立即与支持人员聊天
与支持团队交流

Password Manager 5.13.1 - Administration Guide

About Password Manager Getting Started Password Manager Architecture
Password Manager Components and Third-Party Solutions Typical Deployment Scenarios Password Manager in Perimeter Network Management Policy Overview Password Policy Overview Secure Password Extension Overview reCAPTCHA Overview User Enrollment Process Overview Questions and Answers Policy Overview Password Change and Reset Process Overview Data Replication Phone-Based Authentication Service Overview
Management Policies
Checklist: Configuring Password Manager Understanding Management Policies Configuring Access to the Administration Site Configuring Access to the Self-Service Site Configuring Access to the Helpdesk Site Configuring Questions and Answers Policy Workflow overview Custom workflows Custom Activities Self-Service Workflows Helpdesk Workflows Notification Activities User Enforcement Rules
General Settings
General Settings Overview Search and Logon Options Import/Export Configuration Settings Outgoing Mail Servers Diagnostic Logging Scheduled Tasks Web Interface Customization Instance Reinitialization Realm Instances Domain Connections Extensibility Features RADIUS Two-Factor Authentication Internal Feedback Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email Templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable S2FA for Administrators & Enable S2FA for HelpDesk Users Reporting Password Manager Integration Accounts Used in Password Manager Open Communication Ports for Password Manager Customization Options Overview Feature imparities between the legacy and the new Self-Service Sites Glossary

FailSafe support in Password Manager

This feature allows a user to login to Helpdesk or Self-Service site when Password Manager Service is unavailable.

Helpdesk and Self-Service site use Password Manager Service to communicate with Active Directory. If Password Manager Service is unavailable, authentication and other such services do not function. For such scenario, Password Manager has a FailSafe feature integrated to connect to other available Password Manager service automatically.

After the initializing the Helpdesk and Self-Service sites, WcfServiceRealms.xml file is created. This file has records of all the instances of Password Manager Services installed. The user can use one of the realm instances listed in WcfServiceRealms.xml file, in case of unavailability of services in the primary instance of Password Manager Service.

For example, helpdesk site is connected to PM service 1. If the PM service 1 is non-functional, with the integrated FailSafe feature, the helpdesk site automatically connects to PM service 2 to continue with the tasks uninterrupted. After the PM service 1 is restored, the helpdesk site is connected back to the initially connected PM service, that is PM service 1.

NOTE: Failsafe works in distributed environment. If all the Password Manager components are installed on the same server, the FailSafe operation might not work as expected.

NOTE: The Self-Service and Helpdesk Site's URLs must be accessible from Password Manager Service.

Installing Multiple Instances of Password Manager

Several Password Manager instances sharing common configuration are referred to as a realm. A realm is a group of Password Manager Service instances sharing all settings and having the same set of management policies, that is, the same user and Helpdesk scopes, Q&A policy, and workflow settings. Password Manager realms provide for enhanced availability and fault tolerance.

IMPORTANT: It is not recommended to edit Password Manager settings simultaneously on multiple instances belonging to one realm. Simultaneous modification of settings on multiple Password Manager instances may cause data loss.

To create a Password Manager Realm

  1. Export a configuration file from the instance belonging to the target realm:

    • To export instance settings to the configuration file, connect to the Administration site of the instance belonging to the target realm.

    • On the menu bar, click General Settings, then click Import/Export.

    • On the Import/Export Configuration Settings page, select the Export configuration settings option and click Export to save the configuration file.

      IMPORTANT: Remember the password that is generated while exporting the configuration file. You should enter this password when importing the configuration file for a new instance you want to join to the target realm.

  2. Install a new Password Manager instance by running Password Manager x86 or Password Manager x64from the installation CD autorun window. For more information on the installation procedure, see Installing Password Manager.

  3. Open the Administration site by entering the following address: http(s)://<ComputerName>/PMAdmin, where <ComputerName> is the name of the computer on which Password Manager is installed. On the Instance Initialization page, select the Replica of existing instance option.

  4. Click Upload to select the configuration file that you exported from the instance belonging to the target realm.

  5. Enter the password to the configuration file and click Save.

Specifying Custom Certificates for Authentication and Traffic Encryption Between Password Manager Service and Web Sites

When the Password Manager Service is installed on one computer and the Self-Service and Helpdesk sites are installed on some other computers, certificate-based authentication and traffic encryption is used to protect traffic between these components.

By default, Password Manager uses built-in certificates issued by Password Manager. However, you may want to install and use custom certificates issued by a trusted Windows-based certification authority.

This section provides instructions on how to start using custom certificates for authentication and traffic encryption between Password Manager components.

Complete the following steps:

  1. Step 1: Obtain and Install Custom Certificates From a Trusted Windows-Based Certification Authority

  2. Step 2: Providing Certificate Issued for Server Computer to Password Manager Service

  3. Step 3: Providing Certificate Issued for Client Computers to Self-Service and Helpdesk Sites

Step 1: Obtain and Install Custom Certificates From a TrustedWindows-Based Certification Authority

You must obtain two certificates from a trusted Windows-based certification authority: one for the computer running the Password Manager Service (server computer), and another for computers running the Self-Service or Helpdesk site (client computers).

When obtaining certificates, make sure that:

  • The server computer can be accessed from the client computers by using the server certificate CN.

  • Both is selected as a key usage in a certificate request.

  • Enable strong private key protection option is NOT selected in a certificate request.

The following is a sample procedure describing how to obtain a certificate through the Windows 2012 Certificate Services Web interface.

IMPORTANT: When obtaining a certificate for the server computer, perform the following procedure on a computer where the Password Manager Service runs and use the Password Manager Service account to run a supported web browser.

When obtaining a certificate for the client computers, perform the following procedure on a computer running the Self-Service or Helpdesk site and use the Application Pool Identity account to run a supported web browser.

To request a certificate using Windows 2012 Certificate Services Web Interface

  1. Use a browser to open https://servername/certsrv, where servername refers to the name of the web server running Windows Server 2012 where the certification authority that you want to access is located.

  2. On the Welcome page, click Request a certificate.

  3. On the Request a Certificate page, click Advanced Certificate Request.

  4. On the Advanced Certificate Request page, click Create and submit a certificate request to this CA.

  5. Provide identification information as required. In the Name text box, enter the name of the server for which you are requesting a certificate.

  6. In Type of Certificate Needed, select Server Authentication Certificate.

  7. In Key Options, select Create new key set, and specify the following options:

    • In CSP (Cryptographic service provider), select Microsoft Enhanced RSA and AES Cryptographic Provider.

    • In Key Usage, click Both.

    • In Key Size, set 1024 or more.

    • Select Automatic key container name.

    • Select the Mark keys as exportable check box.

    • Clear the Enable strong private key protection check box.

  8. In Additional Options, specify the following:

    • In Request Format, select CMC.

    • In Hash Algorithm, select sha256.

    • Do not select the Save request check box.

    • Specify attributes if necessary and a friendly name for your request.

  9. Click Submit.

  10. If you see the Certificate Issued web page, click Install this certificate. If your request needs to be approved by your administrator first, wait for the approval and then go to the https://servername/certsrv, click View the status of a pending certificate request, and then install the issued certificate.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级