Identikey Server Windows Installation Guide 3.1

Transcription

1 Identikey Server Windows Installation Guide 3.1

2 Disclaimer of Warranties and Limitations of Liabilities Disclaimer of Warranties and Limitations of Liabilities The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you. Copyright Copyright 2009 VASCO Data Security, Inc., VASCO Data Security International GmbH. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of VASCO Data Security Inc. RADIUS Documentation Disclaimer The RADIUS documentation featured in this manual is focused on supplying required information pertaining to the RADIUS server and its operation in the Identikey Server environment. It is recommended that further information be gathered from your NAS/RAS vendor for information on the use of RADIUS. Trademarks VASCO, Vacman, IDENTIKEY, axs GUARD, DIGIPASS, and are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other countries. Document Version: 1.5

3 Table of Contents Table of Contents 1 2 Introduction Software Components System Requirements Available Guides Pre-installation Tasks Identikey Server Component Set Up Data Store for Identikey Server Active Directory ODBC Database Serial Number and Maintenance ID Start Identikey Server Installation Install Identikey Server in Basic Mode ODBC Basic Installation Mode Basic Installation Install Identikey Server in Advanced mode - ODBC Advanced Installation Install Identikey Server - Active Directory Active Directory Scenario and Decisions Install Identikey Server for Active Directory Deploy Identikey Server Web Administration Deploy Administration Web Interface on the same machine as Identikey Server Deploy Administration Web Interface on a Dedicated Machine Web Administration Setup Tool Post-Installation Tasks Licensing Backup Strategy Audit Settings Database Tasks Set Up User Self Management and OTP Request Websites

4 Table of Contents 10 Install Additional Identikey Server Install Identikey Server Component Configure Additional Identikey Servers Replication Add Components to Installation Repair Installation Uninstall Identikey Server Data Removal Extend Data Store Schema Technical Support Support Contact Information

5 Table of Contents Illustration Index Image 1: Identikey Server Installation Welcome Window...21 Image 2: Identikey Server Installation Welcome Window...22 Image 3: Identikey Server Installation - Installation Type Window...24 Image 4: Identikey Server Installation -License Agreement Window...25 Image 5: Identikey Server Installation - Select Installation Path Window...26 Image 6: Identikey Server Installation - Installation Progress Window...27 Image 7: Identikey Server Installation - Installation Progress Window...28 Image 8: Identikey Server Installation - Installation Progress Window - PostgreSQL...29 Image 9: Identikey ServerConfiguration Wizard - Start Window...30 Image 10: Identikey ServerConfiguration Wizard - IP Address Window...31 Image 11: Identikey ServerConfiguration Wizard - First Administrator Window...32 Image 12: Identikey ServerConfiguration Wizard - License Window...32 Image 13: Identikey ServerConfiguration Wizard - Server Functionality Window...33 Image 14: Identikey ServerConfiguration Wizard - Server Certificate Window...34 Image 15: Identikey ServerConfiguration Wizard - RADIUS Topology Window...34 Image 16: Identikey Server Configuration Wizard - RADIUS Client Window...35 Image 17: Identikey Server Configuration Wizard - RADIUS Backend Window...36 Image 18: Identikey Server Configuration Wizard Summary Window...36 Image 19: Identikey Server Configuration Wizard - Completion Window...37 Image 20: Import DPX Files Window...38 Image 21: Identikey Server Installation Complete Window...39 Image 22: Identikey Server Select Installation Type Window...41 Image 23: Identikey Server Installation - Data Storage Window...42 Image 24: Identikey Server Installation Select Components Window...43 Image 25: Identikey Server Installation License Agreement Window...44 Image 26: Identikey Server Installation Custom Setup window...45 Image 27:Identikey Server Installation Ready to Install Identikey Server window...46 Image 28: Installing Identikey Server progress window...47 Image 29: Identikey Server Setup Wizard Completed window...48 Image 30: Identikey Server Installation - Select Components window...49 Image 31: Identikey Server Configuration Wizard - Start Window...50 Image 32: Identikey Server Configuration Wizard - Select Database Window...50 Image 33: Identikey Server Configuration Wizard - Database Window...51 Image 34: Identikey Server Configuration Wizard - Master Domain Window

6 Table of Contents Image 35: Identikey Server Configuration Wizard - User ID/Domain conversion Window Image 36: Identikey Server Config IP Address Window...54 Image 37: Identikey Server First Administrator Window...55 Image 38: Identikey Server Sensitive Data Encryption Window...55 Image 39: Identikey Server Custom Data Encryption Window...56 Image 40: Identikey Server Load Data Encryption Window...57 Image 41: Identikey Server Configuration Wizard License Window...57 Image 42: Identikey Server Configuration Wizard Server Functionality Window...58 Image 43: Identikey Server Configuration Wizard Server Certificate Window...59 Image 44: Identikey Server Configuration Wizard Server Certificate Password Window...59 Image 45: Identikey Server SSL Server Certificate Selection...60 Image 46: Identikey Server Web Admin Client Window...61 Image 47: Identikey ServerSample Web Client Window...61 Image 48: Identikey Server Configuration Wizard Summary Window...62 Image 49: Identikey Server Install Wizard Completion Window...63 Image 50: Identikey Server Installation Select Components Window...63 Image 51:Deploying Identikey Server Web Administration Module Window...64 Image 52:Deploying Identikey Server Web Administration Module Wizard Results Window...65 Image 53:Select Components completed Window...66 Image 54:Installation Report page...67 Image 55: Identikey Server Setup - Installation Type window...70 Image 56: Identikey Server Setup - Data Storage window...71 Image 57: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window...72 Image 58: Microsoft.NET license agreement...73 Image 59: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window...74 Image 60: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation complete window Image 61: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation hotfix window...76 Image 62: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix installer window Image 63: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix applied window Image 64: Identikey Server Setup - Select Components Window...79 Image 65: Identikey Server Setup Wizard Start Page...80 Image 66: Identikey Server Setup - License Agreement Window...81 Image 67: Identikey Server Setup - Custom Setup window...82 Image 68: Identikey Server Setup - Ready to Install Identikey Server window...83 Image 69: Installing Identikey Server progress window...84 Image 70: Identikey Server Setup Wizard finish window

7 Table of Contents Image 71: Identikey Server Installed Select Components...86 Image 72: Identikey Server Configuration Wizard Start Window...87 Image 73: Identikey Server Configuration Wizard - Active Directory Pre-requisites Window Image 74: Identikey Server Configuration Wizard Digipass Configuration Domain Window...89 Image 75: Identikey Server Configuration Wizard Active Directory Certificate Authority Window...89 Image 76: Identikey Server Configuration Wizard IP Address Window...90 Image 77: Identikey Server Configuration Wizard First Administrator Window...91 Image 78: Identikey Server Configuration Wizard Sensitive Data Encryption Window Image 79: Identikey Server Configuration Wizard Custom Data Encryption Window...93 Image 80: Identikey Server Configuration Wizard Load Data Encryption Window...94 Image 81: Identikey Server Configuration Wizard License Window...95 Image 82: Identikey Server Configuration Wizard Server Functionality Window...96 Image 83: Identikey Server Configuration Wizard SSL Server Certificate Window...97 Image 84: Identikey Server Configuration Wizard SSL Server Certificate Password Window...98 Image 85: Identikey Server Configuration Wizard SSL Server Certificate Selection Window...99 Image 86: Identikey Server Configuration Wizard Web Admin Client Window Image 87: Identikey Server Configuration Wizard Sample Web Client Window Image 88: Identikey Server Configuration Wizard Summary Window Image 89: Identikey Server Configuration Wizard Completion Window Image 90:Deploying Identikey Server Web Administration Module Window Image 91:Deploying Identikey Server Web Administration Module Wizard Results Window Image 92: Identikey Server Installation Complete Window Image 93: Identikey Server Installation Custom Setup Window Image 94: Windows Start Menu showing location of Active Directory Users and Computers Image 95: My Computer - Manage Image 96: Identikey Server Computer Management console Image 97: Apache Tomcat Introduction page Image 98: Apache Tomcat Manager login Image 99: Apache Tomcat Manager Image 100: Apache Tomcat Manager Image 101: Administration Web Interface login Image 102: Apache Tomcat memory pool Image 103: Location of struts.properties file

