Chat now with support
Chat with Support

Password Manager 5.8.2 - Administrator Guide (AD LDS edition)

About Password Manager Getting Started Upgrading Password Manager to 5.8.1 Password Manager Architecture Management Policies
Checklist: Configuring Password Manager Understanding Management Policies Configuring Access to the Administration Site Configuring Access to the Self-Service Site Configuring Access to the Helpdesk Site Configuring Questions and Answers Policy Workflow Overview Custom Workflows Custom Activities Self-Service Workflows Helpdesk Workflows User Enforcement Rules
General Settings Password Policies One Identity Hybrid Subscription One Identity Starling Reporting Appendix A: Accounts Used in Password Manager for AD LDS Appendix B: Open Communication Ports for Password Manager for AD LDS Appendix C: Customization Options Overview Glossary

Steps to Install Password Manager

Steps to Install Password Manager

To install Password Manager

  1. Depending on the hardware, run Password Manager for AD LDS x86 or Password Manager for AD LDS x64 from the autorun window of the installation CD.
  2. Read the license agreement, select I accept the terms in the license agreement, and then click Next.
  3. On the User Information page, specify the following options, and then click Next:
Table 2:  User information details

Option

Action

Full name

Type your name.

Organization

Type the name of your organization.

Licenses

Click this button, and then specify the path to the license file.

A license file is a file with the .ASC extension that you have obtained from your One Identity representative.

  1. On the Custom Setup page, select the components to install, and then click Next.
Table 3:  Installation component details

Option

Description

Full Installation

Select this option to install Password Manager Service and the Administration, Self-Service and Helpdesk sites on this computer.

Self-Service Site

Select this option to install only the Self-Service site.

Helpdesk Site

Select this option to install only the Helpdesk site.

You can install all Password Manager components together on a single server or you can deploy the Self-Service and Helpdesk sites on a standalone server. To learn more about installing the Self-Service and Helpdesk sites on a standalone server, see Installing Self-Service and Helpdesk Sites on a Standalone Server.

  1. On the Password Manager Service Account Information page, specify the name and password for the Password Manager Service account, and then click Next. For more information on the requirements for the Password Manager Service account, see Configuring Password Manager Service Account and Application Pool Identity.
  2. On the Specify Web Site and Application Pool Identity page, select the Web site name and specify the name and password for the account to be used as an application pool identity, and then click Next. For more information on the requirements for the application pool identity, see Configuring Password Manager Service Account and Application Pool Identity.
  3. Click Install.
  4. When the installation is complete, click Finish.

IMPORTANT: By default, Password Manager uses built-in certificates to encrypt traffic between the Password Manager Web sites and Password Manager Service. After installing Password Manager, if the Web sites (Self-Service and Helpdesk) and the Password Manager Service are installed on different computers, it is recommended to replace these certificates. For more information, see Specifying Custom Certificates for Authentication and Traffic EncryptionBetween Password Manager Service and Web Sites.

Extending AD LDS Schema

Extending AD LDS Schema

To use Password Manager with an AD LDS instance, you need to extend the AD LDS schema to include required object class definitions.

When installing a unique AD LDS instance, you must specify the LDAP and SSL port numbers and the application directory partition name. Make sure, you remember the values you enter because you will need to use them when extending the AD LDS schema.

IMPORTANT: When you install an AD LDS instance, in the AD LDS setup wizard select the option to create a new application directory partition and, on the Importing LDIF Files page, select all shown files.

To extend AD LDS schema

  1. On a computer where an AD LDS instance is installed, create a temporary folder.
  2. Copy all files from the Password Manager\Setup\ADLDS Extension folder on the Password Manager installation CD to the folder you created in step 1.
  3. In the temporary folder, modify the prepare_ad_lds.cmd file using any text editor. Replace the port number in the line “SET PORT=50000” with the LDAP port number you specified in the AD LDS setup wizard.
  4. In the temporary folder, modify the data.ldf file using any text editor. Replace all occurrences of the “O=Quest,C=US” with the application directory partition name you specified in the AD LDS setup wizard.
  5. Run the prepare_ad_lds.cmd file.

Instance Initialization

Instance Initialization

After you installed Password Manager on your computer, you need to initialize an instance before you begin to configure a new Management Policy, that is, before configuring the user and helpdesk scopes, Questions and Answers policy, and managing workflows. When initializing a Password Manager instance, you can choose one of the two options: create a unique instance or a replica of an existing instance. When you create the replica of the existing instance, the new instance shares its entire configuration with the existing instance. Password Manager instances sharing the same configuration are referred to as a Password Manager realm. For more information about Password Manager realms, see Installing Multiple Instances of Password Manager.

To initialize Password Manager instance

  1. Open the Administration site by entering the following address: http(s)://<ComputerName>/PMAdminADLDS, where <ComputerName> is the name of the computer on which Password Manager is installed. You can obtain the URL path to the Admin site from your system administrator. On the logon page, enter your user name and password and click Log on. The Instance Initialization page will be displayed automatically.
  2. On the Instance Initialization page, select one of the following options, depending on what type of instance you want to create:
    • Unique instance Creates a new instance.
    • A replica of an existing instance Joins a new instance to a Password Manager realm.
  3. If you have selected the option A replica of an existing instance, follow the instructions provided later in the section “Installing Multiple Instances of Password Manager.
  4. If you have selected the option Unique instance, under Service connection settings, specify the following:
    • Certificate name Select the certificate that was issued for the computer running the Password Manager Service. If you decide to install the Self-Service and Helpdesk sites separately from the Password Manager Service, it is recommended to replace the built-in certificate that is used encrypt traffic between the Service and the sites. For more information, see Specifying Custom Certificates for Authentication and Traffic EncryptionBetween Password Manager Service and Web Sites.
    • Port number Specify the port that the Self-Service and Helpdesk sites will use to connect to the Password Manager Service. By default, port 8085 is used.
  5. Under Advanced settings, specifying the following:
    • Encryption algorithm Specify the encryption algorithm that will be used to encrypt users’ answers to secret questions and other security sensitive information. You can select from two options: Triple DES and AES. By default, Password Manager uses Triple DES algorithm to encrypt data. Note, that users’ answers will be encrypted if the “Store answers using reversible encryption” option is selected in the Q&A Profile settings. Otherwise, the answers will be hashed.
    • Encryption key length Specify whether a 192-bit or 256-bit encryption key will be used.
    • Hashing algorithm Specify the hashing algorithm that will be used to hash users’ answers to secret questions. The following algorithms are available: MD5 and SHA-256. By default, Password Manager uses SHA-256 hashing algorithm. Password Manager will hash users’ answers if “Store answers using reversible encryption” option is not selected in the Q&A Profile settings.
    • Attribute name Enter the attribute of user's account in AD LDS in which user's Questions and Answers profile will be stored. By default, Password Manager stores Q&A profile data in the comment attribute of each user's account and configuration data in the comment attribute of a configuration storage account, which is automatically created when installing Password Manager.

Click Save to complete instance initialization.

Installing Self-Service and Helpdesk Sites on a Standalone Server

Installing Self-Service and Helpdesk Sites on a Standalone Server

Password Manager allows you to install the Self-Service and Helpdesk sites on a standalone server. For example, you can use this installation scenario to deploy Password Manager in a perimeter network (DMZ). For more information see Typical Deployment Scenarios and Password Manager in Perimeter Network.

When deploying Password Manager in a perimeter network, it is recommended to install the Password Manager Service and the sites in a corporate network at first (i.e. use the Full installation option in the Password Manager setup), and then install only the Self-Service site in the perimeter network.

When you use this installation scenario, only one port should be open in the firewall between the corporate network and the perimeter network (by default, port number 8085 is used).

To install Self-Service and Helpdesk sites on a standalone server

  1. Depending on the hardware, run Password Manager for AD LDS x86 or Password Manager for AD LDS x64 from the autorun window of the installation CD.
  2. Read the license agreement, select I accept the terms in the license agreement, and then click Next.
  3. On the User Information page, specify the following options, and then click Next:
    Table 4:  User and license information

    Option

    Action

    Full name

    Type your name

    Organization

    Type the name of your organization

    Licenses

    Click this button, and then specify the path to the license file.

    A license file is a file with the .ASC extension that you have obtained from your One Identity representative.

  1. On the Custom Setup page, select the Self-Service Site and/or Helpdesk Site features, and then click Next.
  2. On the Specify Web Site and Application Pool Identity page, select the Web site name and specify the name and password for the account to be used as application pool identity, and then click Next. For more information on the requirements for the application pool identity, see Configuring Password Manager Service Account and Application Pool Identity.
  3. Click Install.
  4. When installation is complete, click Finish.

After you installed the Self-Service and Helpdesk sites on a standalone server, you need to initialize the sites to start using them.

To initialize the Self-Service site

  1. Open the Self-Service site by entering the following address: http(s)://<ComputerName>/PMUserADLDS, where <ComputerName> is the name of the computer on which Self-Service site is installed. The Self-Service Site Initialization page will be displayed automatically.
  2. In the Computer name or IP address text box, specify the Password Manager Service host name or IP address.
  3. In the Port number text box, specify the port number that the Self-Service site will use to connect to the Password Manager Service.
  4. From the Certificate name drop-down list, select the name of the certificate to be used by this site. By default, Password Manager uses a built-in certificate issued by One Identity. You can specify a custom certificate for authentication and traffic encryption between the Password Manager Service and the Web sites (Self-Service and Helpdesk). For more information on using custom certificates, see Specifying Custom Certificates for Authentication and Traffic EncryptionBetween Password Manager Service and Web Sites.

IMPORTANT: Before selecting a custom certificate on the Self-Service site, specify a custom certificate on the Administration site
  1. Click Save.

To initialize the Helpdesk site

  1. Open the Helpdesk site by entering the following address: http(s)://<ComputerName>/PMHelpdeskADLDS, where <ComputerName> is the name of the computer on which Helpdesk site is installed. The Helpdesk Site Initialization page will be displayed automatically.
  2. In the Computer name or IP address text box, specify the Password Manager Service host name or IP address.
  3. In the Port number text box, specify the port number that the Helpdesk site will use to connect to the Password Manager Service.
  4. From the Certificate name drop-down list, select the name of the certificate to be used by this site. By default, Password Manager uses a built-in certificate issued by One Identity. You can specify a custom certificate for authentication and traffic encryption between the Password Manager Service and the Web sites (Self-Service and Helpdesk). For more information on using custom certificates, see Specifying Custom Certificates for Authentication and Traffic EncryptionBetween Password Manager Service and Web Sites.

IMPORTANT: Before selecting a custom certificate on the Helpdesk site, specify a custom certificate on the Administration site.
  1. Click Save.
Related Documents