ASAS Management Plug-in for MS Active Directory English Only

Transcription

1 Authenex ASAS 3.1 ASAS Management Plug-in for MS Active Directory English Only Installation, Configuration & Administration Guide Version 3.1 Authenex, Inc Salmon Way, Hayward, CA 94544

2 Authenex, Inc Salmon Way Hayward, California Phone: +1, (8am - 6pm PST) Toll Free in USA AUTHENEX Copyright Authenex, Inc. All rights reserved. Authenex, A-Key, ASAS, HDLock, ASafe, ACert, A-Remote and associated logos are registered or unregistered trademarks of Authenex, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners. Document Version Release date: April 2007 Please check Authenex.com for updated documentation.

3 Contents 1 About This Document Audience Documentation Feedback About the Interfaces in This Guide Technical Support and Product Inquiries Customer Support Hours and Contact Information Authenex Online Resources Product and Sales Information Overview ASAS Plug-in for MS Active Directory (Replication Services) System Requirements ASAS Server AASAS Management Plug-in for MS Active Directory System Requirements AASAS Management Plug-in for MS Active Directory Software Requirements Installing ASAS Management Plug-in for MS Active Directory Installation Notes Important Note About Terms in the Interface Procedures Defining ASAS Server Information Completing Replication Services Installation Testing ASAS Management Plug-in for MS Active Directory Configuration Notes/Assumptions Procedures Administering the ASAS Management Plug-in for MS Active Directory Important Note About Terms in the Interface Adding Users Procedures Assigning a ZyWALL OTP Token to a User Assigning a ZyWALL OTP to the Administrator Account Procedures Appendix 1: Reconfiguring Active Directory Replication Services Notes Before You Begin i

4 Contents 6.2 Procedures Appendix 2: Changing Domain Controller Parameters Changing Parameters for Replication Services Changing Parameters for LAN Authentication Services ii

5 1 About This Document This guide provides an overview of the Authenex ASAS Management Plug-in for MS Active Directory and step-by-step procedures for installing, configuring and administering the plug-in. 1.1 Audience The audience for this document is System Administrators and technical support people with solid computer network knowledge and experience building servers. 1.2 Documentation Feedback We welcome and value your feedback on our documents. If you would like to send us comments, opinions, requests, etc., us at: 1.3 About the Interfaces in This Guide This guide is prepared with Windows 2000 Server. If you are using Windows 2003 Server, there may be some variations of the screens. 1.4 Technical Support and Product Inquiries Customer Support Hours and Contact Information Phone Customer Support at Customer Support is available Monday to Friday, 9:00 am to 6:00 pm, PST customer support requests to Authenex Enterprise Support, at Authenex Online Resources The Authenex Web Site provides additional product information The Authenex Support page provides software updates, and notices and updated documentation The Authenex Knowledge Base provides technical support FAQs and articles Use the Authenex Support Ticket page support ticket requests and tracking Product and Sales Information For information about Authenex products or solutions, contact Authenex Sales at AUTHENEX. 1

6 ASAS 3.1 -ASAS Management Plug-in for MS Active Directory - Administrator s Guide 3 Overview 3.1 ASAS Plug-in for MS Active Directory (Replication Services) The ASAS Management Plug-in for MS Active Directory enables you to enter Authenex ZyWALL OTP data in the ASAS database, via the Active Directory interface. Doing so bypasses the need to log on to the machine onto which you installed the Web Management Console (WMC), launching the WMC and doing those procedures. 3.2 System Requirements ASAS Server AASAS Management Plug-in for MS Active Directory System Requirements Component Processor RAM Disk Space Network USB Port Requirement Pentium-compatible CPU 256 MB or higher 8 Gigabytes of free Hard Disk space (after OS) 1 10Base-T/100Base-Tx Ethernet network adapter One USB Port must be available (version 1.1 is supported) AASAS Management Plug-in for MS Active Directory Software Requirements Component Operating System Requirement Microsoft Windows 2000 and 2003 Server Edition Active Directory Services must be installed. Service Packs Microsoft Windows 2000 Service Pack 3 or above. It is recommended that the latest Windows service pack be installed for all Windows machines. 2

7 3 Installing ASAS Management Plug-in for MS Active Directory 3.1 Installation Notes For information on minimum system requirements, refer to the section of this guide titled System Requirements. ASAS Management Plug-in for MS Active Directory Can only be installed on the domain controller. 3.2 Important Note About Terms in the Interface The ASAS System interface uses the term A-Key and A-Key token. In each instance, that term is interchangeable with ZyWALL OTP and ZyWALL OTP token. 3.3 Procedures 1. Insert the installation disc into the CD drive of the target machine.the ZyWALL OTP dialog appears. 2. Click Exit in the lower right corner of the dialog. 3. Navigate to My Computer\CD drive:\ ASAS Management Plug-in for MS Active Directory. 4. Double-click setup.exe. The Welcome screen appears. 5. Click Next. The License Agreement screen appears (not shown here). 6. Click the I accept the terms of the license agreement radio button and click Next. The Configure RADIUS Server screen appears. 3

