etoken Single Sign-On

(1)

eToken Single Sign-On

Version 5.1 Rev A

(2)

inaccuracies or omissions. The specifications in this document are subject to change without notice.

Publication Date: July 2010

(3)

Support

We work closely with our reseller partners to offer the best worldwide technical support services. Your reseller is the first line of support when you have questions about products and services. However, if you require additional assistance you can contact us directly at: Telephone You can call our help‐desk 24 hours a day, seven days a week: USA: 1‐800‐545‐6608 International: +1‐410‐931‐7520 Email You can send a question to the technical support team at the following email address: [email protected] Website You can submit a question through the SafeNet Support portal: http://c3.safenet-inc.com/secure.asp

Additional Documentation

We recommend reading the following Aladdin eToken publications: eToken Single Sign‐On 5.1 Administrator’s Guide _{eToken Single Sign‐On 5.1 User’s Guide (this document)} eToken Single Sign‐On 5.1 ReadMe _{eToken Single Sign‐On 5.1 Help (accessible from the main} window) _{eToken Network Logon 5.1 Administrator’s Guide} eToken Network Logon 5.1 User’s Guide

(4)

Viewing this Document

When viewing this document on‐screen, set the Adobe Reader zoom to 100% to ensure optimum quality.

(5)

1. Introduction... 1

Overview... 2

Supported Logon Technologies... 2

Main Features... 4

New Features ... 5

Components ... 5

eToken Single Sign-On Profiles ... 5

eToken Single Sign-On Templates... 5

eToken Network Logon (Optional) ... 6

2. System Requirements... 7

Software Requirements... 8

3. Installation... 9

Installation Overview ... 10

Upgrading ... 10

Upgrading from eToken SSO... 10

Upgrading from eToken Network Logon... 11

Upgrading Profiles... 11

Installing the eToken SSO Package...11

Installing the Package Using the Setup Wizard... 12

Installing the Package Using the Command Line... 16

Installing eToken SSO Only... 18

Installing eToken SSO Using the Wizard... 19

Installing eToken SSO Using the Command Line ... 22

Locating the Installation Folder ... 23

4. eToken SSO Toolbar...25

Installing the eToken SSO Toolbar... 26

Enabling the Toolbar for Internet Explorer... 26

Enabling the Toolbar for Firefox ... 27

(6)

Opening a Webpage Using the Toolbar ...29

Uninstalling the Toolbar...29

5. Profile Maintenance ...33

eToken SSO Profiles Overview ...34

Opening the eToken SSO Window...34

Restarting eToken SSO ...36

Enabling or Disabling eToken SSO Using the Window...36

Logging On to eToken...37

Selecting a Profile ...37

Creating a Profile ...38

Creating a Profile for Web and Application Logon...39

Creating a Profile for Basic Access Authentication...41

Editing a Profile...44

Editing a Profile for Web and Application Logon...44

Editing a Profile for Basic Access Authentication ...46

Copying a Profile...48

Deleting Profiles...49

Backing Up Profiles...50

Restoring Profiles...52

Restoring All Profiles ...53

Restoring Selected Profiles...55

Migrating a Profile ...58

Changing a Logon Password ...59

Changing the Settings...60

A. FCC Compliance...63

FCC Warning ...63

CE Compliance...64

UL Certification...64

ISO 9001 Certification...64

Certificate of Compliance...65

B. Copyrights and Trademarks...67

(7)

Introduction

eToken Single Sign‐On (SSO) 5.1 is a comprehensive token‐based solution for storing and submitting passwords in an enterprise. It manages credentials for Windows‐based application logon, web logon, web network logon, and Windows network logon.

In this chapter:

Overview

Supported Logon Technologies Main Features

New Features Components

(8)

Overview

With Aladdinʹs eToken Single Sign‐On (SSO) 5.1, you need to authenticate yourself only once by connecting your token and entering the eToken Password. You can then access your different applications, web accounts, and network resources, without needing to log on to each application. eToken SSO 5.1 recognizes each application logon window or webpage, and submits the appropriate stored credentials from your eToken device. This means that the only password you need to remember is your eToken Password. eToken SSO 5.1 enables you to use strong logon passwords that are almost impossible to hack, thereby protecting your online identity. Since you do not need to remember multiple passwords, you can use stronger passwords than you would use if you were required to remember them.

Supported Logon Technologies

eToken SSO supports the following logon types:

Network Logon: Windows logon mechanism used to log on to

computers and networks. Requires installation of eToken Network Logon.

(9)

_{Application Logon: used to authenticate users when logging on}

to specific applications. The system administrator must supply an eToken SSO template for each supported application.

Web Logon: used to authenticate users when logging on to

(10)

_{Basic Access Authentication: HTTP logon mechanism used to} access websites. The logon fields are located in a logon window which opens when attempting to access a particular web address. This type of user authentication is typically used when accessing Intranet sites, as it is not considered secure enough for websites with public access.

Main Features

Eliminates the need to remember multiple passwords Seamlessly integrates with token‐based strong authentication Allows for long, complex, random passwords that are not known to any person Securely stores and submits personal logon credentials Enables smartcard logon using certificates stored on a token Supports application password change Reduces password‐related helpdesk calls within the organization, and enhances user efficiency Offers a customizable user interface Provides administrator‐controlled template management and profile ruling for rapid, intuitive administration of application templates Supports Windows, Web, Java, and command prompt authentication windows

(11)

_{Supports advanced scripting language for non‐standard screen} capturing Supports sharable global values _{Offers secure backup and restoration of user credentials}

New Features

eToken SSO 5.1 introduces the following new features: _{Extended platform support} Windows 7 (32‐bit) Updated browsers support: _{Internet Explorer 8.0} FireFox 3.5 Optional automatic profile backup

Components

The eToken SSO solution includes multiple components.

eToken Single Sign-On Profiles

A profile contains the actual user credentials required to use or log on to a specific application. Profiles are stored on the user’s token. eToken SSO enables users to easily create and manage profiles containing their personal credentials.

eToken Single Sign-On Templates

Each non‐web application requires its own dedicated template. The template contains information required for logging on to the specific application, and defines which logon credentials are needed. The system administrator creates and configures the eToken Single Sign‐ On templates in accordance with company policies.

(12)

eToken Network Logon (Optional)

This component replaces the default Windows user name/password mechanism, assigning eToken solutions as the primary authentication mechanism for added security. eToken Network Logon authentication uses credentials stored on a token, such as a user name/password designation. Enterprises may require a smartcard logon certificate for authentication.

(13)

System Requirements

This section describes the system requirements for eToken SSO 5.1.

In this chapter:

(14)

Software Requirements

Component Requirement Comment

Supported Operating Systems

Windows Server 2003 SP2 / R2 (32-bit) Windows XP SP3 (32-bit)

Windows Server 2008 (32-bit) Windows 7 (32-bit)

Windows Vista SP2 (32-bit) Supported Browsers Internet Explorer 6.0, 7.0, or 8.0

Firefox 2.0, 3.0, or 3.5 Not for template creation

Required Software Microsoft .Net Framework 2.0

J2SE 5.x Required for Java-based

applications Java Access Bridge 2.0.0

Recommended eToken Applications

TMS 2.0 or later,

TMS Connector for eToken SSO 5.1

See TMS documentation for platforms supported by TMS

eToken PKI Client 5.1 SP1 or later Required for:

smartcard logon

automatic profile backup

(15)

Installation

This chapter describes the installation and upgrade of eToken SSO 5.1.

In this chapter:

Installation Overview Upgrading

Installing the eToken SSO Package Installing eToken SSO Only Locating the Installation Folder

(16)

Installation Overview

Do one of the following to install eToken SSO 5.1: _{Use the eToken SSO Package installation to install or upgrade any} combination of the following: eToken SSO _{eToken Network Logon} eToken SSO Template Editor Use the eToken SSO‐only installation to install eToken SSO where eToken PKI Client or eToken PKI Client‐Lite is already installed. Each type of installation can be initiated by one of the following: a wizard _{a command line instruction}

Note:

Local administrator rights are required to install or uninstall eToken SSO 5.1.

Upgrading

We recommend backing up all existing profiles from previous versions of eToken SSO before upgrading to eToken SSO 5.1.

Upgrading from eToken SSO

When upgrading to eToken SSO 5.1, use the eToken SSO 5.1 Package, and not the eToken SSO‐only installation. See Installing the eToken SSO Package on page 11. The eToken SSO 5.1 installation removes all previous installations of eToken SSO 3.0 or later. If a version of eToken SSO earlier than 3.0 is installed, upgrade to eToken SSO 3.14 before upgrading to eToken SSO 5.1.

(17)

Upgrading from eToken Network Logon

All versions of eToken Network Logon earlier than 2.5 must be uninstalled or upgraded before installing eToken Network Logon 5.1. The eToken Network Logon 5.1 installation removes all previous installations of eToken Network Logon (GINA) 2.5 or later.

Upgrading Profiles

There is no need to upgrade profiles. eToken SSO 5.1 recognizes profiles created by the following applications: eToken SSO 3.0 or later eToken WSO 1.4 or later eToken Network Logon 2.5 or later

Installing the eToken SSO Package

The eToken SSO Package does the following: Installs or upgrades any combination of the following applications: _eToken SSO eToken Network Logon _{eToken SSO Template Editor} Automatically installs eToken PKI Client‐Lite, if eToken PKI Client is not yet installed

(18)

Before using the eToken SSO Package installation, ensure that the following requirements are met: _{All versions of eToken PKI Client earlier than 5.1 SP1 must be} uninstalled, or upgraded to eToken PKI Client 5.1 SP1 or later.

