General Installation Instructions
Click Studios
Passwordstate
Installation Instructions
This document and the information controlled therein is the property of Click Studios. It must not be reproduced in whole/part, or
otherwise disclosed, without prior consent in writing from Click Studios.
Click Studios
Passwordstate Installation Instructions
Table of Contents
1
SYSTEM REQUIREMENTS - GENERAL .......................................................................................... 3
2
INTERNET INFORMATION SERVICES (IIS) REQUIREMENTS ........................................................ 4
3
WHAT INFORMATION IS REQUIRED FOR THE INITIAL SETUP .................................................... 5
4
SQL SERVER EXPRESS, AND SQL PORT NUMBER CONSIDERATIONS ......................................... 6
5
CREATING AN APPROPRIATE DNS RECORD................................................................................ 7
6
INSTALLING PASSWORDSTATE ................................................................................................... 8
7
ACTIVE DIRECTORY INTEGRATED AUTHENTICATION & BROWSERS ....................................... 11
8
CONFIGURING PASSWORDSTATE FOR FIRST TIME USE........................................................... 13
9
PASSWORDSTATE BACKUPS ..................................................................................................... 20
10 ENCRYPTING THE DATABASE CONNECTION STRING IN THE WEB.CONFIG FILE ..................... 21
11 SSL CERTIFICATE CONSIDERATIONS .......................................................................................... 22
12 TROUBLESHOOTING CONNECTIVITY ISSUES ............................................................................ 24
13 MCAFEE AND CONSTANT LOGOUT ISSUES ............................................................................... 25
Page 2 of 25
Click Studios
Passwordstate Installation Instructions
1 System Requirements - General
Passwordstate has the following system requirements:
Web Server
Your web server which will host the Passwordstate web site can be any of the following Operating System
versions:






Microsoft Windows Server 2008 & IIS 7.5
Microsoft Windows Server 2008 R2 & IIS 7.5
Microsoft Windows Server 2012 & IIS 8.0
Microsoft Windows Server 2012 R2 & IIS 8.5
Windows 7 & IIS 7.5
Windows 8 & IIS 8.0
Note: Microsoft .Net Framework 4.5 must also be installed on your web server.
Database Server
Your SQL Database which will host the Passwordstate database can be any of the following versions of SQL
Server:
 Microsoft SQL Server 2005
 Microsoft SQL Server 2005 Express
 Microsoft SQL Server 2008
 Microsoft SQL Server 2008 Express
 Microsoft SQL Server 2008 R2
 Microsoft SQL Server 2008 R2 Express
 Microsoft SQL Server 2012
 Microsoft SQL Server 2012 Express
Note: If you would like to use the High Availability module of Passwordstate, your distribution and
publication databases must reside on SQL Server 2005, 2008 or 2012 – SQL Express can only act as a
subscriber to SQL Server replication.
Important: SQL Server must be configured for mixed-mode authentication, so the Passwordstate web site
can connect to SQL Server using an SQL Account. Active Directory Accounts cannot be used to
authenticate against the database.
Email Server
If you would like to receive emails generated from Passwordstate, you must also have an email server
which is capable of sending anonymous SMTP emails, or emails from an authenticated mailbox
Page 3 of 25
Click Studios
Passwordstate Installation Instructions
2 Internet Information Services (IIS) Requirements
When installing Internet Information Services, the following component/roles are required as a minimum.
If these IIS roles are not installed, Passwordstate will install them for you.
Common HTTP Features



Static Content
Default Document
HTTP Errors
Application Development




ASP.NET (or ASP.NET 4.5 on Server 2012 and Windows 8)
.NET Extensibility (or .NET Extensibility 4.5 on Server 2012 and Windows 8)
ISAPI Extensions
ISAPI Filters
Security


Windows Authentication
Request Filtering
Performance

Static Content Compression
Page 4 of 25
Click Studios
Passwordstate Installation Instructions
3 What Information is required for the Initial Setup
Prior to installing Passwordstate and running through the initial Setup Wizard, you will require the
following information:

