AFAIK proper way to authenticate AM with external web page is to use Identity Server Authentication APIs which was introduced in AM 5.0.2.

Check also this: https://www.microfocus.com/documentation/access-manager/5.0/admin/b13e0zob.html#authentication_api

Swagger is here: www.microfocus.com/.../authn-api-1.0.0

Hello,

I am not sure why you want to use the API, perhaps you can share more information on this project?

AAF-NAM integration can be done through OAUTH :

https://www.microfocus.com/documentation/access-manager/5.0/admin/adv_auth.html

Thanks.

Regards,

Luciano Testa

We use NAM already for reverse proxy and identity injection, so we want to build on that.  In our initial research, the built-in page that Advanced Authentication provides for initiating the multi-factor authentication did not have some functionality that we wanted to provide, so we thought we could create a custom page that can perform this authentication for us using the APIs and provide the functionality that we didn't see in the built-in page.  The built-in page automatically responds to NAM when MFA is successful (this must be done via OAUTH), and I'm trying to duplicate that behavior on our own page.

I don't know very much about NAM at all, so if there's any guidance you can provide for setting up OAUTH between NAM and AA, that would be extremely helpful.

Thank you for your advice.

Hello Keith,

Please check the link I copied in my previous answer, that is how AAF and NAM integrate using OAUTH:

https://www.microfocus.com/documentation/access-manager/5.0/admin/adv_auth.html

But you told me 'The built-in page automatically responds to NAM when MFA is successful (this must be done via OAUTH), and I'm trying to duplicate that behavior on our own page.' so this would seem to have been configured already. Can you please confirm?

Thanks.

Regards,

Luciano Testa

Yes, I have confirmed that OAUTH works when it is executed from the built-in page.  It seems like I could completely replace that built-in page if I was able to authenticate the user, trigger the MFA request, and perform the OAUTH in sequence from my own page.  But I haven't figured out how to trigger that same OAUTH request using the APIs.

Plus, would I be able to perform the same NAM identity injection if I used a custom page to trigger the OAUTH integration?

I apologize if these are dumb questions; I'm still climbing the learning curve.

Hello Keith,

For that you will need to use the AAF API. Here is the documentation. The first part shows a sample OAUTH integration.

https://www.netiq.com/documentation/advanced-authentication-64/apidoc/data/apidoc.html

In case you need further help there is always the option of engaging Professional Services.

I would say give the API a try once the OAUTH integration with NAM has been established and keep coming back to this forum for more information. 

Thanks.

Regards,

Luciano Testa

And because there is more than one way to skin a cat, you could also integrate AAF-NAM using the plug-in instead of OAUTH.

When you do this, the pages are presented by NAM and are relatively easy to customize. The videos linked below show a couple of examples.

https://vimeo.com/910960635?share=copy

https://vimeo.com/561948345?share=copy

Thanks.

Regards,

Luciano Testa