Creating a Reverse Proxy Application for the Sample App

1. In the navigation sidebar of the EmpowerID Web interface, expand Applications and click Manage Applications.
2. From the Application page, click the Create Application Action link.
   
   
   
   This opens the Application Details form for the application. This form provides you with fields and options for registering applications in EmpowerID.
   
   
   
   
3. In the General section of the form, enter AndysBeansRP in the Name field.
4. Enter Andy's Beans Reverse Proxy in the Display Name and Description fields.
5. Leave the Icon field as is.

6. Enter the full URL for the Andy's Beans site in the Full URL (Exact Match Path) field.

   For example: sso.empowersso.com:8080/andysbeans where 

   • http:// is the scheme
   • sso.empowersso.com is the FQDN of the server hosting the application,
   • 8080 is the port, and
   • andysbeans is the site.
7. Leave the Base URL for the HTTP Module field empty. This field is reserved for the EmpowerID Web Agent.
8. Leave Allow Access Requests selected so that the application appears in the IT Shop, allowing users to request or claim an account in the application.
9. Leave Allow Claim Account selected so that users can claim their accounts and gain instant access after passing the requisite identity proofs.
10. Select Login Is Email Address (Receive OTP to Claim) to receive a one-time password to claim the account and to pass the appropriate identity assertion to the application when logging in from EmpowerID.
11. Leave Allow Request Account and Allow Access Requests selected so that users can request an account in the application.

12. Select Make me the Application Owner to manage the application and approve or deny access requests.

13. Leave Configure Advanced Claim and Request Account Options cleared.

14. The following image shows what the General section of the Application Details form looks like after completing these steps.
    
    

To configure SSO

1. Click the Single Sign-On tab and, from the Single Sign-On Connection Type drop-down, select Web Access Management (HTTP Header).
   
   
   
   This opens the WAM Connection Information section of the form. Use this section to build the SSO Connection for the Web application.
   
   
   
   

2. In the WAM Connection Information section, leave the Display Name field as is.

3. Enter the base URL for AndysBeans in the Base URL for Reverse Proxy field.

4. Enter Reverse Proxy for Andy's Beans in the Description field.

5. Leave Allow Anonymous Access to Unprotected paths cleared to block access to all paths not specifically protected by the native application.

6. Leave Use Target Hostname in Requests (Reverse Proxy Only) cleared.

7. Select the certificate used in your environment for signing SAML assertions from the Certificate drop-down. 

1. Click the Users tab and select the Create a New Account Directory checkbox.
   
   

   This tells EmpowerID to create a "tracking-only" account store.

   When you create a new Account Directory, EmpowerID gives the directory the same name as the application.

   
   
   
   

2. Click Add to Cart.

3. Click the My Cart icon and in the dialog that appears, enter a reason for creating the application and click Submit.

Now that the WAM application is created, the next step is to add protected application subcomponents for each of the URLs that need to be protected from unauthorized access.

1. In the navigation sidebar, expand Applications and click Manage Applications.
2. Search for Andy's Beans Reverse Proxy and click the Display Name link for it.
   
   
   
   
3. This directs you to the View One page for the application. View One pages allow you to view information about an object in EmpowerID and manage it as needed.
   
   
   
   
4. From the View One page, expand the Protected Application Components accordion and click the Add Protected Application Subcomponent (+) button.
5. In the dialog that appears do the following to protect all pages of Andy's Beans that start with productmanager:
   • From the Type drop-down, select URL.
   • In the Name, Display Name, and Description fields, enter AB Product Manager Pages.
   • Leave the Icon field as is.
   • Select Allow Access Requests. This allows users to request access to the page from the IT Shop.
   • In the Starts With Path field, enter andysbeans/productmanager.
   • Leave ABAC Check cleared.
     
     At this point, the Protected Application Subcomponent dialog looks like this.
     
     
     
     
   • Click Save.
     
     
6. Expand the Protected Application Components accordion and click the Add Protected Application Subcomponent (+) button.
7. In the dialog that appears do the following to protect all pages in Andy's Beans beginning with employees:
   • From the Type drop-down, select URL.
   • In the Name, Display Name, and Description fields, enter AB Employee Pages.
   • Leave the Icon field as is.
   • Select Allow Access Requests. This allows users to request access to the page from the IT Shop.
   • In the Starts With Path field, enter andysbeans/employees.
   • Leave ABAC Check cleared.
     
