HelpSystems Access Authenticator Reference Manual
Reklama
Reklama
Reference Manual
Access Authenticator
1.1
Copyright Terms and Conditions
The content in this document is protected by the Copyright Laws of the United States of America and other countries worldwide. The unauthorized use and/or duplication of this material without express and written permission from HelpSystems is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to HelpSystems with appropriate and specific direction to the original content.
HelpSystems and its trademarks are properties of the HelpSystems group of companies. All other marks are property of their respective owners.
201708310939
Table of Contents
Welcome to Access Authenticator
Installing Access Authenticator
Implementing Access Authenticator
Administrator Setup Procedure
To Configure Access Authenticator
User Setup Procedure
User Authentication
Reference
Agents screen
Authentication Managers screen
Access Authenticator Desktop Agent
Edit Default System
Email Settings screen
Access Authenticator Home
Import Users
LDAP Settings screen
New/Edit Group
New/Edit Manager
New/Edit System
New/Edit User
Promoting a Secondary Authentication Manager to Primary
Select Systems
Settings screen
Troubleshooting Authentication with your Mobile Device
Enable your fingerprint touch sensor
Allow Access Authenticator to use your camera
Allow Access Authenticator to send push notifications
Users screen
Reference Manual www.helpsystems.com
page: iii
IBM i Agent Reference
Deactivate Authentication Verification panel
Emergency Override Setup panel
Insite Server Configuration panel
Powertech Access Authenticator Main Menu
Work with Authentication Managers panel
Appendix
Promoting a Secondary Authentication Manager to Primary
Securing an Authentication Manager Connection on Windows
Other Help
Table of Contents
Reference Manual www.helpsystems.com
page: iv
Welcome to Access Authenticator
Welcome to Access Authenticator
Access Authenticator allows administrators to ensure only authorized users are granted access to their IBM i systems by requiring two pieces of evidence in order to validate each user's identity, a method of access control known as multi-factor authentication. Access Authenticator allows network users to easily register a mobile device or YubiKey to act as the second authentication factor, in addition to their IBM i or Active
Directory credentials.
Access Authenticator is designed to challenge users as they access the IBM i. It can be used to sign on to interactive sessions or when FTP is used to connect to the system.
The installation components required to administer the authentication process include:
l
Version 1.14 or higher of Insite Server. HelpSystems Insite is the web browser interface used to manage Access Authenticator.
l
The Authentication Manager Server. The Authentication Manager is Access Authenticator's central processing component.
l
The Data Services Server. The Data Services includes Access Authenticator's database and backup, recovery, and HA services.
These components can be installed together on one server, or divided on two or more servers. For example, in one possible configuration, the Insite server can be installed where users can connect, and the
Authentication Manager Server and Data Services can be installed together on a different server. (These systems can be Windows servers, or Linux or Unix systems.)
The installation components for user authentication include:
l
The Android app. This app, available from Google Play, can be used to authenticate using Android.
l
The iOS app. This app, available from Apple, can be used to authenticate using an iPhone.
l
The Desktop Agent. This desktop application can be used to authenticate connections made through methods outside of traditional log on screens (like FTP).
The administration and configuration of Access Authenticator is done from a connection with the Insite server. Network users can register their devices using a URL provided via an email they receive after enrolling with Access Authenticator.
See User Setup Procedure for details on setting up Access Authenticator for authentication.
for details on how to authenticate using Access Authenticator as an end user.
Reference Manual www.helpsystems.com
page: 1
Installing Access Authenticator
Installing Access Authenticator
These instructions guide you through the process of installing Access Authenticator.
System Requirements
Compatibility with HelpSystems Insite
To use HelpSystems Insite to access your products through a web browser, you must meet the following browser and/or operating system requirements.
Hardware Type
Desktop/Laptop
Mobile Device
IBM i
Minimum Browser and/or OS
Requirements
Firefox 11 or higher
Chrome 21 or higher
Internet Explorer 11
Safari 6.1 or higher
Microsoft Edge iOS: Browsers on iOS 8 or higher
Android: OS 4.4 or higher using
Chrome
Windows: OS 10 using Edge
V7R1 or higher operating system
For more details, see Insite System Requirements .
IBM i Agent System Requirements
Access Authenticator requires IBM i (i5/OS, OS/400) version V7R1 or higher.
NOTE:
During installation an FTP connection is initiated. The FTP server responds with messages that prompt for FTP login credentials. The standard port reserved to establish an FTP connection to the IBM i is port 21. Consequently, it is required that this port is open and ‘listening’ on the server in order to establish a connection with the Installation Wizard and facilitate a successful installation. Any firewall or exit program technology on the PC or the IBM i system could potentially block the FTP file upload and remote commands running the installation. Ensure any such firewall or program is configured to permit an FTP connection on port 21. If standard FTP is not permitted, contact Technical Support for instructions on how to manually install the product without the installation wizard.
