OpenSSO
You can post comments and questions regarding the documentation provided below on the Documentation Feedback Wiki Page. The page will open in a new window.

Authentication Login URLs and Redirection URL Precedence

The Authentication Service provides different ways in which authentication can be configured and applied. These types of authentication are accessed by specifying login URL parameters, or using the authentication APIs. The types of authentication include:

For each of these types of authentication, the user can either pass or fail. If the user is successfully authenticated, OpenSSO does the following:

  1. Confirms that the authenticated user has a profile defined in the data store and whether that profile is active.

    The User Profile attribute in the Core Authentication module can be defined as Required, Dynamic, Dynamic with User Alias, or Ignored. If the value is Required, the profile is active. (This is the default case.) If the value is Dynamic or Dynamic with User Alias, the Authentication Service will create the user profile in the Data Store. If the value is Ignore, the user validation will not be done.

  2. Executes the Authentication Post Processing service provider interface (SPI), if applicable.

    To accomplish any post processing, the AMPostAuthProcessInterface must be implemented. If the Authentication Post Processing Classes attribute in the Core Authentication module contains a value, the SPI is executed. It can be executed on either successful or failed authentication or on logout.

  3. The following properties are added to, or updated in, the session token and the user's session is activated.

    realm

    This is the DN of the realm to which the user belongs.

    Principal

    This is the DN of the user.

    Principals

    This is a list of names to which the user has authenticated. All Principals must map to the same user. The User Alias List in the user's profile contains this list. (This property may have more then one value defined as a pipe separated list.)

    Note - This is a function of authentication chaining.

    UserId

    This is the user’s DN as returned by the module, or in the case of modules other than LDAP or Membership, the user name. (All Principals must map to the same user. The UserId is the user DN to which they map.)

    Note - This property may be a non-DN value.

    UserToken

    This is a user name. (All Principals must map to the same user. The UserToken is the user name to which they map.)

    Host

    This is the host name or IP address for the client.

    authLevel

    This is the highest level to which the user has authenticated.

    AuthType

    This is a pipe separated list of authentication modules to which the user has authenticated (for example, module1|module2|module3).

    clientType

    This is the device type of the client browser.

    Locale

    This is the locale of the client.

    CharSet

    This is the determined character set for the client.

    Role

    Applicable for role-based authentication only, this is the role to which the user belongs.

    Service

    Applicable for service-based authentication only, this is the service to which the user belongs.

  4. Redirects the user.

    The user can be redirected to either a Federation Manager page or a URL. The redirection is based on the authentication type's order of precedence as explained in the appropriate section:

If the user has failed authentication, Federation Manager simply redirects the user based on the authentication type's order of precedence. See the appropriate section for more information.

Realm-based Authentication

This type of authentication allows a user to authenticate as a member of a specified realm or sub-realm. The authentication method for a realm is set by adding the Core authentication module to the realm and defining the Authentication attributes.

Note - The Core authentication module is added to the top-level realm during installation. As all new realms are configured under the top-level realm, the Core module is dynamically added and enabled for these realms when created.

The following sections contain additional information regarding realm-based authentication.

Realm-based Authentication Login URLs

To access the Authentication Service user interface for realm-based authentication, enter a login URL in the Location Bar of a web browser using the realm=realmName parameter as in:

http://server_name.domain_name:port/amserver/UI/Login?realm=sun

Realm-based authentication is the default method of authentication for Federation Manager. Thus, 

http://server_name.domain_name:port/amserver/UI/Login

will also access the Authentication Service user interface for realm-based authentication. Additionally, the org or domain parameter can be used as in:

http://server_name.domain_name:port/amserver/UI/Login?domain=sun

Tip - The value of the org or domain parameter must match the value defined as the Realm Name in the realm's profile.

The realm of a request for authentication is determined by checking the following, in order of precedence:

  1. The domain parameter

  2. The realm parameter

  3. The org parameter

  4. The value of the DNS Alias Names attribute in the Administration serviceXXXXX

After calling the correct realm, the authentication module(s) to which the user will authenticate are retrieved. If there is no defined realm, it will be determined from the server name and domain specified in the login URL.