An SQL Account (not an Active Directory account) with sufficient permissions to create the
database – at a minimum the ‘dbcreator’ and ‘securityadmin’ SQL Server roles are required (The
‘sa’ account has these privileges, although some DBA’s do not like to use this account due to its
elevated privileges).
During the initial setup, the following will occur:
a. The Passwordstate database will be created and populated with some base data
b. An SQL Account called ‘passwordstate_user’ will be created, and will be given db_owner
rights to the Passwordstate database only

Your Registration Key details for Passwordstate

Host Name and Port Number of an email server capable of sending anonymous SMTP mail, or
from an authenticated mailbox

SMTP Address from which Passwordstate will send the emails from

Proxy Server Details – Passwordstate can periodically check for the updates, and if your
organization requires all internet access to go through a proxy server, you will need to specify the
proxy host name and port number during the installation (this feature can also be disabled once
you’re using Passwordstate if required).
Page 5 of 25
Click Studios
Passwordstate Installation Instructions
4 SQL Server Express, and SQL Port Number Considerations
If you intend to use SQL Server Express to host your Passwordstate database, please consider the following
before installing Passwordstate:
1. If you're using SQL Server Express on a different server to where you installed Passwordstate, you may
need to check if the TCP/IP Protocol is enabled (use SQL Server Configuration Manager -> SQL Server
Network Configuration), and also the Windows Service 'SQL Server Browser' is set to 'Automatic'
Startup Type and has been started. You will need to restart SQL Server Express after changing these
settings
2. By default, SQL Server Express installs with an ‘instance’ name of SQLExpress. When you’re configuring
Passwordstate for first time use, specifically the ‘Database Settings’ page, please ensure you have
specified the name of the instance correctly i.e. HostName\SQLExpress
3. If you intend to also install the High Availability instance of Passwordstate, SQL Server Express can only
be used as the Subscriber for data replication, not the Publisher or Distribution database.
If you are running SQL Server on a non-standard port number, you will need to append the port number to
the end of the Database Server Name during ‘10. Configuring Passwordstate for First Time Use’ in the
following way: ServerHostName,PortNumber i.e. sqlserver1,8484
Page 6 of 25
Click Studios
Passwordstate Installation Instructions
5 Creating an Appropriate DNS Record
During the installation of Passwordstate, you have the option of using a URL which has the host name of
the web server in it, or you can specify your own custom URL e.g. https://passwordstate
If you want to use your own custom URL, you will need to create a CNAME DNS entry as per the following
instructions (please do not use host files for name resolution, as they do not work with Windows
Authentication in IIS):
1. On your server hosting DNS, start ‘DNS Manager’
2. Right click on the appropriate domain, and select ‘New Alias (CNAME)’
3. As per the following screenshot, specify the name of your web server host name in the ‘Fully qualified
domain name (FQDN) for target host’ text box, then click on the ‘OK’ button
Page 7 of 25
Click Studios
Passwordstate Installation Instructions
6 Installing Passwordstate
To install Passwordstate, run ‘Passwordstate.exe’ and follow these instructions:
1. At the ‘Passwordstate Installation Wizard’ screen, click on the ‘Next’ button
2. At the ‘License Agreement’ screen, tick the option ‘I accept the terms in the License Agreement’,
then click on the ‘Next’ button
Page 8 of 25
Click Studios
Passwordstate Installation Instructions
3. At the ‘Destination Folder’ screen, you can either accept the default path or change to a different
location, then click on the ‘Next’ button
4. At the ‘Specify Authentication Options for Passwordstate’ screen, select your preferred
authentication method, and then click on the ‘Next’ button
Page 9 of 25
Click Studios
Passwordstate Installation Instructions
5. At the ‘Specify Web Site URL and Port Number’ screen, specify the URL you would like to use, then
click on the ‘Next’ button
6. At the ‘Completing the InstallAware Wizard for Passwordstate’ screen, click on the ‘Next’ button
7. Once installed, click on the ‘Finish’ button
8. If you have a Firewall enabled on your web server, you may need to open up the port number you
specified during the install (default is 9119), so that users are able to access the web site
Note: When you first access the Passwordstate web site in your browser, you must type HTTPS into the
address bar, otherwise you will receive a ‘Page Not Found’ error. The web site is not configured to use Port
80, as HTTP alone does not encrypt traffic between your browser and the web site.
Page 10 of 25
Click Studios
Passwordstate Installation Instructions
7 Active Directory Integrated Authentication & Browsers
If you choose to install the ‘Active Directory Integrated’ version of Passwordstate, the default settings for
Internet Explorer and Chrome is to pass your domain credentials from the browser to the Passwordstate
web site without prompting you for authentication details.
Please Note: It is recommended that once Passwordstate is installed, you run through the initial setup
using your browser on a desktop computer or notebook, as using Internet Explorer on the server can cause
prompting, regardless of the following recommendations – this is due to further restrictions Microsoft
places on using browsers on server operating systems
Please use the following as a guide for troubleshooting browser prompting issues.
Authentication Providers in IIS
Order of authentication 'providers' for Windows Authentication in IIS. By changing the following setting,
helps prevent the web site prompting for authentication:




