OTP Server. Integration module. Nordic Edge AD Membership Provider for Microsoft ASP.NET. Version 1.0, rev. 6. Nordic Edge

Transcription

1 OTP Server Integration module Nordic Edge AD Membership Provider for Microsoft ASP.NET Version 1.0, rev. 6 Nordic Edge Summary: Installation guide for a Custom ISS web site

2 Copyright Nordic Edge, 2009 Content 1 OVERVIEW INTEGRATION OVERVIEW INSTALLATION MINIMUM REQUIREMENTS INSTALLING THE INTEGRATION MODULE COPY FILES TO THE CUSTOM WEB SITE REGISTER DLL FILES INTO THE GLOBAL ASSEMBLY CACHE CONFIGURATION - CUSTOM IIS SITE CONFIGURE INTERNET INFORMATION SERVICES (IIS) WEB SITE RESTART THE WEB SERVER RESTARTING IIS TESTING THE WEB APPLICATION RUNNING THE CUSTOM WEB SITE WITH NE MEMBERSHIP PROVIDER CUSTOMIZING THE LOGIN PAGE APPENDIX A TROUBLESHOOTING Sida 2 av 16

3 About Nordic Edge Nordic Edge is a leading provider of trusted Identity and Access Management (IAM) solutions that enable organisations to secure and manage their digital identities. With Nordic Edge s solutions, organisations can improve business processes and meet regulatory compliance requirements. The offering includes two-factor authentication, role based delegated user administration, synchronization and provisioning. More than 10 million identities are being administered by Nordic Edge s solutions and over 1 million users securely login with Nordic Edge s products each month. Nordic Edge was founded 2001 in Sweden and has customers in more than 25 countries. Sida 3 av 16

4 1 Overview NordicEdge One-Time Password Server adds an extra security layer to protect your applications. When the user id and password is successfully verified, a One-Time Password is sent to the user s mailbox or mobile phone through SMS (Short Message Services). This One-Time Password will be verified and only then will the user be authenticated to the application. 1.1 Integration overview ASP.Net gives possibility to create a custom membership provider, which you might do to link the membership system. Once you have a custom membership provider, you can configure your application to use that provider in the same way that you configure the application to use an ASP.NET provider. The Membership class will automatically invoke your custom provider to communicate with your authentication data source Nordic Edge ASP.NET Membership Provider Components A custom aspx page is required to use Nordic Edge Membership Provider. The page is called CustomLogin.aspx and will be accessed and handled by the Nordic Edge ASP.NET Membership Provider. The provider itself contains of three dll files which remains on the server. Nordic Edge Membership Provider includes a Role Provider that supports Microsoft Active Directory. This is what you have to do! Copy files to the web site Register DLL files into the Global Assembly Cache Configure Nordic Edge Membership Provider in web.config files Restart IIS Sida 4 av 16

5 2 Installation 2.1 Minimum Requirements This section describes the installation of the Nordic Edge ASP.NET Membership Provider Windows Server Windows 2003 Server or later OTP Server OTP Server 1.6 (Build 2471) or higher. OTP Server must be configured before the integration module can be used. See OTP Server Administration Manual for more information on how to configure this. Sida 5 av 16

6 3 Installing the integration module This chapter describes what s needed for the installation. These are the steps you have to go through: 1. Copy files to the web site 2. Register DLL files into Global Assembly Cache 3. Configure Nordic Edge Membership Provider in web.config file 4. Restart IIS 3.1 Copy files to the Custom Web site Copy the contents from MySite folder into your Web site under \Inetpub\wwwroot Basic installation files for a Custom web site: Folder Site root \bin \images \protected_pages (for test purposes) Files CustomLogin.aspx NE_web.config NordicEdgeADMembershipProvider.dll NordicEdgeOTP.dll NordicEdgeOTPASPplugin.dll A couple of image files SecretPage.aspx Web.config Sida 6 av 16

7 Figure: Custom site file structure Sida 7 av 16

8 3.2 Register DLL files into the Global Assembly Cache The DLL files are signed with Strong Names. You have to add these files to the GAC. Register the dll files below in the GAC (.NET Global Assembly Cache): NordicEdgeOTP.dll NordicEdgeADMembershipProvider.dll NordicEdgeOTPASPplugin.dll You can do this with Explorer by drag'n drop the dll files to the Assembly in c:\%windir%\assembly. Figure: The GAC assembly OR Use the gaqutil.exe (resides in C:\Program Files\Microsoft SDKs\Windows\v6.0A\bin) example: gacutil -i NordicEdgeOTP.dll Figure: Gacutil.exe Sida 8 av 16

9 4 Configuration - Custom IIS site 4.1 Configure Internet Information Services (IIS) Web site NOTE: When you re done with this chapter, go to chapter Restart the web server This section describes how to configure a Web Site that uses Nordic Edge ASP.NET Membership Provider. It also provides information about the configuration options for NordicEdgeOTPASPplugin. The membership API is based on forms authentication and gives you with an out-of-the-box infrastructure for managing and authenticating users. Therefore, as the first step, you have to configure your application for forms authentication as usual. But you will structure the solution a little bit differently this time. The root directory of the web application grants access to anonymous users, while restricted resources are stored in subdirectories with restricted access. These subdirectories have their own web.config file that denies access to anonymous users. As soon as someone tries to access resources stored in this secured directory, the ASP.NET runtime automatically redirects the user to the login page. You can see the structure of the web application in the figure below. Figure: protected_pages Web.config in protected_pages This configuration denies any anonymous user access to the website s secured subfolder. If someone who is not authenticated tries to access resources placed in this directory, the ASP.NET runtime automatically redirects the user to the public available login page (CustomLogin.aspx). <configuration> <appsettings/> <connectionstrings/> <system.web> <authorization> <deny users="?" /> </authorization> </system.web> </configuration Sida 9 av 16

10 4.1.2 Edit the <root> Web.config You have to configure the web.config file before you can use Nordic Edge ASP.NET Membership Provider. In the first step you must configure forms authentication mode. After you have configured the authentication mode you have to configure the membership provider for the application by adding the <membership> section to your web.config file. If your application doesn t have a web.config you just rename NE_web.config to web.config.!!! Before you make any changes: Make a copy of the current web.config file!!! <?xml version="1.0"?> <configuration> <system.web> <!-- The <authentication> section enables configuration of the security authentication mode used by ASP.NET to identify an incoming user. --> <authentication mode="forms"> <forms loginurl="customlogin.aspx" /> </authentication> <!-- The <membership> section enables the Nordic Edge ASP.NET Membership Provider. Variables and settings for Membership and Role Provider. Please modify connectionstringname, ldapsearchbase, ldaprolesearchbase and ldapusersearchbase. Keep: = Keep the given value Modify: = Modify to fit your environment Keep/modify: = The value may be edited though the default value is recommended. Membership Provider Action Variable Value Note Keep applicationname "/" Defaultvalue Modify connectionstringname " :3100" Your OTP Server:Port Keep/modify name "neprovider" If you change this name, you also have to change defaultprovider= "new name" Keep type "NordicEdge.Web.Prov ider.admember... Modify ldapsearchbase "cn=users,dc=ad..." Ldap users context Keep ldap attribute "mail" Keep ldapusernameattribute "samaccountname" To be modified if you use Sida 10 av 16

11 userprincipalname as user name attribute. The OTP Server must search for userprincipalname in this case. Keep/modify ldapdisplaynameattribute "displayname" Keep/modify ldapsearchscope "SUB" BASE, ONE or SUB Keep/modify ldapproxyusername "" Built in privileges are used by default. If you want you re your own proxy user, insert values for a user account with appropriate privileges. Keep/modify ldapproxypassword "" See above Role Provider Action Variable Value Note Keep/modify cacherolesincookie "true" If you don t want roles to be cached in cookie, set the value to = false Keep/modify cookiename "ASPXROLES" Keep/modify cookiepath "/" Keep/modify cookietimeout "30" Minutes Keep/modify cookierequiressl "false" Keep/modify cookieslidingexpiration "true" Keep/modify createpersistentcookie "false" Keep/modify cookieprotection "All" Keep/modify name "neroleprovider" If you change this name, you also have to change defaultprovider= "new name" Keep applicationname "/" Defaultvalue Keep type "NordicEdge.Web.Prov ider.admember... Modify ldaprolesearchbase "ou=groups,dc=ad..." Ldap groups context Keep/modify ldaprolesearchscope "ONE" BASE, ONE or SUB Modify ldapusersearchbase "cn=users,dc=ad..." Ldap users context Keep/modify ldapusersearchscope "SUB" BASE, ONE or SUB Keep/modify ldaproleusernameattribut e "samaccountname" To be modified if you use userprincipalname as user name attribute. The OTP Server must search for userprincipalname in this case. Keep/modify ldapproxyusername "" Built in privileges are used by default. If you want you re your own proxy user, insert values for a user account with appropriate privileges. Keep/modify ldapproxypassword "" See above --> <membership defaultprovider="neprovider"> <providers> <add Sida 11 av 16

12 applicationname="/" connectionstringname=" :3100" name="neprovider" type="nordicedge.web.provider.admembershipprovider, NordicEdgeADMembershipProvider, Version= , Culture=neutral, PublicKeyToken=a27fc70f1b8f276c" ldapsearchbase= "cn=users,dc=ad,dc=nordicedge,dc=se" ldapobjectclass = "user" ldap attribute = "mail" ldapusernameattribute = "samaccountname" ldapdisplaynameattribute = "displayname" ldapsearchscope = "SUB" ldapproxyusername ="" ldapproxypassword ="" /> </providers> </membership> <rolemanager enabled="true" defaultprovider="neroleprovider" > <providers> <clear /> <add cacherolesincookie="true" cookiename="aspxroles" cookiepath="/" cookietimeout="30" cookierequiressl="false" cookieslidingexpiration="true" createpersistentcookie="false" cookieprotection="all" name="neroleprovider" applicationname="/" type="nordicedge.web.provider.adroleprovider, NordicEdgeADMembershipProvider, Version= , Culture=neutral, PublicKeyToken=a27fc70f1b8f276c" ldaprolesearchbase= "ou=groups,dc=ad,dc=nordicedge,dc=se" ldaprolesearchscope = "ONE" ldapusersearchbase= "cn=users,dc=ad,dc=nordicedge,dc=se" ldapusersearchscope = "SUB" ldaproleusernameattribute = "samaccountname" ldapproxyusername ="" ldapproxypassword ="" /> </providers> </rolemanager> <! Appsettings in the <configuration> section --> <appsettings> <add key="loginfailure" value="the user name or the password is incorrect. Please try again."/> <add key="otpfailure" value="the One-Time Password you entered was incorrect. Please reenter your user name and password."/> <add key="otperror" value="there is no connection with the OTP Server. Please contact your system administrator."/> <add key="logintext" value="sign In"/> <add key="changeadpasswordurl" value=""/> </appsettings> </configuration> Sida 12 av 16

13 5 Restart the web server 5.1 Restarting IIS Before you can use the Membership Provider, you have to restart IIS. Open a command prompt and type iisreset to restart the Internet Information System. Figure: Restarting IIS Sida 13 av 16

14 6 Testing the web application 6.1 Running the Custom web site with NE Membership Provider To test the web application in your browser, type the required URL such as: Figure 1: Login page to protected site After supplying user name and password, the user will get authenticated and receives the OTP. Figure 2: The user is asked for the OTP Sida 14 av 16

15 After supplying the received OTP, Nordic Edge OTP Server will validate this OTP. If it is valid, the restricted page will be displayed as shown in the figure below. Figure 3: The protected site 6.2 Customizing the login page I f you want to change the images in the CustomLogin.aspx do the following. Open CustomLogin.aspx with Notepad. exe Copy your image(s) to the image directory and replace the image path in the file. Sida 15 av 16

16 7 Appendix A 7.1 Troubleshooting This section describes provides how to configure a Web Site that uses Nordic Edge IIS Membership Provider. It also provides information about the configuration options for NordicEdge OTPASPplugin Troubleshooting & support For troubleshooting and support, please go to or send an to support@nordicedge.se. Sida 16 av 16