     At this point, the Protected Application Subcomponent dialog looks like this.
     
     
     
     
   • Click Save.
     
     
8. Expand the Protected Application Components accordion and click the Add Protected Application Subcomponent (+) button.
9. In the dialog that appears do the following to protect all pages in Andy's Beans beginning with employeemanager:
   1. From the Type drop-down, select URL.
   2. In the Name, Display Name, and Description fields, enter AB Employee Manager Pages.
   3. Leave the Icon field as is.
   4. Select Allow Access Requests. This allows users to request access to the page from the IT Shop.
   5. In the Starts With Path field, enter andysbeans/employeemanager.
   6. Leave ABAC Check cleared.
      
      At this point, the Protected Application Subcomponent dialog looks like this.
      
      
      
      
   7. Click Save.
      
      The Protected Application Subcomponents accordion looks like this:
      
      
      
      

1. In the navigation sidebar, expand Identity Administration and click User Accounts.
2. Click the Create User (Person Optional) action link.
   
   
   
   
3. From the General tab of the Create User form that appears do the following:
   1. From the Account Type drop-down, select Personal Standard.
   2. In the First Name field, enter Charles, Stripe in the Last Name field, and Charles Stripe in the Display Name field.
      Charles Stripe is the Employee Manager for Andy's Beans.
   3. Under Account Creation Location, click the Select a Location link, and in the Location Selector search for AndysBeans, select it, and click Save.
      
      
      
      
   4. In the Logon Name field, enter charles.stripe@andysbeans.com.
   5. In the Description field, enter Andy's Beans user account for Charles Stripe and, optionally, enter comments in the Comments or Justification field.
   6. Select Create a new EmpowerID Person object. The person created will be the owner of the user account.
   7. Under Person Business Role, click the Select a Role and Location link to open the Business Role and Location selector.
      
      
      
      
      • Search for the Temporary Role Business Role and then click the node for that role to select it.
        
        
        
        
      • Click Location to open the Location panel of the Business Role and Location selector.
      • Search for the Temporary Location Location and then click the node for that location to select it.
        
        
        
        
      • Click Select to select the Business Role and Location combination and close the Business Role and Location selector.
   8. Select Allow me to enter a password and enter pass@word1 in the Password and Confirm Password fields.
      
      
      
      
   9. Ensure that Allow Joining Account to Person and Allow Provisioning a Person from Account are selected.
      
      
      
      
   10. Click Save.

       After EmpowerID creates the user account and the person owning the account, your browser is directed the Account Details page for the account.
       
       

4. From the Account Details page, click the EmpowerID Logon link. This directs your browser to the View page for the Charles Stripe person.
   
   

To assign access

1. From the View page for Charles Stripe, expand the Access Assignments accordion.

2. From the Access Assignments accordion, do the following to give Charles Stripe access to the employees and employeemanager pages of the AndysBeans application.

   • Click the Add New Assignment (+) button.

   • Select Direct from the Assign direct to resource or other method drop-down.

   • Select Pages and Reports from the Resource Type drop-down.

   • In the Enter a Pages and Reports Name to Search field, enter AB Employee Manager Pages and click the tile to select it.

   • Select Viewer from the Access Level drop-down.
     
     
     
     

   • Click Save to add the assignment to the Shopping Cart.

   • Repeat the above, this time giving Charles Stripe Viewer access to AB Employee Pages.

3. Back on the View page for Charles Stripe, click the Edit link.
   
   
   
   

4. Locate the Login field and change the value from charles.stripe@andysbeans.com to charles.stripe.

5. In the Management Roles field, enter Self-Service User and click the tile for the role to select it.
   
   
   
   

6. Click Save.

7. Click the Shopping Cart and in the dialog that appears, enter a reason for the assignment and click Submit.
   
   

Repeat these steps for the following Andy's Beans users:

• George Varghese is the Product Manager and needs access to the employees and productmanager pages.
• Barry Chandler is an employee and needs access to the employees pages.
• Fritz Dame is an employee and needs access to the employees pages.
• Tim Johnson is an employee and needs access to the employees pages.
• Maria Hansen is an employee and needs access to the employees pages.
• Rhonda Black is an employee and needs access to the employees pages.