Setup Reset Password Portal. CloudAnywhere. Auteur Emmanuel Dreux

Transcription

1 Setup Reset Password Portal CloudAnywhere Auteur Emmanuel Dreux Setup RPP, CloudAnywhere, Version 156 Rédacteur Emmanuel Dreux (Cloudiway) "SetupRPP.docx" Modified : 8 juil. 12 Page 1

2 @Copyright 2011 CLOUDIWAY. All right reserved. Use of any CLOUDIWAY solution is governed by the license agreement included in your original contract. The copyright and all other intellectual property rights in the Software are and remain the property of CLOUDIWAY and/or its subsidiaries ( CLOUDIWAY ). The licensee shall not acquire any title, copyright or other proprietary rights in the Software or any copy than specified in. You may not attempt copy, modify, alter, disassemble, de-compile, translate or convert in human readable form, or reverse engineer all or any part of the Features and/or Data. You acknowledge that the Software and all related products (including but not limited to documentation) are the subject of copyright. You therefore, shall not during or any time after the expiry or termination of this Agreement, permit any act which infringes that copyright and, without limiting the generality of the foregoing, You specifically acknowledge that You may not copy the Software or Products except as otherwise expressly authorized by this Agreement. Copyright by CLOUDIWAY. CLOUDIWAY provides this publication as is without warranty of any either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. CLOUDIWAY may revise this publication from time to time without notice. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions; therefore, this statement may not apply to you. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL Release 2.1.6DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Page 2/14

3 Content 1 CONTENT OF THIS GUIDE 4 2 OVERVIEW KEY FUNCTIONALITIES PRE-REQUISITES 6 3 INSTALLATION ACCOUNTS SETUP AND CREATION INSTALLATION 7 4 CONFIGURATION DOMAIN CONFIGURATION SECRET QUESTIONS CONFIGURATION 13 Page 3/14

4 1 CONTENT OF THIS GUIDE The CloudAnywhere Reset Password Portal installation guide provides information about: - Installation of CloudAnywhere - Configuration of the Reset Password and Access Management Portal - Troubleshooting This guide is intended for administrators who will install the portal. Feedback If you have comments about this guide, please send an message to contact@cloudiway.com Page 4/14

5 2 OVERVIEW CloudAnywhere is a cloud based Identity and Access management solution. CloudAnywhere synchronizes your local/on premise directories with your SAAS and ASP providers. It automates users, groups and contact provisioning and de-provisioning and also synchronizes passwords. CloudAnywhere, in the heart of your Cloud IT helps you build you IT strategy around the Cloud and guarantees access to any SAAS and ASP resource. CloudAnywhere is shipped with a portal that brings self service reset password and self service access request management. The reset password functionality helps you reduce your helpdesk costs and the access management portal helps you integrate your SAAS and ASP resources into your IT. Based on a workflow, users request access to SAAS and ASP resources and they are automatically provisioned upon validation. The reset password and access management request portal is a key functionality in your organization to help reduce your helpdesk costs. When a user has lost his on premise or Cloud passwords, he can reinitialize them without having to contact the helpdesk. End users can also request access to any Cloud or local resources. The requests are routed to the managers of the resources who can accept or deny the access. 2.1 KEY FUNCTIONALITIES CloudAnywhere is an ONPREMISE application that you install between you local directories and your SAAS / ASP provider: Universal provisioning solution. Synchronization Active Directory <-> Cloud Synchronize users Synchronize groups Synchronize contacts Synchronize passwords Work with SSO solutions Synchronizes Aliases and Nicknames Synchronize Organizational units Powerful Reconciliation engine for discovering and matching existing accounts between the local directory and the targets. Role based and access management. Self service reset password for Active Directory and SAAS applications The reset password portal has the following functionalities: Page 5/14

6 Reset passwords in Active Directory. Reset passwords in SAAS applications. Enrollment by answering secret questions. Administrators and Helpdesk Roles to reset password of every users in the organization. Self service reset password for end user. Self service Access Management request. The reset password portal can be used in pure On Premise scenario to allow users without computers in the domain to reset their passwords. Mails can be automatically sent to users whose passwords are going to be expired (number of days configurable). 2.2 PRE-REQUISITES Installs on Windows 2003, 2008 or 2008 R2 server. 32 or 64 bits. Dotnet framework 4.0. Requires a Microsoft SQL Server instance. Every version is supported, including SQL express. Requires IIS. Virtualized environment supported. Links to SQL Express with SQL Studio Manager express : Page 6/14

7 3 INSTALLATION Before you install the product, you need a set of specific accounts: - The account that will perform the installation must be administrator of the computer and must have administrative permissions on the SQL server (create the database, stored procedures and logins). - A service account that will execute the Application Pool and that will have permissions on the SQL database. - An account in the Active Directory domains that has permissions to reset passwords and to modify group Membership (for access management portal). 3.1 ACCOUNTS SETUP AND CREATION Application Pool Service Account This account will be used to execute the Application. It must have the permissions on the SQL database You can call it for example SVCCloudAnywhere Active Directory Service accounts These accounts are used by the portal to read and write to the Active Directories. Depending on the usage, you might need to give these accounts full control, or just delegate the relevant permissions to specific Organizational Units. If needed, don t hesitate to contact the CloudIway support to assist you with this task. Depending on the configuration, this account might or might not be needed. Explanation: When you configure your Active Directory access, you specify is the access is of type Windows Integrated or dedicated account. If the access is of type Windows Integrated, then the application pool account will be used for accessing Active Directory. Therefore, you would not need a separate account. 3.2 INSTALLATION Create a directory for example c:\inetpub\www\rpp. Unzip rpp.zip into this directory. Page 7/14

8 3.2.1 SQL DATABASE INSTALLATION. Launch SQL Studio Manager and load rpp.sql Execute it. It creates the rpp database with all the tables and stored procedures. The next step is to give the Applicationpool account the right to read/write and execute stored procedures on the webportal database. In a new SQL Studio Manager window, launch: Use rpp GO /* CREATE A NEW ROLE */ CREATE ROLE db_executor /* GRANT EXECUTE TO THE ROLE */ GRANT EXECUTE TO db_executor GO /* Create new Login */ IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'svccloudAnywhere') CREATE USER [svccloudanywhere] FOR LOGIN [TARGETDOMAIN\svcapppoolcloud] WITH DEFAULT_SCHEMA=[dbo] GO exec sp_addrolemember DB_Executor, svccloudanywhere exec sp_addrolemember DB_Reader, svccloudanywhere exec sp_addrolemember DB_Writer, svccloudanywhere go *replace TARGETDOMAIN\svcapppoolcloud with the name of your application pool account IIS CONDFIGURATION Application Pool Creation Create a dedicated Application Pool Call it for example CloudAnywherePool Launch Internet Information Services Manager Page 8/14

9 Right Click Application Pools and click Add Application Pool Type the name of the Application Pool (ex: Webportal) and select.net Framework 4.0 Right Click the Application Pool and click Advanced Settings Page 9/14

10 In Identity, Click ApplicationPoolIdentity. Select Custom Account and click set Type the name of your application pool account and click Ok Website configuration Page 10/14

11 Create a new website. Call it for example RPP. Select as application pool the application pool created above. In physical path, select the directory in which you have unzipped rpp.zip WEB CONFIGURATION Edit the web.config (in c:\inetpub\www\rpp) and modify the SQL connection string to point to the SQL database. Change the security settings for the anonymous access TROUBLESHOOTING The portal requires that aspnet 4.0 is registered. If this is not the case, you can manually register it: Open an elevated command prompt, navigate to c:\windows\microsoft.net\framework\ v and run Aspnet_regiis.exe -i Page 11/14

12 4 CONFIGURATION When you launch the portal for the first time, you don t have to authenticate. 4.1 DOMAIN CONFIGURATION In Configuration, select Domain Settings Add the Active Directory domains that will be managed by this portal. You must first create three groups in the Active Directory, for example: - PortalAdmins : Members of this group will be allowed to administer the portal. - PortalHeldesk : Members of this group can reset the passwords of the portal users. - PortalUsers : Members of this group can reset their password using the portal. Fields: Domain : FQDN Domain name DN: Distinguished name of the domain (you can select an organizational unit) Netbios Name: The netbios name of the domain. Cloud is Enabled for password change : Passwords will be changed in the Cloud based applications managed by CloudAnywhere. AD Is Enabled for password change : Passwords will be changed in the Active Directory. Page 12/14

13 You must choose one of the options, not both. If you have activated Cloudanywhere password synchronization, you should select the option to reset the passwords in the Active Directory only. Password changes will be caught by the CloudAnywhere agents installed in each Active Directory and passwords will then be propagated to the Cloud. Connection type: Select automatic connection or Manual connection: In Automatic connection, Active Directory DNS mechanisms are used to discover and select the Active Directory where LDAP queries will be performed. In Manual connection, you will have to select an Active Directory server and port (It can be useful if the server is installed in a computer that is not member of the domain, or is installed in a domain without trust relationship to this domain). Windows Integrated vs Simple Bind. In Windows Integrated mode, the identity of IIS Application pool account is used for performing the queries against the Active Directory. Alternatively, you can select Simple Bind and enter the credentials (username /password) of an account with permissions in the Active Directory. 4.2 SECRET QUESTIONS CONFIGURATION Next, in configuration -> Questions and answer settings, Edit Registration settings, Forgot Password Settings and Change Password Settings. Define the number of questions that will be presented to the users during registration. Also define the number of personal questions that the user must enter. In forgot Password Settings, define the number of questions that will be presented to the user, and the number of correct questions that must be answered. In case of incorrect answers, define the number of unsuccessful attempts, and if this limit is reached, how long the user will be locked out in the portal. (He will be locked out in the portal, not in the Active Directory. It means that he will not be allowed to use the portal anymore during X minutes). Last step, define the secret question in french and English that the user can pickup during registration. Example of questions: Page 13/14

14 What is your mother's maiden name? What is the name of your favorite cousin? The country that you always dreamt of vacationing in? What is your favorite color? Who is your childhood hero? What was the name of your elementary / primary school? What is the first name of your eldest nephew/niece? When is your parent's wedding anniversary? What was your favourite cartoon character during your childhood? What is the first name of your grandmother (mother's mother)? 4.3 SELF SERVICE MANAGEMENT If you want to give your users access to self service registration to SAAS or On Premise applications, click on Resources, then Add New Resource. Give it a title and a description. Then select an Active Directory group and a manager for this application. The resource will now appear in resource list. Your users will be able to list them and request access to the resource. Page 14/14