Windows Installation Guide
Disclaimer of Warranties and Limitations of Liabilities
Disclaimer of Warranties and Limitations of Liabilities
The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you.
Copyright
Copyright © 2009 VASCO Data Security, Inc., VASCO Data Security International GmbH. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of VASCO Data Security Inc.
RADIUS Documentation Disclaimer
The RADIUS documentation featured in this manual is focused on supplying required information pertaining to the RADIUS server and its operation in the Identikey Server environment. It is recommended that further information be gathered from your NAS/RAS vendor for information on the use of RADIUS.
Trademarks
VASCO®, Vacman®, IDENTIKEY®, aXs GUARD™, DIGIPASS®, and ® are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other countries.
Table of Contents
1 Introduction... 8
1.1 Software Components... 8
1.2 System Requirements... 10
1.3 Available Guides... 12
2 Pre-installation Tasks... 14
2.1 Identikey Server Component... 14
3 Set Up Data Store for Identikey Server... 17
3.1 Active Directory... 17
3.2 ODBC Database... 19
3.3 Serial Number and Maintenance ID... 20
4 Start Identikey Server Installation... 21
5 Install Identikey Server in Basic Mode – ODBC... 23
5.1 Basic Installation Mode... 23
5.2 Basic Installation... 24
6 Install Identikey Server in Advanced mode - ODBC... 41
6.1 Advanced Installation... 41
7 Install Identikey Server - Active Directory... 69
7.1 Active Directory Scenario and Decisions... 69
7.2 Install Identikey Server for Active Directory... 70
8 Deploy Identikey Server Web Administration... 107
8.1 Deploy Administration Web Interface on the same machine as Identikey Server... 107
8.2 Deploy Administration Web Interface on a Dedicated Machine...116
8.3 Web Administration Setup Tool... 117
Table of Contents
10 Install Additional Identikey Server... 125
10.1 Install Identikey Server Component... 125
10.2 Configure Additional Identikey Servers... 125
10.3 Replication... 125
11 Add Components to Installation... 126
12 Repair Installation... 127
13 Uninstall Identikey Server... 128
13.1 Data Removal... 128
14 Extend Data Store Schema... 129
15 Technical Support... 132
15.1 Support Contact Information... 132
Illustration Index
Image 1: Identikey Server Installation Welcome Window...21
Image 2: Identikey Server Installation Welcome Window...22
Image 3: Identikey Server Installation - Installation Type Window...24
Image 4: Identikey Server Installation -License Agreement Window...25
Image 5: Identikey Server Installation - Select Installation Path Window...26
Image 6: Identikey Server Installation - Installation Progress Window ...27
Image 7: Identikey Server Installation - Installation Progress Window...28
Image 8: Identikey Server Installation - Installation Progress Window - PostgreSQL...29
Image 9: Identikey ServerConfiguration Wizard - Start Window...30
Image 10: Identikey ServerConfiguration Wizard - IP Address Window...31
Image 11: Identikey ServerConfiguration Wizard - First Administrator Window...32
Image 12: Identikey ServerConfiguration Wizard - License Window...32
Image 13: Identikey ServerConfiguration Wizard - Server Functionality Window...33
Image 14: Identikey ServerConfiguration Wizard - Server Certificate Window...34
Image 15: Identikey ServerConfiguration Wizard - RADIUS Topology Window...34
Image 16: Identikey Server Configuration Wizard - RADIUS Client Window...35
Image 17: Identikey Server Configuration Wizard - RADIUS Backend Window...36
Image 18: Identikey Server Configuration Wizard Summary Window...36
Image 19: Identikey Server Configuration Wizard - Completion Window...37
Image 20: Import DPX Files Window...38
Image 21: Identikey Server Installation Complete Window...39
Image 22: Identikey Server Select Installation Type Window...41
Image 23: Identikey Server Installation - Data Storage Window...42
Image 24: Identikey Server Installation – Select Components Window...43
Image 25: Identikey Server Installation – License Agreement Window...44
Image 26: Identikey Server Installation – Custom Setup window...45
Image 27:Identikey Server Installation – Ready to Install Identikey Server window...46
Table of Contents
Image 35: Identikey Server Configuration Wizard - User ID/Domain conversion Window... 53
Image 36: Identikey Server Config IP Address Window...54
Image 37: Identikey Server First Administrator Window...55
Image 38: Identikey Server Sensitive Data Encryption Window...55
Image 39: Identikey Server Custom Data Encryption Window...56
Image 40: Identikey Server Load Data Encryption Window...57
Image 41: Identikey Server Configuration Wizard License Window...57
Image 42: Identikey Server Configuration Wizard Server Functionality Window...58
Image 43: Identikey Server Configuration Wizard Server Certificate Window...59
Image 44: Identikey Server Configuration Wizard Server Certificate Password Window...59
Image 45: Identikey Server SSL Server Certificate Selection...60
Image 46: Identikey Server Web Admin Client Window...61
Image 47: Identikey ServerSample Web Client Window...61
Image 48: Identikey Server Configuration Wizard Summary Window...62
Image 49: Identikey Server Install Wizard Completion Window...63
Image 50: Identikey Server Installation Select Components Window...63
Image 51:Deploying Identikey Server Web Administration Module Window...64
Image 52:Deploying Identikey Server Web Administration Module Wizard Results Window...65
Image 53:Select Components completed Window...66
Image 54:Installation Report page...67
Image 55: Identikey Server Setup - Installation Type window...70
Image 56: Identikey Server Setup - Data Storage window...71
Image 57: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window...72
Image 58: Microsoft .NET license agreement...73
Image 59: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window...74
Image 60: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation complete window...75
Image 61: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation hotfix window...76
Image 62: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix installer window... 77
Image 63: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix applied window... 78
Image 64: Identikey Server Setup - Select Components Window ...79
Image 65: Identikey Server Setup Wizard Start Page...80
Image 66: Identikey Server Setup - License Agreement Window...81
Image 67: Identikey Server Setup - Custom Setup window...82
