Home
Administering
This section describes how to plan for, install, configure, operate, and manage the SafeLinx Server.
Security
HCL SafeLinx includes a range of options for configuring the security of your network, applications, and data.
Third-Party Authentication to the SafeLinx Server
You can configure authentication profiles to enable third-party authentication to the SafeLinx Server.

Administering
This section describes how to plan for, install, configure, operate, and manage the SafeLinx Server.
- Overview
  HCL SafeLinx uses standards-based protocols to enable secure access from mobile computing devices outside the firewall to business applications and data on your organization's internal network.
- Security
  HCL SafeLinx includes a range of options for configuring the security of your network, applications, and data.
  - Using IPSec
    You can configure the operating system to use IPSec to secure data transmitted between the SafeLinx Server and remote servers or among cluster nodes.
  - Security Options
    You can configure SafeLinx to use several different security mechanisms to protect network resources.
  - Authentication and Encryption
    A managed set of public key certificates that are issued by a certificate authority is required to enable TLS communications.
  - Authentication Between the Mobile Access Service and SafeLinx Clients
    SafeLinx Clients must authenticate with the mobile access service before they can establish an encrypted connection.
  - Encryption Between the Mobile Access Service and SafeLinx Clients
    You can modify the type of encryption that is used to transmit data between SafeLinx Clients and the mobile access service.
  - Third-Party Authentication to the SafeLinx Server
    You can configure authentication profiles to enable third-party authentication to the SafeLinx Server.
    - Authentication to a third-party RADIUS server
      You can configure an authentication profile that requires users to submit login credentials to a remote authentication dial-in user service (RADIUS) server.
    - Third-party authentication using LDAP-bind
      You can configure an authentication profile to use an LDAP-bind authentication for HTTP access services or connection profiles.
    - Certificate authentication for SafeLinx Clients
      For mobile access services, you can configure a connection profile to use a certificate-based authentication profile. When a SafeLinx Client user attempts to log in through a connection that is governed by a certificate-based authentication profile, the SafeLinx Server requests an X.509 certificate. Only Rivest-Shamir-Adleman (RSA) certificates are supported.
  - Two-factor authentication
    For a tutorial providing an example of how to set up HCL SafeLinx 1.2 for two-factor authentication, see the article Implementing two-factor authentication with HCL SafeLinx 1.2 on the HCL Customer Support site.
  - Authentication and Encryption Between Messaging Services and Applications that Use Messaging Services and Push APIs
    To ensure secure transmissions with messaging clients, you can configure messaging services to require TLS connections with message processing servers or push initiators.
  - Authentication and Encryption Among Cluster Managers
    To secure communications among cluster manager, you can require transport layer security (TLS) connections among the nodes in a SafeLinx Server cluster.
  - Admin Access
    Administrators who use the SafeLinx Administrator must authenticate by providing an administrator ID and password.
- Installation planning
  Before you install HCL SafeLinx, verify that you meet the hardware and software requirements, and that the network connections that you want to use are available.
- Roadmaps: Installing and setting up SafeLinx
  The following "roadmap" topics guide you through installing and initially configuring SafeLinx. Refer to the topic that corresponds to your relational database and server operating system.
- Installing and initial configuration
  Initial configuration and installation of HCL SafeLinx varies based on your operating system and relational database.
- Adding a secure login profile
  By default, the SafeLinx Administrator communicates with the access manager over an unencrypted connection. If you want the connection between the SafeLinx Administrator and the access manager to use transport layer security (TLS) protocols, add a secure login profile to the SafeLinx Administrator.
- Adding and configuring resources
  After you complete the installation and initial configuration, continue to prepare the deployment by configuring other network resources.
- Administering
  The SafeLinx Administrator administration client is the primary tool for viewing, adding, configuring, and managing HCL SafeLinx resources. Along with the SafeLinx Administrator, you can use the HCL SafeLinx Monitor to view information about packet flow through the SafeLinx Server. You can also use a set of command line tools to perform common SafeLinx Server tasks.
- Programming reference
  There are several programming considerations of which you might want to take advantage.
- Database schema information
  HCL SafeLinx uses a DB2, Oracle, MySQL, or SQL database to store tables of information about current and past activity of SafeLinx Server sessions. The following tables are created and accessed by using the qualifier name wg for DB2 installations.
- Step by step: Nomad configuration
  Here are step-by-step instructions that serve as an example of how to install and configure HCL SafeLinx for Nomad on MySQL on Linux.

Third-Party Authentication to the SafeLinx Server

You can configure authentication profiles to enable third-party authentication to the SafeLinx Server.

You can configure authentication profiles to use the following types of third-party authentication:

Remote authentication dial-in user service (RADIUS) third-party authentication
LDAP-bind authentication
Certificate-based authentication

Some third-party authentication vendors allow users to change their passwords. A change-password dialog displays on the SafeLinx Client system, but the password cannot be changed.

If you configure a connection profile to use single-party or two-party key exchange, and you also configure a secondary authentication profile, SafeLinx Clients take longer to authenticate. An administrator can also choose Additional Authentication Profiles, which allows authentication methods to be chained together. This action also increases the processing time necessary to authenticate SafeLinx Client users. The connection between the SafeLinx Server and SafeLinx Client is not active until the authentication process completes. Before authentication is complete, any packets that are transmitted are discarded.

HTTP clients can connect by using lightweight third-party authentication (LTPA) and single sign-on (SSO). For more information, see Authentication profiles.

Rate this topic

5 stars 4 stars 3 stars 2 stars 1 star

Comment on this topic.

By clicking this box, you acknowledge that you are NOT a U.S. Federal Government employee or agency, nor are you submitting information with respect to or on behalf of one. HCL provides software and services to U.S. Federal Government customers through its partners immixGroup, Inc. Contact this team at https://hcltechsw.com/resources/us-government-contact. Do not include any personal data in this Comment box. Note: To report a problem or question about the product software, do not use this form. Instead, go to the HCL Software Support site.