8 Introduction 1 Introduction This Installation Guide is designed to provide you with the information you will need in order to install Identikey Server. It will guide you through preparation, installation and post-installation tasks which may be required for your system. 1.1 Software Components Identikey Server consists of various components, some necessary and some optional Required Components Identikey Server The Identikey Server is a server component that performs authentication, signature validation, administration and provisioning tasks. It runs as a Windows service. Data Store The following data stores are supported: ODBC either the embedded PostgreSQL database supplied with Identikey Server, or your own Active Directory Web Administration Interface Allows all Identikey Server data store administration tasks to be carried out over a web interface Optional Components Embedded Database An embedded PostgreSQL database is available for use with Identikey Server. Embedded Web Application Server Apache Tomcat may be installed as the embedded web application server for the Web Administration Interface. 8

9 Introduction Note The embedded PostgreSQL database and the Embedded Web Application Server are NOT available for 64-bit Windows. Virtual Digipass Message Delivery Component This is a Service that is responsible for delivering One Time Passwords through a text message HTTP gateway to a User s mobile phone. Digipass TCL Command-Line Administration Administration may also be carried out using Digipass TCL Command-Line Administration Utility, which allows interactive command-line and scripted administration of Identikey Server data. Audit Viewer The Audit Viewer is a GUI application that can display and filter audit messages from the Identikey Server. It can read the data from text files and ODBC databases or receive a live feed from the Identikey Server. OTP Request Site This is a miniature web site that allows a User to request a Virtual Digipass OTP to be sent to their mobile phone. User Self Management Web Site This is a miniature web site that allows Users to make appropriate changes to their own Digipass settings, such as PIN changes. This is used in a RADIUS environment, when the normal authentication requests are made using a CHAP-based protocol and therefore PIN changes and other 'self-management' features are not possible Identikey Server SDK The Software Development Kit allows creation of custom SOAP clients and authentication engines, using the SOAP interface. This is an upgrade add-on to Identikey Server and will only be available for installation if it has been purchased. It requires a separate installation program Data Migration Tool The VASCO Data Migration Tool is a general-purpose utility that allows you to migrate your data from one VASCO product to another. It requires a separate installation. 9

10 Introduction 1.2 System Requirements Server Component Identikey Server requires: Windows Server 2008 (32-bit or 64-bit) Windows Vista (32-bit or 64-bit) Windows XP (32-bit or 64-bit) with service pack 2 or above Windows Server 2003 (32-bit or 64-bit) with Service Pack 1 or above Administration Web Interface The Administration Web Interface can be run on the following operating systems: Windows Server 2008 (32-bit or 64-bit) Windows Vista (32-bit or 64-bit) Windows XP (32-bit or 64-bit) with service pack 2 or above Windows 2003 (32-bit or 64-bit) The Administration Web Interface can be run on any Java web application server running: Java Runtime Environment version 5.0 or above Java Server Pages version 2.0 or above Java Servlets version 2.4 or above It has been tested primarily on Apache Tomcat 5.5. It is compatible with most common browsers, including: Internet Explorer 6.0 Internet Explorer 7.0 Mozilla Firefox 2.0 Opera 9.0 Netscape 8.1 (a few cosmetic issues appear with this browser) Other Components The Message Delivery Component, Audit Viewer and Digipass TCL Command-Line Administration require: Windows Server 2003 (32-bit or 64-bit) with Service Pack 1 or above 10

11 Introduction Windows XP Professional (32-bit or 64-bit) with Service Pack 2 or above Windows Vista (32-bit or 64-bit) Windows 2008 (32-bit or 64-bit) GUI version The Request OTP and User Self Management Websites require any web server capable of running CGI Requirements Specific to Active Directory Digipass Extension for Active Directory Users and Computers Active Directory Users and Computers Snap-In Active Directory set up for SSL In the following cases, SSL must be available for Identikey Server components to connect to Active Directory: Identikey Server not installed on a Domain Controller. Administration Interfaces not installed on a Domain Controller. Identikey Server and/or Administration Interface(s) on a Domain Controller, but accessing data in another domain. An Enterprise Certificate Authority must be installed in the forest to enable SSL. Windows Certificate Services is available as an optional Windows component. However, if you do not wish to install a CA, you can select during installation not to use SSL. Prerequisites If Active Directory is installed on a Windows 2003 machine and it is being managed using a Windows XP machine, you will have to download the Admin Pack from the Microsoft website and install it on the XP machine. 2. If Active Directory is installed on a Windows 2008 machine, and it is being managed using a Windows Vista machine, Vista SP1 must be downloaded from the Microsoft website and installed on the Vista machine. Then the Remote Server Administration Tools package must be downloaded from the Microsoft website and installed and enabled on the Vista machine. Requirements Specific to ODBC Database Identikey Server will support most modern ODBC-compliant relational, transactional databases. It has been tested on the following databases: Oracle 11g Microsoft SQL Server 2005 Full Enterprise Edition and Express DB2 8.1 (32-bit) and 9.1 (64-bit) 11

12 Introduction Sybase Adaptive Server Anywhere 11.0 PostgreSQL Note Please note that when setting up a DB2 database the page size should be set to at least 8192k. A smaller page size will create an error when Identikey Server attempts to connect to the database Language Identikey Server is designed to function on any language version of Windows. However, the product has only been comprehensively tested on English language versions of Windows. 1.3 Available Guides The following Identikey Server guides are available: Product Guide The Product Guide will introduce you to the features and concepts of Identikey Server and the various options you have for using it. Getting Started Guide The Getting Started Guide will lead you through a standard setup and testing of key Identikey Server features. Windows Installation Guide Use this guide when planning and working through an installation of Identikey Server in a Windows environment. Linux Installation Guide Use this guide when planning and working through an installation of Identikey Server in a Linux environment. Administrator Reference In-depth information required for administration of Identikey Server. This includes references such as data attribute lists, backup and recovery and utility commands. Performance and Deployment Guide Contains information on common deployment models and performance statistics. 12

13 Introduction Help Files Context-sensitive help accompanies the Administration Web Interface and Digipass Extension for Active Directory Users and Computers. Identikey Server SDK Programmers Guide In-depth information required to develop using the SDK. 13

14 Pre-installation Tasks 2 Pre-installation Tasks This section outlines the preparation that you need to do before installing Identikey Server. Please note that to perform pre-installation and installation tasks you must be logged in as Administrator on the system where Identikey Server is to be installed. 2.1 Identikey Server Component The following tasks must be completed before installing the Identikey Server on a machine Data Store Type Before starting other pre-install tasks, you must decide on the type of data store to be used. Microsoft Active Directory Integrate Digipass-related data with Active Directory and Windows user accounts using the Active Directory Users and Computers Snap-In. Embedded Database A PostgreSQL database may be installed with Identikey Server. This can only be used with 32-bit Windows. Note If you will be installing Identikey Server with the embedded PostgreSQL database, you will need to run the installation on the machine itself, rather than via Remote Desktop or another remote connection. Other ODBC Database Include Digipass-related data in a new or existing ODBC database. The database may be located on any machine to which the Identikey Server can connect Master Domain Identikey Server has the concept of a Master Domain. This domain has special significance in two ways: It is used as the default domain, when no domain is specified. Only Administrators in the Master Domain may be assigned the privilege to view data from all domains. Administrators in other domains will only ever be able to view data in their own domain. 14

15 Pre-installation Tasks The default name for the Master Domain is master. If you prefer to use another name, you will need to enter this name during the Configuration Wizard User ID and Domain Name Conversion The Identikey Server may be configured to handle User IDs and domain names in a number of ways. It is important that these are set up before data is added to the database. Before installing, decide which settings to use. Case-sensitivity The Identikey Server may be configured to save and retrieve User IDs and domain names in lower case, upper case or with no conversion (data is saved or searched on exactly as entered). The configuration required will depend on your company's requirements and the capabilities of the database used as the data store. See the Encoding and Case-Sensitivity topic in the Administrator Reference for more information. The case conversion of User IDs and domain names is set using the Configuration Wizard immediately after installation, or by running the Identikey Server Configuration utility at any time afterwards. Caution Changing case conversion after the initial configuration may require modification of all User IDs and domain names in the data store. Windows name resolution Enable Windows Name Resolution to allow the Identikey Server to use Windows functionality to resolve a UserID as entered during a login into a User ID and Domain. This feature is recommended if all User accounts correspond to Windows (Active Directory) User accounts. If they do not correspond, the feature will not be suitable. Windows Name Resolution works well with Dynamic User Registration. See the Product Guide for more information System Clock The Identikey Server requires that: Your server s time is set correctly in relation to GMT, and The time zone and daylight savings indicators are set correctly. All machines hosting the Identikey Server component must be very closely clock-synchronized. 15

16 Pre-installation Tasks Embedded PostgreSQL Database Local Users Group Permissions If the local Users group has restricted permissions on the Program Files directory, the installation of the PostgreSQL database may fail. To avoid this problem, two options are available: Set the required permissions for the local Users group Create the PostgreSQL service account before installation and set the required permissions for it (it is usually created automatically during installation) The PostgreSQL service account requires a User ID of dppostgres and password of p!ss&0rd. The permissions required for the Program Files directory are: Read & Execute List Folder Contents Read 16

17 Set Up Data Store for Identikey Server 3 Set Up Data Store for Identikey Server Identikey Server may use either Microsoft's Active Directory or an ODBC-compliant database as its data store. The data store is selected during installation. Active Directory If Identikey Server will use Active Directory as its data store, the steps in 3.1 Active Directory must be followed before installing Identikey Server. ODBC Database If Identikey Server will use the embedded PostgreSQL database as its data store, no specific database setup is required before installing Identikey Server. If Identikey Server will use another ODBC database as its data store, then follow the steps in 3.2 ODBC Database before installing Identikey Server. 3.1 Active Directory Checklist Decisions The following checklist contains the key decisions to make before you start: Approve the Schema Extensions If your company has an approval process to go through for extensions to the Active Directory Schema, then go through this process. Enterprise Root Certificate Server If a new Certificate Server is required, and your company requires an approval process to be followed to install one, go through this process. Identify the Digipass Configuration Domain Either identify an existing Domain or sub-domain into which the Digipass Configuration Container should be added, or plan to create a new one. Domain Administrator Select a Domain Administrator account in the Digipass Configuration Domain to use in installing Identikey Server. Installation Location Decide where to install the Identikey Server. 17

18 Set Up Data Store for Identikey Server If you are installing with the purpose of going through a basic evaluation process, installing onto a Domain Controller is recommended. This will mean that SSL will not need to be set up in order for the Identikey Server to function Active Directory Setup Run the addschema command to extend the Active Directory schema: 1. Log into the Schema Master as a member of the Schema Administrators group. 2. Copy dpadadmin.exe from the CD-IMAGE\Software\Windows\X86 or amd64\utilities\dpadadmin installation directory on the installation CD onto the Schema Master 3. Open a command prompt in the location to which it was copied. 4. Type: dpadadmin addschema -v If DPADadmin detects that Schema extensions are not currently permitted, it will prompt you whether to enable them or not. Enter y to enable them, or n to cancel. 6. Wait several minutes for the Schema extensions to replicate to all the domains and for the local Domain Controller to update its internal data caches. SSL Setup The Identikey Server can use SSL when communicating with Active Directory. For this to work correctly, an Enterprise root Certificate Authority must exist in the forest. It may be installed on any server in the forest, if the server selected is available to the Domain Controller(s) used by the Identikey Server. Alternatively, an option is provided during installation to not use SSL in communications between the Identikey Server and Active Directory. If LDAP SSL will be disabled, no Certificate Authority is required. 1. If not already available, install Certificate Services on the selected machine. This is a Windows component you may need access to the original Windows installation files or CD/DVD. 2. Generate the Enterprise root CA certificate. 3. You may need to wait several minutes to allow the Domain Controllers to enrol for Domain Controller certificates. 18

19 Set Up Data Store for Identikey Server 3.2 ODBC Database The following steps must only be followed if Identikey Server will be using an ODBC database other the embedded PostgreSQL database as its data store. If Identikey Server will be using the embedded database, setup is automatic during installation and configuration Checklist Decisions The following checklist contains the key decisions to make before you start: Database Location and Setup A number of decisions may be required for the ODBC database to be used: The server on which the database will be located. Will the data for the Identikey Server will be stored in a new database, or added to an existing database? Will a new schema be used? New Database Decide the collation sequence to be used for example, case-sensitivity. Database User Accounts Create or select database user accounts for: Modifying the database schema (database administrator account required). Identikey Server (see the Administrator Reference for details on the permissions required) Modify Database Structure DPDBADMIN Utility If the embedded ODBC database is not being used, the addschema command must be run to set up the required schema in the database to be used for Identikey Server. Run the addschema command: 1. Copy dpdbadmin.exe from the CD-IMAGE\Software\Windows\X86 or amd64\utilities\dpdbadmin directory on the installation CD or zip file onto the computer from which the database can be accessed. 2. Create an ODBC Data Source for the database on the computer, if one does not currently exist. 3. Open a command prompt in the location to which it was copied. 4. Enter: dpdbadmin addschema u user_name p password -d dsn 19

20 Set Up Data Store for Identikey Server Ensure that the User ID and password used are that of the database administrator account. For further details on DPDBADMIN, see 14 Extend Data Store Schema. Permissions If the database user account used by the Identikey Server is not the owner of the tables and is not a database administrator account, it must be granted permissions for the tables, or ownership of the tables transferred. Note Ensure that it is possible for the account(s) mentioned to reference the tables by name without a schema prefix. If this cannot be done, see the Administrator Reference for advanced setup instructions. 3.3 Serial Number and Maintenance ID You must have a product Serial Number and a company Maintenance ID unless you are installing an evaluation version of Identikey Server. If these have not been issued to you, contact your VASCO supplier. 20

21 Start Identikey Server Installation 4 Start Identikey Server Installation The installation program will guide you through installing Identikey Server and the initial configuration necessary to get it operational. It will launch one or more Windows Installers (MSI) followed by the Identikey Server Configuration Wizard. Note If you are running the installation on Microsoft Windows Vista or Microsoft Windows 2008 core, the windows shown in this guide may look slightly different to those displayed onscreen, but the procedure will be the same. Image 1: Identikey Server Installation Welcome Window 1. If autorun is enabled on the installation machine the installer will start up when the CD is inserted. If it does not start automatically then double click on autorun.exe. The Welcome window will be displayed. 2. Click Install Identikey Server 3.1 to start the installation. The Welcome window will be displayed. 21

22 Start Identikey Server Installation Image 2: Identikey Server Installation Welcome Window 3. Click Next to continue. The three subsequent chapters cover the three types of installation scenario. Choose the instructions to follow depending on which type of installation you wish to perform: Basic installation, using the embedded PostgreSQL database as data store see 5 Install Identikey Server in Basic Mode ODBC Advanced installation, using an ODBC-compliant database as data store see 6 Install Identikey Server in Advanced mode - ODBC Advanced installation, using Active Directory as data store see 7 Install Identikey Server - Active Directory 22

23 Install Identikey Server in Basic Mode ODBC 5 Install Identikey Server in Basic Mode ODBC There are two installation modes available - Basic and Advanced. If you do not wish to use default installation and configuration settings, follow the instructions in 6 Install Identikey Server in Advanced mode - ODBC. 5.1 Basic Installation Mode Basic Installation will install the following: Identikey Server PostgreSQL database Administration Web Interface Apache Tomcat Java JRE Message Delivery Component (MDC) Audit Viewer After the Identikey Server has been installed the Configuration Wizard will be started up in Basic mode, which means that there will be limited configuration choices, with many settings set to default values. Note Only the embedded PostgreSQL database is available in Basic Installation mode. Basic Installation is NOT available on 64-bit Windows. 23

24 Install Identikey Server in Basic Mode ODBC 5.2 Basic Installation 1. The Installation Type window will be displayed. Image 3: Identikey Server Installation - Installation Type Window 2. Click Perform a basic installation. 3. Click Next. The End-User License Agreement screen will be displayed. 24

25 Install Identikey Server in Basic Mode ODBC Image 4: Identikey Server Installation -License Agreement Window 4. Read the agreement carefully. 5. To accept the License Agreement, check the box I accept the terms in the License Agreement and click Next. If you do not accept the License Agreement, and click Cancel, the install will terminate. The Select Installation Path window will be displayed. 25

26 Install Identikey Server in Basic Mode ODBC Image 5: Identikey Server Installation - Select Installation Path Window 6. If you want to install the Identikey Server somewhere other than the default location, use the browse button to indicate where. 7. Click Next to continue. The Installation Progress window will be displayed. 26

27 Install Identikey Server in Basic Mode ODBC Image 6: Identikey Server Installation - Installation Progress Window 8. Click on Install. The Identikey Server installation will begin. 27

28 Install Identikey Server in Basic Mode ODBC Image 7: Identikey Server Installation - Installation Progress Window The Installer will install each component in turn, checking each one off on the Installation Progress window as it goes. 28

29 Install Identikey Server in Basic Mode ODBC Image 8: Identikey Server Installation - Installation Progress Window - PostgreSQL When the Installer gets to the Run configuration Wizard step, the Identikey Server Configuration Wizard will be started automatically. The Installer runs a contracted version of the wizard, which uses default values for some settings. 29

30 Install Identikey Server in Basic Mode ODBC Image 9: Identikey ServerConfiguration Wizard - Start Window 9. Click Next to continue. The IP Address window will be displayed. 30

31 Install Identikey Server in Basic Mode ODBC Image 10: Identikey ServerConfiguration Wizard - IP Address Window 10. Enter the IP address for the Identikey Server. 11. Click Next. The First Administrator window will be displayed. 31

32 Install Identikey Server in Basic Mode ODBC Image 11: Identikey ServerConfiguration Wizard - First Administrator Window 12. Enter a User ID and Password. Confirm the password and click Next. Image 12: Identikey ServerConfiguration Wizard - License Window 32

33 Install Identikey Server in Basic Mode ODBC 13. Navigate to a license file using the... button, or click Request a license from 'vasco.com'. Note The 'Request a License from vasco.com' button will not be available for Windows 2008 Core, as there is no browser available to load the web site. To obtain a license from vasco.com for Windows 2008 Core you will have to download the license on another machine and copy it across to the Windows 2008 Core machine. Image 13: Identikey ServerConfiguration Wizard - Server Functionality Window The functionality that is permitted by your current license is selected by default. 14. Click to de-select any functions not required. 15. Click Next to continue. 33

34 Install Identikey Server in Basic Mode ODBC Image 14: Identikey ServerConfiguration Wizard - Server Certificate Window 16. Enter a Password for the Server Certificate and confirm it. 17. Click Next to continue. Image 15: Identikey ServerConfiguration Wizard - RADIUS Topology Window 34

35 Install Identikey Server in Basic Mode ODBC 18. Select the format of RADIUS topology required. 19. Click Next to continue. If you selected Identikey Server as a standalone RADIUS server, fill in the details of the RADIUS client and click Next to continue. If you selected Identikey Server in front of RADIUS server, fill in the details of the RADIUS client and RADIUS server and click Next to continue.. Image 16: Identikey Server Configuration Wizard - RADIUS Client Window 35

36 Install Identikey Server in Basic Mode ODBC Image 17: Identikey Server Configuration Wizard - RADIUS Backend Window The Summary window will be displayed. Image 18: Identikey Server Configuration Wizard Summary Window 36

37 Install Identikey Server in Basic Mode ODBC 20. A summary of the settings will be displayed. Click Proceed to continue. Image 19: Identikey Server Configuration Wizard - Completion Window During the deployment of the Administration Web Interface, the Installer will deploy the Administration Web Interface application to the Apache web server using the Identikey Server certificate. The Identikey Server Certificate file will be generated during installation and will be placed in the certificate store file with the default password "ikwebpassword". The location of the server certificate files is \<install directory>\bin\ikeycerts.pem and \<install directory>\bin\ikeypvk.pem (Public and Private certificates respectively) The location of the certificate keystore is \<install directory>\webadmin\keystore.jks 21. Click Finish to complete the configuration. The Import DPX files window will be displayed. 37

38 Install Identikey Server in Basic Mode ODBC Image 20: Import DPX Files Window 22. The Import DPX Files step is optional. To bypass this step, click Next to continue. To import a DPX file: a. Enter the location of the DPX file, or click Browse to navigate to the file. b. Enter the Transport Key, which will be supplied by VASCO to accompany the DPX file. c. Enter the User ID, password and Server IP for the Identikey Server that is being installed. d. Click Import to install the DPX file. When installation is complete, the Installation Complete window will be displayed. 38

39 Install Identikey Server in Basic Mode ODBC Image 21: Identikey Server Installation Complete Window 39

40 Install Identikey Server in Basic Mode ODBC 23. Click Finish when the installation is complete. Note The Embedded Database, embedded Apache Tomcat, and Deploy Web Administration in Apache Tomcat options are NOT available with 64-bit Windows. 40

41 Install Identikey Server in Advanced mode - ODBC 6 Install Identikey Server in Advanced mode - ODBC Advanced Installation allows you to customize your installation and configuration in detail. If you wish to use only default installation and configuration options, see 5 Install Identikey Server in Basic Mode ODBC. 6.1 Advanced Installation The first window to be displayed will be the Install Type window. Image 22: Identikey Server Select Installation Type Window 1. Select the Advanced installation option button. 2. Click Next. The Data Storage window will be displayed. 41

42 Install Identikey Server in Advanced mode - ODBC Image 23: Identikey Server Installation - Data Storage Window 3. Select the ODBC Database option button. 4. Click Next. The Select Components window will be displayed. 42

43 Install Identikey Server in Advanced mode - ODBC Image 24: Identikey Server Installation Select Components Window 5. Click the Identikey Server 3.1 button. The Identikey Server Setup Wizard start window will be displayed. 6. Click Next to continue. The License Agreement screen will be displayed. 43

44 Install Identikey Server in Advanced mode - ODBC Image 25: Identikey Server Installation License Agreement Window 7. Read the agreement carefully. 8. To accept the License Agreement, check the box I accept the terms in the License Agreement and click Next. If you do not accept the License Agreement, and click Cancel, the install will terminate. The next screen to be displayed will be the Custom Setup Window. 44

45 Install Identikey Server in Advanced mode - ODBC 9. Select the features that you want to be installed by clicking on the icons on the window. Click the Reset button to reset all your choices. 10. Click Next to continue. Image 26: Identikey Server Installation Custom Setup window The Ready to Install Identikey Server window will be displayed. 11. Click Install to continue. The Installing Identikey Server progress window will be displayed. 45

46 Install Identikey Server in Advanced mode - ODBC Image 27:Identikey Server Installation Ready to Install Identikey Server window 12. Click the Next button to continue when it becomes available. 46

47 Install Identikey Server in Advanced mode - ODBC Image 28: Installing Identikey Server progress window 13. Click Finish to complete the installation of Identikey Server. The Identikey Server Setup Wizard finish window will be displayed. 47

48 Install Identikey Server in Advanced mode - ODBC Image 29: Identikey Server Setup Wizard Completed window 14. The Installer will install the component for each button that is selected. Each installation after the Identikey Server install is optional. 48

49 Install Identikey Server in Advanced mode - ODBC Image 30: Identikey Server Installation - Select Components window 15. When the Installer gets to the Run configuration Wizard step, click the Run Configuration Wizard button and the Identikey Server Configuration Wizard will be started. 49

50 Install Identikey Server in Advanced mode - ODBC Image 31: Identikey Server Configuration Wizard - Start Window 16. Click Next to continue. The Select Database window will be displayed. Image 32: Identikey Server Configuration Wizard - Select Database Window 50

51 Install Identikey Server in Advanced mode - ODBC 17. Select Embedded database to use the default ODBC database, or Other ODBC-compliant database to use a different ODBC database. If this option is selected, an ODBC-compliant database must exist before installation of Identikey Server. If the Other ODBC-compliant database option has been selected, the Database window will be displayed. Image 33: Identikey Server Configuration Wizard - Database Window a. Enter the ODBC Data Source name for the database that Identikey Server will use, and if required, a Username and Password. b. Click Next to continue. The Master Domain window will be displayed. 51

52 Install Identikey Server in Advanced mode - ODBC Image 34: Identikey Server Configuration Wizard - Master Domain Window 18. Enter the name of the Master Domain where the first administrator account will be created. 19. Click Next to continue. The User ID/Domain conversion window will be displayed. 52

53 Install Identikey Server in Advanced mode - ODBC Image 35: Identikey Server Configuration Wizard - User ID/Domain conversion Window 20. Select the Case conversion format that you require. 21. Tick the Use Windows Name Resolution checkbox to enable Identikey Server to use Windows Name Resolution. This is recommended if Dynamic User Registration is to be enabled. 22. Click Next to continue. The IP Address window will be displayed. 53

54 Install Identikey Server in Advanced mode - ODBC Image 36: Identikey Server Config IP Address Window 23. Enter the IP address for the Identikey Server. 24. Click Next to continue. The First Administrator window will be displayed. The first administrator account can be used to login to Identikey Server (e.g. using the webadmin) and will have a full set of administrative privileges. 54

55 Install Identikey Server in Advanced mode - ODBC Image 37: Identikey Server First Administrator Window 25. The Sensitive Data Encryption window will be displayed. Image 38: Identikey Server Sensitive Data Encryption Window 55

56 Install Identikey Server in Advanced mode - ODBC Note If you will be using a custom encryption key for sensitive data, this should be set before Digipass are imported to the 'live' version of the Identikey Server. See the Sensitive Data Encryption topic in the Administrator Reference for more information. 26. Selecting the Custom with embedded and custom key combination option will result in the Custom Data Encryption windown being displayed. Image 39: Identikey Server Custom Data Encryption Window If you select the Load From File option the Load From File window will be displayed. 56

57 Install Identikey Server in Advanced mode - ODBC Image 40: Identikey Server Load Data Encryption Window 27. With either of the above screens, click Next. The License window will be displayed. Image 41: Identikey Server Configuration Wizard License Window 57

58 Install Identikey Server in Advanced mode - ODBC 28. Navigate to a licence file using the... button, or click Request a licence from 'vasco.com' Note The Request a Licence from 'vasco.com' button will not be available for Windows 2008 Core, as there is no browser available to load the web site. To obtain a licence from vasco.com for Windows 2008 Core you will have to download the licence on another machine and copy it across to the Windows 2008 Core machine. Image 42: Identikey Server Configuration Wizard Server Functionality Window 29. The functions that are available on the Server Functionality window will be determined by your license. Click in the check box to either select or de-select an available function. Click Next to continue. 58

59 Install Identikey Server in Advanced mode - ODBC Image 43: Identikey Server Configuration Wizard Server Certificate Window 30. Select which SSL Server Certificate you want to use with Identikey Server. Click Next to continue. Image 44: Identikey Server Configuration Wizard Server Certificate Password Window 59

60 Install Identikey Server in Advanced mode - ODBC 31. Enter a password foir the SSL Server Certificate and confirm it. Click Next to continue. Image 45: Identikey Server SSL Server Certificate Selection 32. If you want to use private SSL Server Certificate details, enter them on the SSL Server Certificate Selection window. Click Next to continue. 60

61 Install Identikey Server in Advanced mode - ODBC Image 46: Identikey Server Web Admin Client Window 33. Enter the IP address of the location of the Web Administration Client. Image 47: Identikey ServerSample Web Client Window 61

62 Install Identikey Server in Advanced mode - ODBC 34. Enter the IP address of a web client to be used by the Sample Web Pages in the SDK. This page is optional and only needs to be used if the SDK is to be installed. Image 48: Identikey Server Configuration Wizard Summary Window 35. A summary of the settings will be displayed. Click Proceed to continue. 62

63 Install Identikey Server in Advanced mode - ODBC Image 49: Identikey Server Install Wizard Completion Window 36. Click Finish to complete the configuration. 37. Click on the Deploy Web Admin button to install the Web Administration module if required. Image 50: Identikey Server Installation Select Components Window 63

64 Install Identikey Server in Advanced mode - ODBC 38. Enter or browse to the location of the Identikey Server Certificate. Enter of browse to the location of the Web Administration key-store. Enter and confirm the key-store password. Click Deploy to continue. Image 51:Deploying Identikey Server Web Administration Module Window 39. The Web Administration Module will now be deployed. Enter a Key store password and confirm it. Click Deploy and the Web Administration Module will be installed automatically. Click Cancel to stop the Web Administration Module from being installed. 64

65 Install Identikey Server in Advanced mode - ODBC Image 52:Deploying Identikey Server Web Administration Module Wizard Results Window 40. Check the Result field and click Close to continue or Cancel to exit the Installer. 41. The Select Components window will be displayed showing which components have been installed. 65

66 Install Identikey Server in Advanced mode - ODBC Image 53:Select Components completed Window 42. Click Next to continue. The Installation Completed window will be displayed. 66

67 Install Identikey Server in Advanced mode - ODBC Image 54:Installation Report page 67

68 Install Identikey Server in Advanced mode - ODBC Note The Embedded Database, embedded Apache Tomcat, and Deploy Web Administration in Apache Tomcat options are NOT available with 64-bit Windows. 68

69 Install Identikey Server - Active Directory 7 Install Identikey Server - Active Directory 7.1 Active Directory Scenario and Decisions. This 'typical installation' process uses the following decisions and scenario: Implementation Decisions The following decisions were taken for the purposes of this installation process: The Schema extensions have been approved. The Digipass Configuration Domain has been identified as the existing sub-domain, test.dm3.vasco. The member server SVR of the sub-domain test.dm3.vasco will be used to install Identikey Server. This requires an Enterprise Certificate Authority to be installed in the forest, so that SSL is enabled. The instructions will take you through installing Windows Certificate Services onto a Domain Controller in the Forest Root domain. The scenario A Domain dm3.vasco (this is the Forest Root Domain). A sub-domain test.dm3.vasco of dm3.vasco. The sub-domain acts as the Digipass Configuration Domain and contains all the configuration data, including Policies and Components. A single Server SVR, a member server in the Digipass Configuration Domain. A Domain Controller DC-02 acting as the Schema Master on dm3.vasco. Certificate Server will be installed on DC Extend Schema Run the addschema command: 1. Log into the machine from which schema changes will be made (DC-02). 2. Copy dpadadmin.exe onto the machine. 3. Open a command prompt in the location to which it was copied. 4. Type: dpadadmin addschema 5. If DPADadmin detects that Schema extensions are not currently permitted, it will prompt you whether to enable them or not. Enter y to enable them, or n to cancel. 6. Wait several minutes for the Schema extensions to replicate to the sub-domain and for the local Domain Controller to update its internal data caches. To check, use the following command: 69

70 Install Identikey Server - Active Directory dpadadmin checkschema 7.2 Install Identikey Server for Active Directory. 1. The Installation Type window will be displayed. Image 55: Identikey Server Setup - Installation Type window 2. Click on the Advanced installation option button. Click Next to continue. The Data Storage window will be displayed. 70

71 Install Identikey Server - Active Directory Image 56: Identikey Server Setup - Data Storage window 3. Select the Active Directory option button. 4. Click Next. 5. The Digipass Extension for Active Directory Prerequisites page will be displayed. The functions on this page are optional, and need only be used if Digipass and Digipass User administration is to be performed on this machine. 71

72 Install Identikey Server - Active Directory Image 57: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window 6. If you wish to use the Digipass Extension for Active Directory Users and Computers on this machine: a. If the.net 2.0 Framework is to be installed, click the.net 2.0 Framework button. The Microsoft.NET Framework 3.0 SP1 Setup window will be displayed. i Read the license and click to either accept or not accept the terms. ii Click Install to continue or Cancel to cancel the set up. 72

73 Install Identikey Server - Active Directory Image 58: Microsoft.NET license agreement. b. If the MMC 3.0 Framework is to be installed, click the MMC 3.0 Framework button. 73

74 Install Identikey Server - Active Directory Image 59: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window. The Software Update Installation Wizard for your operating system will be displayed. i Click Next to continue. The Digipass Extension for Active Directory Prerequisites window will be displayed, showing the results of the installations. ii Click Next to continue. 74

75 Install Identikey Server - Active Directory Image 60: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation complete window. c. If the Identikey Server is being installed on Microsoft Windows Vista or Microsoft Windows 2008, a hotfix provided by Microsoft must be installed to enable the Active Directory Users and Computers extension to work. If it is not already installed on the machine, the Active Directory Query Form Hotfix button will be enabled. Click this button to install the hotfix. Please note that the Active Directory Query Form Hotfix button will remain unavailable on any operating system other than Microsoft Windows Vista or Microsoft Windows

76 Install Identikey Server - Active Directory Image 61: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation hotfix window. 76

77 Install Identikey Server - Active Directory i Click OK to install the hotfix. Image 62: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix installer window. The result will be shown on the Digipass Extension for Active Directory Prerequisites window. 7. Click Next to continue. 77

78 Install Identikey Server - Active Directory Image 63: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix applied window. The Select Components window will be displayed. 8. Click Identikey Server 3.1 to start the installation wizard. 78

79 Install Identikey Server - Active Directory Image 64: Identikey Server Setup - Select Components Window 9. The Identikey Server Setup Wizard start window will be displayed. Click Next to continue. 79

80 Install Identikey Server - Active Directory Image 65: Identikey Server Setup Wizard Start Page. The License Agreement screen will be displayed. 80

81 Install Identikey Server - Active Directory Image 66: Identikey Server Setup - License Agreement Window 10. Read the agreement carefully. 11. To accept the License Agreement, tick the I accept the terms in the License Agreement checkbox and click Next. If you do not accept the License Agreement, and click Cancel - the install will terminate. 12. To select the features that you want to be installed click on the icons on the window. Click the Reset button to reset all your choices. Click Next to continue. 81

82 Install Identikey Server - Active Directory Image 67: Identikey Server Setup - Custom Setup window 13. The Ready to Install Identikey Server window will be displayed. Click Install to continue. 82

83 Install Identikey Server - Active Directory Image 68: Identikey Server Setup - Ready to Install Identikey Server window The Installing Identikey Server progress window will be displayed. 14. Click the Next button to continue when it becomes available. 83

84 Install Identikey Server - Active Directory Image 69: Installing Identikey Server progress window The Identikey Server Setup Wizard finish window will be displayed. 15. Click Finish to complete the installation of Identikey Server. 84

85 Install Identikey Server - Active Directory Image 70: Identikey Server Setup Wizard finish window 16. The Installer will install the component for each button that is selected. Each installation after the Identikey Server install is optional. 85

86 Install Identikey Server - Active Directory Image 71: Identikey Server Installed Select Components 17. When the Installer gets to the Run Configuration Wizard step, click the Run Configuration Wizard button. The Identikey Server Configuration Wizard will be started. 86

87 Install Identikey Server - Active Directory Image 72: Identikey Server Configuration Wizard Start Window 18. Click Next to continue. The Active Directory pre-requisites window will be displayed. 19. Read the information and make sure all the pre-requisites have been met before clicking Next. 87

88 Install Identikey Server - Active Directory Image 73: Identikey Server Configuration Wizard - Active Directory Pre-requisites Window 20. If this is not the first Identikey Server to be installed, tick the This is NOT the first Identikey Server to be installed check box. Wait for the Active Directory changes made during the installation of the first Identikey Server to replicate fully. You must be logged into the machine as a Domain Administrator in the machine s Domain. 21. Click Next. The Digipass Configuration Domain window will be displayed. 22. Enter the fully qualified name of the Domain in which Identikey Server should store its configuration data. This domain must currently exist. 88

89 Install Identikey Server - Active Directory Image 74: Identikey Server Configuration Wizard Digipass Configuration Domain Window 23. Click Next. The Active Directory Certificate Authority window will be displayed. Image 75: Identikey Server Configuration Wizard Active Directory Certificate Authority Window 89

90 Install Identikey Server - Active Directory 24. Click on the Disable LDAP SSL option box if you want to disable LDAP SSL. 25. Click Next to continue. The IP address winow will be displayed. Image 76: Identikey Server Configuration Wizard IP Address Window 26. Enter the IP address for the Identikey Server. 27. Click Next to continue. 90

91 Install Identikey Server - Active Directory Image 77: Identikey Server Configuration Wizard First Administrator Window 28. Enter a User ID and Password for the First Administrator. Confirm the password and click Next. The Sensitive Data Encryption window will be displayed. 91

92 Install Identikey Server - Active Directory Image 78: Identikey Server Configuration Wizard Sensitive Data Encryption Window Note If you will be using a custom encryption key for sensitive data, this should be set before Digipass are imported to the 'live' version of the Identikey Server. See the Sensitive Data Encryption topic in the Administrator Reference for more information. 29. To use Identikey Server's standard encryption settings: a. Select the Standard with embedded key option button b. Click on Next. To use custom encryption settings, either: 92

93 Install Identikey Server - Active Directory Image 79: Identikey Server Configuration Wizard Custom Data Encryption Window a. Select the Custom with embedded and custom key combination option button. b. Enter the Storage key. c. Select a cipher. OR 93

94 Install Identikey Server - Active Directory Image 80: Identikey Server Configuration Wizard Load Data Encryption Window a. If you have created your own Data Encryption file, select the Load from file option button. b. Browse to the file in this window. 94

95 Install Identikey Server - Active Directory c. 30. Enter the password. Click Next. The License window will be displayed. Image 81: Identikey Server Configuration Wizard License Window 31. Navigate to a license file using the... button, or click Request a licence from 'vasco.com'. Note The Request a License from 'vasco.com' button will not be available for Windows 2008 Core, as there is no browser available to load the web site. To obtain a licence from vasco.com for Windows 2008 Core you will have to download the licence on another machine and copy it across to the Windows 2008 Core machine. 32. Click Next. The Server Functionality window will be displayed. 95

96 Install Identikey Server - Active Directory Image 82: Identikey Server Configuration Wizard Server Functionality Window The functions that are available on this window will be determined by your license. Those shown above are available by default. 33. Click in check boxes to either select or de-select the required functionality. 34. Click Next to continue. The SSL Server Certificate Installation window will be displayed. 96

97 Install Identikey Server - Active Directory Image 83: Identikey Server Configuration Wizard SSL Server Certificate Window 35. To use an SSL certificate generated by the Configuration Wizard: a. Select the Generate and install a new test certificate option button. b. Click on Next. 97

98 Install Identikey Server - Active Directory Image 84: Identikey Server Configuration Wizard SSL Server Certificate Password Window c. Enter a password for the new certificate. To use a commercial SSL Server Certificate: a. Select the Install my own SSL certificate option button. b. Click on Next. 98

99 Install Identikey Server - Active Directory Image 85: Identikey Server Configuration Wizard SSL Server Certificate Selection Window 36. c. Browse to the certificate file. d. Enter the password for the certificate. e. Browse to the trusted certificates file. Click Next to continue. The Web Admin Client window will be displayed. 99

100 Install Identikey Server - Active Directory Image 86: Identikey Server Configuration Wizard Web Admin Client Window 37. Enter the IP address of the Web Administration Client. Click Next to continue. The Sample Web Client window will be displayed. 100

101 Install Identikey Server - Active Directory Image 87: Identikey Server Configuration Wizard Sample Web Client Window 38. Enter the IP address of a web client to be used by the Sample Web Pages in the SDK. This page is optional and only needs to be used if the SDK is to be installed. 39. Click on Next. A summary of the settings will be displayed. 101

102 Install Identikey Server - Active Directory Image 88: Identikey Server Configuration Wizard Summary Window 40. Check the settings carefully, then click Proceed to continue. Image 89: Identikey Server Configuration Wizard Completion Window 41. Click Finish to complete the configuration. 102

103 Install Identikey Server - Active Directory Image 90:Deploying Identikey Server Web Administration Module Window The Web Administration Module, if installed, will now be deployed. 42. Enter a Key store password and confirm it. 43. Click Deploy. The Web Administration Module will be installed automatically. Click Cancel to stop the Web Administration Module from being installed. Image 91:Deploying Identikey Server Web Administration Module Wizard Results Window 103

104 Install Identikey Server - Active Directory 44. Check the Result field and click Close to continue or Cancel to exit the Installer. If you clicked Close the Installation Completed window will be displayed Image 92: Identikey Server Installation Complete Window 45. Click Finish when the installation is complete. Note The Embedded Database, embedded Apache Tomcat, and Deploy Web Administration in Apache Tomcat options are NOT available with 64-bit Windows Install Active Directory Users and Computers Extension on a Child Domain To install the Active Directory Users and Computers Extension on a child domain follow the instructions below. 1. Install Identikey Server on the machine with the parent domain. 2. Log in to the child domain machine, making sure you have administration authority. 3. On the child domain machine, run the Identikey Server installation as detailed above until you get to the Custom Setup window. When you get to this window uncheck every component EXCEPT the Active Directory User and Computers extension. 104

105 Install Identikey Server - Active Directory Image 93: Identikey Server Installation Custom Setup Window. 4. Continue with the Identikey Server Installation instructions from the Custom Setup window as detailed above. After the installation has finished you will see the Active Directory Users and Computers item on the Start Menu under VASCO\Identikey Server. 105

106 Install Identikey Server - Active Directory Image 94: Windows Start Menu showing location of Active Directory Users and Computers. 106

107 Deploy Identikey Server Web Administration 8 Deploy Identikey Server Web Administration 8.1 Deploy Administration Web Interface on the same machine as Identikey Server The Administration Web Interface is provided as a.war (web archive) file, webadmin.war. This web application must be deployed in a Java web application server before it can be used. If the Administration Web Interface and the embedded Tomcat server is installed with Identikey Server, the Administration Web Interface will be deployed automatically by the Configuration Wizard Deploy Administration Web Interface in Apache Tomcat Server (32-bit Windows only) If the Administration Web Interface is not installed at the same time as the Tomcat server, the setup program can still deploy it automatically in an installed Tomcat server. To deploy the Administration Web Interface in an Apache Tomcat server: Run the setup.exe file if it is not still running.. 2. Click on 6. Deploy Web Administration in Apache Tomcat. 3. Enter the location of the Identikey Server certificate if it differs from the default. 4. Enter the location of the Administration Web Interface keystore if it differs from the default. 5. Enter and confirm a new password for the keystore. 6. Click on Deploy. Deploy Web Administration Interface in Apache Tomcat Server Manual Instructions The following instructions may be used where deployment via the setup program has failed: 1. If you have not restarted the machine since installing, the Tomcat service may need to be started manually: a. Go to the desktop. b. Right-click on My Computer. 107

108 Deploy Identikey Server Web Administration Image 95: My Computer - Manage c. Click on Manage. The Computer Management console will be displayed. Image 96: Identikey Server Computer Management console d. Expand the Services and Applications heading. e. Click on Services. f. Right-click on Apache Tomcat. g. Select Start. 108

109 Deploy Identikey Server Web Administration 2. Create a Tomcat administrator. a. Open <install-dir>\tomcat\tomcat 5.5\conf\tomcat-users.xml, b. Add the following lines to this file before the final </tomcat-users> and save the changes: <role rolename="manager"/> <role rolename="admin"/> <user username="admin" password="" roles="admin,manager"/> 3. Open a browser window. 4. Go to localhost:<port on which the web application server is listening>. Typically the port number will be The Tomcat introduction page should be displayed. Image 97: Apache Tomcat Introduction page 5. Click on Tomcat Manager. The Tomcat Manager login window will be displayed. 109

110 Deploy Identikey Server Web Administration Image 98: Apache Tomcat Manager login 6. Log in using admin as your username and a blank password. The Tomcat Web Application Manager will be opened. 7. Scroll down to the WAR file to deploy section. 110

111 Deploy Identikey Server Web Administration Image 99: Apache Tomcat Manager 8. Click on the Browse button. 9. Find and select the webadmin.war file typically in c:\program files\vasco\identikey Server 3.1\webadmin. 10. Click on Open. 11. Click on Deploy. 12. An entry titled /webadmin should appear in the Applications list. 111

112 Deploy Identikey Server Web Administration Image 100: Apache Tomcat Manager 13. Restart the Apache Tomcat service: a. Go to the desktop. b. Right-click on My Computer. c. Click on Manage. d. Expand the Services and Applications heading. e. Click on Services. f. Right-click on Apache Tomcat. g. Select Restart. 14. Go back to the browser window. 15. Click on the new /webadmin entry. The Administration Web Interface login screen should be displayed. 112

113 Deploy Identikey Server Web Administration Image 101: Administration Web Interface login Log in using the username and password entered in the Configuration Wizard. Java Memory Pool The memory pool for Java has be large enough to accommodate the largest administration operations you will perform with the Administration Web Interface. e.g. Import DPX and user files. The embedded Tomcat provided by VASCO has a 128 megabyte memory pool, however another Tomcat version may only have the default 64 megabyte memory pool. You can increase the memory pool if necessary by opening the Apache Tomcat Properties window, selecting the Java tab, and updating the Maximum memory pool field. You must then restart Tomcat. If an operation fails with an out of memory error, increase the pool size by going to Start>Vasco>Identikey Server>Tomcat Monitor. Click on the Java tab. 113

114 Deploy Identikey Server Web Administration Image 102: Apache Tomcat memory pool Upload Limit An upload limit of 5 megabytes has been set in the Administration Web Interface for user DPX import files. To change this value go to the place where Tomcat is installed (usually Program Files\VASCO\Identikey Server\Tomcat). Go to the Tomcat 5.5\webapps\webadmin\WEB-INF\classes directory, double-click the struts.properties file and edit the struts.multipart.maxsize value: #set max upload size to 5 meg. struts.multipart.maxsize=

115 Deploy Identikey Server Web Administration Image 103: Location of struts.properties file. Save the file then restart Tomcat Using the Adminstration Web Interface with Internet Explorer In order for some of the Administration Web Interface pages to work on Microsoft Windows using Internet Explorer 7, active scripting must be enabled and the URL for the Administration Web Interface must be added to the trusted sites. 1. Open Internet Explorer. 2. Go to Tools > Internet Option. Click on the Security Tab. 3. Highlight Internet globe icon, click on the Custom Level.. button. 4. Scroll down to the Active Scripting option and click Enable. 5. Click the OK button, and then the OK button again. To add the URL for the Administration Web Interface to the trusted sites: 6. Stay on the Security Tab. 7. Select the green Trusted Sites icon. 115

116 Deploy Identikey Server Web Administration Click the Sites button. 9. Ensure that the Require server verification ( for all sites in this zone check box is NOT selected. 10. Add the URL of the Administration Web Interface. 11. Click the Add button, and then the Close button. 12. Click the OK button. 13. Restart Internet Explorer. Deploy Administration Web Interface on a Dedicated Machine These instructions describe how to install the Identikey Server Administration Web Interface on a different machine to the Identikey Server. 1. Use setup.exe to install: a. Identikey Server, but only select the Web Administration component. Note The Administration Web Interface is set up differently depending on the data store in use by Identikey Server. Ensure that you select the correct data store either Active Directory or ODBC Database - during installation. 2. b. Java c. Tomcat Copy the ikeycerts.pem file from the Identikey Server installation. The file is typically located in the c:\program files\vasco\identikey Server 3.1\bin directory on the machine that contains the Identikey Server. Copy the file to the c:\program files\vasco\identikey Server 3.1\webadmin directory on the machine on which you are installing the Administration Web Interface. 3. Stop the Tomcat service on the machine on which you are installing the Administration Web Interface using the Tomcat monitor (see Deploy Web Administration Interface in Apache Tomcat Server Manual Instructions above) 4. Copy the webadmin.war file from c:\program files\vasco\identikey Server 3.1\webadmin to c:\program files\vasco\identikey 3.1\tomcat\Tomcat 5.5\webapps. 5. Run the following command on the machine on which you are installing the Administration Web Interface: (See 8.3 Web Administration Setup Tool) java -jar admintool.jar certificate add <keystore file name> <password> <certificate file> Where <keystore file name> is the keystore file name. e.g. c:\program files\vasco\identikey Server 3.1\webadmin\keystore.jks Where <password> is your own password. 116

117 Deploy Identikey Server Web Administration Where <certficatefile> is the path/name of the file which contains the server certificate as used in Step 2. This command will create a new keystore for the Web Administration in Tomcat. 6. Run the following command on the machine on which you are installing the Administration Web Interface. This command will add the server entry to the Web administration tool: java -jar admintool.jar server add <servername> <server url> Where <servername> for the name of the server Where <server url> for the URL you want to use to access the server 7. Start the Tomcat service. 8. Log in as previously described. Select the server on the log in screen to correspond with the server on which you have installed the Web Administration. 8.3 Web Administration Setup Tool Overview The Web Administration Setup Tool is a Java application that allows the set up and configuration of the Administration Web Interface. The Web Administration Setup Tool is used for managing SSL certificates as well as Identikey Servers to which the Web Administration application can connect. The Web Administration Setup Tool requires a Java Runtime Environment. The information created using the Web Administration Setup Tool can be viewed via the Web Administration application. Any changes made using the Web Administration Setup Tool will not be reflected in the Web Administration application until the Web Administration application is restarted. The Web Administration Setup Tool stores its information using the Java preferences API. Under Windows it uses the Windows registry Running the Application 1. Open a command prompt. 2. Navigate to the directory in which the Java executable is located. 3. Enter the following command: java -jar admintool.jar 117