Reference Manual www.helpsystems.com
page: 2
Installing Access Authenticator
System Values
It is HelpSystems’s goal not to change system values on customer systems because we recognize that security-conscious organizations have rigorous change control processes in place for even small changes to system values. Therefore, we ask you to make any system value changes that are needed. However, the
Access Authenticator IBM agent installation process could change a system value to allow the install to proceed if a system value is not set as specified below. If the Installation Wizard changes a system value during install, it changes it back to its original value when the install completes.
To install the Access Authenticator IBM i agent on your system, the following system values that control object restores must be configured as shown.
l
Set QALWOBJRST to *ALWPGMADP (at a minimum) to allow the system to restore programs that adopt authority. Many Powertech programs adopt the authority of the product owner, rather than forcing you to give authority directly to administrators and end users. (Note: For some system configurations, *ALL is required temporarily.) l
QALWUSRDMN controls which libraries on the system can contain certain types of user domain objects. You should set the system value to *ALL or include the name of the Access Authenticator install library (PTMALIB) for the product to function properly.
l
Set QVFYOBJRST to 1, 2, or 3. This allows Access Authenticator to restore all objects regardless of their signature. (Note: If you normally check signatures, remember to check this system value after the
Access Authenticator install process completes.) l
Set QFRCCVNRST (Force conversion on restore) to 0, Do not convert anything.
Desktop Agent System Requirements l
Windows 7 64-bit or Windows 10 64-bit l
2 GB RAM
Mobile App System Requirements
Biometric authentication on Android to devices requires Android 6.0 Marshmallow or newer.
Installation Overview
Access Authenticator installation on your network is a multi-step process that requires several installation procedures. The following entities should be installed in the order listed here: l
HelpSystems Insite. This is required for administrator setup and the User Portal. See HelpSystems
Insite Documentation List for instructions that describe how to install and use HelpSystems Insite.
l
Access Authenticator Authentication Manager and Data Services. The Authentication Manager is
Access Authenticator's central processing component. Data Services include database and high-
.
Reference Manual www.helpsystems.com
page: 3
Installing Access Authenticator
l
Access Authenticator IBM i agent. The IBM i agent software must be installed on all systems to be
secured by Access Authenticator. See Installing the IBM i Agent .
After Access Authenticator has been installed and started, network users need to install up to two
applications, depending on the method of authentication being used (see User Setup
for details): l
Access Authenticator Mobile app. The mobile app is required in order to authenticate with a mobile device. (This installation is not necessary if a YubiKey is being used for the second authentication factor.) l
Access Authenticator Desktop agent. The Desktop Agent allows users to authenticate using a desktop computer as an alternative to the IBM i green screen agent for Exit Point sign on.
Installing the Authentication Manager and Data Services
Access Authenticator can run in two modes: l
Single System: The Authentication Manager and Data Services are installed on the same system. This is the easiest installation that requires the smallest footprint. This is the recommended configuration for the first system.
l
Multiple Systems with Manual Failover: In this configuration, the Authentication Manager and Data
Services are installed on a second system (same as the first), but the installation points back to the
Primary system to replicate its data. The second system can be switched to the Primary system in the event of a system failure, or for maintenance on the Primary system.
The following instructions demonstrate how to install the Authentication Manager and Data Services on a
Primary and Secondary system in order to provide replication and failover capability. If you intend to install on a single system only, use the initial steps of the following procedure for your platform (stopping when directed to repeat steps for a Secondary system).
To install the Access Authenticator Authentication Manager and Data
Services on Windows
1. Login to the Windows server you would like to use for your Primary installation.
2. Download the Access Authenticator installer (setupAccessAuthenticator.exe). To do so, go to the
HelpSystems website and click My Account. (The "Trial" download is the full product, which can be unlocked with a valid License Key.)
3. Double-click the installer file to begin the installation process.
WARNING:
If you need to terminate the installation process before finishing, delete the
C:\Program Files\Help Systems\Access Authenticator
folder and start the installer again.
4. Follow the instructions to continue the installation.
5. The Access Authenticator Create Windows User window prompts you to create a new Windows user named helpsystemsaa. Enter a password for the new user and click Create. Once the password is accepted, click OK to continue installation.
Reference Manual www.helpsystems.com
page: 4
Installing Access Authenticator
NOTE:
If you are reinstalling Access Authenticator over a previous version, you will not see this window.
6. The HelpSystems Access Manager and Data Services Configuration Manager appears. You must configure ports for the manager and services. The installer lets you know if the default ports are available. If a port is not available, enter a new port number and click Test to see if it is available.
Make note of the Database Port and HTTP Port. Also note the Local IP address. These will need to be entered later.
Once all ports are available, click OK to save the ports and continue installation. See also Port
Descriptions .
7. Click Finish to complete installation on the Primary server.
8. Login to the Windows server you would like to use for your Secondary installation.
9. Repeat the installation process on this server until you reach the HelpSystems Access Manager and
Data Services Configuration Manager screen (steps 1-5).
Check Secondary System. Then, enter the Database Port and HTTP port specified for the Primary server. For IP Address, enter the IP address of the Primary server.
Reference Manual www.helpsystems.com
page: 5
Installing Access Authenticator
If a port is not available, enter a new port number and click Test to see if it is available. Once all ports are available, click OK to save the ports and continue installation.
10. Click Finish to complete installation on the Secondary system.
11. On the Secondary system, open a command line and run the following command in the Access
Authenticator directory (C:\Program Files\Help Systems\Access Authenticator by default):
master2standby.bat -a ip address of primary system -p database port of primary
system
This tells Access Authenticator to begin replicating data from the Primary system.
Reference Manual www.helpsystems.com
page: 6
Installing Access Authenticator
NOTE:
You can look at the "PortConfig.txt" file on the Primary system to view the port configuration, including the Database Port. This file is located at C:\Program Files\Help
Systems\Access Authenticator
.
Next, you need to add the IP addresses and ports of the Primary and Secondary systems you have just installed in HelpSystems Insite, which is the browser interface used to administer Access
Authenticator.
12. Open HelpSystems Insite and choose Access Authenticator from the Navigation Pane. (See
HelpSystems Insite Documentation List for Insite installation instructions if you have not yet installed
Insite.)
13. Choose Managers from the Navigation Pane and click Add to add an Authentication Manager. Or, if you have already added the Primary Manager (e.g. for licensing), click next to the Manager and choose Edit.
14. Specify the Address and Port of the Primary system (recorded earlier), then set Primary to On. Enter a valid License Key if you have not already.
TIP:
To verify a system is configured to be the Primary Authentication Manager instance, you can run the command is-master.bat (located in the Access Authenticator folder). If it is Primary, the command will return POSTGRES_MASTER=TRUE.
15. Click Save. The Primary system is added to the list of Managers.
16. Click Add. Or, if you have already added the Secondary Manager, click next to the Manager and choose Edit. Now, enter the IP address and Port of the Secondary Authentication Manager system.
Leave the Primary setting at Off. Enter a valid License Key if you have not already.
17. Click Save. The Secondary system is added to the list of Managers. To promote a Secondary
Authentication Manager to Primary in case of a system failure or maintenance, see Promoting a
Secondary Authentication Manager to Primary .
Reference Manual www.helpsystems.com
page: 7
Installing Access Authenticator
NOTE:
You can view the IP addresses and ports of Primary (master) and Secondary databases in the pckz.properties file located in the Access Authenticator/properties folder.
To install the Access Authenticator Authentication Manager and Data
Services on Linux
1. Login as root on the server you want to use as your Primary installation. The installer must be run as root or with sudo.
2. Download the Access Authenticator for Linux file (installAccessAuthenticator.tgz) to a temporary directory on the system. To acquire the file, go to the HelpSystems website and click My Account.
(The "Trial" download is the full product, which can be unlocked with a valid License Key.)
3. Use the following command to extract the contents of the file: tar xvzf installAccessAuthenticator.tgz
Files are extracted to the directory installAccessAuthenticator.
4. Use the following commands to start the installer: cd installAccessAuthenticator
./serverInstall
WARNING:
If you need to terminate the installation process before finishing, delete the
/opt/helpsystems/AccessAuthenticator
directory and start the installer again.
5. When prompted to choose whether you want to install the Authentication Manager and Data
Services, choose y.
6. When asked if this is the primary data services server, indicate y.
7. When prompted to verify the server IP, confirm it is correct. Or, if it is not correct, enter n, then enter the correct IP.
8. Next you are prompted to confirm a series of ports Access Authenticator uses for communication.
Verify the ports are correct. Record the LAN port number and the Database port number, as you will need to enter these later if you are installing a Secondary instance.
9. Access Authenticator creates the Primary database and starts the product. It installs to
/opt/helpsystems/AccessAuthenticator.
10. Login to the server you want to use for your Secondary installation and repeat the above process through step 4.
11. When asked if this is the primary data services server, indicate n. The Data Services must be running for the following steps to work.
12. Enter the IP of the primary system (the one just installed).
13. Enter the port number of the primary database (recorded earlier).
NOTE:
You can look at "PortConfig.log" in the installAccessAuthenticator directory on the Primary system to view the port configuration, including the Database Port.
Reference Manual www.helpsystems.com
page: 8
Installing Access Authenticator
14. Enter the port number for the primary Discovery LAN (recorded earlier).
NOTE:
If a firewall is preventing communication between the servers, create rules in the firewall to allow the required traffic.
15. When prompted to verify the server IP, confirm it is correct. Or, if it is not correct, enter n, then enter the correct IP.
16. You are prompted to confirm a series of ports Access Authenticator uses for communication. Verify the ports are correct.
17. Access Authenticator creates the Secondary database and starts the product. It installs to
/opt/helpsystems/AccessAuthenticator.
Next, you need to add the IP addresses and ports of the Primary and Secondary systems you have just installed in HelpSystems Insite, which is the browser interface used to administer Access
Authenticator.
18. Open HelpSystems Insite and choose Access Authenticator from the Navigation Pane. (See
HelpSystems Insite Documentation List for Insite installation instructions if you have not yet installed
Insite.)
19. Choose Managers from the Navigation Pane and click Add to add an Authentication Manager. Or, if you have already added the Primary Manager (e.g. for licensing), click next to the Manager and
choose Edit. The New Managers screen appears.
20. Specify the Address and Port of the Primary system (recorded earlier), then set Primary to On. Enter a valid License Key if you have not already.
21. Click Save. The Primary system is added to the list of Managers.
22. Click Add. Or, if you have already added the Secondary Manager, click next to the Manager and choose Edit. Now, enter the IP address and Port of the Secondary Authentication Manager system.
Leave the Primary setting at Off. Enter a valid License Key if you have not already.
Reference Manual www.helpsystems.com
page: 9
Installing Access Authenticator
23. Click Save. The Secondary system is added to the list of Managers. To promote a Secondary
Authentication Manager to Primary in case of a system failure or maintenance, see Promoting a
Secondary Authentication Manager to Primary .
Installing the Access Authenticator IBM i Agent
Ensure the following servers are available and running prior to installation: l
FTP Server l
Remote Command Server
Do the following to perform the installation or update:
1. Download the Access Authenticator installer (setupAccessAuthenticator1.exe) to your PC. To do so, go to the HelpSystems website and click My Account.
2. On the Choose Components panel, select which components you want to install. You can choose to install the Manuals and the Software for IBM i. Click Next.
3. If you are installing the Manuals only, the process completes and the installer closes. The Manuals have been installed. You can skip the rest of these steps.
NOTE:
The manuals are installed to the following location:
C:\Program Files\PowerTech\Access Authenticator\manuals
4. On the IBM i Details panel:
a. Select or enter the IBM i system.
b. Enter a user profile and password that is a member of the user class *SECOFR and has at least the following special authorities: *ALLOBJ, *SECADM, *JOBCTL, *IOSYSCFG, and *AUDIT. The user profile should have Limit capabilities set to *NO.
c. (Optional) In the Advanced Settings section: l
Enter a port number or use the arrows if you want to change the FTP port number to something other than the default of 21.
l
Select Secure File Transfer if you want to use FTPS (FTP over SSL) during the file transfer. The default FTPS secure port is 990, but it can be changed to the required secure port for your environment.
l
In the Timeout (seconds) field, enter the number of seconds the session should be kept active during an FTP transfer. You can choose anywhere between 25 and 1800 seconds
(30 minutes).
NOTE:
If the transfer takes longer than the amount of time specified, the session will expire.
d. Click Next.
5. You have two options on the Product Load Options panel:
Reference Manual www.helpsystems.com
page: 10
Installing Access Authenticator
a. Click Immediate Load if you’d like to load the product on the IBM i now.
b. Click Staged Load if you’d like to transfer the objects now and load them on the IBM i at a later time.
NOTE:
See "Loading Staged Objects on the IBM i" (below) for instructions on how to load the staged objects on your selected IBM i system.
6. The Product Load Progress panel for Access Authenticator launches.
If the Product Load Progress panel ends with an overall Failed message, the product upload could not complete properly. To find the reason the upload failed, click View Logs and review your logs. You can also use Download at the top of the logs to save the information for future review.
When the processing is complete, you have two choices: l
If this is the only installation or update of Access Authenticator that you're doing, click Finish.
l
If you have installs or updates to do on other IBM i systems, click Restart. Then, return to step 4.
Loading Staged Objects on the IBM i
If you chose to stage your objects during step 5b of the installation or update process, do the following to manually load them on the IBM i you identified above.
1. On the IBM i, execute the following command to display the Work with Loads panel:
HSLOADMGR/HSWRKLOAD
2. Enter option 1, Load, next to the Load Name for Access Authenticator and press Enter.
The installation program installs Access Authenticator, including the required user profiles and libraries
(see table below for details).
The installation process displays the job log name, user, and job log number. Use the WRKSPLF command to display the job log for complete information on the Access Authenticator install.
Objects Installed on System
Installed on System Description
Product Library PTMALIB
User Profiles
Authorization List
Subsystem
Job Queue Entries
PMAADMIN, which has special authorities *ALLOBJ, *AUDIT,
*IOSYSCFG, *JOBCTL, *SAVSYS, *SECADM, *SERVICE, and *SPLCTL
PMAUSER, which has no special authorities
(These profiles are set to Password = *NONE so that they can’t be used to sign on to the system.)
PMAADMIN - Access Authenticator Administrators
PMASBS
PTMALIB/PMAJOBQ added to PMASBS
Reference Manual www.helpsystems.com
page: 11
Installing Access Authenticator
Installed on System Description
Objects in QGPL:
Depending on the exit points that are being monitored, there could be up to four programs starting with PMA created in QGPL.
Powertech-created
Unregistered Exit
Points:
POWERLOCK_AA
Configuring the IBM i Agent
After installation, you need to add any profiles that will require access to the IBM i agent's configuration settings to the PMAADMIN authorization list. Then, configure the IBM i agent to synchronize with Insite and the Authentication Manager.