Image 68: Identikey Server Setup - Ready to Install Identikey Server window...83
Image 69: Installing Identikey Server progress window...84
Image 70: Identikey Server Setup Wizard finish window...85
Image 71: Identikey Server Installed – Select Components...86
Image 72: Identikey Server Configuration Wizard Start Window...87
Image 73: Identikey Server Configuration Wizard - Active Directory Pre-requisites Window... 88
Image 74: Identikey Server Configuration Wizard – Digipass Configuration Domain Window...89
Image 75: Identikey Server Configuration Wizard – Active Directory Certificate Authority Window...89
Image 76: Identikey Server Configuration Wizard – IP Address Window...90
Image 77: Identikey Server Configuration Wizard – First Administrator Window...91
Image 78: Identikey Server Configuration Wizard – Sensitive Data Encryption Window...92
Image 79: Identikey Server Configuration Wizard – Custom Data Encryption Window...93
Image 80: Identikey Server Configuration Wizard – Load Data Encryption Window...94
Image 81: Identikey Server Configuration Wizard – License Window...95
Image 82: Identikey Server Configuration Wizard – Server Functionality Window...96
Image 83: Identikey Server Configuration Wizard – SSL Server Certificate Window...97
Image 84: Identikey Server Configuration Wizard – SSL Server Certificate Password Window...98
Image 85: Identikey Server Configuration Wizard – SSL Server Certificate Selection Window...99
Image 86: Identikey Server Configuration Wizard – Web Admin Client Window...100
Image 87: Identikey Server Configuration Wizard – Sample Web Client Window...101
Image 88: Identikey Server Configuration Wizard – Summary Window...102
Image 89: Identikey Server Configuration Wizard – Completion Window...102
Image 90:Deploying Identikey Server Web Administration Module Window...103
Image 91:Deploying Identikey Server Web Administration Module Wizard Results Window...103
Image 92: Identikey Server Installation Complete Window...104
Image 93: Identikey Server Installation Custom Setup Window...105
Image 94: Windows Start Menu showing location of Active Directory Users and Computers...106
Image 95: My Computer - Manage...108
Image 96: Identikey Server Computer Management console...108
Image 97: Apache Tomcat Introduction page...109
Image 98: Apache Tomcat Manager login...110
Image 99: Apache Tomcat Manager...111
Introduction
1 Introduction
This Installation Guide is designed to provide you with the information you will need in order to install Identikey Server. It will guide you through preparation, installation and post-installation tasks which may be required for your system.
1.1 Software Components
Identikey Server consists of various components, some necessary and some optional.
1.1.1 Required Components
Identikey Server
The Identikey Server is a server component that performs authentication, signature validation, administration and provisioning tasks. It runs as a Windows service.
Data Store
The following data stores are supported:
ODBC – either the embedded PostgreSQL database supplied with Identikey Server, or your own Active Directory
Web Administration Interface
Allows all Identikey Server data store administration tasks to be carried out over a web interface.
1.1.2 Optional Components
Embedded Database
An embedded PostgreSQL database is available for use with Identikey Server.
Embedded Web Application Server
Apache Tomcat may be installed as the embedded web application server for the Web Administration Interface.
Note
The embedded PostgreSQL database and the Embedded Web Application Server are NOT available for 64-bit Windows.
Virtual Digipass Message Delivery Component
This is a Service that is responsible for delivering One Time Passwords through a text message HTTP gateway to a User’s mobile phone.
Digipass TCL Command-Line Administration
Administration may also be carried out using Digipass TCL Command-Line Administration Utility, which allows interactive command-line and scripted administration of Identikey Server data.
Audit Viewer
The Audit Viewer is a GUI application that can display and filter audit messages from the Identikey Server. It can read the data from text files and ODBC databases or receive a live feed from the Identikey Server.
OTP Request Site
This is a miniature web site that allows a User to request a Virtual Digipass OTP to be sent to their mobile phone.
User Self Management Web Site
This is a miniature web site that allows Users to make appropriate changes to their own Digipass settings, such as PIN changes. This is used in a RADIUS environment, when the normal authentication requests are made using a CHAP-based protocol and therefore PIN changes and other 'self-management' features are not possible.
1.1.3 Identikey Server SDK
The Software Development Kit allows creation of custom SOAP clients and authentication engines, using the SOAP interface. This is an upgrade add-on to Identikey Server and will only be available for installation if it has been purchased. It requires a separate installation program.
Introduction
1.2 System Requirements
1.2.1 Server Component
Identikey Server requires:
Windows Server 2008 (32-bit or 64-bit) Windows Vista (32-bit or 64-bit)
Windows XP (32-bit or 64-bit) with service pack 2 or above
Windows Server 2003 (32-bit or 64-bit) with Service Pack 1 or above
1.2.2 Administration Web Interface
The Administration Web Interface can be run on the following operating systems:
Windows Server 2008 (32-bit or 64-bit) Windows Vista (32-bit or 64-bit)
Windows XP (32-bit or 64-bit) with service pack 2 or above Windows 2003 (32-bit or 64-bit)
The Administration Web Interface can be run on any Java web application server running:
Java Runtime Environment version 5.0 or above Java Server Pages version 2.0 or above Java Servlets version 2.4 or above
It has been tested primarily on Apache Tomcat 5.5.
It is compatible with most common browsers, including:
Internet Explorer 6.0 Internet Explorer 7.0 Mozilla Firefox 2.0 Opera 9.0
Netscape 8.1 (a few cosmetic issues appear with this browser)
1.2.3 Other Components
The Message Delivery Component, Audit Viewer and Digipass TCL Command-Line Administration require:
Windows Server 2003 (32-bit or 64-bit) with Service Pack 1 or above
Windows XP Professional (32-bit or 64-bit) with Service Pack 2 or above Windows Vista (32-bit or 64-bit)
Windows 2008 (32-bit or 64-bit) GUI version
The Request OTP and User Self Management Websites require any web server capable of running CGI.
1.2.4 Requirements Specific to Active Directory
Digipass Extension for Active Directory Users and Computers Active Directory Users and Computers Snap-In
Active Directory set up for SSL
In the following cases, SSL must be available for Identikey Server components to connect to Active Directory:
Identikey Server not installed on a Domain Controller.
Administration Interfaces not installed on a Domain Controller.
Identikey Server and/or Administration Interface(s) on a Domain Controller, but accessing data in another domain.
An Enterprise Certificate Authority must be installed in the forest to enable SSL. Windows Certificate Services is available as an optional Windows component.
However, if you do not wish to install a CA, you can select during installation not to use SSL.
Prerequisites
1. If Active Directory is installed on a Windows 2003 machine and it is being managed using a Windows XP machine, you will have to download the Admin Pack from the Microsoft website and install it on the XP machine.
2. If Active Directory is installed on a Windows 2008 machine, and it is being managed using a Windows Vista machine, Vista SP1 must be downloaded from the Microsoft website and installed on the Vista machine.
Then the Remote Server Administration Tools package must be downloaded from the Microsoft website and installed and enabled on the Vista machine.
Introduction
Sybase Adaptive Server Anywhere 11.0 PostgreSQL 8.2.5
Note
Please note that when setting up a DB2 database the page size should be set to at least 8192k.
A smaller page size will create an error when Identikey Server attempts to connect to the database.
1.2.6 Language
Identikey Server is designed to function on any language version of Windows. However, the product has only been comprehensively tested on English language versions of Windows.
1.3 Available Guides
The following Identikey Server guides are available:
Product Guide
The Product Guide will introduce you to the features and concepts of Identikey Server and the various options you have for using it.
Getting Started Guide
The Getting Started Guide will lead you through a standard setup and testing of key Identikey Server features.
Windows Installation Guide
Use this guide when planning and working through an installation of Identikey Server in a Windows environment.
Linux Installation Guide
Use this guide when planning and working through an installation of Identikey Server in a Linux environment.
Administrator Reference
In-depth information required for administration of Identikey Server. This includes references such as data attribute lists, backup and recovery and utility commands.
Performance and Deployment Guide
Contains information on common deployment models and performance statistics.
Help Files
Context-sensitive help accompanies the Administration Web Interface and Digipass Extension for Active Directory Users and Computers.
Identikey Server SDK Programmers Guide In-depth information required to develop using the SDK.
Pre-installation Tasks
2 Pre-installation Tasks
This section outlines the preparation that you need to do before installing Identikey Server.
Please note that to perform pre-installation and installation tasks you must be logged in as Administrator on the system where Identikey Server is to be installed.
2.1 Identikey Server Component
The following tasks must be completed before installing the Identikey Server on a machine.
2.1.1 Data Store Type
Before starting other pre-install tasks, you must decide on the type of data store to be used.
Microsoft Active Directory
Integrate Digipass-related data with Active Directory and Windows user accounts using the Active Directory Users and Computers Snap-In.
Embedded Database
A PostgreSQL database may be installed with Identikey Server. This can only be used with 32-bit Windows.
Note
If you will be installing Identikey Server with the embedded PostgreSQL database, you will need to run the installation on the machine itself, rather than via Remote Desktop or another remote connection.
Other ODBC Database
Include Digipass-related data in a new or existing ODBC database. The database may be located on any machine to which the Identikey Server can connect.
2.1.2 Master Domain
Identikey Server has the concept of a Master Domain. This domain has special significance in two ways:
It is used as the default domain, when no domain is specified.
Only Administrators in the Master Domain may be assigned the privilege to view data from all domains.
Administrators in other domains will only ever be able to view data in their own domain.
The default name for the Master Domain is master. If you prefer to use another name, you will need to enter this name during the Configuration Wizard.
2.1.3 User ID and Domain Name Conversion
The Identikey Server may be configured to handle User IDs and domain names in a number of ways. It is important that these are set up before data is added to the database. Before installing, decide which settings to use.
Case-sensitivity
The Identikey Server may be configured to save and retrieve User IDs and domain names in lower case, upper case or with no conversion (data is saved or searched on exactly as entered). The configuration required will depend on your company's requirements and the capabilities of the database used as the data store. See the Encoding and Case-Sensitivity topic in the Administrator Reference for more information.
The case conversion of User IDs and domain names is set using the Configuration Wizard immediately after installation, or by running the Identikey Server Configuration utility at any time afterwards.
Caution
Changing case conversion after the initial configuration may require modification of all User IDs and domain names in the data store.
Windows name resolution
Enable Windows Name Resolution to allow the Identikey Server to use Windows functionality to resolve a UserID – as entered during a login – into a User ID and Domain. This feature is recommended if all User accounts correspond to Windows (Active Directory) User accounts. If they do not correspond, the feature will not be suitable.
Windows Name Resolution works well with Dynamic User Registration. See the Product Guide for more information.
2.1.4 System Clock
The Identikey Server requires that:
Pre-installation Tasks
2.1.5 Embedded PostgreSQL Database
2.1.5.1 Local Users Group Permissions
If the local Users group has restricted permissions on the Program Files directory, the installation of the PostgreSQL database may fail. To avoid this problem, two options are available:
Set the required permissions for the local Users group
Create the PostgreSQL service account before installation and set the required permissions for it (it is usually created automatically during installation)
The PostgreSQL service account requires a User ID of dppostgres and password of p!ss&0rd.
The permissions required for the Program Files directory are:
Read & Execute List Folder Contents Read
3 Set Up Data Store for Identikey Server
Identikey Server may use either Microsoft's Active Directory or an ODBC-compliant database as its data store. The data store is selected during installation.
Active Directory
If Identikey Server will use Active Directory as its data store, the steps in 3.1 Active Directory must be followed before installing Identikey Server.
ODBC Database
If Identikey Server will use the embedded PostgreSQL database as its data store, no specific database setup is required before installing Identikey Server.
If Identikey Server will use another ODBC database as its data store, then follow the steps in 3.2 ODBC Database before installing Identikey Server.
3.1 Active Directory
3.1.1 Checklist – Decisions
The following checklist contains the key decisions to make before you start:
Approve the Schema ExtensionsIf your company has an approval process to go through for extensions to the Active Directory Schema, then go through this process.
Enterprise Root Certificate ServerIf a new Certificate Server is required, and your company requires an approval process to be followed to install one, go through this process.
Identify the Digipass Configuration DomainEither identify an existing Domain or sub-domain into which the Digipass Configuration Container
Set Up Data Store for Identikey Server
If you are installing with the purpose of going through a basic evaluation process, installing onto a Domain Controller is recommended. This will mean that SSL will not need to be set up in order for the Identikey Server to function.
3.1.2 Active Directory Setup
Run the addschema command to extend the Active Directory schema:
1. Log into the Schema Master as a member of the Schema Administrators group.
2. Copy dpadadmin.exe from the CD-IMAGE\Software\Windows\X86 or amd64\Utilities\dpadadmin installation directory on the installation CD onto the Schema Master
3. Open a command prompt in the location to which it was copied.
4. Type:
dpadadmin addschema -v
5. If DPADadmin detects that Schema extensions are not currently permitted, it will prompt you whether to enable them or not. Enter y to enable them, or n to cancel.
6. Wait several minutes for the Schema extensions to replicate to all the domains and for the local Domain Controller to update its internal data caches.
3.1.3 SSL Setup
The Identikey Server can use SSL when communicating with Active Directory. For this to work correctly, an Enterprise root Certificate Authority must exist in the forest. It may be installed on any server in the forest, if the server selected is available to the Domain Controller(s) used by the Identikey Server.
Alternatively, an option is provided during installation to not use SSL in communications between the Identikey Server and Active Directory. If LDAP SSL will be disabled, no Certificate Authority is required.
1. If not already available, install Certificate Services on the selected machine. This is a Windows component - you may need access to the original Windows installation files or CD/DVD.
2. Generate the Enterprise root CA certificate.
3. You may need to wait several minutes to allow the Domain Controllers to enrol for Domain Controller certificates.
3.2 ODBC Database
The following steps must only be followed if Identikey Server will be using an ODBC database other the embedded PostgreSQL database as its data store.
If Identikey Server will be using the embedded database, setup is automatic during installation and configuration.
3.2.1.1 Checklist – Decisions
The following checklist contains the key decisions to make before you start:
Database Location and SetupA number of decisions may be required for the ODBC database to be used:
The server on which the database will be located.
Will the data for the Identikey Server will be stored in a new database, or added to an existing database?
Will a new schema be used?
New DatabaseDecide the collation sequence to be used – for example, case-sensitivity.
Database User AccountsCreate or select database user accounts for:
Modifying the database schema (database administrator account required).
Identikey Server (see the Administrator Reference for details on the permissions required).
3.2.1.2 Modify Database Structure
DPDBADMIN Utility
If the embedded ODBC database is not being used, the addschema command must be run to set up the required schema in the database to be used for Identikey Server.
Set Up Data Store for Identikey Server
Ensure that the User ID and password used are that of the database administrator account.
For further details on DPDBADMIN, see 14 Extend Data Store Schema . Permissions
If the database user account used by the Identikey Server is not the owner of the tables and is not a database administrator account, it must be granted permissions for the tables, or ownership of the tables transferred.
Note
Ensure that it is possible for the account(s) mentioned to reference the tables by name without a schema prefix. If this cannot be done, see the Administrator Reference for advanced setup instructions.
3.3 Serial Number and Maintenance ID
You must have a product Serial Number and a company Maintenance ID unless you are installing an evaluation version of Identikey Server. If these have not been issued to you, contact your VASCO supplier.
4 Start Identikey Server Installation
The installation program will guide you through installing Identikey Server and the initial configuration necessary to get it operational. It will launch one or more Windows Installers (MSI) followed by the Identikey Server Configuration Wizard.
Note
If you are running the installation on Microsoft Windows Vista or Microsoft Windows 2008 core, the windows shown in this guide may look slightly different to those displayed onscreen, but the procedure will be the same.
Image 1: Identikey Server Installation Welcome Window
Start Identikey Server Installation
Image 2: Identikey Server Installation Welcome Window 3. Click Next to continue.
The three subsequent chapters cover the three types of installation scenario. Choose the instructions to follow depending on which type of installation you wish to perform:
Basic installation, using the embedded PostgreSQL database as data store – see 5 Install Identikey Server in Basic Mode – ODBC
Advanced installation, using an ODBC-compliant database as data store – see 6 Install Identikey Server in Advanced mode - ODBC
Advanced installation, using Active Directory as data store – see 7 Install Identikey Server - Active Directory
5 Install Identikey Server in Basic Mode – ODBC
There are two installation modes available - Basic and Advanced. If you do not wish to use default installation and configuration settings, follow the instructions in 6 Install Identikey Server in Advanced mode - ODBC .
5.1 Basic Installation Mode
Basic Installation will install the following:
Identikey Server PostgreSQL database Administration Web Interface Apache Tomcat
Java JRE
Message Delivery Component (MDC) Audit Viewer
After the Identikey Server has been installed the Configuration Wizard will be started up in Basic mode, which means that there will be limited configuration choices, with many settings set to default values.
Note
Only the embedded PostgreSQL database is available in Basic Installation mode.
Basic Installation is NOT available on 64-bit Windows.
Install Identikey Server in Basic Mode – ODBC
5.2 Basic Installation
1. The Installation Type window will be displayed.
Image 3: Identikey Server Installation - Installation Type Window 2. Click Perform a basic installation.
3. Click Next.
The End-User License Agreement screen will be displayed.
Image 4: Identikey Server Installation -License Agreement Window 4. Read the agreement carefully.
5. To accept the License Agreement, check the box I accept the terms in the License Agreement and click Next.
If you do not accept the License Agreement, and click Cancel, the install will terminate.
The Select Installation Path window will be displayed.
Install Identikey Server in Basic Mode – ODBC
Image 5: Identikey Server Installation - Select Installation Path Window
6. If you want to install the Identikey Server somewhere other than the default location, use the browse button to indicate where.
7. Click Next to continue.
The Installation Progress window will be displayed.
Image 6: Identikey Server Installation - Installation Progress Window 8. Click on Install.
The Identikey Server installation will begin.
Install Identikey Server in Basic Mode – ODBC
Image 7: Identikey Server Installation - Installation Progress Window
The Installer will install each component in turn, checking each one off on the Installation Progress window as it goes.
Image 8: Identikey Server Installation - Installation Progress Window - PostgreSQL
When the Installer gets to the Run configuration Wizard step, the Identikey Server Configuration Wizard will be started automatically. The Installer runs a contracted version of the wizard, which uses default values for some settings.
Install Identikey Server in Basic Mode – ODBC
Image 9: Identikey ServerConfiguration Wizard - Start Window 9. Click Next to continue.
The IP Address window will be displayed.
Image 10: Identikey ServerConfiguration Wizard - IP Address Window 10. Enter the IP address for the Identikey Server.
11. Click Next.
The First Administrator window will be displayed.
Install Identikey Server in Basic Mode – ODBC
Image 11: Identikey ServerConfiguration Wizard - First Administrator Window 12. Enter a User ID and Password. Confirm the password and click Next.
Image 12: Identikey ServerConfiguration Wizard - License Window
13. Navigate to a license file using the ... button, or click Request a license from 'vasco.com'.
Note
The 'Request a License from vasco.com' button will not be available for Windows 2008 Core, as there is no browser available to load the web site. To obtain a license from vasco.com for Windows 2008 Core you will have to download the license on another machine and copy it across to the Windows 2008 Core machine.
Image 13: Identikey ServerConfiguration Wizard - Server Functionality Window
The functionality that is permitted by your current license is selected by default.
14. Click to de-select any functions not required.
15. Click Next to continue.
Install Identikey Server in Basic Mode – ODBC
Image 14: Identikey ServerConfiguration Wizard - Server Certificate Window 16. Enter a Password for the Server Certificate and confirm it.
17. Click Next to continue.
Image 15: Identikey ServerConfiguration Wizard - RADIUS Topology Window
18. Select the format of RADIUS topology required.
19. Click Next to continue.
If you selected Identikey Server as a standalone RADIUS server, fill in the details of the RADIUS client and click Next to continue.
If you selected Identikey Server in front of RADIUS server, fill in the details of the RADIUS client and RADIUS server and click Next to continue..
Image 16: Identikey Server Configuration Wizard - RADIUS Client Window
Install Identikey Server in Basic Mode – ODBC
Image 17: Identikey Server Configuration Wizard - RADIUS Backend Window The Summary window will be displayed.
Image 18: Identikey Server Configuration Wizard Summary Window
20. A summary of the settings will be displayed. Click Proceed to continue.
Image 19: Identikey Server Configuration Wizard - Completion Window
During the deployment of the Administration Web Interface, the Installer will deploy the Administration Web Interface application to the Apache web server using the Identikey Server certificate. The Identikey Server Certificate file will be generated during installation and will be placed in the certificate store file with the default password "ikwebpassword". The location of the server certificate files is \<install
directory>\bin\ikeycerts.pem and \<install directory>\bin\ikeypvk.pem (Public and Private certificates respectively) The location of the certificate keystore is \<install directory>\webadmin\keystore.jks 21. Click Finish to complete the configuration.
The Import DPX files window will be displayed.
Install Identikey Server in Basic Mode – ODBC
Image 20: Import DPX Files Window
22. The Import DPX Files step is optional. To bypass this step, click Next to continue.
To import a DPX file:
a. Enter the location of the DPX file, or click Browse to navigate to the file.
b. Enter the Transport Key, which will be supplied by VASCO to accompany the DPX file.
c. Enter the User ID, password and Server IP for the Identikey Server that is being installed.
d. Click Import to install the DPX file.
When installation is complete, the Installation Complete window will be displayed.
Image 21: Identikey Server Installation Complete Window
Install Identikey Server in Basic Mode – ODBC
23. Click Finish when the installation is complete.
Note
The Embedded Database, embedded Apache Tomcat, and Deploy Web Administration in Apache Tomcat options are NOT available with 64-bit Windows.
6 Install Identikey Server in Advanced mode - ODBC
Advanced Installation allows you to customize your installation and configuration in detail. If you wish to use only default installation and configuration options, see 5 Install Identikey Server in Basic Mode – ODBC .
6.1 Advanced Installation
The first window to be displayed will be the Install Type window.
Image 22: Identikey Server Select Installation Type Window 1. Select the Advanced installation option button.
Install Identikey Server in Advanced mode - ODBC
Image 23: Identikey Server Installation - Data Storage Window 3. Select the ODBC Database option button.
4. Click Next.
The Select Components window will be displayed.
Image 24: Identikey Server Installation – Select Components Window 5. Click the Identikey Server 3.1 button.
The Identikey Server Setup Wizard start window will be displayed.
6. Click Next to continue.
The License Agreement screen will be displayed.
Install Identikey Server in Advanced mode - ODBC
Image 25: Identikey Server Installation – License Agreement Window 7. Read the agreement carefully.
8. To accept the License Agreement, check the box I accept the terms in the License Agreement and click Next.
If you do not accept the License Agreement, and click Cancel, the install will terminate.
The next screen to be displayed will be the Custom Setup Window.
9. Select the features that you want to be installed by clicking on the icons on the window. Click the Reset button to reset all your choices.
10. Click Next to continue.
Image 26: Identikey Server Installation – Custom Setup window The Ready to Install Identikey Server window will be displayed.
11. Click Install to continue.
The Installing Identikey Server progress window will be displayed.
Install Identikey Server in Advanced mode - ODBC
Image 27:Identikey Server Installation – Ready to Install Identikey Server window 12. Click the Next button to continue when it becomes available.
Image 28: Installing Identikey Server progress window
13. Click Finish to complete the installation of Identikey Server.
The Identikey Server Setup Wizard finish window will be displayed.
Install Identikey Server in Advanced mode - ODBC
Image 29: Identikey Server Setup Wizard Completed window
14. The Installer will install the component for each button that is selected. Each installation after the Identikey Server install is optional.
Image 30: Identikey Server Installation - Select Components window
15. When the Installer gets to the Run configuration Wizard step, click the Run Configuration Wizard button and the Identikey Server Configuration Wizard will be started.
Install Identikey Server in Advanced mode - ODBC
Image 31: Identikey Server Configuration Wizard - Start Window 16. Click Next to continue.
The Select Database window will be displayed.
Image 32: Identikey Server Configuration Wizard - Select Database Window
17. Select Embedded database to use the default ODBC database, or Other ODBC-compliant database to use a different ODBC database. If this option is selected, an ODBC-compliant database must exist before installation of Identikey Server.
If the Other ODBC-compliant database option has been selected, the Database window will be displayed.
Image 33: Identikey Server Configuration Wizard - Database Window
a. Enter the ODBC Data Source name for the database that Identikey Server will use, and if required, a Username and Password.
b. Click Next to continue.
The Master Domain window will be displayed.
Install Identikey Server in Advanced mode - ODBC
Image 34: Identikey Server Configuration Wizard - Master Domain Window
18. Enter the name of the Master Domain where the first administrator account will be created.
19. Click Next to continue.
The User ID/Domain conversion window will be displayed.
Image 35: Identikey Server Configuration Wizard - User ID/Domain conversion Window 20. Select the Case conversion format that you require.
21. Tick the Use Windows Name Resolution checkbox to enable Identikey Server to use Windows Name Resolution. This is recommended if Dynamic User Registration is to be enabled.
22. Click Next to continue.
The IP Address window will be displayed.
Install Identikey Server in Advanced mode - ODBC
Image 36: Identikey Server Config IP Address Window 23. Enter the IP address for the Identikey Server.
24. Click Next to continue.
The First Administrator window will be displayed. The first administrator account can be used to login to Identikey Server (e.g. using the webadmin) and will have a full set of administrative privileges.
Image 37: Identikey Server First Administrator Window
25. The Sensitive Data Encryption window will be displayed.
Install Identikey Server in Advanced mode - ODBC
Note
If you will be using a custom encryption key for sensitive data, this should be set before Digipass are imported to the 'live' version of the Identikey Server. See the Sensitive Data Encryption topic in the Administrator Reference for more information.
26. Selecting the Custom with embedded and custom key combination option will result in the Custom Data Encryption windown being displayed.
Image 39: Identikey Server Custom Data Encryption Window
If you select the Load From File option the Load From File window will be displayed.
Image 40: Identikey Server Load Data Encryption Window
27. With either of the above screens, click Next. The License window will be displayed.
Install Identikey Server in Advanced mode - ODBC
28. Navigate to a licence file using the ... button, or click Request a licence from 'vasco.com'
Note
The Request a Licence from 'vasco.com' button will not be available for Windows 2008 Core, as there is no browser available to load the web site. To obtain a licence from vasco.com for Windows 2008 Core you will have to download the licence on another machine and copy it across to the Windows 2008 Core machine.
Image 42: Identikey Server Configuration Wizard Server Functionality Window
29. The functions that are available on the Server Functionality window will be determined by your license. Click in the check box to either select or de-select an available function. Click Next to continue.
Image 43: Identikey Server Configuration Wizard Server Certificate Window
30. Select which SSL Server Certificate you want to use with Identikey Server. Click Next to continue.
Install Identikey Server in Advanced mode - ODBC
31. Enter a password foir the SSL Server Certificate and confirm it. Click Next to continue.Image 45: Identikey Server SSL Server Certificate Selection
32. If you want to use private SSL Server Certificate details, enter them on the SSL Server Certificate Selection window. Click Next to continue.
Image 46: Identikey Server Web Admin Client Window
33. Enter the IP address of the location of the Web Administration Client.
Install Identikey Server in Advanced mode - ODBC
34. Enter the IP address of a web client to be used by the Sample Web Pages in the SDK. This page is optional and only needs to be used if the SDK is to be installed.
Image 48: Identikey Server Configuration Wizard Summary Window
35. A summary of the settings will be displayed. Click Proceed to continue.
Image 49: Identikey Server Install Wizard Completion Window 36. Click Finish to complete the configuration.
37. Click on the Deploy Web Admin button to install the Web Administration module if required.
Install Identikey Server in Advanced mode - ODBC
38. Enter or browse to the location of the Identikey Server Certificate.
Enter of browse to the location of the Web Administration key-store.
Enter and confirm the key-store password.
Click Deploy to continue.
Image 51:Deploying Identikey Server Web Administration Module Window
39. The Web Administration Module will now be deployed. Enter a Key store password and confirm it. Click Deploy and the Web Administration Module will be installed automatically. Click Cancel to stop the Web Administration Module from being installed.
Image 52:Deploying Identikey Server Web Administration Module Wizard Results Window 40. Check the Result field and click Close to continue or Cancel to exit the Installer.
41. The Select Components window will be displayed showing which components have been installed.
Install Identikey Server in Advanced mode - ODBC
Image 53:Select Components completed Window
42. Click Next to continue. The Installation Completed window will be displayed.
Image 54:Installation Report page
Install Identikey Server in Advanced mode - ODBC
Note
The Embedded Database, embedded Apache Tomcat, and Deploy Web Administration in Apache Tomcat options are NOT available with 64-bit Windows.
7 Install Identikey Server - Active Directory
7.1 Active Directory Scenario and Decisions.
This 'typical installation' process uses the following decisions and scenario:
Implementation Decisions
The following decisions were taken for the purposes of this installation process:
The Schema extensions have been approved.
The Digipass Configuration Domain has been identified as the existing sub-domain, test.dm3.vasco.
The member server SVR of the sub-domain test.dm3.vasco will be used to install Identikey Server. This requires an Enterprise Certificate Authority to be installed in the forest, so that SSL is enabled. The instructions will take you through installing Windows Certificate Services onto a Domain Controller in the Forest Root domain.
The scenario
A Domain dm3.vasco (this is the Forest Root Domain).
A sub-domain test.dm3.vasco of dm3.vasco. The sub-domain acts as the Digipass Configuration Domain and contains all the configuration data, including Policies and Components.
A single Server SVR, a member server in the Digipass Configuration Domain.
A Domain Controller DC-02 acting as the Schema Master on dm3.vasco.
Certificate Server will be installed on DC-02.
7.1.2 Extend Schema
Run the addschema command:
1. Log into the machine from which schema changes will be made (DC-02).
2. Copy dpadadmin.exe onto the machine.
Install Identikey Server - Active Directory
dpadadmin checkschema
7.2 Install Identikey Server for Active Directory.
1. The Installation Type window will be displayed.
Image 55: Identikey Server Setup - Installation Type window
2. Click on the Advanced installation option button. Click Next to continue. The Data Storage window will be displayed.
Image 56: Identikey Server Setup - Data Storage window 3. Select the Active Directory option button.
4. Click Next.
5. The Digipass Extension for Active Directory Prerequisites page will be displayed. The functions on this page are optional, and need only be used if Digipass and Digipass User administration is to be performed on this machine.
Install Identikey Server - Active Directory
Image 57: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window
6. If you wish to use the Digipass Extension for Active Directory Users and Computers on this machine:
a. If the .NET 2.0 Framework is to be installed, click the .NET 2.0 Framework button.
The Microsoft .NET Framework 3.0 SP1 Setup window will be displayed.
i Read the license and click to either accept or not accept the terms.
ii Click Install to continue or Cancel to cancel the set up.
Image 58: Microsoft .NET license agreement.
b. If the MMC 3.0 Framework is to be installed, click the MMC 3.0 Framework button.
Install Identikey Server - Active Directory
Image 59: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites window.
The Software Update Installation Wizard for your operating system will be displayed.
i Click Next to continue.
The Digipass Extension for Active Directory Prerequisites window will be displayed, showing the results of the installations.
ii Click Next to continue.
Image 60: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation complete window.
c. If the Identikey Server is being installed on Microsoft Windows Vista or Microsoft Windows 2008, a hotfix provided by Microsoft must be installed to enable the Active Directory Users and Computers extension to work. If it is not already installed on the machine, the Active Directory Query Form Hotfix button will be enabled. Click this button to install the hotfix.
Please note that the Active Directory Query Form Hotfix button will remain unavailable on any operating system other than Microsoft Windows Vista or Microsoft Windows 2008.
Install Identikey Server - Active Directory
Image 61: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites installation hotfix window.
i Click OK to install the hotfix.
Image 62: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix installer window.
The result will be shown on the Digipass Extension for Active Directory Prerequisites window.
7. Click Next to continue.
Install Identikey Server - Active Directory
Image 63: Identikey Server Setup - Digipass Extension for Active Directory Prerequisites hotfix applied window.
The Select Components window will be displayed.
8. Click Identikey Server 3.1 to start the installation wizard.
Image 64: Identikey Server Setup - Select Components Window
9. The Identikey Server Setup Wizard start window will be displayed. Click Next to continue.
Install Identikey Server - Active Directory
Image 65: Identikey Server Setup Wizard Start Page.
The License Agreement screen will be displayed.
Image 66: Identikey Server Setup - License Agreement Window 10. Read the agreement carefully.
11. To accept the License Agreement, tick the I accept the terms in the License Agreement checkbox and click Next.
If you do not accept the License Agreement, and click Cancel - the install will terminate.
12. To select the features that you want to be installed click on the icons on the window.
Click the Reset button to reset all your choices.
Click Next to continue.
Install Identikey Server - Active Directory
Image 67: Identikey Server Setup - Custom Setup window
13. The Ready to Install Identikey Server window will be displayed. Click Install to continue.
Image 68: Identikey Server Setup - Ready to Install Identikey Server window The Installing Identikey Server progress window will be displayed.
14. Click the Next button to continue when it becomes available.
Install Identikey Server - Active Directory
Image 69: Installing Identikey Server progress window
The Identikey Server Setup Wizard finish window will be displayed.
15. Click Finish to complete the installation of Identikey Server .
Image 70: Identikey Server Setup Wizard finish window
16. The Installer will install the component for each button that is selected. Each installation after the Identikey Server install is optional.
Install Identikey Server - Active Directory
Image 71: Identikey Server Installed – Select Components
17. When the Installer gets to the Run Configuration Wizard step, click the Run Configuration Wizard button.
The Identikey Server Configuration Wizard will be started.
Image 72: Identikey Server Configuration Wizard Start Window 18. Click Next to continue.
The Active Directory pre-requisites window will be displayed.
19. Read the information and make sure all the pre-requisites have been met before clicking Next.
Install Identikey Server - Active Directory
Image 73: Identikey Server Configuration Wizard - Active Directory Pre-requisites Window
20. If this is not the first Identikey Server to be installed, tick the This is NOT the first Identikey Server to be installed check box. Wait for the Active Directory changes made during the installation of the first Identikey Server to replicate fully. You must be logged into the machine as a Domain Administrator in the machine’s Domain.
21. Click Next.
The Digipass Configuration Domain window will be displayed.
22. Enter the fully qualified name of the Domain in which Identikey Server should store its configuration data.
This domain must currently exist.
Image 74: Identikey Server Configuration Wizard – Digipass Configuration Domain Window 23. Click Next.
The Active Directory Certificate Authority window will be displayed.
Install Identikey Server - Active Directory
24. Click on the Disable LDAP SSL option box if you want to disable LDAP SSL.
25. Click Next to continue.
The IP address winow will be displayed.
Image 76: Identikey Server Configuration Wizard – IP Address Window 26. Enter the IP address for the Identikey Server.
27. Click Next to continue.
Image 77: Identikey Server Configuration Wizard – First Administrator Window
28. Enter a User ID and Password for the First Administrator. Confirm the password and click Next.
The Sensitive Data Encryption window will be displayed.
Install Identikey Server - Active Directory
Image 78: Identikey Server Configuration Wizard – Sensitive Data Encryption Window
Note
If you will be using a custom encryption key for sensitive data, this should be set before Digipass are imported to the 'live' version of the Identikey Server. See the Sensitive Data Encryption topic in the Administrator Reference for more information.
29. To use Identikey Server's standard encryption settings:
a. Select the Standard with embedded key option button b. Click on Next.
To use custom encryption settings, either:
Image 79: Identikey Server Configuration Wizard – Custom Data Encryption Window a. Select the Custom with embedded and custom key combination option button.
b. Enter the Storage key.
c. Select a cipher.
OR
Install Identikey Server - Active Directory
Image 80: Identikey Server Configuration Wizard – Load Data Encryption Window
a. If you have created your own Data Encryption file, select the Load from file option button.
b. Browse to the file in this window.
c. Enter the password.
30. Click Next.
The License window will be displayed.
Image 81: Identikey Server Configuration Wizard – License Window
31. Navigate to a license file using the ... button, or click Request a licence from 'vasco.com'.
Note
The Request a License from 'vasco.com' button will not be available for Windows 2008 Core, as there is no browser available to load the web site. To obtain a licence from vasco.com for Windows 2008 Core you will have to download the licence on another machine and copy it across to the Windows 2008 Core machine.
32. Click Next.
Install Identikey Server - Active Directory
Image 82: Identikey Server Configuration Wizard – Server Functionality Window
The functions that are available on this window will be determined by your license. Those shown above are available by default.
33. Click in check boxes to either select or de-select the required functionality.
34. Click Next to continue.
The SSL Server Certificate Installation window will be displayed.
Image 83: Identikey Server Configuration Wizard – SSL Server Certificate Window 35. To use an SSL certificate generated by the Configuration Wizard:
a. Select the Generate and install a new test certificate option button.
b. Click on Next.
Install Identikey Server - Active Directory
Image 84: Identikey Server Configuration Wizard – SSL Server Certificate Password Window c. Enter a password for the new certificate.
To use a commercial SSL Server Certificate:
a. Select the Install my own SSL certificate option button.
b. Click on Next.
Image 85: Identikey Server Configuration Wizard – SSL Server Certificate Selection Window c. Browse to the certificate file.
d. Enter the password for the certificate.
e. Browse to the trusted certificates file.
36. Click Next to continue.
The Web Admin Client window will be displayed.
Install Identikey Server - Active Directory
Image 86: Identikey Server Configuration Wizard – Web Admin Client Window 37. Enter the IP address of the Web Administration Client.
Click Next to continue.
The Sample Web Client window will be displayed.
Image 87: Identikey Server Configuration Wizard – Sample Web Client Window
38. Enter the IP address of a web client to be used by the Sample Web Pages in the SDK. This page is optional and only needs to be used if the SDK is to be installed.
39. Click on Next.
A summary of the settings will be displayed.
Install Identikey Server - Active Directory
Image 88: Identikey Server Configuration Wizard – Summary Window 40. Check the settings carefully, then click Proceed to continue.
Image 89: Identikey Server Configuration Wizard – Completion Window 41. Click Finish to complete the configuration.
Image 90:Deploying Identikey Server Web Administration Module Window The Web Administration Module, if installed, will now be deployed.
42. Enter a Key store password and confirm it.
43. Click Deploy.
The Web Administration Module will be installed automatically. Click Cancel to stop the Web Administration Module from being installed.
Install Identikey Server - Active Directory
44. Check the Result field and click Close to continue or Cancel to exit the Installer.
If you clicked Close the Installation Completed window will be displayed
Image 92: Identikey Server Installation Complete Window 45. Click Finish when the installation is complete.
Note
The Embedded Database, embedded Apache Tomcat, and Deploy Web Administration in Apache Tomcat options are NOT available with 64-bit Windows.
7.2.1 Install Active Directory Users and Computers Extension on a Child Domain
To install the Active Directory Users and Computers Extension on a child domain follow the instructions below.
1. Install Identikey Server on the machine with the parent domain.
2. Log in to the child domain machine, making sure you have administration authority.
3. On the child domain machine, run the Identikey Server installation as detailed above until you get to the Custom Setup window. When you get to this window uncheck every component EXCEPT the Active Directory User and Computers extension.
Image 93: Identikey Server Installation Custom Setup Window.
4. Continue with the Identikey Server Installation instructions from the Custom Setup window as detailed above.
After the installation has finished you will see the Active Directory Users and Computers item on the Start Menu under VASCO\Identikey Server.
Install Identikey Server - Active Directory
Image 94: Windows Start Menu showing location of Active Directory Users and Computers.
8 Deploy Identikey Server Web Administration
8.1 Deploy Administration Web Interface on the same machine as Identikey Server
The Administration Web Interface is provided as a .war (web archive) file, webadmin.war. This web application must be deployed in a Java web application server before it can be used.
If the Administration Web Interface and the embedded Tomcat server is installed with Identikey Server, the Administration Web Interface will be deployed automatically by the Configuration Wizard.
8.1.1 Deploy Administration Web Interface in Apache Tomcat Server (32-bit Windows only)
If the Administration Web Interface is not installed at the same time as the Tomcat server, the setup program can still deploy it automatically in an installed Tomcat server.
To deploy the Administration Web Interface in an Apache Tomcat server:
1. Run the setup.exe file if it is not still running..
2. Click on 6. Deploy Web Administration in Apache Tomcat.
3. Enter the location of the Identikey Server certificate if it differs from the default.
4. Enter the location of the Administration Web Interface keystore if it differs from the default.
5. Enter and confirm a new password for the keystore.
6. Click on Deploy.
8.1.2 Deploy Web Administration Interface in Apache Tomcat Server – Manual Instructions
The following instructions may be used where deployment via the setup program has failed:
1. If you have not restarted the machine since installing, the Tomcat service may need to be started manually:
a. Go to the desktop.
b.