Note:

If eToken PKI Client 5.1 SP1 or later is not installed, the eToken SSO Package installs eToken PKI Client‐Lite. eToken PKI Client‐Lite does not have the complete range of eToken PKI Client functions. It contains only those functions required by the eToken Network Logon and eToken Single Sign‐ On applications. Microsoft .Net Framework 2.0 must be installed on the computer.

Installing the Package Using the Setup Wizard

To install the eToken SSO 5.1 Package via the wizard:

1. Close all Windows programs.

2. Double‐click eTokenSSOPackage51_x86.exe. The installation wizard opens.

(19)

The License Agreement window opens. 4. Select I accept the terms of the License Agreement, and click Next. The Language Selection window opens. 5. From the drop‐down list, select the user interface language for all eToken applications on this computer, and click Next.

(20)

The Location window opens, displaying the default destination folder. 6. To select a different destination folder, click Browse, and select a folder. This destination folder will be used as the installation library for all future eToken application installations.

Note:

If eToken PKI Client 4.55 or higher has been installed, the destination folder for all eToken applications has already been defined. 7. Click Next.

(21)

The Choose Components window opens. 8. Select one or more of the following installation options: eToken PKI Client or eToken PKI Client‐Lite This option is not enabled. If eToken PKI Client is not yet installed, eToken PKI Client‐ Lite will automatically be installed.

Note:

On a Windows 7 platform, the full eToken PKI Client 5.1 SP1 application will be installed, and not eToken PKI Client‐Lite. eToken Network Logon Select this to install the eToken Network Logon solution. If eToken Network Logon is already installed, this option is not enabled, and eToken Network Logon will automatically be upgraded. _{eToken Single Sign‐On} Select this to install the eToken Single Sign‐On solution. If eToken Single Sign‐On is already installed, this option is not enabled, and eToken Single Sign‐On will automatically be upgraded. eToken Single Sign‐On Template Editor If enabled, select this option to install the eToken SSO Template Editor component for template maintenance. 9. Click Next.

(22)

The installation begins.

When the installation completes, the Completing the Wizard window opens.

10. Click Finish.

11. Restart the computer if prompted.

Installing the Package Using the Command Line

The command line eToken SSO Package installation installs or upgrades all of the following products: eToken PKI Client‐Lite, if eToken PKI Client is not installed

Note:

On a Windows 7 platform, the full eToken PKI Client 5.1 SP1 application will be installed, and not eToken PKI Client‐Lite. _eToken SSO eToken Network Logon _{eToken SSO Template Editor}

(23)

To install the eToken SSO 5.1 Package via the command line: 1. From the Windows taskbar, select Start > Programs > Accessories > Command Prompt. 2. On the command line, type: [path]eTokenSSOPackage51_x86.exe /S /PROPERTY=VALUE where:

[path] _{is the path to}eTokenSSOPackage51_x86.exe

/S is an optional parameter to run the installation silently, with no user interface /PROPERTY=VALUE represents one or more optional parameters defining a feature to be installed Optional Properties Property Feature

"/PKICMD=value” Replace value with one or more parameters to override eToken PKI Client installation defaults.

See the eToken PKI Client (Windows) 5.1 Administrator’s Guide.

"/NLCMD=value” Replace value with one or more parameters to override eToken Network Logon installation defaults.

See the eToken Network Logon 5.1 Administrator’s Guide. "/SSOCLIENTCMD=value” Replace value with one or more parameters to override

eToken SSO installation defaults.

See Chapter 3:Installing eToken SSO Using the Command Line, on page 22 of this document.

(24)

Installing eToken SSO Only

Using the eToken SSO‐only installation, you can create an eToken Virtual file on your computer for storing your credentials. Before using the eToken SSO‐only installation, ensure that the following requirements are met: _{If eToken SSO version 3.0 through 3.14 is installed, use the eToken} SSO 5.1 Package, and not the eToken SSO‐only installation, to upgrade to eToken SSO 5.1. See Installing the eToken SSO Package on page 11. eToken PKI Client 5.1 SP1 or later must be installed on the computer. Earlier versions must be upgraded to eToken PKI Client 5.1 SP1 or later. _{Microsoft .Net Framework 2.0 must be installed on the computer.}

"/SSOTECMD=value” Replace value with one or more parameters to override eToken SSO Template Editor installation defaults. See the eToken SSO 5.1 Administrator’s Guide.

"/Language=value” To set the interface language for all eToken products on the computer, replace value with one of the following:

English

German

Chinese

Japanese

"/InstallDir=value” To override the default, replace value with the required destination folder.

Optional Properties (Continued) Property Feature

(25)

Installing eToken SSO Using the Wizard

To install eToken SSO 5.1 via the wizard:

1. Close all Windows programs. 2. Double‐click etsso51_x86.msi. The installation wizard opens. 3. Click Next. The License Agreement window opens. 4. Select I accept the license agreement, and click Next.

(26)

The Destination Folder window opens, displaying the folder path in which the application will be installed.

Note:

The eToken PKI Client installation has determined the destination folder for subsequent eToken application installations. 5. Click Next.

(27)

The Select Token Type window opens.

Note:

If an eToken Virtual is already installed on your computer, this window does not open. 6. Do one of the following: Τo store your credentials on an existing token, select Physical token. If you select the Physical Token option, you may be able to create an eToken Virtual later, using TMS. Το create a new eToken Virtual file on your computer, select eToken Virtual. A new eToken Virtual file is created in your personal file. The file is named DefaulteTokenVirtual.etv. To locate and maintain eToken Virtual files, use the eToken PKI Client eToken Properties application.

Note:

Regardless of your selection, you will be able to use eToken SSO to store your credentials on any physical token or eToken Virtual that you have. 7. Click Next. The installation begins.

(28)

When the wizard completes the installation, the Successfully installed message is displayed. 8. Click Finish. 9. If you selected eToken Virtual in step 6, the Change Password window may open. To change the password of the eToken Virtual, do the following: In the Current eToken Password field, enter the initial eToken Password. By default, this is 1234567890. In the New eToken Password and Confirm New eToken Password fields, enter a new eToken Password. You will need this password to use your eToken Virtual. Click OK. 10. Restart the computer if prompted.

Installing eToken SSO Using the Command Line

To install eToken SSO 5.1 via the command line:

1. From the Windows taskbar, select Start > Programs > Accessories

> Command Prompt.

2. On the command line, type:

(29)

where:

[path] is the path to etsso51_x86.msi

/qn_{is an optional parameter to run the installation silently,} with no user interface

PROPERTY=VALUE represents an optional parameter defining a

feature to be installed

Locating the Installation Folder

The default path to the eToken SSO installation folder is: C:\Program Files\Aladdin\eToken

Use the Registry Editor to find the actual installation folder path.

To find the installation folder path using the Registry Editor:

1. From the Windows taskbar, select Start > Run. 2. In the Run dialog box, type regedit, and click OK. The Registry Editor opens. 3. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Aladdin\eToken. 4. In the right panel, double‐click Path. The installation folder path is displayed. Optional Parameter Parameter Feature

CREATE_ETOKEN_VIRTUAL=1 Only during installation and not repair; installs an eToken Virtual

(30)

(31)

eToken SSO Toolbar

This chapter describes how to work with your browser’s eToken SSO toolbar.

In this chapter:

Installing the eToken SSO Toolbar Enabling the Toolbar for Internet Explorer Enabling the Toolbar for Firefox

Enabling or Disabling eToken SSO Using the Toolbar Opening a Webpage Using the Toolbar

(32)

Installing the eToken SSO Toolbar

When eToken SSO is installed, an eToken SSO toolbar is added to the browser. The eToken SSO toolbar may be used to open webpages having saved profiles, and to save web profiles manually when Enable autosave for web profiles is not selected in the eToken SSO ‐ Client Settings window.

Enabling the Toolbar for Internet Explorer

If the eToken SSO toolbar is not visible when browsing with Internet Explorer, select View > Toolbars > eToken SSO from the browser menu.

If you are running Windows Server 2003 R2, you may need to modify your explorer settings to enable the eToken SSO toolbar.

To enable the eToken SSO toolbar in Windows Server 2003 R2:

1. From the Windows taskbar, select Start > Settings > Control Panel. The Control Panel opens. 2. Double‐click Add or Remove Programs. The Add or Remove Programs window opens. 3. In the left panel, click Add/Remove Windows Components. The Windows Components Wizard opens. 4. Clear the Internet Explorer Enhanced option, and click Next. The Windows Components Wizard runs. 5. Click Finish.

(33)

Enabling the Toolbar for Firefox

The eToken SSO toolbar must be installed manually for each Firefox user.

To install the eToken SSO toolbar for Firefox:

1. From the browser menu, select File > Open File. The Open File window opens. 2. In the Look in field, browse to the eToken SSO installation folder. The default installation folder is: C:\Program Files\Aladdin\eToken\eTokenSSO To locate the installation folder, see Chapter 3:Locating the Installation Folder, on page 23. 3. Select the .xpi template file: [email protected] 4. Click Open. The Software Installation window opens. 5. Click Install Now. The Add‐ons window opens. 6. Click Restart Firefox.