1. Sign on to the IBM i system and add the product administrator's user profile to the PMAADMIN authorization list:
WRKAUTL PMAADMIN
2. Repeat this step for any other product administrators.
3. Use the following command to open the Main Menu:
PTMALIB/WRKPTMA
4. Choose option 1 to open the Insite Server Configuration panel
.
5. Enter the IP address and port of the Insite server. Press Enter to save changes.
the Authentication Manager IP(s) to Insite, they appear here automatically.
NOTE:
If you have not yet installed/configured an Authentication Manager, you can press F6 to add it here manually before it has been installed/added to Insite. (You will need to know the IP and port it will be installed on.)
7. Press F3 to return to the Main Menu, then choose option 4. The Emergency Override Setup panel
appears.
8. Enter any profiles that will be allowed to bypass authentication in case of an emergency. Press Enter.
The IBM i agent has been configured.
NOTE:
Choose option 3 to stop authentication on this IBM i system. See Deactivate Authentication
Verification panel for details.
Next, you need to add the IBM i agent to Access Authenticator in Insite.
9. Open HelpSystems Insite and choose Access Authenticator from the navigation pane on the left, then choose Agents.
10. Ensure the IBM i system has been added as a product connection in Insite. See Product Connections in the Insite documentation.
11. Click IBM i agent, then click Add. The Agents > New System screen appears.
Reference Manual www.helpsystems.com
page: 12
Installing Access Authenticator
12. For System, choose Select System and choose the system you just configured.
13. Configure any system settings and click Save. You return to the Agents > IBM i agent screen .
14. To activate the system, click (on the right side of the screen) and choose Activate.
When the necessary components have been installed, see Administrator Setup Procedure to begin
configuring and using Access Authenticator.
Reference Manual www.helpsystems.com
page: 13
Implementing Access Authenticator
Implementing Access Authenticator
This guide describes how to configure and use Access Authenticator. It describes how administrators can tailor Access Authenticator to fit the security needs of their organization, how users can register devices to act as authentication factors, and how those users can authenticate using a registered factor.
NOTE:
The separate Access Authenticator Implementation Guide is an abbreviated resource that includes only the following implementation instructions, and in a slightly abbreviated format.
Reference Manual www.helpsystems.com
page: 14
Administrator Setup Procedure
Administrator Setup Procedure
After installation, complete the following procedure to configure Access Authenticator.
NOTE:
See Installing Access Authenticator for installation information.
To Configure Access Authenticator
Configure Access Authenticator in HelpSystems Insite by adding and configuring IBM i agents in Insite, configuring email settings, then adding and/or importing users to Access Authenticator.
Add and Configure IBM i Agents in Insite
NOTE:
The following instructions assume the Access Authenticator IBM i Agent software has been
installed on the IBM i system. See Installing the IBM i Agent
.
1. Sign in to Insite and choose Access Authenticator from the Navigation Pane on the left.
2. Click Systems Defaults to configure default agent settings. The Edit Default System screen
appears.
Here, you can: l
Choose whether or not to allow user profiles that have not been assigned to a user in Access
Authenticator.
l
Choose whether to allow or deny individual profiles for exit point sign on.
l
Choose whether to activate Exit Points by default for new IBM i Agents when the agent is activated.
3. When you have finished configuring the defaults, click Save.
NOTE:
Settings for individual systems in Edit Systems override the equivalent settings configured in
.
a. Choose Select System and choose the IBM i system.
b. Select whether or not to allow profiles that have not been assigned in Access Authenticator.
c. Choose how to handle sign on of unassigned profiles. You can set Use Agent Defaults to Off in order to specify a profile to use for unassigned profile sign ons. Or, choose On to use the default
settings defined in the Edit Default System screen .
d. Check the Exit Points you want to enable and click Activate.
NOTE:
If you choose to require authentication for Exit Point sign on, users will need to download the Desktop Agent from the User Portal during User Setup. Instructions for doing
so are included under User Setup .
e. Click Save.
5. To enable the system, click and choose Activate.
Reference Manual www.helpsystems.com
page: 15
Administrator Setup Procedure
6. Click Agents again in the navigation pane to show the IBM i agent option. If the "IBM i agent" row reads
"Disabled", click for this option (on the right side of the screen) and choose Enable to enable IBM i agent service with Access Authenticator. You are asked if you want to change the statuses (activated or deactivated) of all systems connected to the agent. Choose Yes to do so and No to change only this system.
Add Groups
Before you begin adding Access Authenticator users, it is a good idea to create any Groups you would like to organize your users into. When users are organized into a Group, they can, for example, be enabled, disabled, or sent an email all at once. They can also be configured to use their own authentication method(s). (Users not assigned to a Group when added are assigned to the default group.)
1. On the Navigation Screen, choose Users.
2. Choose Add > Add Group. The New Group screen appears.
3. Enter a Name and Description for the Group.
4. Choose whether to Enable, Disable, or Inherit the five authentication methods.
5. Click Save. This Group will not be available for selection when you add Access Authenticator Users.
Add Users
Access Authenticator must be added and linked to a profile on an IBM i agent system before registration or authentication can take place. Users can be added manually on an individual basis, or imported from Access
Directory and created automatically.
