Chat now with support
Chat with Support

Password Manager 5.14.3 - Administration Guide

About Password Manager Getting started Password Manager architecture
Password Manager components and third-party applications Typical deployment scenarios Password Manager in a perimeter network Management Policy overview Password policy overview Secure Password Extension overview reCAPTCHA overview User enrollment process overview Questions and Answers policy overview Password change and reset process overview Data replication Phone-based authentication service overview
Management policies
Checklist: Configuring Password Manager Understanding Management Policies Adding or cloning a new Management Policy Configuring access to the Administration Site Configuring access to the Password Manager Self-Service Site Configuring access to the Helpdesk Site Configuring Questions and Answers policy Workflow overview Custom workflows Custom activities Password Manager Self-Service Site workflows Helpdesk workflows Notification activities User enforcement rules
General Settings
General Settings overview Search and logon options Importing and exporting configuration settings Outgoing mail servers Diagnostic logging Scheduled tasks Web Interface customization Instance reinitialization Realm Instances Domain Connections Extensibility features RADIUS Two-Factor Authentication Internal Feedback Customizing help link URL Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable 2FA for administrators and helpdesk users Reporting Password Manager integration Accounts used in Password Manager Open communication ports for Password Manager Customization options overview Glossary

FailSafe support in Password Manager

This feature allows a user to login to Helpdesk or Self-Service Site when Password Manager Service is unavailable.

Helpdesk and Self-Service Site use Password Manager Service to communicate with Active Directory. If Password Manager Service is unavailable, authentication and other such services do not function. For such scenario, Password Manager has a FailSafe feature integrated to connect to other available Password Manager service automatically.

After the initializing the Helpdesk and Self-Service Sites, WcfServiceRealms.xml file is created. This file has records of all the instances of Password Manager Services installed. The user can use one of the realm instances listed in WcfServiceRealms.xml file, in case of unavailability of services in the primary instance of Password Manager Service.

For example, Helpdesk Site is connected to Password Manager service 1. If the Password Manager service 1 is non-functional, with the integrated FailSafe feature, the Helpdesk Site automatically connects to Password Manager service 2 to continue with the tasks uninterrupted. After the Password Manager service 1 is restored, the Helpdesk Site is connected back to the initially connected Password Manager service, that is Password Manager service 1.

NOTE: Failsafe works in distributed environment. If all the Password Manager components are installed on the same server, the FailSafe operation might not work as expected.

NOTE: The Self-Service and Helpdesk Site's URLs must be accessible from Password Manager Service.

Installing multiple instances of Password Manager

Several Password Manager instances sharing common configuration are referred to as a realm. A realm is a group of Password Manager Service instances sharing all settings and having the same set of management policies, that is, the same user and Helpdesk scopes, Q&A policy, and workflow settings. Password Manager realms provide for enhanced availability and fault tolerance.

IMPORTANT: It is not recommended to edit Password Manager settings simultaneously on multiple instances belonging to one realm. Simultaneous modification of settings on multiple Password Manager instances may cause data loss.

To create a Password Manager Realm

  1. Export a configuration file from the instance belonging to the target realm:

    • To export instance settings to the configuration file, connect to the Administration Site of the instance belonging to the target realm.

    • On the menu bar, click General Settings, then click Import/Export.

    • On the Import/Export Configuration Settings page, select the Export configuration settings option and click Export to save the configuration file.

      IMPORTANT: Remember the password that is generated while exporting the configuration file. You should enter this password when importing the configuration file for a new instance you want to join to the target realm.

  2. Install a new Password Manager instance by running Password Manager x86 or Password Manager x64from the installation CD autorun window. For more information on the installation procedure, see Installing Password Manager.

  3. Open the Administration Site by entering the following address: http(s)://<ComputerName>/PMAdmin, where <ComputerName> is the name of the computer on which Password Manager is installed. On the Instance Initialization page, select the Replica of existing instance option.

  4. Click Upload to select the configuration file that you exported from the instance belonging to the target realm.

  5. Enter the password to the configuration file and click Save.

Specifying Custom Certificates for Authentication and Traffic Encryption Between Password Manager Service and Websites

When the Password Manager Service is installed on one computer and the Self-Service and Helpdesk sites are installed on some other computers, certificate-based authentication and traffic encryption is used to protect traffic between these components.

By default, Password Manager uses built-in certificates issued by Password Manager. However, you may want to install and use custom certificates issued by a trusted Windows-based certification authority.

This section provides instructions on how to start using custom certificates for authentication and traffic encryption between Password Manager components.

Complete the following steps:

  1. Step 1: Obtain and install custom certificates from a trusted Windows-based certification authority

  2. Step 2: Providing certificate issued for server computer to Password Manager Service

  3. Step 3: Providing certificate issued for client computers to Self-Service and Helpdesk Sites

Step 1: Obtain and install custom certificates from a trusted Windows-based certification authority

You must obtain two certificates from a trusted Windows-based certification authority: one for the computer running the Password Manager Service (server computer), and another for computers running the Self-Service or Helpdesk Site (client computers).

When obtaining certificates, make sure that:

  • The server computer can be accessed from the client computers by using the server certificate CN.

  • Both is selected as a key usage in a certificate request.

  • Enable strong private key protection option is NOT selected in a certificate request.

The following is a sample procedure describing how to obtain a certificate through the Windows 2012 Certificate Services Web interface.

IMPORTANT: When obtaining a certificate for the server computer, perform the following procedure on a computer where the Password Manager Service runs and use the Password Manager Service account to run a supported web browser.

When obtaining a certificate for the client computers, perform the following procedure on a computer running the Self-Service or Helpdesk Site and use the Application Pool Identity account to run a supported web browser.

To request a certificate

  1. Use a browser to open https://servername/certsrv, where servername refers to the host name of the computer that runs the CA Web Enrollment role service.

  2. On the Welcome page, click Request a certificate.

  3. On the Request a Certificate page, click Advanced Certificate Request.

  4. On the Advanced Certificate Request page, click Create and submit a certificate request to this CA.

  5. Provide identification information as required. In the Name text box, enter the name of the server for which you are requesting a certificate.

  6. In Type of Certificate Needed, select Server Authentication Certificate.

  7. In Key Options, select Create new key set, and specify the following options:

    • In CSP (Cryptographic service provider), select Microsoft Enhanced RSA and AES Cryptographic Provider.

    • In Key Usage, click Both.

    • In Key Size, set 1024 or more.

    • Select Automatic key container name.

    • Select the Mark keys as exportable check box.

    • Clear the Enable strong private key protection check box.

  8. In Additional Options, specify the following:

    • In Request Format, select CMC.

    • In Hash Algorithm, select sha256.

    • Do not select the Save request check box.

    • Specify attributes if necessary and a friendly name for your request.

  9. Click Submit.

  10. On the Certificate Issued web page, click Download certificate chain. Save the file to your hard disk drive, and import it into your certificate store.

For more information on requesting a certificate, see Request a certificate using Certification Authority Web Enrollment on the Microsoft website.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating