Chat now with support
Chat with Support

Enterprise Single Sign-On 8.0.6 - Installation Guide

1. Overview 2. Preparing the Storage of Security Data in the LDAP Directory
2.1 Active Directory 2.2 Active Directory + ADAM or AD LDS 2.3 OpenLDAP 2.4 Netscape iPlanet / Sun Java System / Red Hat / Fedora Directory Server 2.5 Novell eDirectory 2.6 IBM Tivoli Directory Server 2.7 Deploying a Workstation LDAP User Account
3 Installing Quest ESSO Controllers and Audit Databases 4 Installing and Configuring the Software Modules on the Workstations 5 Enabling the Self Service Password Request (SSPR) Capability 6. Enabling OTP Authentication 7 Enabling the Group Membership Modification Feature 8 Centralizing Parameters Using Group Policy Objects (GPO) 9 Installing Quest ESSO MSI Packages in Silent Mode Appendix A: Advanced Configuration: Audit Appendix B: Activating Traces Appendix C: Retrieving the Serial Number on a MiFARE RFID Badge

4.4 Installing French Healthcare Smart Cards (CPS)

Subject
If you are using CPS smart cards, you must install the CPS smart card middleware on every client workstation that will be using it.
Procedure
1.
Start the Administration Tools window (see 3.1, "Starting the Administration Tools window").
2.
In the Select a task list, select Install software modules.
3.
In the Software Installation task list, click Install French Healthcare (CPS) smart cards.
If the CPS installation wizard does not appear: from the downloaded installation package browse the INSTALL directory and double-click ESSOCPS.msi.
The CPS installation wizard appears.
4.
Follow the displayed instructions.
The CPS smart card middleware is installed as a Windows service.

4.5 Installing Finger Vein Biometric Drivers

Subject
If you are using Hitachi finger vein biometrics, you must install finger vein biometric drivers on every client workstation that will be using it.
Procedure
1.
Start the Administration Tools window (see 3.1, "Starting the Administration Tools window").
2.
In the Select a task list, select Install software modules.
3.
In the Software Installation task list, click Install finger vein biometric drivers.
If the installation does not starts: from the downloaded installation package browse the DRIVERS directory and double-click BioHitachi_Install.exe.
The installation proceeds.

4.6 Modifying the Possible Domains List

Subject
Upon the Quest ESSO installation process in multi-domain mode, you may need to modify the list of possible domains displayed by the authentication windows of Quest ESSO workstation clients. The following procedure describes how to modify the possible domains list.
Restrictions
Only for Quest ESSO in multi-domain mode with Active Directory or Active Directory/ADAM (or Active Directory/AD LDS) architectures.
Procedure
1.
On the wanted Quest ESSO Controller, start Registry Editor.
2.
In the HKLM\Software\Enatel\WiseGuard\FrameWork\Directory, add the following value:
Value Type
Value Name
Value
String
PossibleDomainsList
Domain1 [...] DomainN.

5 Enabling the Self Service Password Request (SSPR) Capability

Subject
Depending on your corporate security policies, you may need to allow end-users to reset their password connected to a Self Service Password Request server. This server allows end users to reset their primary password either using the SOS button (or I have forgotten my password on Windows Seven) of Advanced Login (if installed on workstations) and/or the Self Service Admin Portal.
This section describes how to install and activate the Self Service Password Request (SSPR) capability, from downloaded Quest ESSO installation package. You can install these components on any supported Windows systems.
Interactive/Silent Mode Installation
The Self Service Password Request (SSPR) capability is delivered as installation packages using the Microsoft Windows Installer (MSI) format.
You can install this package:
•
In interactive mode: follow the instructions of the installation wizard, as described in the following procedure.
•
In silent mode: command line options allow you to specify installation options for each of the installation packages: see 9., "Installing Quest ESSO MSI Packages in Silent Mode".
The silent installation can only be used for updating the web server: the MSI does not include the Apache server installation, which is a prerequisite for the Self-Service Password Request and the Quest ESSO API.
Before Starting
The Self Service Password Request (SSPR) capability requires a dedicated user account to perform operations in the directory. This account must exist before starting the installation procedure, as the wizard will prompt you for account credentials. The following procedure details how to create and configure this account:
From a workstation where Quest ESSO Console is installed, do the following:
•
Create or select in your directory a user account that will be used exclusively for the Self Service Password Request (SSPR) capability.
Enable the Password never expires option for this account.
•
If you start Quest ESSO Console in hardware protection mode, assign a smart card to this user account using Quest ESSO Console, with the following guidelines (this card will be used by the Quest ESSO Security Services to enable the Self Service Password Request (SSPR) capability):
•
The assigned smart card must not expire.
•
The owner of this token must have the Delegate the right to retrieve SSO data administration right.
•
The user must have authenticated at least once on Quest ESSO; so that specific administration rights to manage Self Service Password Request (SSPR) can be delegated to him/her:
•
In classic administration mode: SSO Data Recoverer administration role.
•
In advanced administration mode:
•
Self Service Password Request: Answer deletion
•
Self Service Password Request: Challenge generation
•
Self Service Password Request: Reset attempt counter
•
User:password modification.
Restrictions
•
If you have downloaded the installation packages, do not start the following procedure from a network drive: copy the installation packages locally before starting the installation.
•
Check that port 80 is not used.
Procedure
1.
If you have chosen the Hardware protection mode at Quest ESSO primary controller initialization (see 3.3, "Initializing the Primary Controller"), install the driver for your smart card reader.
2.
Start the Administration Tools interface, as described in 3.1, "Starting the Administration Tools window".
If you want to install a standalone Quest ESSO SSPR Web server on a 64-bit environment, where no other Quest ESSO package (client or controller) is installed and will never be installed, you must select the 32-bit installer.
Use the 64-bit installer only if another Quest ESSO 64-bit package is already installed on the computer.
3.
In the Select a task drop-down list, click Install Self Service Password Request capability:
4.
If you are installing Self Service Password Request (SSPR) on a workstation where no other Quest ESSO software module is running, click Configure workstation and follow the displayed instructions (for details, see 4.1, "Configuring Workstations").
5.
Click Install Quest ESSO Web Server.
You can also start the installation wizard by double-clicking TOOLS\APACHE\WGInstaller.exe.
The following window appears.
If a previous version of the Self Service Password Request (SSPR) is already installed, the wizard prompts you to select the features to be updated.
 
6.
Do the following:
a)
Select the Self Service Password Reset check box.
b)
To use the SSPR server with Advanced Login, select the Web Service check box.
In case of update, you can also start the setup wizard by double-clicking ESSOWebServer.msi. For 32-bit environment, run the 32-bit package located in E-SSO\INSTALL. For 64-bit environment, you can either run the 64-bit package located in E‑SSO.X64\INSTALL, or the 32-bit package, depending on your configuration.
7.
Click the Install (or Update) button to launch installation.
During the installation process, the Apache web server icon appears on the task bar.
This Apache web server runs with the Apache mod_ssl module, PHP (used by the Self Service Admin Portal) and the gSOAP module (used by Advanced Login in connected mode).
 
The Apache web server listens on port 80. That port number cannot be changed.
8.
In the Administration Tools window, click Define administrator credentials for Self Service Password Request.
The following window appears:
9.
Do one of the following, depending on the protection mode you have selected in Section 3.3, "Initializing the Primary Controller":
•
If you have chosen the Software protection mode, select Software credentials and fill-in the Software credentials area with the credentials of the dedicated user account allowed to manage SSPR (see Before Starting above).
•
If you have chosen the Hardware protection mode, select Hardware credentials, insert the SSPR smart card previously created in the smart card reader and provide the PIN for the smart card.
10.
Click OK to register the administrator’s credentials
11.
Declare the users allowed to use the Self Service Password Request (SSPR) capability. For more information, see Advanced Login Self Service Password Request Administrator Guide.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating