Disable SSL for Digipass Plug- I n for I AS access to Active Directory. Creation date: 26/ 06/ 2006 Last Review: 26/ 06/ 06 Revision num ber: 1

Transcription

1 Disable SSL for Digipass Plug- I n for I AS access to Active Directory Creation date: 26/ 06/ 2006 Last Review: 26/ 06/ 06 Revision num ber: 1 Docum ent type: How To Security status: EXTERNAL Sum m ary This docum ent describes how to disable SSL for the access of the Digipass Plug-in for I AS to Active Directory. Details I n the following cases, SSL m ust be available for Digipass Plug-I n (DPP) for I AS com ponents to connect to Active Directory (AD): I AS Plug-I n is not installed on a Dom ain Controller. Adm inistration I nterfaces are not installed on a Dom ain Controller. The Adm inistration interfaces used by the DPP for I AS are: - The Active Directory Users & Com puters (ADU&C) extention - The adm inistration MMC interface I AS Plug-I n and/ or Adm inistration I nterface(s) are on a Dom ain Controller, but accessing data in another dom ain. An Enterprise Certificate Authority (CA) m ust be installed in the forest to enable SSL. I n the paragraphs below, we will describe how to proceed if you do not wish to install an enterprise CA in the forest. 1. Disable SSL for the access of the DPP to AD. 2. Disable SSL for the access of the ADU&C extentions to AD. 3. Disable SSL for the access of the adm inistration MMC to AD..doc (1.0) 26/ 06/ : 04 Page 1 of 7

2 1. Disable SSL for DPP access to AD. By default SSL is enabled for the access of DPP for I AS to AD. To disable this follow the next steps: Open the I AS Plug-in Configuration tool from the start m enu: Select the Active Directory Connection TAB and press the Edit button:.doc (1.0) 26/ 06/ : 04 Page 2 of 7

3 Uncheck the Encrypt Rem ote Connections checkbox: Restart the I AS Service, so the DPP for I AS picks up the new param eter.doc (1.0) 26/ 06/ : 04 Page 3 of 7

4 2. Disable SSL for ADU&C extension. You can install the ADU&C extension on non-dom ain controller to adm inister the Digipass User Accounts and the Digipass assignm ents. I f you do not have a root CA in the forest, you will get the following error when you try to open the properties of a user: When you click one of the Vasco ADU&C extension TABs, you get this error:.doc (1.0) 26/ 06/ : 04 Page 4 of 7

5 The cause of these errors is that, by default, SSL is enabled for the ADU&C extension. To disable SSL for the ADU&C extension, you have to add the registry key: HKEY_LOCAL_MACHI NE/ Software/ VASCO Data Security/ AD U&C Extension/ Encrypt = "Off" The screenshots below show how to proceed: Start regedit from a com m and prom pt to start the registry editor Open the location HKEY_LOCAL_MACHI NE/ Software/ VASCO Data Security/ AD U&C Extension in the registry tree Add a new String value Give it the new String Value the nam e Encrypt and the value Off Close the ADU&C and reopen it. Now you will be able to adm inister the Digipass User Accounts and the Digipass assignm ents..doc (1.0) 26/ 06/ : 04 Page 5 of 7

6 3. Disable SSL for Adm inistration MMC. You can install the Adm inistration MMC on non-dom ain controller to adm inister the DPP for I AS com ponents and policies. I f you do not have a root CA in the forest, you will get the following error: The cause of this errors is that, by default, SSL is enabled for the Adm inistration MMC. To disable SSL for the adm inistration MMC, you have to add the registry key: HKEY_LOCAL_MACHI NE/ Software/ VASCO Data Security/ MMC Adm in I nterface/ Encrypt = "Off" The procedure to add this key is sim ilar as the procedure described in the previous paragraph, but this tim e for MMC Adm in I nterface instead of AD U&C Extension:.doc (1.0) 26/ 06/ : 04 Page 6 of 7

7 Applies to: Digipass Plug-in for I AS Docum entation: Digipass Plug-I n for I AS Adm inistration Reference Digipass Plug-I n for I AS I nstallation Guide.doc (1.0) 26/ 06/ : 04 Page 7 of 7