118 Deploy Identikey Server Web Administration Available Commands The commands should be in the following format: java -jar admintool.jar <command> [options] The following commands are available: Setup Tool Command Explanation autoadd <name> <url> <certificate archive> <password> <connection limit> <connection timeout> Creates a new Identikey Server connection for the Administration Web Interface. If a certificate archive and password is specified, the Identikey Server's SSL certificate will be added to it. If no certificate archive is specified, it will be added to the existing keystore. A connection limit (number of concurrent connections to allow) and connection timeout may also be specified. server list List the available Identikey SOAP servers server add <name> <url> <connection_timeout> <connection limit> Add a new Identikey Server connection. A connection limit (number of concurrent connections to allow) and connection timeout may also be specified. server delete <name> Remove an existing Identikey Server server default <name> Set the specified Identikey SOAP server as the default server localaddress <name> <local address> Specify a local IP address to specify when connecting to the provided server name. certificate list Displays the list of certificate alias which are in the used certificate archive certificate list <certificate archive> <passphrase> Displays the list of certificate alias which are in the specifiedcertificate archive (opened using the specified passphrase) certificate add <certificate archive> <passphrase> <certificate file> <name> Installs the certificate into an existing or new certificate archive using the provided passphrase and alias the certificate using the provided name. certificate delete <certificate archive> <passphrase> <name> Removes the certificate with the specified alias from the provided certificate delete <certificate archive> <passphrase> Removes the certificate with the default alias "IdentikeyServer" certificate archive using the provided password. autoadd <name> <url> <certificate archive> <passphrase> Combines the functionality of the server add and certificate add commands and automates the retrieval of the certificate from the Identikey Server Command Usage Examples Adding an Identikey Server To add an Identikey Server, navigate to the i<install dir>\webadmin directory and then run the command java -jar admintool.jar autoadd new_server 118

119 Deploy Identikey Server Web Administration This command will create a new Identikey Server record which will be displayed in the Web Administration application using the name new_server and will connect to the Identikey SOAP communicator using http (inherent to SOAP) at address using port 8888 (as configured for the identikey server). NOTE Protocol strings must be provided (http or https for SSL connections). You can verify that this server has been created by running the following command: java -jar admintool.jar server list which will display the current list of servers. NOTE The server name and url are considered to be unique. Attempting to add another server with a different name and the same url will fail (adding a server with the same name and different url will overwrite the existing server's entry) Adding a certificate To connect to an Identikey Server which is using an SSL connection we must add the server's certificate to the Web Administration application's certificate archive. The certificate used by the Identikey Server is usually created with the filename ikeycerts.pem and located in : <install dir>\bin To add this certificate to the Web Administration application's certificate archive, run the following command: java -jar admintool.jar autoadd new_server webadmin.jks ourpassword \etc\vasco\ikeycerts.pem where the webadmin.jks is the Web Administration application's keystore filename and ourpassword is the password we use to make sure that no-one can simply add another certificate to our Web Administration application's certificate archive. Once this certificate has been added we can connect to the Identikey Server. NOTE Make sure that the connection url to the server is updated (https is used as opposed to http). All other commands provided are extensions of these two basic commands. 119

120 Post-Installation Tasks 9 Post-Installation Tasks 9.1 Licensing Each Identikey Server will require a license key to be loaded into its Server record even if you are using an evaluation license. If this is not completed during the install process, it will need to be done before the Identikey Server can be used for authentication, signature validation or provisioning. Refer to the Licensing section of the Administration Reference for instructions Evaluation Serial Number If you do not obtain a license key file during installation of the Identikey Server, but wish to use an evaluation license, you will need to use this serial number on the VASCO licensing site: 012E Backup Strategy Consider a backup strategy to be put in place for files which will require backing up. For more information, see the Backup and Recovery section of the Administrator Reference. 9.3 Audit Settings Configure how and when the Identikey Server will record audit messages. Text File If auditing to a text file, you will need to decide how often a new text file should be created. By default, a new text file is created monthly. To change this frequency, modify the variables used in the file name. For example, if the Identikey Server is configured to write to a text file set to IdentikeyServer-{year}-{month}.audit, a new text file will be created monthly. If the text file name is set to IdentikeyServer-{year}-{month}-{mday}.audit, a new text file will be created daily. For more information, see the Auditing section of the Administrator Reference. Event Log If auditing primarily to the Windows Event Log, ensure that the Event Log is configured to not overwrite old entries automatically. This is the default setting. To check: 1. Open the Event Log. 2. Right-click on the specific log to which the Identikey Server will be auditing. 120

121 Post-Installation Tasks 3. Select Properties. 4. Select Do not overwrite events (clear log manually) from the When maximum log size is reached option button group. 5. Click on OK. 9.4 Database Tasks Embedded Database: dppostgres account When Identikey Server is installed with the embedded database, a local machine account called dppostgres is created on the installation machine. If installed on a domain controller, this account will be a domain account which has privileges to log on as a service and locally. The privileges to log on locally may be removed manually. Note The dppostgres account is not automatically deleted upon uninstallation of Identikey Server. Changing the dppostgres account password If the password for the dppostgres account is modified, it must also be changed for the PostgreSQL Database Server 8.2 service running on the machine. To do this: 1. Open the Computer Management console (right-click on My Computer and select Manage) 2. Expand the Services and Applications node, and click on Services. 3. Scroll down the Services list to PostgreSQL Database Server 8.2. Double-click on the entry. 4. Click on the Log On tab. 5. Enter the new password in the Password and Confirm Password fields. 6. Click on Apply. Note If the dppostgres account password is changed, it should be changed back to the default before uninstalling and reinstalling Identikey Server. If not, the new installation will fail Configure Connection Parameters You may wish to increase the number of connections attempted to the database if: 121

122 Post-Installation Tasks The load on the database will be high, and Changes to the connection settings will be efficient with the database and database driver in question. Setting an idle timeout will allow connections which are no longer required to be closed as soon as possible, which may lower the load on the database server. See the Administrator Reference for more information Additional Databases If additional databases are required for backup, failover or load-balancing purposes, configure the Identikey Server to use them now. See the Additional ODBC Databases topic in the Product Guide and the Database Connection Handling topic in the Administrator Reference for more information Permissions for Windows Group Check If you plan to use the Windows Group Check feature, additional permissions need to be set up. Add LocalSystem ( SYSTEM ) to either Administrators or the Account Operators Windows group on the server to allow the Identikey Server to run a group check: 1. Go to the desktop and right-click on My Computer. 2. Click on Manage. 3. Expand the Local Users and Groups node. 4. Click on Groups. 5. Right-click on Administrators or Account Operators. 6. Click on Add to Group Click on Add Click on Locations Select the local machine and click on OK. 10. Enter SYSTEM in the object name memo. 11. Click on OK. 122

123 Post-Installation Tasks A new entry will be added to the Members list. 9.5 Set Up User Self Management and OTP Request Websites To set up the User Self Management and OTP Request Websites you need to deploy the web pages to a web server such as IIS and configure the CGI used by the web site with the location of the Identikey Server. The web sites consist of HTML pages with JavaScript, CSS and image files and the CGI. Therefore it can be deployed in a wide variety of web servers. The CGI needs to be located in a directory where it can be executed. For Windows 2003 you are able to automatically deploy the User Self Management and OTP Request Websites to the default website in IIS during installation. Alternatively, you may install the User Self Management and OTP Request Websites manually using the following instructions: 1. Open the IIS Window. Go to websites\default web site. 2. Create a virtual directory (right click on defalut web site, create virtual directory) for the web site you are installing. A wizard will appear: a. Enter the virtual directory name. b. Browse to where the websites have been installed to usually Program Files\VASCO\Identikey Server 3.1\websites 123

124 Post-Installation Tasks c. Check execute. d. Click Finish. 3. Higlight the virtual directory and right click. Select Properties. Check read on the Virtual Directory tab. 4. Run the Configuration GUI for the web site you are setting up. One is installed for each web site. They usually under Program Files\VASCO\Identikey Server 3.1\web site name. When the virtual directory is opened in a browser the following page should be displayed: 124