Open IIS and select the Passwordstate web site
Double click on the "Authentication" option
Right click the "Windows Authentication" item and select "Providers"
Try moving NTLM to the top, then restart the web site
Password Site being detected in Intranet Zone
The Passwordstate web site needs to be detected as being in the Local Intranet Zone, as the default
settings in Internet Explorer for this zone is to 'pass through' credentials from the browser to IIS. In Internet
Explorer, the option for 'User Authentication' is set to 'Automatic logon only in Intranet zone' for this zone


Check the site is being detected in the Intranet Zone in Internet Explorer (IE9) by going to the ‘File’
menu and selecting ‘Properties’
Ensure ‘Automatic logon only in Intranet zone’ is selected for the ‘Local Intranet Zone’ as per the
following screenshot:
Page 11 of 25
Click Studios
Passwordstate Installation Instructions
DNS Entry and IIS Site Bindings
Other issues which can cause authentication prompting relates to the DNS entry created for the site URL, in
combination with the IIS site bindings. The following is a guide, and you may need to test various settings
to see if you can resolve the issue this way:



A CNAME DNS entry needs to be created, where the 'Alias' name can be anything you like generally most customers use the Alias 'passwordstate'. The Alias needs to point to the fully
qualified domain name (FQDN) for the web server host i.e. servername.domain.com. We've seen
some customer bind to the IP Address of the server, and this has caused issues
For the IIS site 'Bindings', the hostname you specify should generally just be 'passwordstate', as per
the DNS entry you created, and the IP Address you select should be 'All Unassigned'. Some
customers have needed to specify the FQDN name as the Host Name i.e.
passwordstate.domain.com, but generally you should not need to do this
You should restart the web site if you make any changes with these settings
Rebooting the Web Server
On occasion as well, simply rebooting the web server for a few customers has resolved the browser
prompting issue.
Page 12 of 25
Click Studios
Passwordstate Installation Instructions
8 Configuring Passwordstate for First Time Use
Introduction - Now that Passwordstate is installed, you can direct your browser to the URL you specified during the initial install, and follow the initial Setup
Wizard – this wizard will guide you through a series of questions for configuring Passwordstate for use.
Please Note 1: If using ‘Active Directory Integrated’ authentication, please ensure you are logged onto your normal domain, and not logged on locally to your
server, before proceeding.
Page 13 of 25
Click Studios
Passwordstate Installation Instructions
Database Settings – On this screen you will need to specify database settings for creating the Passwordstate database. Please use the onscreen instructions if you
have any issues connecting to the database.
Please Note: Creating the database, and populating the tables with data, could take up to a minute to complete.
Page 14 of 25
Click Studios
Passwordstate Installation Instructions
Registration Details – On this screen you need to specify your Registration details for Passwordstate. If you have not received your registration details, please visit
www.clickstudios.com.au.
Page 15 of 25
Click Studios
Passwordstate Installation Instructions
System Settings – On this screen you specify various system wide settings for Passwordstate usage. Please note that any of these settings can be changed after the
initial Setup Wizard has completed. Explanation for each of these settings is detailed after this screenshot.
Page 16 of 25
Click Studios
Passwordstate Installation Instructions
System Settings Detail
Action
Email Settings
Email Server Host Name
Email Server Port Number
SMTP Address
Use Mailbox to Send
User Name & Password
Domain Name
Emergency Access Account
Miscellaneous Settings
Locale
Proxy Server
Description
The host name of a email server which is able to send either anonymous SMTP email, or authenticated email from a specify mailbox
The port number in which your email server is configured to send mail (port 25 is generally the default port)
The SMTP address you would like emails to be sent from when generated from within Passwordstate
If you would like to send all email in Passwordstate from an authenticated mailbox, then select this option. If unselected, email will
be sent via anonymous SMTP
Domain user name and Password for the authenticated mailbox
NetBIOS name for the domain the mailbox belongs to
Specify a password for the Emergency Access Account feature of Passwordstate
Select the appropriate locale for your region. This will be the default Locale for all users. If you require different Locales for different
users (as they cross different time-zones), you can set this for individual accounts after the initial setup is complete
Passwordstate can check if new versions are available. If you require to specify some proxy server details to access the Internet, you
can do so here (checks for updates can also be disabled once you’ve started Passwordstate)
Emergency Access Account The Emergency Access Account is only used if you’re unable to authenticate with any other accounts
Active Directory Domain (not visible when using Forms-Based Authentication)
AD Domain NetBIOS Name The NetBIOS name for your Active Directory domain
AD Domain LDAP String The LDAP Query String for your Active Directory Domain (Please confirm these settings have been detected successfully before
proceeding)
Active Directory Privileged (not visible when using Forms-Based Authentication)
Account Credentials
UserName
Specify domain account credentials so Passwordstate can synchronize User Account & Security Group Memberships, and if required,
Password
to synchronize passwords between Passwordstate and Active Directory/Windows Servers.
(Note: If you don’t plan on synchronizing any password changes into Active Directory, then this account only needs read access to
Page 17 of 25
Click Studios
Passwordstate Installation Instructions
AD.
Create Admin Account – On this screen you specify details for the first user account to be created in Passwordstate. This account will be granted Security
Administrator privileges, and assign all Security Administrator roles.
Page 18 of 25
Click Studios
Passwordstate Installation Instructions
Setup Complete – The installation is now complete and you can begin using Passwordstate. Prior to granting access, or informing users of the new version, you
may wish to review some of the system wide settings found under the ‘Administration’ area of Passwordstate.
Page 19 of 25
Click Studios
9 Passwordstate Backups
To allow backups to work through the Passwordstate web interface, you will need to specify an account
(domain or Windows account), which has the following permissions:

Permissions to write to the Backup path you’ve specified

Permissions to stop and start the Passwordstate Windows Service on the web server

Permissions to write to the Passwordstate folder.
In addition to this, you must configure the SQL Server service to use a domain or Windows account which
has permissions to also write to the Backup Path. To do this, you need to open the ‘SQL Server
Configuration Manager’ utility on your database server, click on ‘SQL Server Services’, and then specify and
account as per the next screenshot:
1. Now you can navigate to the page Administration -> Backups & Upgrades
2. Click on the ‘Backup & Upgrade Settings’ button
3. Using the Windows/Domain account mentioned above, configure the options on the screen and click
on the ‘Test Permissions’ button. If the Test Permissions is successful, you can return to the previous
screen and run a manual backup by clicking on the ‘Backup Now’ button.
Page 20 of 25
Click Studios
10 Encrypting the Database Connection String in the Web.config file
Whilst it’s not entirely necessary to encrypt the database connection strings within the web.config file, it is
recommended so the SQL Account credentials used to access the Passwordstate database is encrypted and
unreadable from anyone who can read the file system on your web server.
To encrypt the database connections string, please follow these instructions:
Encrypt Connection String