(34)

Firefox closes and reopens.

The eToken SSO toolbar is displayed.

Enabling or Disabling eToken SSO Using the Toolbar

When eToken SSO is enabled, it runs in the background. To prevent eToken SSO from automatically logging on to your applications, you must disable it. eToken SSO can be enabled or disabled from the following locations: Internet browser toolbar _{eToken SSO window} To enable eToken SSO, click the Disabled. Click to enable eToken SSO icon. To disable eToken SSO, click the Enabled. Click to disable eToken SSO icon. Even when eToken SSO has been disabled, you can do the following: To save a profile, click the Save icon on the toolbar. To log on using a saved profile, click the Fill icon on the toolbar.

(35)

Opening a Webpage

Using

the Toolbar

You can open a webpage by selecting its profile from the eToken SSO toolbar.

To open a webpage that has a saved profile:

1. Connect your token.

Note:

To connect a physical token, insert it into your computer’s USB port. 2. On the eToken SSO toolbar, click the eToken SSO Select Web Profile icon. The available web profiles are shown in the drop‐down menu. 3. Select the required profile. The website opens, and eToken SSO fills the fields with your saved credentials.

Note:

If eToken SSO is disabled, the website opens but your credentials are not filled.

Uninstalling the Toolbar

When eToken SSO 5.1 is uninstalled, its toolbar is automatically removed from Internet Explorer.

(36)

To remove the eToken SSO toolbar from Firefox: 1. From the browser menu, select Tools > Add‐ons. The Add‐ons window opens. 2. Under eToken SSO Firefox extension, click Uninstall. An Uninstall window opens. 3. Click Uninstall.

(37)

A message is displayed in the Add‐ons window.

(38)

(39)

Profile Maintenance

This chapter describes how to work with your eToken SSO profiles. Some of the functions described in this chapter may be limited by your organizationʹs policies.

In this chapter:

eToken SSO Profiles Overview Opening the eToken SSO Window Restarting eToken SSO

Enabling or Disabling eToken SSO Using the Window Logging On to eToken Selecting a Profile Creating a Profile Editing a Profile Copying a Profile Deleting Profiles Backing Up Profiles Restoring Profiles Migrating a Profile

Changing a Logon Password Changing the Settings

(40)

eToken SSO Profiles Overview

Use eToken SSO to create and maintain profiles on your token for all your applications and websites. When eToken SSO is enabled, it submits the saved credentials to each application and website you open. The only password you need to remember is your eToken Password. Before each profile procedure, ensure that your token is connected.

Note:

To connect a physical token, insert it into your computer’s USB port.

Opening

the eToken SSO Window

Use the eToken SSO window to copy and maintain your profiles.

To open the eToken SSO window:

Do one of the following: _{From the Windows taskbar, select Start > Programs > eToken} > eToken SSO > eToken SSO Client. Right‐click the eToken icon in the system tray, and select eToken SSO Client. Click the Open eToken SSO icon on the browser toolbar. Configure eToken SSO to open when you launch Windows. See Changing the Settings on page 60. The eToken SSO window opens, displaying the names of the profiles on your connected token, and the dates they were last modified.

(41)

Each profile displayed is preceded by one or two icons.

eToken SSO Properties Icons Icon Description

Default profile

"Broken template" - the template has been changed and this profile no longer functions. Re-create the profile.

eToken Network Logon profile

Profile for a template or website with no predefined icon

WSO profile

Predefined Icon Profile for a template or website with a predefined icon

(42)

Restarting eToken SSO

If the eToken SSO window stops responding, use the Resume function to restart it.

To restart the eToken SSO window:

From the Windows taskbar, select Start > Programs > eToken >

eToken SSO > Resume eToken SSO Client.

The eToken SSO window resumes operation.

Enabling or Disabling eToken SSO Using the Window

When eToken SSO is enabled, it runs in the background. To prevent eToken SSO from automatically logging on to your applications, you must disable it. eToken SSO can be enabled or disabled from the following locations: Internet browser toolbar _{eToken SSO window} To enable eToken SSO, click the Disabled. Click to enable eToken SSO icon. To disable eToken SSO, click the Enabled. Click to disable eToken SSO icon. Even when eToken SSO has been disabled, you can do the following: To save a profile, click the Save icon on the toolbar. To log on using a saved profile, click the Fill icon on the toolbar.

(43)

Logging On to eToken

To use your profiles, you must be logged on to the connected token device or to the eToken Virtual on which your profiles are stored. If you are not yet logged on, the Log On to eToken window opens when you access your token. Enter your eToken Password, and click OK.

Selecting a Profile

When eToken SSO 5.1 is enabled, the credentials saved in a profile are automatically supplied whenever its associated webpage or application is opened. If the token holds more than one profile for the webpage or application, the following occurs: If one profile has been defined as the default profile, that profile is used.

