Configuring The Adfs Server - Novell ACCESS MANAGER 3.1 SP2 - IDENTITY SERVER GUIDE 2010 Manual

11 Click OK, then update the Identity Server.
12 Continue with "Importing the ADFS Signing Certificate into the NIDP-Truststore" on
page 257.
Importing the ADFS Signing Certificate into the NIDP-Truststore
The Novell Identity Provider (NIDP) must have the trusted root of the ADFS signing certificate (or
the certificate itself) listed in its Trust Store, as well as specified in the relationship. This is because
most ADFS signing certificates are part of a certificate chain, and the certificate that goes into the
metadata is not the same as the trusted root of that certificate. However, because the Active
Directory step-by-step guide uses self-signed certificates for signing, it is the same certificate in both
the Trust Store and in the relationship.
To import the ADFS signing certificate's trusted root (or the certificate itself) into the NIDP-
Truststore:
1 On the Identity Servers page, click Edit > Security > NIDP Trust Store.
2 Click Add.
3 Next to the Trusted Root(s) field, click the Select Trusted Root(s) icon.
This adds the trusted root of the ADFS signing certificate to the Trust Store.
4 On the Select Trusted Roots page, select the trusted root or certificate that you want to import,
then click Add Trusted Roots to Trust Stores.
If there is no trusted root or certificate in the list, click Import. This enables you to import a
trusted root or certificate.
5 Next to the Trust store(s) field, click the Select Keystore icon.
6 Select the trust stores where you want to add the trusted root or certificate, then click OK twice.
7 Update the Identity Server so that the changes can take effect.
This finishes the configuration that must be done on the Identity Server for the Identity Server to
trust the ADFS server. The ADFS server must be configured to trust the Identity Server. Continue
with Section 10.1.2, "Configuring the ADFS Server," on page

10.1.2 Configuring the ADFS Server

The following tasks must be completed on the Trey Research server (adfsresouce.treyresearch.net)
to establish trust with the Novell Identity Server.
"Enabling E-mail as a Claim Type" on page 258

"Creating an Account Partners Configuration" on page 258

 "Enabling ClaimApp and TokenApp Claims" on page 259
"Disabling CRL Checking" on page 259

257.
Configuring WS Federation 257