McAfee Cloud Identity Manager

NetSuite Cloud Connector Guide McAfee Cloud Identity Manager version 2.0 or later

COPYRIGHT Copyright 2013 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, Avert, epo, epolicy Orchestrator, Foundstone, GroupShield, IntruShield, LinuxShield, MAX (McAfee SecurityAlliance Exchange), NetShield, PortalShield, Preventsys, SecureOS, SecurityAlliance, SiteAdvisor, SmartFilter, Total Protection, TrustedSource, Type Enforcement, VirusScan, and WebShield are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANTOR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

Contents 1.0 Introduction to McAfee Cloud Identity Manager... 5 1.1 Supported environments... 6 1.2 Supported browsers... 6 1.2.1 Application portal... 6 1.2.2 Management Console... 6 1.3 Available documentation... 7 1.4 Technical support... 7 2.0 Configuring SSO for a NetSuite User... 9 2.1 NetSuite Cloud Connector Overview...10 2.2 Generating an RSA Key Pair Using OpenSSL...11 3.0 Configuring a NetSuite Cloud Connector...13 3.1 Select the Cloud Application Type...14 3.2 Specifying an Identity Connector...14 3.2.1 Select an Existing Identity Connector...15 3.2.2 Create a New Identity Connector...17 3.3 Configure Credential Mapping for a NetSuite Cloud Connector...18 3.4 Configuring SSO for a NetSuite Cloud Connector...19 3.4.1 Configure SSO for a NetSuite Cloud Connector...20 3.5 Apply an Authorization Policy to a NetSuite Cloud Connector...22 3.5.1 Configure the default policy action...22 3.5.2 Configure policy rules and add them to the policy...23 3.5.3 Policy conditions and their Boolean expressions...24 3.5.4 Expression editor examples...27 3.6 Review the NetSuite Cloud Connector Configuration...29 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 3

4 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

1.0 Introduction to McAfee Cloud Identity Manager McAfee Cloud Identity Manager (Cloud Identity Manager, formerly Intel Expressway Cloud Access 360-SSO) simplifies the management and secures the use of cloud, Software as a Service (SaaS), and web applications for companies and large organizations. Service and application providers can also use Cloud Identity Manager to simplify and improve the authentication process for their customers. Cloud Identity Manager provides support for the following features: Extensible framework Web single sign on (SSO) Multiple authentication methods Credential mapping and user provisioning Authorization policies and access control enforcement Event auditing and monitoring Connectors for popular cloud services and applications Web-based Management Console Cloud Identity Manager runs as a stand-alone server and is configured by an administrator using a webbased Management Console accessible from a web browser. For information about installing Cloud Identity Manager as a standalone server or as a cluster of servers, see the McAfee Cloud Identity Manager Installation Guide. For information about configuring Cloud Identity Manager in the Management Console, see the McAfee Cloud Identity Manager Product Guide. Cloud Identity Manager provides connectors for many popular cloud services and applications, including Google Apps and Salesforce.com. These connectors are built in to Cloud Identity Manager and simplify the deployment of the cloud service or application in an organization. Web SSO requires configuration in the Management Console and in the cloud application s user interface. Instructions for configuring SSO on the cloud application side are included in the documentation set. For customers who have Java-based or.net web applications that do not support SAML2 authentication, Cloud Identity Manager provides a custom connector. For information about integrating Java-based and.net web applications with Cloud Identity Manager, see the McAfee Cloud Identity Manager Integration Guide. For software developers who want to write their own cloud service connectors or authentication modules, Cloud Identity Manager provides an SDK. For more information about the SDK, see the McAfee Cloud Identity Manager Developer s Guide. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 5

1.1 Supported environments Cloud Identity Manager supports these environments. Version Architecture IA-32 Intel 64 Linux Operating System Red Hat Enterprise Linux Server and Advanced Platform 5.0 Windows Operating System Yes Yes Windows Server 2003 Standard Edition Yes Yes Windows Server 2003 DataCenter Edition Yes Yes Windows Server 2003 Enterprise Edition Yes Yes Windows Server 2008 Yes Yes 1.2 Supported browsers Cloud Identity Manager supports different browsers for the application portal and the Management Console. 1.2.1 Application portal For end users who seek access to SaaS and web applications through a portal using Cloud Identity Manager identity services, Cloud Identity Manager supports the following desktop and mobile web browsers. Note that Cloud Identity Manager services are running in the background and are not visible to the end user. Desktop browsers Google Chrome 16 Mozilla Firefox 9 Microsoft Internet Explorer 7, 8, and 9 Safari 5.1.2 Mobile browsers Android 2.0 devices and WebKit browser ios devices and Safari browser 1.2.2 Management Console The Cloud Identity Manager Management Console is a web-based user interface that provides administrators with a single, central point of management and control through a web browser on a local computer. For Management Console administrators, Cloud Identity Manager supports the following desktop and mobile web browsers. Desktop browsers Firefox 9 Internet Explorer 7, 8, and 9 Mobile browsers None are currently supported. 6 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

1.3 Available documentation The Cloud Identity Manager documentation set includes the following guides: McAfee Cloud Identity Manager Product Guide A complete guide to the Management Console and the configuration tasks needed to administer Cloud Identity Manager McAfee Cloud Identity Manager Developer s Guide Provides information for software developers who want to write custom Java code that extends Cloud Identity Manager functionality McAfee Cloud Identity Manager Installation Guide Includes the tasks and procedures that you need to install and remove Cloud Identity Manager as a standalone server on Microsoft Windows and Linux operating system platforms McAfee Cloud Identity Manager Integration Guide Provides instructions on how to integrate Javabased and.net web applications that do not support SAML2 authentication with Cloud Identity Manager Note: In addition to these guides, there are separate guides that document how to configure the different Cloud Connectors. For more information, see the McAfee Cloud Identity Manager Product Guide. 1.4 Technical support For technical assistance, contact McAfee support by one of the following options: Support portal: https://mysupport.mcafee.com Phone number: 1-800-937-2237 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 7

8 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

2.0 Configuring SSO for a NetSuite User NetSuite supports Identity Provider (IdP)-initiated single sign-on (SSO). In IdP-initiated SSO, the end user sends the request for access to Cloud Identity Manager. Cloud Identity Manager initiates SSO by forwarding the request to an identity store or authentication service. In the context of providing identity and SSO services, Cloud Identity Manager is also a Service Provider (SP). Configuring SSO for NetSuite users includes the following tasks. For more information, see the corresponding sections. For an overview, see section 2.1 NetSuite Cloud Connector Overview. Generating an RSA Key Pair Using OpenSSL See section 2.2 Generating an RSA Key Pair Using OpenSSL. Configuring a NetSuite Cloud Connector in the Cloud Identity Manager Management Console See section 3.0 Configuring a NetSuite Cloud Connector. Note: After you configure the NetSuite Cloud Connector, the first login to NetSuite must be to the NetSuite administrator s account. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 9

2.1 NetSuite Cloud Connector Overview NetSuite s inbound single sign-on feature allows users to authenticate using Cloud Identity Manager and then access NetSuite without having to log in again. Cloud Identity Manager passes authentication information to NetSuite with an encrypted token. When integrated with NetSuite, Cloud Identity Manager is called the external application. 1. The user requests access to a NetSuite application or Web store through Cloud Identity Manager. 2. Cloud Identity Manager authenticates the user against the Identity Provider. 3. Cloud Identity Manager redirects the user to NetSuite with an encrypted token and the authentication information. 4. NetSuite decrypts the token and checks the timestamp. If the timestamp is valid, NetSuite grants access to the user. 10 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

2.2 Generating an RSA Key Pair Using OpenSSL An RSA key pair is needed for encrypting and decrypting security tokens. Cloud Identity Manager uses the private key to encrypt the security token, and NetSuite uses the public key paired with the private key to decrypt the security token. Generating the public-private key pair and distributing the keys includes the following steps: 1. Generating a key pair using OpenSSL. 2. Sending the public key to NetSuite. 3. Importing the private key in Cloud Identity Manager. To generate a key pair and distribute the keys, you: 1. Download the inbound single sign-on kit from NetSuite: https://system.netsuite.com/download/nlsinglesignon.zip 2. Install OpenSSL from the OpenSSL subdirectory in the inbound single sign-on kit provided by NetSuite or from the OpenSSL website: http://www.openssl.org/source. 3. Type openssl in a command prompt. The OpenSSL prompt opens. 4. At the OpenSSL prompt, type the following command: genrsa out <privkey.pem> -rand <f1><s><f2><s><f3><s><f4><s><f5> 1024 <privkey.pem> Specifies the name of the output file. <f1>... <f5> Specify the names of five files that are used as random seeds. <s> Specifies a separator, as follows: ; semicolon Windows, comma OpenVMS : colon all other operating systems A private key is generated having the length 1024. 5. Convert the private key from the PEM format to the DER format, as follows: java com.netledger.forpartners.encryption.pem2der <privkey.pem> <privkey.der> <privkey.pem> Specifies the name of the output file in PEM format. <privkey.der> Specifies the name of the output file in DER format. 6. Extract the public key from the private key, as follows: java com.netledger.forpartners.encryption.priv2pub <privkey.der> <pubkey.der> <privkey.der> Specifies the private key generated using OpenSSL. <pubkey.der> Specifies the public key extracted from the private key. 7. Send the public key to NetSuite by email: CertSignReq@netsuite.com. a. In the subject line, include your NetSuite Company ID and your company s name. b. In the message body, include the email address of the NetSuite account administrator who is setting up inbound single sign-on. c. Attach the public key DER file in zipped format. 8. Import the private key in Cloud Identity Manager. For more information, see section 3.4 Configuring SSO for a NetSuite Cloud Connector. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 11

12 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.0 Configuring a NetSuite Cloud Connector A Cloud Connector is the configuration that allows Cloud Identity Manager to connect to and provide services for a cloud application. When a NetSuite Cloud Connector is configured, Cloud Identity Manager can provide identity and SSO services for NetSuite users. You configure a NetSuite Cloud Connector in the Cloud Connector wizard in the Cloud Identity Manager Management Console. Configuring a NetSuite Cloud Connector in the wizard involves the following steps. For more information about each step, see the corresponding sections: 1. Cloud Application Type See section 3.1 Select the Cloud Application Type. 2. Identity Connector See section 3.2 Specifying an Identity Connector. 3. Credential Mapping See section 3.3 Configure Credential Mapping for a NetSuite Cloud Connector. 4. SSO Configuration See section 3.4 Configuring SSO for a NetSuite Cloud Connector. 5. Authorization Enforcement See section 3.5 Apply an Authorization Policy to a NetSuite Cloud Connector. 6. Review See section 3.6 Review the NetSuite Cloud Connector Configuration. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 13

3.1 Select the Cloud Application Type A Cloud Connector is the configuration that allows Cloud Identity Manager to connect to and provide services for a cloud application. For example, a NetSuite Cloud Connector is the configuration that allows Cloud Identity Manager to connect to a NetSuite application and to provide SSO, SLO, and other services. To select the NetSuite cloud application type 1. Select the Cloud Connectors tab in the Management Console, and then click New Cloud Connector. The Cloud Connector wizard opens on the Cloud Application Type step. 2. Select the cloud application type: NetSuite. Note: If the application is not one of the built-in types shown in the Cloud Application Type window, click More to open the More Applications window. This window shows all plug-in cloud application types in the Cloud Identity Manager system. 3. Type a name for the NetSuite Cloud Connector in the Cloud Connector Name field. Note: The name can contain only letters, numbers, and the following characters:., _ and -. The name cannot contain spaces or exceed 64 characters in length and is not case-sensitive. Specify a meaningful name. For example, a name that identifies the Cloud Connector-Identity Connector combination is more useful than a URL, which can change. 4. Click Next. The Identity Connector step opens. 3.2 Specifying an Identity Connector To specify an Identity Connector, you select an existing Identity Connector or create a new one. There are six types of Identity Connectors: LDAP Integrated Windows Authentication with Active Directory (IWA-AD) ECA360 Token Authentication Authentication Chain SAML2 Proxy Central Authentication Service (CAS) For LDAP and IWA-AD Identity Connectors, identity information is retrieved from an identity store. To configure these Identity Connectors, you specify the ID of the identity store containing the identity information and how to search the specified identity store. To specify the search, you configure the following LDAP parameters: Base DN Specifies where to start searching in the LDAP tree Search Attribute Specifies the user attribute to retrieve from the identity store Search Scope Specifies how many levels to search in the LDAP tree below the Base DN For CAS and other Identity Connectors, identity information is retrieved from an authentication result provided by an external authentication service. To configure one of these Identity Connectors, you specify fields specific to each connector type. 14 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.2.1 Select an Existing Identity Connector If the Identity Connector is already configured, you can select it on the Identity Connector step of the Cloud Connector wizard. The settings on this step depend on the Identity Connector you select. For example, the Enable Additional Authentication Module(s) area is only displayed when the following conditions are met: The selected Identity Connector type is an authentication chain. When the authentication chain was created, one or more authentication modules were configured as Determined by Cloud Connector on the Policy Setting step of the Authentication Module wizard. To enable these modules, select the checkboxes in the Enable Additional Authentication Module(s) area. For more information, see the McAfee Cloud Identity Manager Product Guide. To select an existing Identity Connector 1. Select an existing Identity Connector from the list in the window, or click New Identity Connector to create a new one and add it to the list. 2. (Optional) To test the connection to the Identity Connector, click Test. Note: The Test button is disabled for Identity Connectors of type authentication chain. 3. (Optional) Select a user-defined portal category from the Category drop-down list, click Manage Categories, or both. For more information, see the next section. 4. (Optional) In the Enable Additional Authentication Module(s) area, select the checkboxes corresponding to the authentication modules you want to enable. Note: This area is only displayed when one or more modules in an authentication chain are configured as Determined by Cloud Connector. Example: OTP () 5. Click Next. The Identity Connector configuration is saved. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 15

3.2.1.1 Manage User-defined Portal Categories On the Identity Connector step of the Cloud Connector wizard, you can assign a user-defined portal category to the Cloud Connector that you are configuring. User-defined portal categories allow you to group applications having the same category on the application portal associated with that Identity Connector. For example, all applications tagged with the Cash Management category are displayed together on the portal. Each Identity Connector has its own menu of categories. To manage user-defined portal categories 1. To manage user-defined portal categories, click Manage Categories on the Identity Connector step of the Cloud Connector wizard. The Manage Categories dialog box opens. To add a new category, click Add, provide values for the fields in the Add Category dialog box, and click Save. URL Specifies the portal URL that you can use to access the Cloud Identity Manager service and the category ID. This value is provided for you. Name Specifies the name of the new category. Description (Optional) Specifies a description of the new category. To edit an existing category, click Edit, modify the values in the fields in the Edit Category dialog box, and click Save. To remove an existing category, select it in the Manage Categories dialog box, and click Remove. 2. Click OK. The Manage Categories dialog box closes, and the categories are saved and added to the Categories drop-down list in the Identity Connector window. 16 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.2.2 Create a New Identity Connector To create a new Identity Connector, you specify a name and an Identity Connector type. Fields open that correspond to the type that you select. To configure an LDAP or IWA-AD Identity Connector, you create a new or use an existing identity store. To configure a CAS or other Identity Connector, you specify fields specific to that connector type. You begin this procedure on the Identity Connector step of the Cloud Connector wizard. To create a new Identity Connector 1. Click New Identity Connector. The New Identity Connector dialog box opens. 2. Type a name in the Identity Connector field. 3. Select one of the following types from the Identity Connector Type drop-down list: LDAP Integrated Windows Authentication with Active Directory (IWA-AD) ECA360 Token Authentication Authentication Chain SAML2 Proxy Central Authentication Service (CAS) The New Identity Connector dialog box expands to show the parameters required to configure the selected Identity Connector type. 4. Configure the parameters required for the specified Identity Connector type. For more information, see the McAfee Cloud Identity Manager Product Guide. 5. Click Save Identity Connector. The Identity Connector configuration is saved. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 17

3.3 Configure Credential Mapping for a NetSuite Cloud Connector To configure credential mapping, specify the subject type and source. The subject is the user whose identity is authenticated. The subject type is the type of identity information. For example, identity information can be a constant string value, an authentication result, or the result of an expression. The subject source is a value that corresponds to the specified subject type. For example, if the subject type is an authentication result, the subject source is the result of an authentication decision. Because the subject source uniquely identifies the subject or user, it must have a unique value. This procedure begins on the Credential Mapping step of the Cloud Connector wizard. To configure credential mapping for a NetSuite Cloud Connector 1. Select a subject type from the Subject Type drop-down list: CONSTANTS Specifies a constant string value. AUTHN_RESULT_FIELD Specifies the result of an authentication decision. EXPRESSION Specifies the result of an expression. 2. Type the value corresponding to the specified subject type in the Subject Source field. 3. Click Next. The SSO Configuration window opens. 18 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.4 Configuring SSO for a NetSuite Cloud Connector To configure SSO for a NetSuite Cloud Connector, you generate an RSA public-private key pair using OpenSSL, send the public key to NetSuite, and import the private key in Cloud Identity Manager. Cloud Identity Manager uses the private key to encrypt the token. NetSuite uses the public key paired with the private key to decrypt the token. The token is a hex-encoded, encrypted string containing the following information: Company ID Specifies the string assigned by the Cloud Identity Manager administrator to the company associated with the end user. The Company ID is also known as the remote company ID. The string value cannot contain spaces. User ID Specifies the string that Cloud Identity Manager uses to uniquely identify the user. The string value cannot contain spaces. Timestamp Specifies the time of token creation as a decimal string that represents the number of milliseconds since January 1, 1970, 00:00:00 GMT. Note: Before encryption, the token string has the following format: <companyid><space><userid><space><timestamp> For information about generating the public-private key pair, see section 2.2 Generating an RSA Key Pair Using OpenSSL. To import the private key in Cloud Identity Manager, see section 3.4.1 Configure SSO for a NetSuite Cloud Connector. You also provide values for the parameters that Cloud Identity Manager uses to build the redirect URL. The redirect URL is based on the target NetSuite service, as follows. Application When the target service is a NetSuite application, the redirect URL is based on the string: https://system.netsuite.com/pages/partners/singlesignon.jsp?a=<token> <token> Specifies the hex-encoded, encrypted token string. Web Store When the target service is a NetSuite Ecommerce website, the redirect URL is based on the string: https://checkout.netsuite.com/app/site/backend/sitesso.nl?a=<token> In addition to specifying the target NetSuite service, you provide values for the following parameters. Cloud Identity Manager uses these values to build the redirect URL from the base URL. Some parameters are only required for one of the two NetSuite target services: Company ID (pacct) Assigned by the Cloud Identity Manager administrator to the company associated with the end user. Partner ID (pid) Assigned by NetSuite Customer Support to Cloud Identity Manager after you purchase the inbound single sign-on feature. Landing URL (landingurl) Optional single sign-on login page. Hide Login Page (hideloginpage) Optional Boolean value. Return URL (returnurl) Required when Hide Login Page is TRUE. Site Domain Optional custom domain name for your Web store. NetSuite Company ID (c) Assigned by NetSuite and required for Web store access when Site Domain is not set. Site ID (n) Required for Web store access when Site Domain is not set. You can locate the site ID on the preview page of your website. Example Redirect URL for a NetSuite Application: https://system.netsuite.com/pages/partners/singlesignon.jsp?a=<token> &pid=36530&pacct=lenkelectriccompany Example Redirect URL for a Web Store: https://checkout.netsuite.com/app/site/backend/sitesso.nl?a=<token> &pid=36530&hideloginpage=true&returnurl=http://www.lec.com/ &c=896983&n=1 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 19

3.4.1 Configure SSO for a NetSuite Cloud Connector To configure SSO for a NetSuite Cloud Connector, you import the private key that Cloud Identity Manager uses to encrypt the token, and you provide values for the parameters that Cloud Identity Manager uses to build the redirect URL. To configure SSO for a NetSuite Cloud Connector 1. Click Upload Key. The Import Key dialog box opens. 2. Click Browse to locate and open the private key file. Example: netsuite_private-key.der 3. Click Upload Certificate to import the private key in Cloud Identity Manager. 4. Click Ok to close the Import Key dialog box and configure SSO. 5. In the SSO Configuration window, complete the following fields: Company ID (pacct) Specifies the identifier assigned by the Cloud Identity Manager administrator to the company associated with the end user. The Company ID is also known as the remote company ID. Note: The Company ID cannot contain any spaces. Example: pacct=lenkelectriccompany Partner ID (pid) Specifies the identifier assigned by NetSuite Customer Support to Cloud Identity Manager. NetSuite associates this value with the public key Cloud Identity Manager provides and uses the public key to decrypt the token. Example: pid=36530 20 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

Target service Specifies the NetSuite service to which Cloud Identity Manager redirects the user with the encrypted token (a). The target service has one of two values: Application (app) The user is redirected to a NetSuite application. Web Store (site) The user is redirected to a NetSuite Ecommerce website. Landing URL (landingurl) (Optional) Specifies the webpage to which NetSuite redirects the user. This page is called the inbound single sign-on login page. Application default: user s home page Web Store default: site home page Example: landingurl=http://www.lec.com/login/ Hide Login Page (hideloginpage) Specifies whether to use the Return URL s value in place of the Landing URL s value, as follows: TRUE Select this checkbox to use the value specified by the Return URL (hideloginpage=true). FALSE Deselect this checkbox to use the value specified by the Landing URL (hideloginpage=false). Return URL (returnurl) Specifies a webpage to which SSO users are redirected when they log out, a session times out, or errors occur. Note: This parameter is required when Hide Login Page is set to TRUE. Default: returnurl=landingurl Example: returnurl=http://www.lec.com/logout/ Specify Site Domain (Web Store) Specifies whether to use the default NetSuite domain or a custom domain for your company s Web store, as follows: TRUE Select this checkbox to use a custom domain for your company s Web store. FALSE Deselect this checkbox to use the default NetSuite domain (checkout.netsuite.com). Site Domain (Web Store) Specifies a custom domain for accessing your company s Web store. Example: shop.lec.com NetSuite Company ID (c) (Web Store) Specifies the identifier assigned by NetSuite to your company. This value is required when the target service is a Web store, and the domain setting is the NetSuite default. Example: c=896983 Site ID (n) (Web Store) Identifies the website when you have more than one website in your Web store. This value is required when the target service is a Web store and the domain setting is the NetSuite default. Example: n=1 Note: You can view the site ID on the website preview page by navigating to Setup Web Site Preview Web Site. 6. Click Next. The Authorization Enforcement window opens. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 21

3.5 Apply an Authorization Policy to a NetSuite Cloud Connector On the Authorization Enforcement step of the Cloud Connector wizard, you can build an authorization policy that determines which users can access your cloud application and under what conditions. To build the policy, you configure individual policy rules and add them to the overall policy. Each rule consists of an expression, which can be made up of sub expressions. Each rule has an action, as does the overall policy. The rule action is to permit or deny access to your cloud application when the rule evaluates to TRUE. The overall policy action the default action is to permit or deny access to your cloud application when none of the rules in the policy evaluates to TRUE. When the policy configuration area first opens, the default policy action is set to deny access. 3.5.1 Configure the default policy action Configure the overall policy action for when none of the rules in the policy evaluates to TRUE. 1. Select the Enable Authorization Policy checkbox. The policy configuration area opens. 2. To modify the overall policy action, click the Permit access to myapp or Deny access to myapp link that is shown, where myapp is the name of your cloud application, select an option in the Change Default Action dialog box, and click OK. 22 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.5.2 Configure policy rules and add them to the policy Each policy rule has an action and consists of an expression, which can be made up of sub expressions. 1. Click Add Rule, select an option in the Rule Action dialog box, and click OK. The new rule is added above the Add Rule button and shown with the selected permit or deny action. 2. Configure the new rule by clicking the following options. For more information about configuring expressions, see section 3.5.3 Policy conditions and their Boolean expressions. Table 1. Option Policy Rule Configuration Options Description (Permit Deny) access to myapp Delete Rule AND OR +! Move Down Move Up Toggles the rule s action from permit to deny and deny to permit. Note: myapp is the name you assign to the Cloud Connector. Deletes the rule. Toggles the Boolean operators that specify whether the relationship among the expressions in the group at the current level of the rule have an AND relationship or an OR relationship. Note: All expressions at one level in the rule have the same Boolean relationship. Opens the Add Expression dialog box where you can configure an expression and add it to the rule. Note: Clicking the + sign above a group of expressions adds the expression to the bottom of the group. Clicking the + sign to the right side of an individual expression creates a sub group that consists of the selected expression and the new expression. Alternately adds the NOT operator to and removes the NOT operator from the group of expressions at the current level in the rule. Moves the rule down one position in the rule list in the configuration area. Note: This option is only visible when more than one rule is added to the policy. Moves the rule up one position in the rule list in the configuration area. Note: This option is only visible when more than one rule is added to the policy. 3. Click Next. The Review step opens. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 23

3.5.3 Policy conditions and their Boolean expressions When you configure an expression, you first select the expression type or condition. When the condition is met, the expression evaluates to TRUE. The conditions and their corresponding Boolean expressions are shown in the following table. Condition Access Time Day of Week Client IP Address Client Device Subject Attribute Match Advanced Expression Boolean Expression The time of access falls within the specified time range. The day of the week belongs to the specified set of days. The client IP address falls within the specified address range. The client device has one of the specified types. The user attribute value meets the specified match. The specified Boolean expression evaluates to TRUE. 3.5.3.1 Restrict access to the specified time range You can restrict when users are allowed to access your application to a specified time range. 1. Click + to open the Add Expression dialog box. 2. Select Access Time from the Expression Type drop-down list. 3. Select an operator from the Access Time drop-down list, and specify the required values: Between Select a starting and ending time for the time range from the From and To dropdown lists, respectively. Greater than Select a value from the Time drop-down list. Less than Select a value from the Time drop-down list. Greater than or equal to Select a value from the Time drop-down list. Less than or equal to Select a value from the Time drop-down list. 4. Click OK to close the dialog box and add the expression to the policy rule. 3.5.3.2 Restrict access to specified days of the week You can restrict when users are allowed to access your application to specified days of the week. 1. Click + to open the Add Expression dialog box. 2. Select Day of Week from the Expression Type drop-down list. 3. Select one or more of the checkboxes corresponding to the days of the week. 4. Click OK to close the dialog box and add the expression to the policy rule. 24 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.5.3.3 Restrict access to the specified range of client IP addresses You can restrict access to your application to users having an IP address in the specified range. 1. Click + to open the Add Expression dialog box. 2. Select Client IP from the Expression Type drop-down list. 3. Select an operator from the IP Address drop-down list, and specify the required values: Between Select a starting and ending IP address for the address range from the From and To drop-down lists, respectively. Equals Type a valid IP address in the IP field. Greater than Type a valid IP address in the IP field. Less than Type a valid IP address in the IP field. Greater than or equal to Type a valid IP address in the IP field. Less than or equal to Type a valid IP address in the IP field. Masked IP address Type values for the base IP address and the bit mask in the Base IP and Mask fields, respectively. 4. Click OK to close the dialog box and add the expression to the policy rule. 3.5.3.4 Restrict access to specified client devices You can restrict access to your application to users on a personal computer or a mobile device. 1. Click + to open the Add Expression dialog box. 2. Select Client Device from the Expression Type drop-down list. 3. Select one or both of the following checkboxes: PC Allows users on a personal computer to access your application. Mobile Allows users on a mobile device to access your application. 4. Click OK to close the dialog box and add the expression to the policy rule. 3.5.3.5 Restrict access to subjects having the specified attribute value You can restrict access to your application to subjects or users having a specified attribute value. To do so, you specify the subject type and the subject source. The subject type is the type of identity information. The subject source is a value that corresponds to the specified subject type. For example, if the subject type is an authentication result, the subject source is an attribute output by the Identity Connector. 1. Click + to open the Add Expression dialog box. 2. Select Subject Attribute Match Expression from the Expression Type drop-down list. 3. Select an option from the Subject Type drop-down list: CONSTANT Type a constant value in the Subject Source field. AUTHN_RESULT_FIELD Select a user attribute from the Subject Source drop-down list. EXPRESSION Type an expression in the Subject Source field. 4. Select an option from the Operator drop-down list, and specify the required values: Equals The user attribute value must equal the value you specify in the Value field. Contains The user attribute value must contain the value you specify in the Value field. Starts with The user attribute value must start with the value you specify in the Value field. Ends with The user attribute value must end with the value you specify in the Value field. Matches (regular expression) The user attribute value must equal the result of the regular expression you specify in the Regex field. In list The user attribute value must belong to the list of specified values. 5. Click OK to close the dialog box and add the expression to the policy rule. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 25

3.5.3.6 Restrict access based on the specified expression You can restrict access to your application based on whether the expression you specify evaluates to TRUE or FALSE. To build the expression, you select and combine components from the drop-down lists with text that you type in the expression editor. 1. Click + to open the Add Expression dialog box. 2. Select Advanced Expression from the Expression Type drop-down list. 3. Click Edit to open the Expression editor. 4. Select components from the following drop-down lists, and add them to the expression. Built-in Library Function Select the following built-in function: $AuthnResult.isIPInRange Tests whether the client computer s IP address falls within the specified range. Syntax: $AuthnResult.isIPInRange(low_IP,high_IP,target_IP) Parameters low_ip Specifies the beginning value of the IP address range. high_ip Specifies the ending value of the IP address range. target_ip Specifies the IP address of the client computer seeking access to the application. Return Value Returns one of the following values: TRUE The client IP address falls within the specified range. FALSE The client IP address does not fall within the specified range. Built-in Library Variable Select one of the following built-in variables: $IP Specifies the IP address of the client computer seeking access to the application. $UserAgent Specifies the web browser s user agent which provides information about whether the browser is running on a personal computer or mobile device. AuthnResult Select an attribute from the AuthnResult drop-down list. Example: mail Expression: $AuthnResult.getField("mail") Note: This attribute is an authentication result output by the Identity Connector or by the preceding authentication module in an authentication chain. Operator Select an operator from the Operator drop-down list. Example: contains Expression: $AuthnResult.getField("mail") contains Note: The available operators are: ==,!=, >, <, >=, <=, contains, &&,, or, ~=, +, -, *, %, /, and =. 5. Complete the expression by typing in the Expression editor field. Example: mcafee.com Expression: $AuthnResult.getField("mail") contains "mcafee.com" 26 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

6. Click OK to close the Expression editor. 7. Click OK to close the dialog box and add the expression to the policy rule. 3.5.4 Expression editor examples The following examples show how to build an expression using the expression editor. Expression editor: example 1 The expression in the following example retrieves the attribute corporation from the authentication results and compares its value to the empty string on the right side of the expression. If the expression evaluates to TRUE, the user is not part of any corporation. If the Rule Effect is set to Deny, the user is denied access to the SaaS or web application. To create this expression: 1. Select the attribute corporation from the AuthnResult drop-down list. 2. Select the operator == from the Operator drop-down list. 3. Type the double quotes in the Expression editor field. 4. Click OK. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 27

Expression editor: example 2 The expression in the following example uses the built-in library function $AuthnResult.isIPInRange and the built-in library variables: $IP and $UserAgent. The expression evaluates to TRUE if one or more of these conditions are met: The client computer IP address falls within the specified range. The client computer IP address equals the specified value. The web browser is running on an iphone. If the expression evaluates to TRUE and the Rule Effect is set to Permit, the user is granted access to the SaaS or web application. To create this expression: 1. Select $AuthnResult.isIPInRange from the Built-in Library Function drop-down list. 2. Type the low and high IP addresses that specify the range inside the first two pairs of quotes inside the parentheses. 3. Replace the third pair of quotes with the Built-in Library Variable $IP, which is the IP address of the client computer seeking access to the application. 4. Select the operator from the Operator drop-down list. 5. Select $IP from the Built-in Library Variable drop-down list. 6. Select the operator == from the Operator drop-down list. 7. Type an IP address enclosed in quotes in the Expression editor field. 8. Select the operator from the Operator drop-down list. 9. Select $UserAgent from the Built-in Library Variable drop-down list. 10. Select the operator contains from the Operator drop-down list. 11. Type iphone (including the quotes) in the Expression editor field. 12. Click OK. 28 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

3.6 Review the NetSuite Cloud Connector Configuration In the Review step of the Cloud Connector wizard, you can view the application type, application name, and Identity Connector. You can also test the configuration with the SSO test URL that is provided. The Alias is a short name that you can use in place of the longer SSO test URL. To accept and save the configuration, click Finish. McAfee Cloud Identity Manager NetSuite Cloud Connector Guide 29

30 McAfee Cloud Identity Manager NetSuite Cloud Connector Guide

Order Number: 326426-005US [Revision A]