One Identity Manager 8.1.

Web Application Configuration Guide

Copyright 2020 One Identity LLC.
ALL RIGHTS RESERVED.
This guide contains proprietary information protected by copyright. The software described in this guide
is furnished under a software license or nondisclosure agreement. This software may be used or copied
only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced
or transmitted in any form or by any means, electronic or mechanical, including photocopying and
recording for any purpose other than the purchaser’s personal use without the written permission of
One Identity LLC .
The information in this document is provided in connection with One Identity products. No license,
express or implied, by estoppel or otherwise, to any intellectual property right is granted by this
document or in connection with the sale of One Identity LLC products. EXCEPT AS SET FORTH IN THE
TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT,
ONE IDENTITY ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR
STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-
INFRINGEMENT. IN NO EVENT SHALL ONE IDENTITY BE LIABLE FOR ANY DIRECT, INDIRECT,
CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT
LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF
INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF
ONE IDENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. One Identity makes no
representations or warranties with respect to the accuracy or completeness of the contents of this
document and reserves the right to make changes to specifications and product descriptions at any
time without notice. One Identity does not make any commitment to update the information
contained in this document.
If you have any questions regarding your potential use of this material, contact:
One Identity LLC.
Attn: LEGAL Dept
4 Polaris Way
Aliso Viejo, CA 92656
Refer to our Web site ([Link] for regional and international office information.
Patents
One Identity is proud of our advanced technology. Patents and pending patents may apply to this
product. For the most current information about applicable patents for this product, please visit our
website at [Link]
Trademarks
One Identity and the One Identity logo are trademarks and registered trademarks of One Identity
LLC. in the U.S.A. and other countries. For a complete list of One Identity trademarks, please visit
our website at [Link]/legal. All other trademarks are the property of their
respective owners.
Legend

WARNING: A WARNING icon highlights a potential risk of bodily injury or property

damage, for which industry-standard safety precautions are advised. This icon is
often associated with electrical hazards related to hardware.

CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if

instructions are not followed.

One Identity Manager Web Application Configuration Guide

Updated - March 2020
Version - 8.1.2
Contents

About this guide 5

Configuring the Web Portal 6

IT shop configuration 6
Requesting by reference user 6
Enabling or disabling 'by reference user' 7
Setting the reference user display 7
Enabling requests by peer group 8
Sending the shopping cart 8
Setting the priority 9
Confirming requests 9
Forcing reauthentication 10
Handling required products 10
Approver options 11
Setting validity periods 11
Submitting inquiries 12
Require a reason 12
Approval decisions about URL links 12
Displaying user-specific processes in the Web Portal 13
Configuring self-registration of new users 14
Configuring the four eyes principle for issuing a passcode. 15
Configuring password questions 16

WebAuthn security keys 18

WebAuthn configuration 18
Step 1: Configuring an OAuth certificate 19
Step 2: Configuring the RSTS 19
Step 3: Configuring the application server 21
Step 4: Configuring the web application 22

Starling Two-Factor Authentication 24

Setting up Starling Two-Factor Authentication 24
Starling Two-Factor Authentication for specific people 25

One Identity Manager 8.1.2 Web Application Configuration Guide 3

Logging in without Starling 2FA tokens 25
Activating Starling Two-Factor Authentication for the Operations Support Web Portal 26

Password Reset Portal 27

Setting up a Password Reset Portal 27
Installing the Password Reset Portal 27
Authentication 28
Settable passwords 28
Excluding passwords from being reset 29
Central password 30
Defining password dependencies 30
Setting a central password 31
Configuring checks for all passwords 31
Setting up a new application token 32
Configuring Password Reset Portal login using target system user accounts 32

Recommendations for secure operation of web applications 34

Using HTTPS 34
Disable automatic password storage 35
Disabling the HTTP request method TRACE 35
Using HTTP Strict Transport Security (HSTS) 35
Disabling insecure encryption mechanisms 36
Setting the "HttpOnly" attribute for [Link] session cookies 36
Setting the "same-site" attribute for [Link] session cookies 37
Setting the "secure" attribute for [Link] session cookies 38
Disabling Windows IIS 8.3 short names 38
Removing the HTTP response header in Windows IIS 39
Creating X-Frame-Options HTTP response header 39
Running web applications in release mode 40

About us 41
Contacting us 41
Technical support resources 41

One Identity Manager 8.1.2 Web Application Configuration Guide 4

 1

About this guide

This guide book provides administrators and web developers with information about
configuration and operation of One Identity Manager web applications.

Available documentation

The online version of the One Identity Manager documentation is available in the Support-
Portal under Online-Documentation. You will find videos with additional information at
[Link]/OneIdentity.

One Identity Manager 8.1.2 Web Application Configuration Guide

5
About this guide
 2

Configuring the Web Portal

This section describes the configuration steps and parameters that you will require to
configure some of the features of the Web Portal.
For more detailed information about the Web Designer, see the One Identity Manager Web
Designer Reference Guide.

Detailed information about this topic

l IT shop configuration on page 6

l Displaying user-specific processes in the Web Portal on page 13
l Configuring self-registration of new users on page 14
l Configuring the four eyes principle for issuing a passcode. on page 15

IT shop configuration
You can configure the Web Portal's IT Shop in the Web Designer.

Requesting by reference user

Table 1: Configuration parameter for requesting by reference user

Configuration parameter Description

VI_ITShop_ProductSelectionByReferenceUser Provides "By reference user" for

requests in the Web Portal.

VI_ITShop_Filter_PersonReference Specifies the number of reference

users displayed. This configuration
parameter is a SQL filter on the
"Person" table.

One Identity Manager 8.1.2 Web Application Configuration Guide

6
Configuring the Web Portal
To make requests by reference user in the Web Portal or to determine the number of
reference displayed, you must adjust the configuration parameter settings.

Detailed information about this topic

l Enabling or disabling 'by reference user' on page 7

l Setting the reference user display on page 7

Enabling or disabling 'by reference user'

In the Web Designer, you can specify whether it is possible to make a request using
another user's requests. This function means requesting by reference user. To do this you
must edit "VI_ITShop_ProductSelectionByReferenceUser" in the Web Designer.

To enable or disable requesting by reference user

1. Open the Web Designer.

2. Open "VI_ITShop_ProduCtSelection" and search for "VI_ITShop_
ProductSelectionByReferenceUser".
3. Select "VI_ITShop_ProductSelectionByReferenceUser".
4. In the definition tree view, choose to switch to the Configuration (custom)
view. where you can edit the configuration parameter.
5. Perform one of the following tasks.
a. To disable requesting by reference user: In the Node editor view, set the
value True.
b. To enable requesting by reference user: In the Node editor view, set the
value false.

Setting the reference user display

To set the number of reference users displayed in the Web Portal when you select a
reference user, you must configure the configuration parameter in Web Designer.
NOTE: If you can include the variable %useruid% if want to reference the current user.

To set the number of reference users displayed

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_Filter_PersonReference".
3. Select "VI_ITShop_Filter_PersonReference".
4. Enter the desired value Value in the Node editor.

One Identity Manager 8.1.2 Web Application Configuration Guide

7
Configuring the Web Portal
Enabling requests by peer group
Web Portal users can display and request products that other people from your
surroundings have already requested. Managers can also show information for individual
members of their staff. This way, you have a quick method of requesting products that are
important to them or their team members.
TIP: A peer group contains all the people that have the same manager or the same
primary or secondary department as the requester.
NOTE_ Before you can enable requests by peer group, you must configure and enable
peer group analysis. For more information about peer group analysis and how to
configure it, see the One Identity Manager IT Shop Administration Guide.

To enable requests by peer groups

1. Start the Web Designer.

2. Configure the following configuration keys:
l VI_ITShop_Find_Products_By_Peer_Group: Set this configuration key to
enable requests by peer group. If you enable this configuration key, all users
can display and request products from their own peer group.
l VI_ITShop_Manager_Find_Products_By_Peer_Group: Set this
configuration key to enable requests by peer group. If you enable this
configuration key, managers can display and request products of a staff
member’s peer group.
TIP: If managers make requests by peer group for themselves and for members of
their staff, enable both configuration keys.

Sending the shopping cart

There are difference ways you can configure the shopping cart in the Web Portal.

Detailed information about this topic

l Setting the priority on page 9

l Confirming requests on page 9
l Forcing reauthentication on page 10
l Handling required products on page 10

One Identity Manager 8.1.2 Web Application Configuration Guide

8
Configuring the Web Portal
Setting the priority
Table 2: Configuration parameters for the request priority

Configuration parameter Description

VI_ITShop_DisablePWOPriorityChange Disables the priority's setting for a

request made by a user in the Web
Portal.

By default, users can set the priority of their own request.

To disable a priority setting

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_DisablePWOPriorityChange".
3. Select "VI_ITShop_DisablePWOPriorityChange".
4. Set the value to true in the Node editor view.

Confirming requests
Table 3: Configuration parameter for confirming requests

Configuration parameter Description

VI_ITShop_SubmitOrderImmediately Forces confirmation of a request in

the Web Portal.

The user can send a request in the Web Portal without confirmation, by default. However,
confirmation is required if at least one warning is issued while checking the request.
If you want to have confirmation for requests without requiring a warning, you can
configure "VI_ITShop_SubmitOrderImmediately".

To demand confirmation for a request

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_SubmitOrderImmediately".
3. Select the configuration parameter "VI_ITShop_SubmitOrderImmediately".
4. Set the value to false in the Node editor view.

One Identity Manager 8.1.2 Web Application Configuration Guide

9
Configuring the Web Portal
Forcing reauthentication
Table 4: Configuration parameter for Active Directory request authentication

Configuration Description Setting

Parameter
False True

VI_ITShop_ Forces Active Directory Denied and Denied and

TermsOf UseRe- reauthentication during unsubscribed unsubscribed
quireAD Authentic- execution of a request. requests cannot requests can be
ation be directly reinstated by
reinstated as recipients or
new requests. requesters of the
request.

To force reauthentication during a request

1. Assign the terms of use to the service item.

For more detailed information about assigning service items, see the One Identity
Manager IT Shop Administration Guide.
2. Open the Web Designer.
3. Open a module and search for "VI_ITShop_TermsOfUseRequireADAuthentication".
4. Select the configuration parameter "VI_ITShop_
TermsOfUseRequireADAuthentication".
5. Set the value to true in the Node editor view.

Handling required products

There are different ways of handling required products in the Web Portal. Configuration
parameter settings are carried out in Web Designer.

Table 5: Configuration parameter for required products

Configuration parameter Description

VI_ITShop_AllowRequestWithMissingDependencies If the configuration parameter

is set, a request can be sent
even though the required
product cannot be requested
due to an existing assignment.

"VI_ITShop_AllowRequestWithMissingDependencies" is not set by default. This means a

request cannot be sent if the required product cannot be requested.

One Identity Manager 8.1.2 Web Application Configuration Guide

10
Configuring the Web Portal
To configure required product handling

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_AllowRequestWithMissingDependencies".
3. Mark "VI_ITShop_AllowRequestWithMissingDependencies".
4. Edit the configuration parameter on Configuration by setting the value true in the
Node Edit. This overwrites the default setting.

Approver options
There are various configuration options available for request approvers in the Web Portal.

Detailed information about this topic

l Setting validity periods on page 11

l Submitting inquiries on page 12
l Require a reason on page 12

Setting validity periods

Table 6: Configuration parameter for validity

Configuration parameter Description

VI_ITShop_ApproverCanSetValidFrom Allows the approver to set a new start

time for a request's validity period.

VI_ITShop_ApproverCanSetValidUntil Allows the approver to set a end time

for a request's validity period.

The settings for VI_ITShop_ApproverCanSetValidFrom and VI_ITShop_

ApproverCanSetValidUntil allow the request's approver to set a new validity period.

To set the validity period

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_ApproverCanSetValidFrom".
3. Select "VI_ITShop_ApproverCanSetValidFrom".
4. Set the value to true in the Node editor view.
5. Search for "VI_ITShop_ApproverCanSetValidUntil".
6. Select the configuration parameter "VI_ITShop_ApproverCanSetValidUntil"
7. Set the value to true in the Node editor view.

One Identity Manager 8.1.2 Web Application Configuration Guide

11
Configuring the Web Portal
Submitting inquiries
Table 7: Configuration parameters for the inquiry

Configuration parameter Description

VI_ITShop_WantSeeQueryToPerson Allows the approver to ask another

employee a question in the context of
the approval workflow.

To submit inquiries

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_WantSeeQueryToPerson".
3. Select "VI_ITShop_WantSeeQueryToPerson".
4. Set the value to true in the Node editor view.

Require a reason
Table 8: Configuration parameter for reason

Configuration parameter Description

VI_ITShop_ApproverReasonMandatoryOnDeny Requires a reason from the approver

for denying a request.

To ask a question

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_ApproverReasonMandatoryOnDeny".
3. Select the configuration parameter "VI_ITShop_ApproverReasonMandatoryOnDeny".
4. Set the value to true in the Node editor view.

Approval decisions about URL links

Table 9: Configuration parameter for approval decisions about URL links

Configuration Description Meaning

parameter

VI_ITShop_Approvals Requires consultation with Product Approval is not

_InteractiveApproval the user before approval. fulfills filter done directly.
This key is a SQL filter condition Displays form

One Identity Manager 8.1.2 Web Application Configuration Guide

12
Configuring the Web Portal
Configuration Description Meaning
parameter

condition on the "AccProduct" for confirming

table. the approval
decision.

Product does Approval

not fulfill decision is made
filter when the page is
condition called.
Approvers
receive a
message that
the approval
decision has
been entered
into the system.

An approval decision about a request can be made by opening a URL that is sent in an
email, for example.
Cases that use this type of messaging for request approvals are special service items,
which are required for informing the user about the approval decision. Approvals through
these service items are not permitted without prior consultation.

To prevent a approval by URL link

1. Open the Web Designer.

2. Open a module and search for "VI_ITShop_Approvals_InteractiveApproval".
3. Select the configuration parameter "VI_ITShop_Approvals_InteractiveApproval".
4. In the Node editor, set the value to true.

Displaying user-specific processes in

the Web Portal
A user-specific process is a process that is specifically configured for tracing by the user. It
enables status tracking and confirmation of a processing result to the Web Portal.
A user who is logged on to the Web Portal can see all processes that they have initiated.
The value in the XUserInserted column corresponds to the user who is currently logged on.
A process can only be generated from within a session of the current logged on user if it is
to be identified as a user-specific process.
The user-specific processes are displayed in the Web Portal in the My Processes view.
For more detailed information, see the One Identity Manager Web Portal User Guide.

One Identity Manager 8.1.2 Web Application Configuration Guide

13
Configuring the Web Portal
This section only covers the configuration for displaying the process information in the Web
Portal. For more detailed information about process monitoring, recording process
information, and the configuration of processes and process steps, see the One Identity
Manager Configuration Guide.

Configuration recommendations for the recording of user-specific

processes

l In the Designer, check the Common | ProcessState configuration parameter. The

configuration parameter must be set.
l In the Designer, check the Common | ProcessState | JobHistory configuration
parameter. The configuration parameter must be set. As a value for the configuration
parameter, select ERRORorSELECTED or SELECTED.
NOTE: The value ALL also takes into account the notifications from the process
history. However, this setting can lead to an extremely large data volume.
l In the Designer, check the Common | ProcessState | ProgressView
configuration parameter. The configuration parameter must be set and should have
the value 2.
l In the Designer, check the Common | ProcessState | ProgressView | LifeTime
and Common | ProcessState | JobHistory | LifeTime configuration parameters.
These configuration parameters define the retention time of the process information
and notifications in the process history. The configuration parameters must be set.
Adjust the retention times if necessary. By default, the information is stored for 30
days before it is removed from the One Identity Manager database.
l In the Designer, configure the processes and process steps for recording process
information.
l In the Process information property for a process, select the value Web
Portal tracking.
l In the Process information property for the process steps, select the value
Web Portal tracking. Enable the Process history option.
l Use user-friendly informative display values for the processes and process
steps. To do this, enter the formatting rules for the process information of
processes and process steps.

Configuring self-registration of new

users
Users who are not yet registered have the option to register themselves to use the Web
Portal. Users who self-register, receive a verification email with a link to a verification
page. On this page, users can complete registration themselves and then set their initial
login password.
NOTE: To user this functionality, new users must supply an email address, otherwise the

One Identity Manager 8.1.2 Web Application Configuration Guide

14
Configuring the Web Portal
 verification email cannot be sent.
NOTE: For detailed information about self-registration of new users in the Web Portal
and associated attestation process, see the One Identity Manager Attestation Admin-
istration Guide.

To configure self-registration

1. Start the Designer.

2. Configure the following configuration parameters:
NOTE: See the One Identity Manager Configuration Guide, to find out how to edit
configuration parameters in the Designer.
l QER | WebPortal | PasswordResetURL: Specify the Password Reset
Portal's web address. This URL is used, for example, in the email notification
to new users.
l QER | Attestation | MailTemplateIdents |
NewExternalUserVerification:
By default, the verification message and link is sent with the Attestation -
new external user verification link mail template.
To use another template for this notification, change the value in the
configuration parameter.
TIP: In the Designer, you can configure the current mail template in the Mail
templates | Person category. For more information about mail templates,
see the One Identity Manager Operational Guide.
l QER | Attestation | ApproveNewExternalUsers: Specify whether self-
registered users must be attested before they are activated. A manager then
decides whether to approve the new user's registration.
l QER | Attestation | NewExternalUserTimeoutInHours: For new self-
registered users, specify the duration of the verification link in hours.
l QER | Attestation | NewExternalUserFinalTimeoutInHours: Specify
the duration in hours, within which self-registration must be successfully
completed.
3. Assign at least one employee to the Identity & Access Governance | Attestation
| Attestor for external users application role.

Configuring the four eyes principle for

issuing a passcode.
You can control whether passcodes generated by the help desk are divided into two parts.
One half of the passcode is issued to the help desk staff and the other half is sent to the
employee's manager. The employee must ask the manager for the second half of the
passcode. This procedure increases the security for issuing passcodes.

One Identity Manager 8.1.2 Web Application Configuration Guide

15
Configuring the Web Portal
To configure the four eye principle for issuing passcodes

1. Start the Designer.

2. Set the QER | Person | PasswordResetAuthenticator | PasscodeSplit
configuration parameter.
NOTE: See the One Identity Manager Configuration Guide, to find out how to edit
configuration parameters in the Designer.
3. Set the QER | WebPortal | MailTemplateIdents |
InformManagerAboutSecondHalfOfPasscode configuration parameter.
By default, the second half of the passcode is sent with the Employee - manager
half of passcode for password reset mail template.
To use another template for this notification, change the value in the
configuration parameter.
TIP: In the Designer, you can configure the current mail template in the Mail
templates | Person category. For more information about mail templates, see
the One Identity Manager Operational Guide.

