Novell ACCESS MANAGER 3.1 SP2 - POLICY GUIDE 2010 Manual page 54

9 To enable the role so that it can be used in Authorization and Identity Injection policies, click
Devices > Identity Servers > Edit > Roles.
10 Select the check box next to the name of the role, then click Enable.
11 Click OK.
12 Update the Identity Server.
13 (Optional) Verify the name used for the role and the user assigned to it:
13a Enable logging by clicking Devices > Identity Servers > Edit > Logging, then set the
following values:
File Logging: Select Enabled.
Echo To Console: Select this option to enable it.
Application: In the Component File Logger Levels section, set to info.
13b Click OK, then update the Identity Server.
13c Log in to the Identity Server by using the credentials of a user who belongs the LDAP
group.
13d View the log file for the Identity Server by clicking Auditing > General Logging
13e Select the file (for Windows, select the
catalina.out
13f Look for two log entries (<amLogEntry>) similar to the following:
<amLogEntry> 2009-10-09T21:58:55Z INFO NIDS Application: AM#500199050:
AMDEVICEID#CA50FD51DB1EEE3E:
AMAUTHID#213E610199A14CEAF27395A6B35F3162:
IDP RolesPep.evaluate(), policy trace:
ou=ContentPublisherContainer,ou=Partition,ou=PartitionsContainer,
ou=VCDN_Root,ou=accessManagerContainer,o=novell:romaContentCollection
XMLDoc),Policy=(LDAP_Group),Rule=(1::RuleID_1223587171711),Action=
(AddSelectedRole::ActionID_1223588319336)~~~~Success(0)
<amLogEntry> 2009-10-09T21:58:55Z INFO NIDS Application: AM#500105013:
AMDEVICEID#CA50FD51DB1EEE3E:
AMAUTHID#213E610199A14CEAF27395A6B35F3162:
Authenticated user cn=jwilson,o=novell in User Store Internal with
roles
"cn=Doc,o=novell","authenticated".
</amLogEntry>
The first <amLogEntry> entry indicates that the action in the LDAP_Group policy was
successfully assigned.
The second entry gives the DN of the user and lists the roles assigned to the user:
cn=Doc,o=novell and authenticated.
54 Novell Access Manager 3.1 SP2 Policy Guide
file), then click Download.
~~RL~1~~~~Rule Count: 1~~Success(67)
~~RU~RuleID_1223587171711~LDAP_Group~DNF~~0:1~~Success(67)
~~PA~ActionID_1223588319336~~AddSelectedRoles~cn=Doc~~~Success(0)
~~PA~ActionID_1223588319336~~AddSelectedRoles~o=novell~~~Success(0)
~~PC~ActionID_1223588319336~~Document=(ou=xpemlPEP,ou=mastercdn,
</amLogEntry>
file; for Linux, select the
stdout.log