Creating a Pre-Authentication Header WAM Application for AndysBeans

From your EmpowerID server, open the EmpowerID Certificate Manager by searching for EmpowerID Certificate Manager.From the EmpowerID Certificate Manager, click the Generate tab and then do the following:

• Select the X509 Certificate certificate type.
• Enter a password for the certificate in the Password field.
• Browse to and select an Output Folder for the certificate.
• Check Import to EmpowerID Certificate store.
• Check Import to Local Certificate Store.
• Click Generate.

Next, map the certificate to an EmpowerID Person with the access to make API calls by doing the following:

1. From the EmpowerID Web interface, navigate to the View page for the Person to whom you want to map the certificate.
2. From the View page for the person, expand the Role, Accounts, and Login Security accordion and then click the Edit link in the Mapped Login Certificates pane.
3. Search for and select the self-signed certificate and then click Save.

When you have finished the above, the WAM Connection Information section should look similar to the following image.

Click the Users tab and tick Create a New Account Directory so that the option is selected. In this way, EmpowerID will create a special type of account store for AndysBeans, known as a "tracking-only" account store. A tracking-only account store exists as a container within EmpowerID for storing user and group records for SSO or attestation withoutmaking a connection to the external directory associated with the application. Opting to create a new accountstore when registering applications in EmpowerID is advantageous in that doing so creates a one-to-one correlationbetween the account store and the application, as well as the SSO connection for the application. Click the Extension tab and enter 1111 in the AppExtensionAttribute12 field. Click Add to Cart. Click the My Cart icon and in the dialog that appears, enter a reason for creating the application and then click Submit.

Now that the WAM application has been created, the next step is to add protected application subcomponents for each of the URLs that need to be protected for unauthorized access.

To add protected application subcomponents (URLs)

From the Navigation Sidebar of the EmpowerID Web interface, navigate to the Application page by expanding Applications and clicking Manage Applications. Search for Andy's Beans Web Site and then click the Display Name link for it. This directs you to the View One page for the application. View One pages allow to view information about an object in Empoweridand manage it as needed. From the View One page, expand the Protected Application Components accordion and then click the Add Protected Application Subcomponent (+) button. In the dialog that appears do the following to protect all pages of Andy's Beans that start withproductmanager:

1. Select URL from the Type drop-down.
2. EnterAB Product Manager Pages in the Name, Display Name and Description fields.
3. Leave the Icon field as is.
4. Check Allow Access Requests. This allows users to request access to the page from the IT Shop.
5. Enter andysbeans/productmanager in the Starts With Path field.
6. Leave ABAC Check deselected.
7. Click Save.

From the Protected Application Components accordion click the Add Protected Application Subcomponent (+) button. In the dialog that appears do the following to protect the all pages in Andy's Beans beginning withemployees:

1. Select URL from the Type drop-down.
2. Enter AB Employee Pages in the Name, Display Name andDescription fields.
3. Leave the Icon field as is.
4. Check Allow Access Requests. This allows users to request access to the page from the IT Shop.
5. Enter andysbeans/employees in the Starts With Path field.
6. Leave ABAC Check deselected.
7. Click Save.

From the Protected Application Components accordion then click the Add Protected Application Subcomponent (+) button. In the dialog that appears do the following to protect the all pages in Andy's Beans beginning withemployeemanager:

1. Select URL from the Type drop-down.
2. Enter AB Employee Manager Pages in the Name, Display Name and Description fields.
3. Leave the Icon field as is.
4. Check Allow Access Requests. This allows users to request access to the page from the IT Shop.
5. Enter andysbeans/employeemanager in the Starts With Path field.
6. Leave ABAC Check deselected.
7. Click Save.

The Protected Application Subcomponents accordion should look like the below image:

Now that the application and the protected application subcomponents for the application have been created, the next step is to create a number of people in EmpowerID with accounts in Andy's Beans. For the full list of these user accounts see

To add user accounts to the Andy's Beans WAM application account store

Navigate to the User Accounts page by expanding Identities and clicking User Accounts. Click the Create User (Person Optional) action link.