Note - If a user is a member of (and authenticated to) one realm, and tries to authenticate to a different realm, the only two parameters that are passed are realm and module. For example, assume Ann is a member of, and authenticated to, Realm A. After she tries to authenticate to Realm B, Ann receives a request to do one of the following: start a new authentication process using the module specified for Realm B, or return to her existing authenticated session with Realm A. If Ann chooses to authenticate to Realm B, only the realm name and module name (if specified) are passed and honored for determining authentication in Realm B.

Realm-based Authentication Redirection Precedence

Upon a successful or failed realm-based authentication, Federation Manager looks for information on where to redirect the user. Following is the order of precedence in which the application will look for this information.

Successful Realm-based Authentication Redirection Precedence

The redirection URL for successful realm-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Success URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Success URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Success Login URL attribute in the realm to which the user is a member specific to the client type from which the request was received.

  6. The value of the Default Success Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Success URL attribute in the user's profile.

  8. The value of the Success URL attribute in the role entry of the user's profile.

  9. The value of the Success URL attribute in the realm to which the user is a member.

  10. The value of the Default Success Login URL attribute in the top-level realm.

Failed Realm-based Authentication Redirection Precedence

The redirection URL for failed realm-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a gotoOnFail Login URL parameter.

  3. The value of the Failure URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Failure URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Failure Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Failure Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Failure URL attribute in the user's profile.

  8. The value of the Failure URL attribute in the role entry of the user's profile.

  9. The value of the Default Failure Login URL attribute in the realm entry of the user's profile

  10. The value of the Default Failure Login URL attribute in the top-level realm.

To Configure Realm-based Authentication

  1. Login as the realm's administrator.
  2. Click the name of the realm you are configuring.
  3. Click the Authentication tab.
  4. Select an authentication chain from pull down menu of the Default Authentication Chain attribute.
  5. (Optional) Select an authentication chain from pull down menu of the Administrator Authentication Chain attribute.

    This attribute can be used if the authentication module for administrators must be different from the module for users.

  6. Click Save.
  7. Log out.
  8. Access the Authentication Service user interface as described in Realm-based Authentication Login URLs.

Role-based Authentication

This type of authentication allows a user to authenticate as a member of a specified role (either static or filtered) configured within a realm or sub-realm. The authentication method for a role is set by adding the Authentication Configuration Service to the role and choosing the appropriate authentication chain from the displayed choices. For authentication to be successful, the user must belong to the role and they must authenticate to each module defined in the authentication chain selected for that role. The following sections contain additional information regarding role-based authentication.

Role-based Authentication Login URLs

To access the Authentication Service user interface for role-based authentication, enter a login URL in the Location Bar of a web browser using the role=roleName parameter as in:

http://server_name.domain_name:port/amserver/UI/Login?role=manager

The parameter sends the user to the authentication configuration defined for the specified role. A user who is not already a member of the specified role will receive an error message when they attempt to authenticate with this parameter.

Role-based Authentication Redirection Precedence

Upon a successful or failed role-based authentication, Federation Manager looks for information on where to redirect the user. Following is the order of precedence in which the application will look for this information.

Successful Role-based Authentication Redirection Precedence

The redirection URL for successful role-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Success URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Success URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Success URL attribute in another role entry of the user's profile specific to the client type from which the request was received.

    Note - This option is a fallback if the previous redirection URL fails.

  6. The value of the Default Success Login URL attribute in the realm to which the user is a member specific to the client type from which the request was received.

  7. The value of the Default Success Login URL attribute in the top-level realm specific to the client type from which the request was received.

  8. The value of the Success URL attribute in the user's profile.

  9. The value of the Success URL attribute in the role entry of the user's profile.

  10. The value of the Success URL attribute in another role entry of the user's profile.

    Note - This option is a fallback if the previous redirection URL fails.

  11. The value of the Default Success Login URL attribute in the realm to which the user is a member.

  12. The value of the Default Success Login URL attribute in the top-level realm.

Failed Role-based Authentication Redirection Precedence

The redirection URL for failed role-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Failure URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Failure URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Failure URL attribute in another role entry of the user's profile specific to the client type from which the request was received.

    Note - This option is a fallback if the previous redirection URL fails.

  6. The value of the Default Failure Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  7. The value of the Default Failure Login URL attribute in the top-level realm specific to the client type from which the request was received.

  8. The value of the Failure URL attribute in the user's profile.

  9. The value of the Failure URL attribute in the role entry of the user's profile.

  10. The value of the Failure URL attribute in another role entry of the user's profile.

    Note - This option is a fallback if the previous redirection URL fails.

  11. The value of the Default Failure Login URL attribute in the realm entry of the user's profile.

  12. The value of the Default Failure Login URL attribute in the top-level realm.

To Configure Role-based Authentication

To configure role-based authentication, you add the Authentication Configuration Service to a role within a realm and choose a configured authentication chain. If you are creating a new role, the Authentication Configuration Service is not automatically assigned to it.

  1. Login as the administrator for the realm under which the role is configured.
  2. Click the name of the realm you are configuring.
  3. Click the Subjects tab.
  4. Click the Roles tab.
  5. Click the name of the role you are configuring.
  6. Click the Services tab.
  7. Click Add.
  8. Select Authentication Configuration.
  9. Click Next.
  10. Select the appropriate authentication chain from those displayed.
  11. Click Finish.
  12. Log out.
  13. Access the Authentication Service user interface as described in Role-based Authentication Login URLs.

Service-based Authentication

This type of authentication allows a user to authenticate to a specified authentication chain in a realm or sub realm. For authentication to be successful, the user must authenticate to each module defined in the chain. The following sections contain additional information regarding service-based authentication.

Service-based Authentication Login URLs

To access the Authentication Service user interface for service-based authentication, enter a login URL in the Location Bar of a web browser using the service=AuthChainName parameters as in:

http://server_name.domain_name:port/amserver/UI/Login?service=ldapService

Additionally, you can add the realm=realmName attribute as in:

http://server_name.domain_name:port/amserver/UI/Login?realm=opensso&service=ldapService

Note - If there is no defined realm parameter, the realm will be determined from the server name and domain specified in the login URL.

Service-based Authentication Redirection Precedence

Upon a successful or failed service-based authentication, Federation Manager looks for information on where to redirect the user. Following is the order of precedence in which the application will look for this information.

Successful Service-based Authentication Redirection Precedence

The redirection URL for successful service-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Success URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Success URL attribute in the service to which the user is authenticated specific to the client type from which the request was received.

  5. The value of the Success URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Success Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  7. The value of the Default Success Login URL attribute of the top-level realm specific to the client type from which the request was received.

  8. The value of the Success URL attribute in the user's profile.

  9. The value of the Success URL attribute in the service to which the user is authenticated.

  10. The value of the Success URL attribute in the role entry of the user's profile.

  11. The value of the Default Success Login URL attribute in the realm entry of the user's profile.

  12. The value of the Default Success Login URL attribute of the top-level realm.

Failed Service-based Authentication Redirection Precedence

The redirection URL for failed service-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Failure URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Failure URL attribute of the service to which the user has authenticated specific to the client type from which the request was received.

  5. The value of the Failure URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Failure Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  7. The value of the Default Failure Login URL attribute in the top-level realm specific to the client type from which the request was received.

  8. The value of the Failure URL attribute in the user's profile.

  9. The value of the Failure URL attribute of the service to which the user has authenticated.

  10. The value of the Failure URL attribute in the role entry of the user's profile.

  11. The value of the Default Failure Login URL attribute in the realm entry of the user's profile

  12. The value of the Default Failure Login URL attribute in the top-level realm.

To Configure Service-based Authentication

To configure for service-based authentication, you create an authentication chain within a realm and force authentication with that chain by accessing the Authentication Service user interface with the appropriate login URL.

  1. Login as the administrator for the realm under which you are creating an authentication chain.
  2. Click the name of the realm.
  3. Click the Authentication tab.
  4. (Optional) Create the appropriate authentication module instances.
  5. Create an authentication chain.
  6. Click Save.
  7. Log out.
  8. Access the Authentication Service user interface as described in Service-based Authentication Login URLs.

User-based Authentication

This type of authentication allows a user to authenticate using an authentication chain defined as the value of the User Authentication Configuration attribute in the user's profile. For authentication to be successful, the user must authenticate to each module defined in the chain. The following sections contain additional information regarding user-based authentication.