Open a command prompt and change to the folder C:\Windows\Microsoft.NET\<Framework or
Framework64>\v4.0.30319

Type the following:
o
aspnet_regiis.exe -pef "connectionStrings" "c:\inetpub\passwordstate" (change the path if
you’ve installed Passwordstate to a different location)
Decrypt Connection String

Open a command prompt and change to the folder C:\Windows\Microsoft.NET\<Framework or
Framework64>\v4.0.30319

Type the following:
o
aspnet_regiis.exe -pdf "connectionStrings" "c:\inetpub\passwordstate" (change the path if
you’ve installed Passwordstate to a different location)
Note: If you intend to rename your server host name, you should decrypt these settings first, rename the
server, then encrypt again.
Page 21 of 25
Click Studios
11 SSL Certificate Considerations
The installer for Passwordstate installs a self-signed SSL certificate on your web server, and binds it to the
Passwordstate web site.
If you have your own SSL certificate installed on the web server you’d prefer to use, you can modify the
bindings for the site in IIS, and select the appropriate certificate.
If you wish to continue using the self-signed SSL certificate, then you may want to instruct your users to
“Install” the certificate on their computer, so the various Internet browsers don’t complain about the
certificate not being issued by a trusted authority.
To install the certificate, you can follow these steps:
1. Using Internet Explorer, browser to the Passwordstate web site
2. When you see the following screen, click on the ‘Continue to this website’ link
3. Now click on the ‘Certificate error’ link at the top of your screen
4. The click on ‘View Certificates’, then on the ‘Install Certificate…’ button
5. Select the ‘Local Machine’ Store Location, then click on the ‘Next’ button
6. Select ‘Place all certificates in the following store’ option, click on the ‘Browse’ button, and select
‘Trusted Root Certification Authorities’ as per the next screenshot
Page 22 of 25
Click Studios
7. Now click on the ‘OK’ button, then the ‘Next’ and ‘Finish’ buttons
8. After the certificate is installed, you can close and re-open your browser to the Passwordstate web
site, and it should no longer complain about an untrusted certificate
Page 23 of 25
Click Studios
12 Troubleshooting Connectivity Issues
If when you first try and browse to the Passwordstate web site you get a blank page, or an error saying ‘The
page cannot be displayed because an internal server error has occurred.’, this may be caused by the order
in which you installed Internet Information Services and the .Net Framework 4.5 – if you install the .NET
Framework first, this error will occur.
Note: These instructions only apply to Microsoft Windows Server 2008, Server 2008 R2 and Windows 7
To resolve this, follow these instructions:

Open an Command Prompt as an Administrator

Type CD C:\Windows\Microsoft.NET\Framework\v4.0.30319 or
C:\Windows\Microsoft.NET\Framework64\v4.0.30319 depending on our operating system version

Now type aspnet_regiis -i

After ASP.NET has been re-registered, ensure the Passwordstate Application Pool in IIS is set to
'Integrated Managed Pipeline Mode', and then restart IIS (you need to open the Internet Information
Services (IIS) Manager tool to do this

Now open your browser and point it back to the Passwordstate web site
You may need to do this for both the 32bit and 64bit versions on the Framework directories above if you
still experience issues.
Page 24 of 25
Click Studios
13 McAfee and Constant Logout Issues
McAfee’s Anti-Virus On-Demand scan can cause issues with logging users out of Passwordstate
prematurely, before the default IIS session time of 10 minutes.
The On-Demand scan process isn't blocking the accessing of any files, but when it scans either the
web.config file, or any files in the /bin folder, it can cause sessions in IIS to end.
We recommend excluding the Passwordstate folder from On-Demand scanning, as this has helped a lot of
customers.
If you are seeing the same symptoms, but are using a different Anti-Virus suite, please also exclude the
Passwordstate folder from real-time scanning to see if this helps.
Page 25 of 25
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement