Configuring User Management

You can use various settings to customize User Management. Some of these settings are available in administration console and others can be changed only by editing a configuration file.

AEM forms provides two ways to enable single sign-on (SSO) – HTTP headers and SPNEGO.

When SSO is implemented, the AEM forms user login pages are not required and do not appear if the user is already authenticated through their company portal.

If AEM forms cannot authenticate a user by using either of these methods, the user is redirected to a login page.

User Management usually performs authentication by using a user name and password. User Management also supports certificate-based authentication, which you can use to authenticate users through Acrobat or to authenticate users programmatically. For details about authenticating users programmatically, see Programming with AEM forms .

To use certificate-based authentication, import a Certificate Authority (CA) certificate that you trust into the Trust Store and then create a certificate mapping.

For synchronization to work properly over LDAPS, the LDAP certificates that the certificate authority (CA) issued must be present in the application server’s Java runtime environment (JRE). Import the certificate into the application server’s JRE cacerts file, which is usually in the [JAVA_HOME] /jre/lib/security/cacerts directory.

1. Enable SSL on the directory server. For details, see the documentation provided by your directory vendor.

2. Export a client certificate from the directory server.

3. Use the keytool program to import the client certificate file into the default Java virtual machine (JVM™) certificate store of the AEM forms application server . The procedure for this task varies, depending on your JVM and client installation paths. For example, if you use BEA WebLogic Server with JDK 1.5, from a command prompt, type this text:

   keytool -import -alias alias -file certificatename -keystore C:\bea\jdk15_04\jre\lib\security\cacerts

4. When prompted, type the password. (For Java, the default password is changeit .) A message appears stating that the certificate is imported successfully.

5. When prompted, type Yes to trust the certificate.

6. Enable SSL in User Management and, when configuring the directory settings, select Yes for the SSL option and change the port setting accordingly. The default port number is 636.

Use the Configure Advanced System Attributes page to modify certain settings in the configuration file without the need to export, edit, and import the file. (See Importing and exporting the configuration file .)

1. In administration console, click Settings > User Management > Configuration > Configure Advanced System Attributes.

2. (Optional) Change any of the following session attributes:

   Session Timeout Limit (Minutes): The amount of time, in minutes, before a user is automatically logged out of the system. By default, AEM forms components such as Workbench time out after two hours, regardless of activity or inactivity, and the user must log in again. Valid values are 1 to 1440 . The default value is 120 (2 hours). This setting updates the SAML/Producer/assertionValidityInMinutes entry key in the configuration file.

   You should not set Session Timeout Limit below 10 minutes as the system may not behave correctly. The recommended value is 10–120 (minutes).

   Assertion Threshold (Seconds): A buffer time to offset delays due to system time differences between AEM forms application server s in a cluster. AEM forms backdates a user's login time by the amount of time (in seconds) specified in this property. Valid values are 0 to 3600 . The default value is 60 . This setting updates the SAML/Producer/assertionThresholdInSeconds entry key in the configuration file.

   Maximum Allowed Renewals of an Assertion: The maximum number of times a user's session can be transparently renewed without requiring a login. Valid values are 0 to 9999 . A value of 0 means that assertions are not renewed. The default value is 10. This setting updates the SAML/Producer/maxAssertionRenewalCount entry key in the configuration file.

3. (Optional) Change any of the following directory synchronization attributes:

   Synch Statistics Logging: Specifies whether User Management logs detailed statistics during the synchronization process. (See Enable or disable detailed logging during synchronization .)

   Synch Finisher Cron Expression: The interval at which User Management retries failed synchronizations. (See Configure the directory synchronization retry option .)

   Cluster Job Lock Timeout In Minutes: Used in clustered environments. If the synchronization on one node fails and the cluster lock is not released, this value specifies the number of minutes that another node waits before forcibly acquiring the lock. The default value is 15 minutes. Valid values are 1 to 1440 minutes.

4. (Optional) Change the following attributes and then click OK:

   User Manager Event Auditing: Select this option to enable auditing of directory synchronization events and of authentication events such as success, failure, and lockout. By default, this option is not selected unless you installed a component that requires auditing, such as Rights Management. This setting updates the APSAuditService entry key in the configuration file.

   Auto Creation of Dynamic Group: Enables the automatic creation of dynamic groups based on email domains. (See Create a dynamic group .)

You can also revert to the original User Management settings by clicking Reload.

Security Assertion Markup Language (SAML) is one of the options that you can select when configuring authorization for an enterprise or hybrid domain. SAML is primarily used to support SSO across multiple domains. When SAML is configured as your authentication provider, users log in and authenticate to AEM forms via a specified third-party identity provider (IDP).

For an explanation of SAML, see Security Assertion Markup Language (SAML) V2.0 Technical Overview .

1. In administration console, click Settings > User Management > Configuration > SAML Service Provider Settings.

2. In the Service Provider Entity ID box, type a unique ID to use as an identifier for the AEM forms service provider implementation. You also specify this unique ID when configuring your IDP (for example, um.lc.com .) You can also use the URL that is used to access AEM forms (for example, http://AEMformsserver ).

3. In the Service Provider Base URL box, type the base URL for your forms server (for example, http://AEMformsserver:8080 ).

4. (Optional) To enable AEM forms to send signed authentication requests to the IDP, perform the following tasks:

   • Use Trust Manager to import a credential in PKCS #12 format with Document Signing Credential selected as the Trust Store Type. (See Managing local credentials .)

   • In the Service Provider Credential Key Alias list, select the alias you assigned to the credential in Trust Store.

   • Click Export to save the URL contents to a file and then import that file into your IDP.

5. (Optional) In the Service Provider Name ID Policy list, select the name format that the IDP uses to identify the user in a SAML assertion. The options are Unspecified, Email, X509 Subject Name, Kerberos Principal, Entity, Persistent, Transient, or Windows Domain Qualified Name.

   Note: Name formats are not case-sensitive.

6. (Optional) Select Enable Authentication Prompt For Local Users. When this option is selected, users will see two links:

   • a link to the login page of the third-party SAML identity provider, where users who belong to an Enterprise domain can authenticate.

   • a link to the AEM forms login page, where users who belong to a Local domain can authenticate.

   When this option is not selected, users will be taken directly to the login page of the third-party SAML identity provider, where users who belong to an Enterprise domain can authenticate.

7. (Optional) Select Enable Artifact Binding to enable artifact binding support. By default, POST binding is used with SAML. But if you have configured Artifact Binding, select this option. When this option is selected, the actual user assertion is not passed through the Browser request. Instead, a pointer to the assertion is passed and the assertion is retrieved using a backend web service call.

8. (Optional) Select Enable Re-Direct Binding to support SAML bindings that use redirects.

9. (Optional) In Custom Properties, specify additional properties. The additional properties are name=value pairs separated by new lines.

   • You can configure AEM forms to issue a SAML assertion for a validity period that matches the validity period of a third-party assertion. To honor the third-party SAML assertion timeout, add the following line in Custom Properties:

     saml.sp.honour.idp.assertion.expiry=true

   • Add the following custom property for using RelayState to determine the URL where the user will be redirected after successful authentication.

     saml.sp.use.relaystate=true

   • Add the following custom property to configure the URL for the custom Java Server Pages (JSP), which will be used to render the registered list of identity providers. If you have not deployed a custom web application, it will use the default User Management page to render the list.

     saml.sp.discovery.url=/custom/custom.jsp

10. Click Save.

Use the Manual Configuration page to download a copy of the configuration settings in XML format. The settings in this file control all server preferences. You can then edit the file and upload it back to the server. You can also use the file to configure another AEM forms product instance.

To avoid security risks, the bind password value for the directory server is not included in an exported configuration file. Update the password in the XML file before you import the file to a new system.

To avoid security risks, the bind password field in the exported configuration file (config.xml) is not configured. Before you import the configuration file into another system, ensure that you configure this password. This password overrides an existing password that is stored in the database. A null password does not override an existing non-null password value.

1. In administration console, click Settings > User Management > Configuration > Import And Export Configuration Files.

2. To export the current configuration setting to a file, click Export and save the configuration file in another location.

3. In the file, locate the Domains > [Your domain name] > DirectoryConfigs > LDAPGroupConfig node. Here is an example:

   <node name="LDAPGroupConfig"> 
       <map> 
           <entry key="bindanonymously" value="false" />  
           <entry key="basedn" value="dc=corp,dc=adobe,dc=com" />  
           <entry key="batchSize" value="200" />  
           <entry key="binduser" value="cn=Directory Manager" />  
           <entry key="bindpassword" value="" /> 
       </map>

   Type a value for bindpassword and save your changes.

4. In the file, locate the Domains > [Your domain name] > DirectoryConfigs > LDAPGroupConfig > LDAPUserConfig node. Here is an example:

   <node name="LDAPUserConfig"> 
       <map> 
           <entry key="bindanonymously" value="false" />  
           <entry key="batchSize" value="200" />  
           <entry key="basedn" value="dc=corp,dc=adobe,dc=com" />  
           <entry key="bindpassword" value="" /> 
           <entry key="binduser" value="cn=Directory Manager" />  
       </map>

   Type a value for bindpassword and save your changes.

5. To import the updated file, in User Management, click Configuration > Import And Export Configuration Files.

6. Click Browse to find the file, click Import, and then click OK.

If you configured multiple authentication providers, you can change the order in which AEM forms evaluates them for authentication. The order of the authentication providers that are listed in the config.xml file determines the order of evaluation for authentication.

1. In administration console, click Settings > User Management > Configuration > Import And Export Configuration Files.

2. To export the current configuration setting to a file, click Export and save the configuration file in another location.

3. Find the following node in the file:

   <node name="AuthSchemes"> 
       <map />  
           <node name="CertificateAuth"> 
               <map> 
                   <entry key="order" value="3" />  
                   <entry key="name" value="edc.server.auth.scheme.certificate" />  
               </map> 
       </node> 
       <node name="Kerberos"> 
           <map> 
               <entry key="kerberosSPN" value="defaultSPN" />  
               <entry key="order" value="1" />  
               <entry key="name" value="edc.server.auth.scheme.kerberos" />  
           </map> 
   </node>

   In <entry key="order" value="3" /> , edit the value for each node to set the order of the authentication evaluation.

4. To import the updated file, in User Management, click Configuration > Import And Export Configuration Files.

5. Click Browse to find the file, click Import, and then click OK.

Users may experience a slower response time if they belong to many groups (for example, 500 or more) or if the groups are nested deeply (for example, 30 levels). If you are experiencing this problem, you can configure AEM forms to prefetch information from certain domains.

1. In administration console, click Settings > User Management > Configuration > Import And Export Configuration Files.

2. To export the current configuration setting to a file, click Export and save the configuration file in another location.

3. Add the following node (marked in bold):

   <node name="UM"> 
   <map/>  
   <node name="PrincipalCache"> 
       <map> 
           <entry key="principalCacheSize" value="1000"/> 
           <entry key="principalCacheBatchFetchSize" value="10"/> 
           <entry key="rebuildCacheAfterSync" value="true /> 
           <entry key="enableFullPrefetch" value="false"/> 
           <entry key="principalCacheDomains" value="Domain_Name1/Domain_Name2/Domain_Name3"/> 
       <map> 
   </node> 
   <node name="APSAuditService">

   In this example, multiple domains are configured for prefetch. The domain names are separated by a "/". This is shown in the example above with Domain_Name1 , Domain_Name2 , and Domain_Name3 .

4. To import the updated file, in User Management, click Configuration > Import And Export Configuration Files.

5. Click Browse to find the file, click Import, and then click OK.