User-based Authentication Login URLs

To access the Authentication Service user interface for user-based authentication, enter a login URL in the Location Bar of a web browser using the user=userName parameter as in:

http://server_name.domain_name:port/amserver/UI/Login?user=eileenA

Additionally, you can add the realm=realmName attribute as in:

http://server_name.domain_name:port/amserver/UI/Login?realm=opensso&user=eileenA

If there is no defined realm parameter, the realm will be determined from the server name and domain specified in the login URL.

Caution - On receiving a request for user-based authentication, the Authentication Service first verifies that the user is a valid user and then retrieves the User Authentication Configuration data. In the case where there is more then one valid user profile associated with the value passed by the Login URL, all profiles must map to the specified user. The User Alias List attribute is where mappings to the user's other profiles are defined. If mapping fails, the user is denied a valid session. An exception would be if one of the users is a top-level administrator; in this case, user mapping validation is not done and the user is given top-level administrator rights.

User-based Authentication Redirection Precedence

Upon a successful or failed user—based authentication, Federation Manager looks for information on where to redirect the user. Following is the order of precedence in which the application will look for this information.

Successful User-based Authentication Redirection Precedence

The redirection URL for successful user-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Success URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Success URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Success Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Success Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Success URL attribute in the user's profile.

  8. The value of the Success URL attribute in the role entry of the user's profile.

  9. The value of the Default Success Login URL attribute in the realm entry of the user's profile.

  10. The value of the Default Success Login URL attribute in the top-level realm.

Failed User-based Authentication Redirection Precedence

The redirection URL for failed user-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a gotoOnFail Login URL parameter.

  3. The value of the Failure URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Failure URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Failure Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Failure Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Failure URL attribute in the user's profile.

  8. The value of the Failure URL attribute in the role entry of the user's profile.

  9. The value of the Failure URL attribute in the realm entry of the user's profile

  10. The value of the Default Failure Login URL attribute in the top-level realm.

To Configure User-Based Authentication

  1. Login as the administrator for the realm under which the user is configured.
  2. Click the name of the realm.
  3. Click the Subjects tab and click Users.
  4. Click the name of the user you wish to modify.

    The User Profile is displayed.

  5. Select the authentication chain you want the user to use for the User Authentication Configuration attribute.
  6. Click Save.
  7. Log out.
  8. Access the Authentication Service user interface as described in User-based Authentication Login URLs.

Authentication Level-based Authentication

Each authentication module can be associated with an integer that defines its authentication level. A higher authentication level value indicates a higher level of trust for the user once successful authentication has occurred. Once authenticated, the authentication level is stored in the user's session token. When a user requests access to a service, the service can determine if the user is allowed by checking the authentication level set in the user's session token. If the level does not reach the level of trust needed by the service, the user is redirected to complete an authentication process with the appropriate authentication level.

Note - If the user is required to authenticate to multiple authentication modules, and does so successfully, the highest authentication level value will be set in the session token.

The following sections contain additional information regarding authentication level-based authentication.

Authentication Level-based Authentication Login URLs

To access the Authentication Service user interface for authentication level-based authentication, enter a login URL in the Location Bar of a web browser using the authlevel=authlevelValue parameter as in:

http://server_name.domain_name:port/amserver/UI/Login?authlevel=7

With this URL, all authentication modules whose authentication level is larger or equal to the value defined (in this case, 7) will be displayed as a menu from which the user can choose. (If only one matching module is found, the login page for that authentication module will be displayed.) After viewing the relevant list of modules, the user must choose one with which to authenticate.

Note - Once the user selects the module, the authentication process is the same as that described in Module-based Authentication.

Additionally, you can add the realm=realmName attribute as in:

http://server_name.domain_name:port/amserver/UI/Login?realm=opensso&authlevel=7

Note - If there is no defined realm parameter, the realm will be determined from the server name and domain specified in the login URL.

Authentication Level-based Authentication Redirection Precedence

Upon a successful or failed authentication level-based authentication, Federation Manager looks for information on where to redirect the user. Following is the order of precedence in which the application will look for this information.

Successful Authentication Level-based Authentication Redirection Precedence

The redirection URL for successful authentication level-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Success URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Success URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Success Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Success Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Success URL attribute in the user's profile.

  8. The value of the Success URL attribute in the role entry of the user's profile.

  9. The value of the Default Success Login URL attribute in the realm entry of the user's profile

  10. The value of the Default Success Login URL attribute in the top-level realm.

Failed Authentication Level-based Authentication Redirection URLs

The redirection URL for failed authentication level-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a gotoOnFail Login URL parameter.

  3. The value of the Failure URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Failure URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Failure Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Failure Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Failure URL attribute in the user's profile.

  8. The value of the Failure URL attribute in the role entry of the user's profile.

  9. The value of the Default Failure Login URL attribute in the realm entry of the user's profile.

  10. The value of the Default Failure Login URL attribute in the top-level realm.

To Configure for Authentication Level-based Authentication

Authentication levels are assigned when creating an Authentication Module Instance.

  1. Click the name of the realm to which you will add the new authentication module instance.
  2. Select the Authentication tab.

    Note - The Administrator Authentication Configuration button under Advanced Properties defines the authentication module instance for administrators only. This attribute can be used if the authentication module for administrators needs to be different from the module for end users. The modules configured in this attribute are picked up when the Federation Manager administrator interface is accessed.

  3. Click New under Module Instances.
  4. Enter a unique Name for the authentication module instance.
  5. Select the Type of authentication module for this instance.
  6. Click OK.
  7. Click the name of the newly created module instance and edit the properties for that module.

    The Authentication Level attribute is a property.

  8. Click Save and Back to Authentication, respectively.
  9. Access the Authentication Service user interface as described in Authentication Level-based Authentication Login URLs.

Module-based Authentication

This type of authentication allows an administrator to specify the authentication module to which a user will authenticate. The specified module must be registered to the realm or sub-realm that the user is accessing and the realm's Module-based Authentication attribute (found in the Core Authentication Service) must be enabled. The following sections contain additional information regarding module-based authentication.

Module-based Authentication Login URLs

To access the Authentication Service user interface for module-based authentication, enter a login URL in the Location Bar of a web browser using the module=authModuleName parameter as in:

http://server_name.domain_name:port/amserver/UI/Login?module=LDAP

Additionally, you can add the realm=realmName attribute as in:

http://server_name.domain_name:port/amserver/UI/Login?realm=opensso&module=LDAP

Note - If there is no defined realm parameter, the realm will be determined from the server name and domain specified in the login URL.

Module-based Authentication Redirection Precedence

Upon a successful or failed module-based authentication, Federation Manager looks for information on where to redirect the user. Following is the order of precedence in which the application will look for this information.

Successful Module-based Authentication Redirection Precedence

The redirection URL for successful module-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a goto Login URL parameter.

  3. The value of the Success URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Success URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Success Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Success Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Success URL attribute in the user's profile.

  8. The value of the Success URL attribute in the role entry of the user's profile.

  9. The value of the Default Success Login URL attribute in the realm entry of the user's profile.

  10. The value of the Default Success Login URL attribute in the top-level realm.

Failed Module-based Authentication Redirection Precedence

The redirection URL for failed module-based authentication is determined by checking the following places in order of precedence:

  1. A URL set by the authentication module.

  2. A URL set by a gotoOnFail Login URL parameter.

  3. The value of the Failure URL attribute in the user's profile specific to the client type from which the request was received.

  4. The value of the Failure URL attribute in the role entry of the user's profile specific to the client type from which the request was received.

  5. The value of the Default Failure Login URL attribute in the realm entry of the user's profile specific to the client type from which the request was received.

  6. The value of the Default Failure Login URL attribute in the top-level realm specific to the client type from which the request was received.

  7. The value of the Failure URL attribute in the user's profile.

  8. The value of the Failure URL attribute in the role entry of the user's profile.

  9. The value of the Default Failure Login URL attribute in the realm entry of the user's profile.

  10. The value of the Default Failure Login URL attribute in the top-level realm.

To Configure for Module-based Authentication

  1. Login as the administrator for the realm you are modifying.
  2. Click the name of the realm.
  3. Click the Authentication tab.
  4. Enable Module-based Authentication if not already.
  5. Click Save.
  6. Log out.
  7. Access the Authentication Service user interface as described in Module-based Authentication Login URLs.