8 3.3.1 Defining ASAS Server Information 1. Click in the Primary text field and enter the IP address of your Primary ASAS Radius Server. 2. Click in the Secondary text field and enter the IP address of your Secondary ASAS Radius Server, if you have one. 3. Click Next. The Ready to Install the Program appears. 4. Click Install. Installation begins, then the Replication Configuration dialog appears. 4

9 3.3.2 Completing Replication Services Installation 1. Enter your Active Directory information: Important! You can enter more than one kind of name Domain text field. You can enter either IP address (e.g ), the host name (rocko), or the fully qualified domain name (rocko.authenex.com). However, you must enter the information in a precise format. If you do not, authentication will consistently fail. If you enter an IP address in the Domain Controller text field, you must enter the full domain name into the User Name text field. If you enter a hostname in the Domain Controller text field, then enter the plain username into the User Name text field. Review the two examples below: Example 1 Example 2 Domain Controller Full Computer Name IP address Username username domain name/username Password password password a b Click in the Domain Controller text field and enter the IP address or hostname of your domain controller. Click in the User Name (Admin) text field and enter one of the following: The domain name/username, if you entered an IP address in the Domain Controller text field. The plain username, if you entered a hostname in the Domain Controller text field. 5

10 c Click in the Password text field and enter the password for the domain controller s administrator. 2. Enter your Authenex database configuration information: a b As necessary: Highlight the existing name of the ODBC Connection text field and change the name of the ODBC connection. Highlight the existing user name for the ODBC connection in the User Name text field and change the user name of the ODBC connection. Click in the Password text field and enter the password for your ODBC connection (authenex by default). 3. Click Next. Installation completes, then the InstallShield Wizard Complete screen appears. 4. Click the Yes, I want to restart my computer now radio button and click Finish. 6

11 4 Testing ASAS Management Plug-in for MS Active Directory 4.1 Configuration Notes/Assumptions The procedures below assume that: LAN Authentication Services is installed on the Domain Controller. ASAS is up and running. You have a client machine with A-Remote for LAN Authentication installed on it. 4.2 Procedures 1. Create a user account on the domain controller and assign the account to a specific ZyWALL OTP. This procedure is done from the WMC or from ADI. Note: For instructions on creating a user account via the WMC, refer to the document titled Administering ASAS, specifically the section titled Adding Users Individually or Managing ZyWALL OTP tokens with Active Directory/Adding a User and Assigning a ZyWALL OTP to that User. 2. Using A-Remote for LAN Authentication, log in using the ZyWALL OTP from a client workstation that belongs to the above domain. Note: If you need to change your configuration, refer to Administering ASAS. 7

12 5 Administering the ASAS Management Plug-in for MS Active Directory ASAS Replication Services for Active Directory enables you to add users and assign ZyWALL OTP tokens to them, via an Active Directory interface. Then, ASAS Replication Services for Active Directory replicates the data into the ASAS database. 5.1 Important Note About Terms in the Interface The ASAS System interface uses the term A-Key and A-Key token. In each instance, that term is interchangeable with ZyWALL OTP and ZyWALL OTP token. 5.2 Adding Users Follow the standard procedure to add a new user in Active Directory. Certain parameter configurations are important to follow for interoperability with ASAS 3.1. Subsequent to setting up a new user, you need to assign a ZyWALL OTP to the user, and set the user's ZyWALL OTP configuration parameters. Assigning a ZyWALL OTP to a user is optional. However, if a ZyWALL OTP is assigned to a user, that user must log on using their ZyWALL OTP, PIN and six digit OTP number. The ZyWALL OTP can be unassigned to a user, enabling the user to log on without the ZyWALL OTP. Users without assigned ZyWALL OTP tokens log on using the default log on Procedures All the procedures below take place on the domain controller onto which you installed ASAS Management Plug-in for MS Active Directory. You can add a user at any time and the data will be replicated to the ASAS database. Important! If you add a user through the Web Management Console (WMC), do not add them through Active Directory (WMC), which may add the user twice. 8

13 1. Select Start Programs Administrative Tools Active Directory Users and Computers. The Active Directory Users and Computers dialog appears. 2. Click the plus sign (+) beside the local host icon, to expand the tree. 3. Right click Users and select New User from the menu that appears. The New Object - User dialog appears. 4. Click in the First Name text field and enter the user s first name. 5. Click in the Last Name text field and enter the user s last name. 6. Click in the Full Name text field and enter the user s full name. 7. Click in the User logon name text field and enter the user s logon user name. 8. Select the domain the user is assigned to from the User logon name dropdown list. 9

14 9. As necessary, click in the User logon name (pre-windows 2000) text field and enter the user s pre-windows 2000 logon user name. 10. Click Next. The New Object - User dialog refreshes. Important! If you are a Citrix and LAN Authentication administrator and you want to check the User Must Change Password at Next Logon check box, you must ALSO change the policy in the server, to Allow User to Change Password. Otherwise, the user will receive an error message when they are prompted to change their password (this occurs immediately after the first time the user is authenticated with their ZyWALL OTP.) 11. Click in the Password text field and enter the user s password. 12. Click in the Confirm Password text field and re-enter the user s password. 13. Click a checkbox to select the appropriate password policy. Your choices are: User must change password at next logon User cannot change password Password never expires Account is disabled Note: It is okay to not click any checkbox. 14. Click Next. The New Object - User dialog refreshes. 10

15 15. Click Finish. The Active Directory Users and Computers dialog returns, displaying the new user in the list of users. 11

16 5.3 Assigning a ZyWALL OTP Token to a User Assigning a ZyWALL OTP to a user is optional. However, if a ZyWALL OTP is assigned to a user, that user must log on using their ZyWALL OTP, PIN and six digit OTP number. The ZyWALL OTP can be unassigned to a user, enabling the user to log on without the ZyWALL OTP. Users without assigned ZyWALL OTP tokens log on using the default log on Assigning a ZyWALL OTP to the Administrator Account The administrator s account must not have a ZyWALL OTP assigned to it. Currently, ASAS Replication Services for Active Directory uses the administrator s account for replicating data. If you assign a ZyWALL OTP to the administrator s account, the replication service will need the ZyWALL OTP and the input of that ZyWALL OTP s information every time it tries to replicate data (about every five (5) minutes). Therefore, do not assign a ZyWALL OTP to the administrator s account. Instead, create another account and give it administrator s privileges. Then, use that as your administrative account. This will ensure that replication services can do its job unencumbered Procedures 1. Right click the new user and select All Tasks Manage A-Key from the menu that appears. The Authenex A-Key Properties dialog appears. The Authenex A-Key Properties dialog box enables you to: Assign a ZyWALL OTP token to a user Enable and disable user ZyWALL OTP tokens Allow or deny user Remote Access Permission Edit user information from ASAS server 2. Select the ESN of the ZyWALL OTP assigned to the user from the User s A-Key dropdown. 3. Click the A-Key Active checkbox (to check it) and click the Allow Access radio button (to select it). 4. Enter the user s information in the User Information from Active Directory area of the dialog. Important! The ASAS System generates an error message if the first and last name fields are empty. 5. As necessary, enter a brief description of the user in the Description text field. 12

17 6. Click OK. 13

18 6 Appendix 1: Reconfiguring Active Directory Replication Services Active Directory is automatically configured during LAN Authentication Services for Active Directory installation. Do the following procedures if you want to change the configuration of your ASAS Management Plug-in for MS Active Directory setup. 6.1 Notes Before You Begin If you do not know the configuration information for your environment, contact your database administrator. 6.2 Procedures To reconfigure Active Directory, on the Active Directory machine: 1. Select Start Programs Authenex Active Directory Replication Services. The Replication Configuration dialog appears. 2. Make the necessary configuration entries. Important! You can enter more than one kind of name Domain text field. You can enter either IP address (e.g ), the host name (rocko), or the fully qualified domain name (rocko.authenex.com). However, you must enter the information in a precise format. If you do not, authentication will consistently fail. If you enter an IP address in the Domain Controller text field, you must enter the full domain name into the User Name text field. If you enter a hostname in the Domain Controller text field, then enter the plain username into the User Name text field. Review the two examples below: 14

19 Example 1 Example 2 Domain Controller Full Computer Name IP address Username username domain name/username Password password password 3. Click Next. The Replication Configuration dialog refreshes. The new version enables you to setup replication from Active Directory to ASAS Server. Select how often you want replication to occur from the dropdown lists in the Configure Schedule area of the dialog. (Five minutes is recommended, and is the allowed minimum interval.) Put a check in the Log successful replication checkbox to generate a log of successful replications. Note: If there are performance problems, increase the interval frequency. 4. Click Finished when you are done. 15

20 7 Appendix 2: Changing Domain Controller Parameters All the modifications below do not require a reboot on the Domain Controller (DC). Note: These steps need to be performed on every DC in the domain (where Replication Services or LAN Authentication Services are installed). 7.1 Changing Parameters for Replication Services Authenex Replication Services uses asas_conn.properties. This file contains a valid ASAS DB IP address (which replication services uses for DB Connection), dummy port and dummy shared secret (which replication services does not use). 1. Launch a text editor and open C:\Program Files\Authenex\Active Directory\asas_conn.properties. 2. If you need to modify this entry, modify the DB IP address only. 3. If you need to create a new entry, cut and paste the old entry in the same format. For example: ASAS.A secret port Make sure to increment the ASAS Node letter, and enter the right ASAS DB IP address. For example: ASAS.B secret port 4. Configure the DB IP address in the ODBC DSN entry of Microsoft's ODBC Administrator tool. Note: This step may not be necessary. 5. Launch the Services console and restart the Authenex Replication service. 7.2 Changing Parameters for LAN Authentication Services LAN Authentication Services uses Asas_server.properties. This file contains ASAS Radius IP address, Radius Shared Secret and Radius Port (all used for RADIUS authentication). 1. Launch a text editor and open: C:\Program Files\Authenex\Active Directory\asas_server.properties. 2. Modify or add entries accordingly. For example: authenex authenex Launch the Services console and restart the Authenex Connection Manager service. 16