This opens the Create User form.

Select Personal Standard from the Account Type drop-down. Enter Charles in the First Name field. Enter Stripe in the Last Name field. Enter Charles Stripe in the Display Name field.Underneath Account Creation Location, click the Select a Location link and in the Location Selector search for AndysBeans and then click the node for AndysBeans to select it. Click Save to close the Location Selector. Enter charles.stripe@andysbeans.com in the Logon Name field. Enter Andy's Beans user account for Charles Stripe in the Description field. Optionally, enter any comments in the Comments or Justification field. Check Create a new EmpowerID Person object. The person created will be the owner of the user account. Underneath Person Business Role, click the Select a Role and Location link to open the Business Role and Location selector. Search for the Temporary Role Business Role and then click the node for that role to select it. Click Location to open the Location panel of the Business Role and Location selector. Search for the Temporary Location Location and then click the node for that location to select it. Click Select`to select the Business Role and Location combination and close the Business Role and Location selector. Check Allow me to enter a password and then enter pass@word1 in the Password and Confirm Password fields. Ensure that Allow Joining Account to Person and Allow Provisioning a Person from Account are selected Click Save.

After EmpowerID creates the user account and the person owning the account, your browser will be directed the Account Details page for the account.

From the Account Details page, click the EmpowerID Logon link. This will direct your browser to the View page for the Charles Stripe person. From the View page for Charles Stripe, expand the Access Assignments accordion. From the Access Assignments accordion, do the following to give Charles Stripe access to the employees and employeemanager pages of the AndysBeans application.

• Click the Add New Assignment (+) button.
• Select Direct from the Assign direct to resource or other method drop-down.
• Select Pages and Reports from the Resource Type drop-down.
• In the Enter a Pages and Reports Name to Search field, enter AB Employee Manager Pages and then click the tile to select the resource.
• Select Viewer from the Access Level drop-down.
• Click Save to add the assignment to the Shopping Cart.
• Repeat the above, this time giving Charles Stripe Viewer access to AB Employee Pages.

Next, change the EmpowerID Login for Charles Stripe from the click the Edit link to put the page in edit mode.

From the View page for Charles Stripe, click the Edit link to put the page in edit mode. Locate the Login field and change the value from charles.stripe@andysbeans.com to charles.stripe. Enter Self-Service User in the Management Roles field and then click the tile for the role to select it. Click Save. Finally, click the Shopping Cart and in the dialog that appears, enter a reason for the assignment and then click Submit. Repeat the above steps for the following Andy's Beans users:

• George Varghese - George Varghese is the Product Manager for Andy's Beans and needs access to the employees and productmanager pages of Andy's Beans.
• Barry Chandler - Barry Chandler is an employee of Andy's Beans and needs access to the employees pages of Andy's Beans.
• Fritz Dame - Fritz Dame is an employee of Andy's Beans and needs access to the employees pages of Andy's Beans.
• Tim Johnson - Tim Johnson is an employee of Andy's Beans and needs access to the employees pages of Andy's Beans.
• Maria Hansen - Maria Hansen is an employee of Andy's Beans and needs access to the employees pages of Andy's Beans.
• Rhonda Black - Rhonda Black is an employee of Andy's Beans and needs access to the employees pages of Andy's Beans.

Now that you have created the WAM application for AndysBeans, the next step is to create an OAuth application for it.

• Related Topics

  Concepts:

  • Understanding EmpowerID Web Access Management
  • About the Sample Web Application

  Administrative Procedures:

  • Installing the EmpowerID Reverse Proxy
  • Creating an OAuth app the Sample App
  • Configuring the Sample App for the EmpowerID Web Agent
  • Testing WAM

  References:

  • SSO Application Configuration Settings