Check deselected cleared.
      
      The Protected Application Subcomponent dialog looks like this:
      
      Image Added
      
      
   7. Click Save.

The Protected Application Subcomponents accordion looks like the image below

:

Now that the application and the protected application subcomponents for the application have been are created, the next step is to create a number of people in EmpowerID with accounts in Andy's Beans. For the full list of these user accounts see 

1. Navigate to the User Accounts page by expanding Identities and clicking User Accounts.
2. Click the Create User (Person Optional) action link.  
   
   Image Added
   
   This opens the Create User form.
   Select Personal Standard from
   Image Added
   
   
3. From the Account Type drop-down, select Personal Standard.
4. Enter Charles in In the First Name field.Enter Stripe in the , enter Charles, and in the Last Name field, enter Stripe.
5. Enter Charles Stripe in

   In the Display Name field, enter Charles Stripe.
   
   

   Tip
   Charles Stripe is the Employee Manager for Andy's Beans.

   
   

6. Below Account Creation Location, click the Select a Location link.
   1. In the Location Selector, search for AndysBeans and then click the node for AndysBeans to select it.
   2. Click Save to close the Location Selector.  
   Enter
   1. 
      
      Image Added
      
      
7. In the Logon Name field, enter charles.stripe@andysbeans.com in the Logon Name field.Enter .
8. In the Description field, enter Andy's Beans user account for Charles Stripe in the Description field.
9. Optionally, enter any comments in the Comments or Justification field.
10. Check Select Create a new EmpowerID Person object. The person created will be the owner of the user account.
11. Below Person Business Role, click the Select a Role and Location link to open the Business Role and Location selector.
    
    Image Added
    
    
    1. Search for the Temporary Role Business Role and then click the node for that role to select it.
       
       Image Added
       
       
    2. Click Location to open the Location panel of the Business Role and Location selector.
    3. Search for the Temporary Location Location and then click the node for that location to select it.
       
       Image Added
       
       
    4. Click Select to select the Business Role and Location combination and close the Business Role and Location selector.
12. Select Allow me to enter a password and then enter pass@word1 in the Password and Confirm Password fields.
    
    Image Added
    
    
13. Ensure that Allow Joining Account to Person and Allow Provisioning a Person from Account are selected.
    
    Image Added
    
    
14. Click Save.

    After EmpowerID creates the user account and the person owning the account, your browser is directed to the Account Details page for the account.

To assign access to the Account Store 

1. From the Account Details page that opens, click the EmpowerID Logon link. This directs your browser to the View page for the Charles Stripe person.
   
   Image Added
   
   

2. From the View page for Charles Stripe, expand the Access Assignments accordion .From the Access Assignments accordion, and do the following to give Charles Stripe access to the employees and employeemanager pages of the AndysBeans application.

   1. Click the Add New Assignment (+) button.

   Select Direct from

   1. From the Assign direct to resource or other method drop-down, select Direct.

   Select Pages and Reports from

   1. From the Resource Type drop-down, select Pages and Reports.

   2. In the Enter a Pages and Reports Name to Search field, enter AB Employee Manager Pages and

   then

   1. click the tile to select

   the resource

   1. it.

   Select Viewer from

   1. From the Access Level drop-down, select Viewer.
      
      Image Added
      
      

   2. Click Save to add the assignment to the Shopping Cart.

   3. Repeat the above, this time giving Charles Stripe Viewer access to AB Employee Pages

   .Next, change the EmpowerID Login for Charles Stripe from the click the Edit link to put the page in edit mode

   1. .

3. From the View page for Charles Stripe, click the Edit link to put the page in edit mode.
   
   Image Added
   
   
4. Locate the Login field and change the value from charles.stripe@andysbeans.com to charles.stripe.
5. Enter Self-Service User in the Management Roles field and then click the tile for the role to select it.
   
   Image Added
   
   
6. Click Save.
7. Finally, click the Shopping Cart and in the dialog that appears, enter a reason for the assignment and then click Submit.
   
   Image Added
   
   
8. Repeat these steps for the following Andy's Beans users:
   • George Varghese is the Product Manager for Andy's Beans Manager  and needs access to the employees and productmanager pages.
   • Barry Chandler is an employee of Andy's Beans and needs access to the employees pages.
   • Fritz Dame is an employee of Andy's Beans and needs access to the employees pages.
   • Tim Johnson is an employee of Andy's Beans and needs access to the employees pages.
   • Maria Hansen is an employee of Andy's Beans and needs access to the employees pages.

   • Rhonda Black is an employee

     of Andy's Beans

     and needs access to the employees pages.
     
     

     Tip
     For a full list of all Andy's Beans users and their roles, see About the Sample Web Application.