Configuring password questions

If Web Portal users forget their password, they can set a new one with the help of the
password questions.

To configure the use of password questions.

1. Start the Designer.

2. Configure the following configuration parameters:
NOTE: See the One Identity Manager Configuration Guide, to find out how to edit
configuration parameters in the Designer.
l QER | Person | PasswordResetAuthenticator |
QueryAnswerDefinitions: Specify how many password questions and
answers users must enter. Users who do not enter enough or any questions
and answers, cannot reset their password.
NOTE: The value must not be less than the value in the QueryAn-
swerRequests configuration parameter.
l QER | Person | PasswordResetAuthenticator |
QueryAnswerRequests: Specify how many password questions users have
to answer before they can reset their password.
NOTE: The value must not be higher than the value in the QueryAn-
swerDefinitions configuration parameter.
l QER | Person | PasswordResetAuthenticator | InvalidateUsedQuery:
Specify whether users must enter new password questions and answers after

One Identity Manager 8.1.2 Web Application Configuration Guide

16
Configuring the Web Portal
successfully resetting their password. In this case, correctly answered
questions are deleted.

One Identity Manager 8.1.2 Web Application Configuration Guide

17
Configuring the Web Portal
 3

WebAuthn security keys

One Identity offers users the option to log in, simply and securely, to One Identity Manager
web applications with help of (physical) security keys. These security keys support the
W3C standard WebAuthn.
Use of security keys guarantees increased security when logging in.

Advice

l You can run Starling Two-Factor Authentication and WebAuthn in parallel for a web
application. Users that have at least one valid security key, do not have to go through
the Starling 2FA process as well. Users that do not have a security key must still use
Starling 2FA.
l In the Manager, employee administrators have the option to view all of an
employee's security keys and to delete them. For more information, see the One
Identity Manager Identity Management Base Module Administration Guide.
l The WebAuthn standard is NOT support in Internet Explorer. Users must use
another browser.

Related topics

l WebAuthn configuration on page 18

WebAuthn configuration
To configure WebAuthn for a web application, carry out these four steps:

1. Configure the OAuth certificate to enable secure communication between RSTS and
One Identity Manager.
2. Configure the RSTS.
3. Configure the application server.
4. Configure the web application.

One Identity Manager 8.1.2 Web Application Configuration Guide

18
WebAuthn security keys
Related topics

l WebAuthn security keys on page 18

l Step 1: Configuring an OAuth certificate on page 19
l Step 2: Configuring the RSTS on page 19
l Step 3: Configuring the application server on page 21
l Step 4: Configuring the web application on page 22

Step 1: Configuring an OAuth certificate

Communication between the RSTS (redistributable security token service) and One Identity
Manager uses tokens that are signed with the private key of a certificate. This certificate
must be valid and trusted because the RSTS also uses this certificate for client certificate
registration on the application server. One Identity recommends that either you use a
public key infrastructure (PKI) that already exists or a new certificate chain from the root
certificate and the associated OAuth signing certificate.

To configure the OAuth signing certificate

1. Create a new, valid, and trusted, OAuth signing certificate.

2. Ensure the following:
l The RSTS must have access to the OAuth signing certificate with a private key.
l The application server from which, the RSTS requests the WebAuthn security
keys, must trust the certificate chain of the OAuth signing certificate.
l The web application that allows login by RSTS, must have access to the OAuth
signing certificate with a private key.
l The web application used to manage the WebAuthn security keys, must have
access to the OAuth signing certificate with a private key.

Related topics

l WebAuthn security keys on page 18

l Step 2: Configuring the RSTS on page 19
l Step 3: Configuring the application server on page 21
l Step 4: Configuring the web application on page 22

Step 2: Configuring the RSTS

NOTE: Before you can configure the RSTS, you must configure the OAuth signing
certificate. For more information, see Step 1: Configuring an OAuth certificate on page

One Identity Manager 8.1.2 Web Application Configuration Guide

19
WebAuthn security keys
19.

To configure WebAuthn on the RSTS

1. Perform one of the following tasks:

l If you are installing the RSTS: When you install the RSTS, select the previously
created OAuth signing certificate so that the corresponding entry in the identity
provider in One Identity Manager is set.
l If RSTS already exists: Quit the relevant service, replace the file [Link] with
the current version and restart the RSTS.
You will find the current version of the [Link] file on the installation medium
in the Modules\QBM\dvd\AddOn\Redistributable STS directory.
2. In your web browser, call the URL of the RSTS administration interface:
[Link]
3. On the start page, click Applications.
4. On the Applications page, click Add Application.
5. On the Edit page, complete the data on the various tabs.
NOTE: The forwarding URLs (Redirect Url) on the General tab us the
following formats:
l For the API Server:
[Link]
Pfad>/html/<Webanwendung>/#/?Module=OAuthRoleBased
l For the Web Portal:
[Link] name>/<web application>
6. Switch to the Two Factor Authentication tab.
7. On the Two Factor Authentication tab, in the list in Required by pane, click:
l All Users: All users must log in with two-factor authentication.
l Specific Users/Groups: Specific users must log in using two-factor
authentication. You can add these by clicking Add.
l Note Required: The application server decided which users must log in using
two-factor authentication.
8. In the navigation, click Home.
9. On the home page, click Authentication providers.
10. On the Authentication Providers page, edit the entry in the list.
11. On the Edit page, switch to the Two Factor Authentication tab.
12. In the Two Factor Authentication Settings pane, click FIDO2/WebAuthn.
13. Edit the following input fields:
l Relying Party Name: Enter any name.
l Domain Suffix: Enter the suffix of your Active Directory domain that hosts

One Identity Manager 8.1.2 Web Application Configuration Guide

20
WebAuthn security keys
 the RSTS.
l API URL Format: Enter the application server's URL. The given URL
must contain a place-holder in {0} format that supplies a unique identifier
for the user.
The API URL Format is used by RSTS to call the list of WebAuthn security
keys of a specified user. Enter the URL in the following format:
[Link] name>/<application server
path>/appServer/WebAuthn/<identity provider>/Users/{0}
l Server name – fully qualified host name of the web server hosting the
application server
l <Application server path> – path to the web application of the
application server (default: AppServer)
l <Identity provider> – name of the identity provider
TIP: You can find the name of the identity provider in the Designer:
Base data | Security settings | OAuth 2.0/OpenId Connect
configuration

Example:
[Link]
y/Users/{0}

14. Click Finish.

Related topics

l WebAuthn security keys on page 18

l Step 1: Configuring an OAuth certificate on page 19
l Step 3: Configuring the application server on page 21
l Step 4: Configuring the web application on page 22

Step 3: Configuring the application server

The RSTS call the WebAuthn security key for Active Directory users over an interface. This
information is sensitive and must not be called by unauthorized persons, therefore, access
must secured through by client certificate login.
In order for this to work, certificates must be valid and client certificate login on IIS must
be enabled.

One Identity Manager 8.1.2 Web Application Configuration Guide

21
WebAuthn security keys
The application server checks the certifcate's thumbprint the client used to login. Only if
the thumbprint matches the stored thumbprint, is the information returned.
If the application server is also used as the backend for web applications, grant access
rights to the application pool users for the OAuth signing certificate's private key.

To enable client certificate login on IIS

1. Start the Internet Information Services Manager.

2. Open the SSL Setting menu for the relevant application server.
3. In the Client certificates option, change the value to Accept.

Related topics

l WebAuthn security keys on page 18

l Step 1: Configuring an OAuth certificate on page 19
l Step 2: Configuring the RSTS on page 19
l Step 4: Configuring the web application on page 22

Step 4: Configuring the web application

NOTE: The web application to be used by WebAuthn, must apply the HTTPS secure
communications protocol (see Using HTTPS on page 34).

To configure WebAuthn in web applications

1. Start the Web Designer.

2. Click View | Start page on the menu bar.
3. In the toolbar, click Select web application and select the web application you
want to use.
4. Click Edit web application settings.
5. In the Edit web application settings dialog, in the Authentication module
menu, click OAuth 2.0/OpenID Connect.
6. In the OAuth pane, in the OAuth 2.0/OpenID Connect configuration menu, click
the appropriate identity provider.
7. Click OK.
8. Click Edit | Configure project | Web project on the menu bar.
9. Configure the following configuration keys:
l VI_Common_RequiresAccessControl: Set this parameter to enable two-
factor authentication.
l VI_Common_AccessControl_WebAuthn_2FA: Specify whether you want
to enable WebAuthn two-factor authentication for the web application.

One Identity Manager 8.1.2 Web Application Configuration Guide

22
WebAuthn security keys
 You can configure WebAuthn two-factor authentication and security key
management separately. If, for example, you want to only enable
management of security keys but not of two-factor authentication with the help
of security keys in the web application, do not set this configuration key and
set the VI_Common_AccessControl_WebAuthn_2FA_VisibleControls
configuration key described below.
l VI_Common_AccessControl_WebAuthn_2FA_VisibleControls: Specify
whether users can manage security keys in the web application.
l VI_Employee_QERWebAuthnKey_Filter: Specify, which employees can
manage security keys in the web application. If you do not enter anything here,
all web application users manage the security keys (assuming the VI_
Common_AccessControl_WebAuthn_2FA_VisibleControls configuration
key is set).
l VI_Common_AccessControl_WebAuthn_2FAID: Enter a unique identifier
for the secondary authentication provider for WebAuthn two-factor
authentication. You will find this identifier in your RSTS configuration.
a. In your Internet browser, call the URL of the RSTS administration
interface: [Link]
b. On the main page, click Authentication Providers.
c. On the Authentication Providers page, click the appropriate entry.
d. On the Edit page, switch to the Two Factor Authentication tab.
e. Take the ID from the Provider ID field.

Related topics

l WebAuthn security keys on page 18

l Step 1: Configuring an OAuth certificate on page 19
l Step 2: Configuring the RSTS on page 19
l Step 3: Configuring the application server on page 21

One Identity Manager 8.1.2 Web Application Configuration Guide

23
WebAuthn security keys
 4

Starling Two-Factor Authentication

Multi-factor authentication guarantees better security for logging into web applications.
One Identity Manager tools user Starling Two-Factor Authentication for multi-factor
authentication.
The following prerequisites must be fulfilled to use Starling Two-Factor Authentication:

l Users must have a registered Starling 2FA token.

l Use of an employee-related authentication module, for example "Person (role-
based)"

Starling Two-Factor Authentication takes place after initial database login and is
independent of it. At web application level, every access attempt is prevented until Starling
Two-Factor Authentication has been executed.

Setting up Starling Two-Factor

Authentication
Table 10: Configuration parameter for multi-factor authentication

Configuration parameter Description

VI_Common_RequiresAccessControl Requires authentication for web applic-

ations.

VI_Common_AccessControl_StarlingEnabled Enables use of Starling Two-Factor

Authentication.

Multi-factor authentication is done in the web project in the Web Designer.

To set up Starling Two-Factor Authentication

1. Open the Web Designer.

2. Open a module and search for "VI_Common_RequiresAccessControl".

One Identity Manager 8.1.2 Web Application Configuration Guide

24
Starling Two-Factor Authentication
 3. Mark the configuration parameter "VI_Common_RequiresAccessControl" and set the
value to true.
4. Mark the configuration parameter "VI_Common_AccessControl_StarlingEnabled" and
set the value to true.

Starling Two-Factor Authentication for

specific people
Table 11: Configuration parameter for multi-factor authentication for specific
people

Configuration parameter Description

VI_Common_AccessControl_Filter Sets up multi-factor authentication for specific

people.

You need to specify, which people can use multi-factor authentication in your web project.

To set up Starling Two-Factor Authentication only for specific people

1. Open the Web Designer.

2. Open a module and search for "VI_Common_AccessControl_Filter".
3. Mark the configuration parameter "VI_Common_AccessControl_Filter".
4. Enter a filter condition in the node editor view that only matches people who require
multi-factor authentication.

Logging in without Starling 2FA tokens

Table 12: Configuration parameter for logging in without multi-factor
authentication

Configuration Description Setting

parameter
True False

VI_Common_ Allows users to log in to the Users without a Users without a

AccessControl_ web application without registered Starling registered
Starling_ multi-factor authentication. 2FA token can log Starling 2FA
AllowUnregistered in to the web token cannot log
application without in to the web
Starling Two-Factor application.
Authentication.

One Identity Manager 8.1.2 Web Application Configuration Guide

25
Starling Two-Factor Authentication
You can configure your web project to allow users without multi-factor authentication to log
in to the web application.

To log in without Starling 2FA tokens

1. Open the Web Designer.

2. Open a module and search for "VI_Common_AccessControl_Starling_
AllowUnregistered".
3. Mark the configuration parameter "VI_Common_AccessControl_Starling_
AllowUnregistered".
4. Set the value in the node editor view to true.

Activating Starling Two-Factor

Authentication for the Operations
Support Web Portal
On the API Server, you can enable Starling 2FA for the Operations Support Web Portal.

To enable Starling Two-Factor Authentication for the Operations Support

Web Portal

1. Start the API Designer.

2. Click on View | Navigation on the menu bar.

3. Click API projects in the navigation.

4. In the tree view, double-click on the QBM_OperationsSupport project.
5. In the definition tree view, right-click Authentication node.
6. In the context menu, click Object in extension | Add to extension <extension
name> | Authentication module.
7. Click on View | Node editor on the menu bar.
8. In the definition tree view, click the newly created Second authentication factor.
9. In the Node editor pane, tick the Second authentication factor box.
10. In the menu, click Starling 2FA.

One Identity Manager 8.1.2 Web Application Configuration Guide

26
Starling Two-Factor Authentication
 5

Password Reset Portal

The Password Reset Portal allows users to reset passwords of the user accounts they
manage securely.

Setting up a Password Reset Portal

To utilize the Password Reset Portal, it must be installed as a dedicated web application.
The necessary security is guaranteed by multi-factor authentication.

Installing the Password Reset Portal

Table 13: Configuration parameters for application tokens

Configuration parameter Description

QER | Person | PasswordResetAuthenticator | Sets a application token for the

ApplicationToken Password Reset Portal.

During installation, you will be prompted to enter an application token. This application
token functions like a password, which the web application uses to authenticate itself on
the database. This ensures that the password can only be reset by the web application
assigned for the purpose.

To install the Password Reset Portal

1. Follow the step-by-step "To install the Web Portal" from "Installing the Web Portal" in
the One Identity Manager Installation Guide.
2. Select QER_PasswordWeb from Web Project.
After selecting the web project, you are prompted to enter an application token.
3. Select a sufficiently secure token and enter it in the box provided.

One Identity Manager 8.1.2 Web Application Configuration Guide

27
Password Reset Portal
 The application token is saved as a hash value in the database in "QER | Person |
PasswordResetAuthenticator | ApplicationToken" and stored encrypted in the file
[Link].

Authentication
Authentication on the Password Reset Portal differs from authentication on the Web Portal.
The user has three options to choose from.

Table 14: Authentication options

Login Type Authentication Module Used Application (QBMProduct)

Login with Password reset (role-based), read- Password reset, read-only.

passcode. only.
Login using a Password reset (role-based), read- Password reset, read-only.
secret password only.
question.
Login with user Specified in the web application Specified in the web application
name and configuration. configuration.
password.

Settable passwords
Users can set the following default passwords.

Table 15: Password overview

User Password Table / Column

Everyone Own password [Link]

Everyone User account password, which is [Link]

a. Directly assigned to the [Link]

current employee. [Link]
- OR - [Link]
b. Assigned to the current [Link]
employee's sub identity. [Link]
- OR - [Link]
c. Assigned to the current [Link]
employee's sponsored [Link]

One Identity Manager 8.1.2 Web Application Configuration Guide

28
Password Reset Portal
User Password Table / Column

identity, service identity [Link]

or group identity.

- OR -

d. Assigned to one of the

current user's shared user
accounts.

Members of the Password for individual system [Link]

application role Base users
roles |
Administrators

NOTE: The system user is not suggested for resetting the password in the
following cases:

l If external password management is enabled for the system user.

l If the system user is enabled as service account.

l If the system user is used for automatic software updating of One Identity Manager
web applications.

These cases are implemented in the QER_PasswordWeb_IsAllowSet script, which can be

overwritten.

l If the system user is used for role-based login.

In this case, the system user is not accepted by the Password Reset Portal.

Excluding passwords from being reset

Table 16: Script for resetting passwords

Script Description

QER_PasswordReset_IsAllowSet Specifies whether resetting a password in the

Password Reset Portal is allowed.

To prevent users from setting passwords by mistake, you can exclude certain password
from being reset.
User cases for this may be passwords that are calculated from other values or passwords
for target systems that are only connected as read-only.
NOTE: In "QER_PasswordWeb_IsAllowSet", the system user is prevented, by default,
from resetting the password in the following cases.

One Identity Manager 8.1.2 Web Application Configuration Guide

29
Password Reset Portal
 l If external password management is enabled.
l If the system user is enabled as service account.
l If the system user is used for automatic software updating of One Identity Manager
web applications.

To exclude passwords from being reset

1. Open the Designer.

2. Find "QER_PasswordReset_IsAllowSet".
3. Use "QER_PasswordReset_IsAllowSet" as the basis for an overrideable script with
the following parameters.
a. Current user's UID_Person.
b. Object's key (ObjectKey) offered for password reset.
c. Password column name.
4. Save the setting in the Designer.
5. Compile the Password Reset Portal.

Central password
Apart from setting individual passwords in the Password Reset Portal, you can also set the
central password. Each user has a central password, with which other passwords can be
managed depending on the configuration of the target system.

Defining password dependencies

By defining password dependencies, you specify which passwords are managed through
the central password.

Table 17: Script for declaring passwords

Script Description

QER_PasswordWeb_IsByCentralPwd By default, the script checks whether "QER |

Person | UseCentralPassword"
is set. If the configuration parameter is set, the
employee's central password is mapped to the
password column of the employee's user
account. A user account must be linked to the
current user, it cannot be a privileged account.
The script can be overwritten.

One Identity Manager 8.1.2 Web Application Configuration Guide

30
Password Reset Portal
To define password dependencies

1. Open the Designer.

2. Search QER_PasswordWeb_IsByCentralPwd.
3. Use "QER_PasswordWeb_IsByCentralPwd" as the basis for an overrideable script
with the following parameters.
a. Current user's UID_Person.
b. Object's key (ObjectKey) offered for password reset.
c. Password's column name.
Using this input parameter, the script must return the information regarding whether
or not a password is managed by the central password.
4. Save the setting in the Designer.
5. Compile the Password Reset Portal.

Setting a central password

The central password is set separately from other password to prevent problems.
Once at least one of the logged in user's passwords is managed by the central password,
two options are provided after authentication.

a. Setting the central password

b. Setting one or more passwords

If setting one or more passwords, it is possible to set a password managed by the central
password. If you want to prevent this, you can exclude the password from being reset.
For more information, see Excluding passwords from being reset on page 29.

Configuring checks for all passwords

Once a user has changed their central password and the user account is linked to other
target system accounts, the password can be checked against all the password policies of
the connected target systems.

To configure checks for all passwords

1. Start the Designer.

2. Set the QER | Person | UseCentralPassword | CheckAllPolicies
configuration parameter.
NOTE: See the One Identity Manager Configuration Guide, to find out how to edit
configuration parameters in the Designer.

One Identity Manager 8.1.2 Web Application Configuration Guide

31
Password Reset Portal
Setting up a new application token
You can set a new application token using [Link].

To set a new application token

1. Open [Link].
2. Ensure that QER_PasswordWeb is set as the web project.
3. Click next to Application token exists.

Configuring Password Reset Portal login

using target system user accounts
By default, it is only possible to log in to the Password Reset Portal using password
questions or a passcode if you use a central user account. You can configure the Password
Reset Portal's authentication module such that log in with the help of password questions or
a passcode is also possible using a target system user account (Active Directory user
accounts, for example). To do this, enter database tables and columns containing the user
names of user accounts that are permitted to log in to the Password Reset Portal. For more
information the about Password Reset Portal's authentication module, see the One Identity
Manager Authorization and Authentication Guide.

To configure login using target system user accounts

1. Start the Designer.

2. Set and configure the following configuration parameters:
NOTE: See the One Identity Manager Configuration Guide, to find out how to edit
configuration parameters in the Designer.
l QER | Person | PasswordResetAuthenticator | SearchTable: Enter the
name of the database table containing the use names of the user accounts
permitted to log in to the Password Reset Portal.
When a user tries to log in to the Password Reset Portal, this table and the
column given under SearchColumn are searched for the user names
permitted for use.
Example: ADSAccount
NOTE: This database table must have a foreign key named UID_Person that
references the Person table. This is required to match the user names to the
One Identity Manager user accounts.
l QER | Person | PasswordResetAuthenticator | SearchColumn: Enter the
name of the table column containing the use names of the user accounts
permitted to log in to the Password Reset Portal.
When a user tries to log in to the Password Reset Portal, this column and the

One Identity Manager 8.1.2 Web Application Configuration Guide

32
Password Reset Portal
 table given under SearchTable are searched for the user names permitted for
use.
Example: CN
l QER | Person | PasswordResetAuthenticator | DisabledBy: (Optional)
Enter the name of the Boolean table column that specifies whether a user
account is locked. User accounts that are marked as locked (column value:
true) cannot log in to the Password Reset Portal.
TIP: To enter more than one column, delimit them with the pipe
character (|).
Example: Locked|Disabled
l QER | Person | PasswordResetAuthenticator | EnabledBy: (Optional)
Enter the name of the Boolean table column that specifies whether a user
account is enabled. User accounts that are marked as disabled (column value:
false) cannot log in to the Password Reset Portal.
TIP: To enter more than one column, delimit them with the pipe
character (|).
Example: Active|Enabled

One Identity Manager 8.1.2 Web Application Configuration Guide

33
Password Reset Portal
 6

Recommendations for secure

operation of web applications

Here are some solutions that have been tried and tested in conjunction with One Identity
Manager tools to guarantee secure operation of One Identity web applications. You decide
which security measures are appropriate for your individually customized web
applications.

Detailed information about this topic

l Using HTTPS on page 34

l Disable automatic password storage on page 35
l Disabling the HTTP request method TRACE on page 35
l Using HTTP Strict Transport Security (HSTS) on page 35
l Disabling insecure encryption mechanisms on page 36
l Setting the "HttpOnly" attribute for [Link] session cookies on page 36
l Setting the "same-site" attribute for [Link] session cookies on page 37
l Setting the "secure" attribute for [Link] session cookies on page 38
l Disabling Windows IIS 8.3 short names on page 38
l Removing the HTTP response header in Windows IIS on page 39
l Creating X-Frame-Options HTTP response header on page 39

Using HTTPS
Always run the One Identity Manager's web application over the secure communications
protocol "Hypertext Transfer Protocol Secure" (HTTPS).
In order for the web application to use the secure communications protocol, you can force
the use of the "Secure Sockets Layer" (SSL) when you install the application. For more
information for using HTTPS/SSL, see the One Identity Manager Installation Guide.

One Identity Manager 8.1.2 Web Application Configuration Guide

34
Recommendations for secure operation of web applications
Disable automatic password storage
Use this setting to prevent auto-filling of your user data on the login page. This setting is
made in the Web Designer and can help running of web applications more securely.

Table 18: Configuration parameter for disabling automatic password storage

Configuration parameter Description

VI_Common_Login_PrefillLoginData Prevents auto-filling user data on the login page.

To disable automatic password storage

1. Open the Web Designer.

2. In the menu bar, select the Edit | Configure project | Web project menu item.
3. On the Configure Project tab, search for "VI_Common_Login_PrefillLoginData".
4. In the Allow prefill of login data key, in the Value (custom) column, click .

This sets the default value to "false". This disables automatic password storage.

Disabling the HTTP request method

TRACE
The TRACE request allows the path to the web server to be traced and to check that data is
transferred there correctly. This allows a trace route to be determined at application level,
meaning the path to the web server over various proxies. This method is particularly useful
for debugging connections.
IMPORTANT: TRACE should not be enable in a productive environment because it can
reduce performance.

To disable the HTTP request method TRACE using Internet Information Services

l You will find instructions by following this link:

[Link]

Using HTTP Strict Transport Security

(HSTS)
HTTP Strict Transport Security (HSTS) is a security mechanism for HTTPS connections. is a
web security policy mechanism which helps to protect websites against protocol downgrade

One Identity Manager 8.1.2 Web Application Configuration Guide

35
Recommendations for secure operation of web applications
attacks and cookie hijacking. For example, a server could send a header "Strict-Transport-
Security" to the user's browser such that in future, at a defined time (max-age), this
domain should exclusively use encrypted connections. This setting can be optionally
extended by the parameter includeSubDomains to all subdomains. This means that not only
[Link] is taken into account but also [Link]

To enable HSTS

1. Open the configuration file [Link] for the chosen web application.
2. Set the HTTP Response Header to Strict-Transport-Security and the value maxage =
expireTime.
For more detailed information about setting the HTTP Response Header, see
[Link]
us/iis/configuration/[Link]/sites/site/hsts.

Disabling insecure encryption

mechanisms
It is recommended that you disable all unnecessary encryption methods and protocols on
the grounds of security. If you disable redundant protocols and methods, older platforms
and systems may not be able to establish connections with web applications anymore.
Therefore, you must decide which protocols and methods are necessary, based on the
platforms required.
NOTE: The software "IIS Crypto" from Nartac Software is recommended for disabling
encryption methods and protocols.
For more information about disabling encryption, see [Link]
[Link]/Products/IISCrypto.

Detailed information about this topic

l [Link]
practices/

l [Link]
certain-cryptographic-algorithms-and-protoc

Setting the "HttpOnly" attribute for

[Link] session cookies
To prevent cookies being manipulated by JavaScript and to reduce the risk of cross-site
scripting attacks and cook theft, you can set the so called "HttpOnly" attribute for your

One Identity Manager 8.1.2 Web Application Configuration Guide

36
Recommendations for secure operation of web applications
[Link] session cookies. This means that cookies can no longer be used by client-side
scripts.

To set the "HttpOnly" attribute for [Link] session cookies

1. Open the configuration file [Link] for the chosen web application.
2. In the <configuration> section, enter the following code snippet:

<[Link]>
<httpCookies httpOnlyCookies="true"/>
</[Link]>

3. Save the file.

Related topics

l Setting the "secure" attribute for [Link] session cookies on page 38

l Setting the "same-site" attribute for [Link] session cookies on page 37

Setting the "same-site" attribute for

[Link] session cookies
To prevent cross-site request forgery (CSRF), you can set the same-site attribute for your
[Link] session cookies.

To set the same site attribute for all .NET versions from 4.7.2.

1. Open the configuration file [Link] for the chosen web application.
2. Enter the following code snippet in the <configuration> section:

<[Link]>
<httpCookies sameSite="Strict" />
</[Link]>

3. Save the file.

Related topics

l Setting the "HttpOnly" attribute for [Link] session cookies on page 36

l Setting the "secure" attribute for [Link] session cookies on page 38

One Identity Manager 8.1.2 Web Application Configuration Guide

37
Recommendations for secure operation of web applications
Setting the "secure" attribute for
[Link] session cookies
To prevent cookies being read by unauthorized persons, you can set the so called "secure"
attribute for your [Link] session cookies. This means that cookies are only transferred
over secure SSL connections.

To set the "secure" attribute for [Link] session cookies

1. Open the configuration file [Link] for the chosen web application.
2. In the <configuration> section, enter the following code snippet:

<[Link]>
<httpCookies requireSSL="true"/>
</[Link]>

3. Save the file.

Related topics

l Setting the "same-site" attribute for [Link] session cookies on page 37

l Setting the "HttpOnly" attribute for [Link] session cookies on page 36

Disabling Windows IIS 8.3 short names

The URL parser in Microsoft Internet Information Services (IIS) makes it possible for
remote attackers to reveal file and folder names of web applications (that should not be
accessible) by using IIS 8.3 short names.
Use of this weak point can lead to files with sensitive data, such as login data, configuration
files, maintenance scripts and other data, being passed on.
To prevent this, you can stop short names in Windows IIS 8.3 from being created.

To disable creation of Windows IIS 8.3 short names

1. On the system the web application is installed on, create the following registry entry:
l Path: HKLM\SYSTEM\CurrentControlSet\Control\FileSystem
l Name: NtfsDisable8dot3NameCreation
l Value: 1
2. Reinstall the web application.

One Identity Manager 8.1.2 Web Application Configuration Guide

38
Recommendations for secure operation of web applications
Detailed information about this topic

l [Link]
server/cc959352(v=technet.10)

Removing the HTTP response header in

Windows IIS
Attackers can obtain a lot of information about your servers and network by looking at the
response header your server returns.
To give attackers a little information as possible, you can remove the HTTP response
header in Windows IIS.

To remove the HTTP response header in Windows IIS

l Read the instructions in the following links:

l [Link]
l [Link]

Creating X-Frame-Options HTTP

response header
Attackers can create their own website and use it to load the contents of your website
within an iframe. This can result in a clickjacking attack, whereby the attacker targets user
input or tricks the user into performing undesired actions within the fake application.
To prevent this, you can create an X-Frame-Option HTTP response header. This stops site
content from being embedded into other websites.

To create an X-Frame-Option HTTP response header

1. Open the configuration file [Link] for the chosen web application.
2. In the <configuration> section, enter the following code snippet:

<httpProtocol>
<customHeaders>
<add name="X-Frame-Options" value="SAMEORIGIN" />
</customHeaders>
</httpProtocol>

3. Save the file.

One Identity Manager 8.1.2 Web Application Configuration Guide

39
Recommendations for secure operation of web applications
Running web applications in release
mode
To prevent user session from being stolen, run your web applications in release mode. This
stops the session ID being given in the HTML code.

To run web applications in release mode

1. Start the Web Designer.

2. Click on View | Home on the menu bar.
3. In the toolbar, click Select web application and select the web application you
want to use.
4. Click Edit web application settings.
5. Uncheck the Debugging box.
TIP: If the check box is not set anyway, you do not have to do anything. You web
application is now running in release mode.
6. Click OK.
7. Restart the Web Designer.
8. On the start page, select a web application and click Release (Compile
for release).

One Identity Manager 8.1.2 Web Application Configuration Guide

40
Recommendations for secure operation of web applications
 About us

About us

One Identity solutions eliminate the complexities and time-consuming processes often
required to govern identities, manage privileged accounts and control access. Our solutions
enhance business agility while addressing your IAM challenges with on-premises, cloud and
hybrid environments.

Contacting us
For sales and other inquiries, such as licensing, support, and renewals, visit
[Link]

Technical support resources

Technical support is available to One Identity customers with a valid maintenance contract
and customers who have trial versions. You can access the Support Portal at
[Link]
The Support Portal provides self-help tools you can use to solve problems quickly and
independently, 24 hours a day, 365 days a year. The Support Portal enables you to:

l Submit and manage a Service Request

l View Knowledge Base articles
l Sign up for product notifications
l Download software and technical documentation
l View how-to videos at [Link]/OneIdentity
l Engage in community discussions
l Chat with support engineers online
l View services to assist you with your product

One Identity Manager 8.1.2 Web Application Configuration Guide

41
About us