Cloud Access Manager 8.1.2 - Installation Guide

Installation

This guide will take you through the steps required to deploy a typical two host production installation of Dell™ One Identity Cloud Access Manager. Once completed, Cloud Access Manager will allow employees to securely Single Sign-On (SSO) to internal and external web-based applications from within the company network and remotely, without the need for a virtual private network (VPN). This example uses two separate hosts, one for the Proxy and the other for the Secure Token Service (STS). The diagram below represents a typical Cloud Access Manager deployment, and shows the proxy host deployed within the DMZ area of the network and the STS host on the internal network.

Figure 1. Two host Cloud Access Manager deployment

Prerequisites

Make sure the following prerequisites are met before you attempt to install Dell™ One Identity Cloud Access Manager, please refer to Proxy host and STS host for component specific requirements.

NOTE: Please be aware that domain controllers are not valid Cloud Access Manager hosts.

1 Supported for Integrated Windows Authentication (IWA).

2 Supported for Cloud Access Manager Administration.

3Internet Explorer® version 9 and above supported for Cloud Access Manager Administration.

Ensure the following prerequisites are met before installation:

To support the scenario illustrated in Figure 1 where you need to expose internal applications to external users, the host should be deployed within the DMZ network.

Ensure that the following hardware requirements are met:

Ensure that the following operating system requirements are met with the latest Microsoft® Hotfixes applied.

You must configure the host to use the internal Domain Name System (DNS) server(s) so that it can resolve the hostnames of the internal web applications that will be configured. In addition to the internal DNS, Dell™ One Identity Cloud Access Manager requires a public DNS record for the proxy host and an additional public DNS record for each internal application.

Each of these DNS records must be resolvable to the proxy’s public IP address from outside of your corporate network. To avoid the need to create a new DNS record each time a new application is added to Cloud Access Manager, we recommend that you create a new wildcard DNS subdomain for Cloud Access Manager to resolve any name within the new subdomain to the public IP address of the proxy.

The host must be assigned a private IP address which is accessible from the internal network. For external access a public IP address is required. This is typically assigned to an internet facing router where destination network address translation (DNAT) or port forwarding is performed to route traffic destined for ports 80 and 443 on a public IP address to the private IP address of the proxy host.

Domain hosting companies typically allow the creation of a wildcard subdomain by adding a new DNS A (Host) record for your domain in the format *.subdomain, where subdomain is the name of the new subdomain you want to create for the Cloud Access Manager Proxy. Point the new DNS record to the public IP address used by the Cloud Access Manager Proxy so that any hostname in the new subdomain resolves to the proxy’s public IP address.

For example, adding a new A record *.webapps to a domain called company.com would allow the Cloud Access Manager Proxy to use hostnames such as:

Essentially <anything>.webapps.company.com, this allows each internal application to have its own internet resolvable hostname.

To create a wildcard subdomain within the Microsoft DNS server you must first add a new subdomain (zone) and then add a single A (Host) record within the subdomain with the name *. As with the previous instructions, the new DNS record should be pointed to the public IP address used by the Cloud Access Manager Proxy so that any hostname in the new subdomain resolves to the proxy’s public IP address.

A signed wildcard Secure Sockets Layer (SSL) certificate is required to cover the wildcard DNS subdomain used by the Cloud Access Manager Proxy. The wildcard SSL certificate must be obtained using the Certificate Signing Request (CSR) generated by Cloud Access Manager during configuration. For example, if you created a wildcard DNS subdomain called webapps within your domain company.com, then you would need to obtain a signed wildcard SSL certificate for *.webapps.company.com for full instructions, please refer to Managing your SSL Certificate in the Dell One Identity Cloud Access Manager Configuration Guide.

Access to TCP ports 80 and 443 on the host should be permitted from both the internal and external network. The host should also be permitted to access the internal web applications through the ports they use, typically TCP port 80 and 443.

Port 8553 is the admin port used to configure the Cloud Access Manager Proxy. The proxy host downloads its configuration and then locally uses port 8553 to load the configuration. Ensure that port 8553 is not already being used by another application. If port 8553 is already in use, enter an alternative port number in the Cloud Access Manager proxy Installation Wizard. This port does not need to be open on the proxy host for Cloud Access Manager to function.

If you enable smart card authentication you will need to open the configured port. The default is port 8443.

The host should be deployed within the internal network.

Ensure that the following hardware requirements are met:

If Active Directory® will be used to source users for SSO, the Security Token Service (STS) host must be a member of the Active Directory domain containing these users. Dell™ One Identity Cloud Access Manager can also use federated identities from third party domains using SAML 2.0 or WS-Federation.

You must configure the host to use the internal Domain Name System (DNS) server(s) so that it can resolve the hostnames of the internal web applications that will be configured.

Ensure that the following database requirements are met:

Dell™ One Identity Cloud Access Manager requires an instance of Microsoft SQL Server 2008 or above, to store its configuration, audit and session data. Microsoft SQL Server Express can also be used for small deployments, for example, where high availability of the database is not required.

Cloud Access Manager can either create its database within a new dedicated instance of Microsoft SQL Server installed directly on the Security Token Service (STS) host, or in an existing remote instance of Microsoft SQL Server deployed within your internal network.

NOTE: If you choose to use a dedicated instance of Microsoft SQL Server on the STS host, ensure that it is installed before you run the Cloud Access Manager installer.

When you install Dell™ One Identity Cloud Access Manager using the Dell Autorun, as described in Installing Cloud Access Manager, the following software is automatically installed. This software is required for support purposes only.

The UI/STS msi will install using Deployment Image Servicing and Management (DISM), (command line in brackets):

If you want to install this software using a local path, rather than the default internet sourcing use the DismSource switch to specify where the Cloud Access Manager bootstrapper will instruct the DISM tool to look for the required files. For example, if the installation CD is in drive D then you could specify:

“Cloud Access Manager Setup.exe" DismSource=d:\sources\sxs

As an example, this will result in a call to DISM similar to the following:

dism.exe /online /enable-feature:Windows-Identity-Foundation /source:d:\sources\sxs

Installing Cloud Access Manager

2	Start the Dell Autorun and navigate to the Install section.

NOTE: The Dell Autorun cannot be used for Cloud Access Manager STS and Proxy host installations running Server Core installations of Microsoft Windows Server. You must run the installer files directly from the command line.

5	Click Production Installation.

NOTE: The account specified must exist prior to installation of Cloud Access Manager. The account credentials entered must be successfully verified before you can proceed with the installation.

7	Click Install to deploy the components required for the STS host.

NOTE: The STS host requires Microsoft® .NET framework version 4.5. If this is not already installed on the host, the installer will download and install .NET framework from the internet.

NOTE: On a Server Core installation you will need to access the configuration wizard from a separate machine. The last page of the Cloud Access Manager install wizard will show the URL for the configuration page.

9	The configuration wizard can take a while to open when accessed for the first time. This is due to Internet Information Services (IIS) initializing and starting the web applications. Please wait while Internet Explorer® opens and displays the Cloud Access Manager Welcome page.

15	Accept the License Agreement and then click Next.

18	Return to the STS host. In the Cloud Access Manager browser window, click Next on the Install the Proxy page.

20	Click Next.

This installation of a typical two host production deployment of Cloud Access Manager is now complete.

Configuring Cloud Access Manager

Now that you have successfully installed Dell™ One Identity Cloud Access Manager, you need to:

Please refer to the Dell™ One Identity Cloud Access Manager Configuration Guide for further information.