(44)

_{If none of the profiles has been set as the default, the Select a Profile} window is displayed. Select a profile from the Profile Name list, and click OK.

Creating a Profile

When you open a webpage or application that requires you to submit credentials, you can save a profile for it to your connected token. Whenever that webpage or application is opened again, eToken SSO fills the fields with your saved credentials. This section describes how to create a profile for the following logon types: _{application logon} web logon _{basic access authentication} For a description of eToken Network Logon profiles, see the eToken Network Logon User’s Guide. For more information about logon types, see Supported Logon Technologies on page 2. If a profile for the webpage or application already exists on your token, you can create an alternative profile. See Copying a Profile on page 48.

(45)

An application profile can be created only if your system administrator has created a template for it on your computer.

Creating a Profile for Web and Application Logon

To create a profile: 1. Ensure that eToken SSO is enabled. See Enabling or Disabling eToken SSO Using the Window on page 36. 2. Open the webpage or application for which the profile will be created. An application profile can be created only if your system administrator has created a template for it on your computer. 3. To save a profile for a webpage that does not have a template, do one of the following: When Enable autosave for web profiles is not selected in the eToken SSO settings, the web profile can be saved manually by clicking the Save icon in the eToken SSO toolbar. When Enable autosave for web profiles is selected, browse away from the webpage. A message prompts you to save the logon form. 4. Click Yes.

(46)

The New Profile window opens and displays any logon credentials already entered.

5. Edit the fields as follows:

6. Click OK.

Field Description

Profile Name Set the name of the profile.

Enter the required details For each field, enter a value to be submitted to the application window or webpage. The fields that are displayed vary according to the data on the form. Automatic submit Select to automatically submit your credentials when

opening the website or application. Set as default for

application

Select to define this profile as the default when there are multiple profiles for the application or website. Verify site identity Select to confirm the domain name, either with or

(47)

If the token already contains a profile with the same name as the new profile, a name conflict window opens. 7. Do one of the following: Select Yes to replace the profile on the token. Select No to return to the previous window and change the profile name. Select Cancel to cancel the profile creation request. A profile containing your credentials is saved to your token.

Note:

Some application profiles require that the application be closed and reopened before the profile is applied.

If a New Profile process is ended by clicking Cancel, further attempts to create a profile for that form may be disabled. To enable another new profile attempt, click the Refresh icon in the eToken SSO window.

Creating a Profile for Basic Access Authentication

Note:

Profiles cannot be created for basic access authentication using Firefox. To create a profile: 1. Ensure that eToken SSO is enabled. See Enabling or Disabling eToken SSO Using the Window on page 36. 2. Navigate to the website for which the profile will be created.

p

(48)

The basic access authentication Logon window opens.

(49)

4. Click OK.

A profile containing your credentials is saved to your token.

User Name Enter the user name.

Password Enter the user’s logon password.

Sites Enter the address of the website. If the logon applies

to more than one website, enter each address separated by a comma (,).

Automatic submit Select to automatically submit your credentials when opening the website.

Set as default for application

Select to define this profile as the default when there are multiple profiles for the website.

Verify site identity Select to confirm the domain name, either with or without the server name.

(50)

Editing a Profile

Editing a Profile for Web and Application Logon

To edit a profile:

1. Open the eToken SSO window.

The eToken SSO window displays the names of the profiles on your token, and the dates they were last modified.

(51)

The More Details window is displayed. 3. Edit the fields as follows:

Note:

The fields that are displayed in the More Details window vary according to the web or application logon window. . Field Description

(52)

4. Click OK to save your changes.

Editing a Profile for Basic Access Authentication

To edit a profile:

1. Open the eToken SSO window.

The eToken SSO window displays the names of the profiles on your token, and the dates they were last modified.

2. Select the profile to edit, and click More Details. Set as default for

application

Use advanced Fill & Submit mode

Select if the profile does not perform fill-and-submit correctly during logon.

This option is enabled only if the profile uses a template for which automatic script generation is selected.

(53)

The More Details window is displayed.

Set as default for application

(54)

4. Click OK to save your changes.

Copying a Profile

You can create multiple profiles for each application or website.

To create an additional profile:

1. Open the eToken SSO window. TheeToken SSO window displays the names of the profiles on your token. 2. Select an existing profile for the application or website. 3. Click the Copy profile icon . A window opens asking if you want the new profile to be the default one. 4. Click Yes or No. A copy of the profile is created. The new profile has the same name as the original profile, followed by the next number in the series, starting from (1).

(55)

Deleting Profiles

Delete profiles that are no longer needed.

Note:

All profiles preceded by a broken template icon should be deleted. To delete profiles: 1. Open the eToken SSO window. The eToken SSO window displays the names of the profiles on your token. 2. Select one or more profiles to delete. 3. Click the Delete profile icon . A window asks for confirmation. 4. Click Yes to confirm. The selected profiles are deleted.

(56)

Backing Up Profiles

Profiles on a token can saved to a backup file. These profiles can be restored to a token later if your token is lost or damaged. See Restoring Profiles on page 52. The backup file can be created in one of the following ways: _{Your system administrator enables the automatic backup feature.} You use the Back up profiles icon to manually back up your profiles to a backup file on your computer. The backup file is protected by a password that you assign.

To manually back up your profiles:

1. Open the eToken SSO window, and click the Back up profiles icon

.

The Profile Backup window opens.

(57)

The Backup File Location window opens. 3. In the Save in field, select a folder in which to save the backup file. 4. Enter a name for the backup file in the File name field (or accept the default file name), and click Save.

Note:

The backup file has the extension .bak If a file of that name exists, you are asked to confirm that you want to replace the file. 5. Click Yes. You return to the Profile Backup window. 6. Enter a backup file password in the Backup File Password and Confirm File Password fields.

(58)

You will need this password to restore the profiles.

Note:

The password must be at least eight characters long and must be a combination of at least three of the following: _{Upper‐case letters} Lower‐case letters _Digits Special characters, such as @, #, $, * 7. Click Back Up. A confirmation message is displayed. 8. Click OK.

Restoring Profiles

Profiles saved to a backup file can be restored to your token. See Backing Up Profiles on page 50. You can restore profiles in one of the following ways: Restore all of the profiles. _{Select only specific profiles to restore.}

(59)

Restoring All Profiles

To restore all profiles:

1. Open the eToken SSO window, and click the Restore profiles icon

.

The Profile Restore window opens.

(60)

The Backup File Location window opens. 3. Browse to the required backup (.bak) file, and click Open. The Profile Restore window displays the path to the backup file. 4. In the Backup File Password field, enter the backup file’s password.

Note:

If your profiles were backed up using the automatic backup feature, you do not need to enter a password. .

To restore selected profiles only, continue from Restoring Selected Profiles on page 55.

(61)

5. Click Restore All. A progress bar displays the restore operation’s progress, followed by a confirmation message. If the token already contains a profile with the same name as a restored profile, the restored profile is renamed, and the Profile Restore Report is displayed.

Note:

If a profile with the same name already exists on the token, the name of the new profile is followed by the next number in the series, starting from (1). 6. Click OK.

Restoring Selected Profiles

To restore selected profiles:

1. Perform step 1 to step 4 as described in the Restoring All Profiles section on page 53.

(62)

Two additional boxes are displayed in the Profile Restore window: Profiles to restore: a list of the profiles in the backup file that have not yet been restored to the token. _{Profiles already on token: a list of the profiles on the token.} 3. Do any of the following: Select Show restored profiles to include in the Profiles to restore box even profiles that have already been restored to the token. Clear Show restored profiles to include in the Profiles to restore box only profiles that have not yet been restored to the token. In the Profiles already on token box, select which profiles to delete from the token to make room for the tokens to be restored. Click Delete from token. 4. In the Profiles to restore box, select the profiles to restore, and click Copy to token.

(63)

5. If the token already contains a webpage, application, or network logon profile with the same name as a profile being copied, the Profile Name Conflict window opens. Do any of the following: _{Select Overwrite to replace the profile on the token.} Select Create new to add a new profile. If this is an eToken Network Logon profile, the Skip field is displayed instead of the Create New field. Select Skip to avoid restoration of this profile. Select Apply to all selected profiles apply this action to all profiles selected for copying that already exist on the token. _{Clear Apply to all selected profiles to open the Profile Name} Conflict window for each profile selected for copying that already exists on the token. 6. Click Restore.

Note:

If a profile with the same name already exists on the token, the name of the new profile is followed by the next number in the series, starting from (1). The profiles selected are restored to the token, and are displayed in the Profiles already on token box. 7. Click Close.

(64)

Migrating a Profile

If your system administrator instructs you to migrate an eToken WSO profile to the eToken SSO format, use the Migrate profiles icon. To migrate a profile: 1. Open the eToken SSO window. 2. Select the WSO profile to be migrated, and click the Migrate profiles icon .

(65)

A migrated profile is created in eToken SSO format.

Changing a Logon Password

If the system administrator has defined a Change Password form in an application or web template, the saved profile is automatically updated when the user changes the logon password. If there is no template, or if no Change Password form is defined to the template, the user must manually update the profile when the password is changed.

To manually update the profile:

Do one of the following:

Edit the password field value in the profile. See Editing a Profile on page 44.

Delete the profile and create a new one with the new password. See Deleting Profiles on page 49, and Creating a Profile on page 38.

(66)

Changing the Settings

Personal eToken SSO user settings are saved to the computer and can be changed by the user. Settings saved to a computer by one user do not affect the settings of any other user on the same computer.

To modify the settings:

1. Open the eToken SSO window, and click the Settings icon . The Client Settings window opens. 2. Select the options as follows:

Tip:

Some of the options in the Client Settings window may be disabled, in accordance with your organization’s policies.

(67)

3. To view the templates stored in eToken SSO, click Show Loaded

Templates.

Open main window when eToken SSO starts

Select to open the eToken SSO window when Windows starts.

Always display eToken SSO main window on top

Select to display the eToken SSO window over other windows.

Enable autosave for web profiles

Select to open a window that saves the logon webpage when you browse away from it. To apply, close and reopen the browser.

Request eToken Password Only once per session: the eToken Password

must be entered only one time for each session

Every _ minutes: the maximum duration, in

minutes, of a session, after which the user must re-enter the eToken Password.

Note: The maximum duration of a session is also

determined by the settings in eToken PKI Client. If Single Logon is not activated in eToken PKI Client, the settings in eToken SSO determine the length of the session. However, if Single Logon is activated in eToken PKI Client, the length of the session is determined by whichever setting is the longest of the two: eToken PKI Client setting or eToken SSO setting.

If the Only Once option is selected in eToken SSO, this defines the behavior, regardless of the settings in eToken PKI Client.

(68)

The Loaded Templates window opens. 4. To close the Loaded Templates window, click Close. 5. Click OK.

Note:

For some of these settings to take effect, you must disconnect the token, or restart the computer.

(69)

FCC Compliance

eToken USB has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures: a. Reorient or relocate the receiving antenna. b. Increase the separation between the equipment and receiver. c. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected. d. Consult the dealer or an experienced radio/TV technician.

FCC Warning

Modifications not expressly approved by the manufacturer could void the user authority to operate the equipment under FCC rules. All of the above applies also to the eToken USB.

(70)

FCC authorities have determined that the rest of the eToken product line does not contain a Class B Computing Device Peripheral and therefore does not require FCC regulation.

CE Compliance

The eToken product line complies with the CE EMC Directive and related standards*.eToken products are marked with the CE logo and an eToken CE conformity card is included in every shipment or upon demand. *EMC directive 89/336/EEC and related standards EN 55022, EN 50082‐1.

UL Certification

The eToken product line successfully completed UL 94 Tests for Flammability of Plastic Materials for Parts in Devices and Appliances. eToken products comply with UL 1950 Safety of Information Technology Equipment regulations.

ISO 9001 Certification

The eToken product line is designed and manufactured by Aladdin Knowledge Systems, an ISO 9001‐certified company. Aladdinʹs quality assurance system is approved by the International Organization for Standardization (ISO), ensuring that Aladdin products and customer service standards consistently meet specifications in order to provide outstanding customer satisfaction.

(71)

Certificate of Compliance

Upon request, Aladdin Knowledge Systems will supply a Certificate of Compliance to any software developer who wishes to demonstrate that the eToken product line conforms to the specifications stated. Software developers can distribute this certificate to the end user along with their programs.

(72)

(73)

Copyrights and Trademarks

The eToken™ system and its documentation are copyrighted © 1985 to present, by Aladdin Knowledge Systems Ltd. All rights reserved. eToken™ is a trademark and ALADDIN KNOWLEDGE SYSTEMS LTD is a registered trademark of Aladdin Knowledge Systems Ltd. All other trademarks, brands, and product names used in this Manual are trademarks of their respective owners. This manual and the information contained herein are confidential and proprietary to Aladdin Knowledge Systems Ltd. (hereinafter ʺAladdinʺ). All intellectual property rights (including, without limitation, copyrights, trade secrets, trademarks, etc.) evidenced by or embodied in and/or attached/connected/related to this manual, information contained herein and the Product, are and shall be owned solely by Aladdin. Aladdin does not convey to you an interest in or to this manual, information contained herein and the Product, but only a limited right of use. Any unauthorized use, disclosure or reproduction is a violation of the licenses and/or Aladdinʹs proprietary rights and will be prosecuted to the full extent of the Law.

NOTICE

All attempts have been made to make the information in this document complete and accurate. Aladdin is not responsible for any direct or indirect damages or loss of business resulting from inaccuracies or omissions. The specifications in this document are subject to change without notice.

(74)

(75)

Aladdin eToken Patent Protection

eToken Hardware and/or Software products described in this document are protected by one or more of the following Patents: US 6,748,541, US 6,554,621, US 7,249,266, US 6,763,399, and EP 1001329, and may be protected by other U.S. Patents, foreign patents, or pending applications.

(76)