NOTE:
It is faster to import Active Directory users than create them manually, as they are created
automatically upon import (see the next section, Importing Users , for details).
Adding Users Manually
Access Authenticator Users can be created individually using the following procedure:
1. In the Navigation Pane, choose Users, then Add > Add User to open the New User screen .
2. Enter the Access Authenticator Name. This is the name the user will be instructed to use to, for example, login to the Access Authenticator User Portal during the registration procedure. It can be the same as the Active Directory account name or IBM i profile the user will be attached to.
3. Enter the Active Directory Username, if one exists for the user. Skip this step if the user has only an
IBM i profile, and no Active Directory Username.
4. Enter the user's Full Name, email, and desired Group.
5. For 'User Status,' set Enabled to Yes, which activates the user within Access Authenticator.
6. For 'Authenticate User,' choose Yes if you want the user to be required to authenticate immediately, then next time they attempt to sign on to the IBM i. You can leave this set to No if you would rather wait and give the user time to register an authentication device before requiring them to authenticate.
Reference Manual www.helpsystems.com
page: 16
Administrator Setup Procedure
7. For Authentication Methods, select whether you want to enable or disable each method, or inherit settings from the Group settings.
8. Link IBM i profiles with this Access Authenticator User:
a. Under 'IBM i Profiles and Systems,' click Add.
b. Select a system and choose Next.
c. Select one or more profiles and choose Save.
d. Repeat the above steps to add profiles from additional systems.
9. Click Save to save the User in Access Authenticator's database.
Importing Users
Import users to expedite the process of creating Access Authenticator users using the following procedure:
1. Import Active Directory users.
In order for Access Authenticator to authenticate a user, it must have its own record of the user enrolled in Access Authenticator's database. Access Authenticator can create these users automatically while importing Active Directory users. However, before importing IBM i user profiles, the Access Authenticator users must already exist.
Import Active Directory users first. This way, your Access Authenticator users can be created quickly for every Active Directory user. Then, you can import IBM i user profiles and use Access
Authenticator's Smart Match feature to link them to the existing Access Authenticator users that were created when you imported from Active Directory.
Any individual who does not have an Active Directory account must be imported manually. See
Importing Users Manually .
a. Configure LDAP using the LDAP Settings screen
. To do so, in the Navigation Pane, click LDAP.
b. Once LDAP has been configured, in the Navigation Pane, choose Users, then select Add
> Import Users. The Import Users screen
appears.
c. For Location, choose Active Directory. For LDAP Context, enter the LDAP attributes you would like to use.
d. For Group, select a Group for the users you are about to import.
NOTE:
To add a group, on the Users screen, click Add > Add Group. See Users screen
for more details.
e. Click Start Import. An Access Authenticator user is created for every Active Directory user.
2. Import a list of IBM i user profiles and map them to the appropriate Access Authenticator users.
WARNING:
Access Authenticator does not prevent the possibility of system access using the
Program/procedure field by a user during sign on. To disable the use of this field for users, set their
Limit Capabilities user profile setting to *YES or *PARTIAL.
a. In the Navigation Pane, choose Users, then select Add > Import Users. The Import Users screen
appears.
b. For Location, choose IBM i Profiles.
c. For System, select the IBM system that includes the profiles you would like to import.
Reference Manual www.helpsystems.com
page: 17
Administrator Setup Procedure
d. You can filter results using a string of up to ten characters.
e. Set Smart Match to On if you want Access Authenticator to attempt to match profiles with
existing Access Authenticator users. (See Import Users screen for more details.)
f. Click Start Import to begin importing profiles. After import, use the 'Assign Users to IBM i
Profiles' section to link Access Authenticator users with imported IBM i profiles. Tips: l
If Smart Match was enabled, use the icon to help identify matching users.
l
If the IBM i user was already assigned to an Access Authenticator user, the Access
Authenticator user name appears in the column to the right of the Smart Match results.
l
Click Add User to display a menu that allows you to select an Access Authenticator user for the imported IBM i profile. Click within the text box and type to quickly identify the
Access Authenticator user you would like to select, or use the scroll bar.
l
Click Edit User to open the Edit User screen
where you can edit user settings.
Send Email to Users
After users have been added to Access Authenticator, they need to be informed how to register the device(s) they will be using for authentication. Access Authenticator provides administrators with a pre-configured (and customizable) email that can be used for this purpose. The email includes the Access Authenticator User name, and a link to the User Portal, which allows them to register devices.
Configuring Email Settings
1. In the Navigation Pane, click Email to configure email settings. See Email Settings screen .
a. For 'Enabled,' choose On to allow emails to be sent from Access Authenticator.
b. For 'Host,' enter your organization's email server (e.g. smtp.yourcompany.com).
c. For 'Port,' select the email server port. (The default is 25, the usual default smtp port.)
d. Set 'Use SSL with Email' to On to secure the connection between Access Authenticator and your mail server.
e. For 'Email,' enter the account you want in the From field for outgoing messages.
f. Enter your login credentials.
g. If desired, enter a custom message. For example, if you intend to enable Exit Point authentication, you might inform users that they will need to download and install the Desktop
Reference Manual www.helpsystems.com
page: 18
Administrator Setup Procedure
Agent from the User Portal during the registration process in order to authenticate Exit Point
Sign ons.
2. Click Preview User Portal registration email to preview the contents of the email. This is a representation of how the message will look to users.
3. Click Save.
Sending a 'Welcome' Email to Users
1. On the Navigation Pane, choose Users to go to the Users screen .
2. Check the user(s) and/or group(s) you want to email.
3. Click Send Email. A confirmation message appears.
4. Click Send. An email is sent to the selected recipients.
Users will now be able to register devices using the User Portal and authenticate.
Reference Manual www.helpsystems.com
page: 19
User Setup Procedure
User Setup Procedure
Use the following procedure to install and configure Access Authenticator in preparation for authenticating with your mobile device or YubiKey.
You will receive an email from your administrator when you are ready to begin. This email will include the links you need to get started.
1. Open the email sent by your administrator with the subject "Welcome to Access Authenticator." Read this email.
2. If you will be using a mobile device for authentication, download the HelpSystems Access
Authenticator mobile app from your device's app store (iTunes App Store for iOS or Google Play for
Android). Links to these apps are included in the email you received.
3. Click the Go to Access Authenticator User Portal link, complete the sign in form (using the Access
Authenticator User Name specified in the email you received), and click Login. The User Portal appears. This is the page used to register and manage your device(s).
4. If you will be using Exit Point sign on (e.g. FTP), you will also need the Access Authenticator Desktop
Agent installed on your desktop (Windows) workstation, and started (if the Desktop Agent has not already been installed by your IT staff).
a. Click Download the Desktop Agent and follow the on-screen instructions to install it.
b. Use your Windows Start Menu to start the Access Authenticator Desktop Agent program.
c. Login to the Desktop Agent and specify the Insite server URL (e.g. http://yourservername:3030).
for more details.
Reference Manual www.helpsystems.com
page: 20
5. In the User Portal, click Add Device to add an authentication device.
User Setup Procedure
6. Select the type of device from the Device drop-down and add a description.
7. Check 'Make this my default device' if this is the device you will usually use to authenticate.
8. Complete the registration using the following steps: l
To add a YubiKey, insert the YubiKey and press the button (a short press). This will authenticate it and add it as a device.
NOTE:
If this is the first time the YubiKey has been inserted, it may take a few moments to install drivers. After installation, you may need to remove the YubiKey, re-insert, and repress.
l
To add a mobile device:
a. Click Sync device. The Sync Mobile Device screen appears.
NOTE:
You can choose Save device, sync later to keep a record of the device in the
User Portal, buy synchronize it with Access Authenticator later.
Reference Manual www.helpsystems.com
page: 21
User Setup Procedure
b. On your mobile device, open the Access Authenticator app. Click the gear icon in the upper right .
Reference Manual www.helpsystems.com
page: 22
User Setup Procedure
c. Scan the on-screen QR code with your device's camera to sync. (When the QR code appears in the camera's range, it scans and closes automatically).
NOTE:
If your camera is broken, you can click Manual Entry to type the string manually on your mobile device. In the Sync Mobile Device screen, scroll down and choose
Switch to manual entry to acquire the Authentication Key to be entered.
d. Click Close to close the Sync Mobile Device window. Your device is registered.
9. An email with the subject "Access Authenticator - New Device Registration" appears in your inbox, which includes the type and description of the registered device. You are now ready to authenticate.
Reference Manual www.helpsystems.com
page: 23
User Authentication
User Authentication
After you have registered a YubiKey or mobile device, you are ready to authenticate.
Authenticating an Interactive IBM i Sign On
1. Sign on to the IBM i system your administrator has configured with Access Authenticator. When you do, a screen with one or more of the possible authentication methods appears:
2. Enter 1 next to the authentication method you would like to use, and do the following to authenticate: l
For One-Time Password (OTP), open the mobile app and enter the six-digit number from your mobile device into the IBM i prompt, then press Enter.
l
For Mobile Push Notification, open the notification using the Access Authenticator mobile app and tap Accept.
l
For Biometrics (Mobile Fingerprint Scan), open the notification using the Access Authenticator mobile app and tap Accept, then scan your fingerprint.
l
For Printed list of backup OTPs, enter a valid six-digit password, then press Enter.
l
For YubiKey ID, insert the YubiKey and press (short press) the YubiKey button.
NOTE:
See Troubleshooting Authentication with your Mobile Device if you have difficulties
authenticating with your mobile device.
3. If authentication is successful, you are allowed to sign on.
Authenticating an FTP IBM i Sign On
If you are signing on using an Exit Point, like FTP, the Access Authenticator Desktop Agent must be installed
).
1. Connect to the IBM i via FTP and sign on.
2. The Access Authenticator Desktop Agent appears on your Windows workstation.
Reference Manual www.helpsystems.com
page: 24
User Authentication
NOTE:
If you do not see the above screen, click the arrow in the upper right corner of the Desktop
Agent window:
Reference Manual www.helpsystems.com
page: 25
User Authentication
3. To allow the connection, click Allow. For Device, click the drop-down arrow and select the device you will use to authenticate. You are presented with one or more authentication options. Use one of the following methods to authenticate: l
Click One-Time Password (OTP), then open the Access Authenticator mobile app. Enter the six-digit number from your mobile device into the Desktop Agent, then press Enter or click
Submit.
l
Click Push Notification, the open the notification using the Access Authenticator mobile app and tap Accept.
l
Click Mobile Biometrics, then open the notification using the Access Authenticator mobile app and tap Accept, then scan your fingerprint.
l
For YubiKey ID, click Not ready. Click here. if shown. Insert the YubiKey and press (short press) the YubiKey button.
l
For Printed list of backup OTPs, enter a valid six-digit password, then press Enter (or click
Submit).
NOTE:
See Troubleshooting Authentication with your Mobile Device if you have difficulties
authenticating with your mobile device.
4. If authentication is successful, you are granted access.
Reference Manual www.helpsystems.com
page: 26
Reference
The topics in this section include descriptions of Access Authenticator's options and controls.
Reference
Reference Manual www.helpsystems.com
page: 27
Agents screen
Agents screen
How to Get There
In the Navigation Pane, choose Agents.
What it Does
Use these settings to add, remove, enable, disable Access Authenticator agents.
Options
Add
Click Add to open the New Systems
page where you can define a new agent.
Systems Defaults
[agent list]; Cancel • Delete • Enable Selected • Disable Selected
Check the box to the left of one or more systems and additional buttons appear at the top of the screen.
l
Cancel. Click Cancel to dismiss the buttons.
l
Delete. Click Delete to remove the selected systems from Access Authenticator.
Reference Manual www.helpsystems.com
page: 28
l
Enable Selected. Click Enable Selected to begin authentication for the selected systems.
l
Disable Selected.Click Disable Selected to end authentication for the selected systems.
Click the icon to display the following context menu.
Agents screen
You can use these options to make changes to the system.
l
Enable. Click Enable to begin authentication on the system.
l
Edit. Click Edit to open the Edit System
screen, where you can make changes to the system's settings.
l
Delete. Click Delete to remove the system from Access Authenticator.
l
Close. Click Close to dismiss the context menu.
Reference Manual www.helpsystems.com
page: 29
Authentication Managers screen
Authentication Managers screen
How to Get There
In the Navigation Pane, choose Managers.
What it Does
This screen lists the Authentication Managers that have been added to Access Authenticator. You can use settings on this screen to view, add, and delete Authentication Managers. At least one Authentication
Manager must be added before configuration settings can be made (using the Settings screen
). The
Authentication Manager set to Primary is the one used for configuration (see Edit Manager screen
).
The Authentication Manager is Access Authenticator's central processing component. It houses all the configuration settings and user registration data, and is the software that users connect to when they authenticate. Administration of the Authentication Manager is controlled with HelpSystems Insite. See the
HelpSystems Insite User Guide for more details on HelpSystems Insite.
Upon signing on to any system secured by Access Authenticator, an Authentication Manager is chosen at random to process the authentication request.
Reference Manual www.helpsystems.com
page: 30
Authentication Managers screen
Options
Add
Click Add to open the New Manager
page where you can define a new Authentication Manager.
[manager list]; Cancel • Delete
Check the box to the left of one or more Managers and additional buttons appear at the top of the screen.
l
Cancel. Click Cancel to dismiss the buttons.
l
Delete. Click Delete to remove the selected Managers from Access Authenticator.
Click the icon to display the following context menu.
You can use these options to make changes to the Manager.
l
Edit. Click Edit to open the Edit Manager screen, where you can make changes to the Manager's
settings.
l
Delete. Click Delete to remove the Manager from Access Authenticator.
l
Close. Click Close to dismiss the context menu.
Reference Manual www.helpsystems.com
page: 31
Access Authenticator Desktop Agent
Access Authenticator Desktop Agent
How to get there
The desktop agent appears when prompted by an Access Authenticator authentication request.
What it does
The Desktop Agent allows you to authenticate using a desktop computer as an alternative to the IBM i green screen agent.
When prompted, you are presented with the authentication methods made available by your Access
Authenticator administrator. If you select one of the One-Time Password methods, for example, a One-Time
Password sent to a mobile device via SMS, you will be able to enter the One-Time Password into the Desktop
Agent to be submitted to Access Authenticator for validation.
See also User Authentication .
Reference Manual www.helpsystems.com
page: 32
Access Authenticator Desktop Agent
Login Options
Login Type
Choose whether you are using Active Directory or an IBM i user profile for authentication.
Access Authenticator Username
This is your Access Authenticator user name.
The remaining login options change depending on your selection:
For Active Directory
Active Directory Username
This is the username of your Active Directory account.
Active Directory Password
This is the password for your Active Directory username.
For IBM i
IBM i System
This is the IBM i system that is being used by your administrator for authentication.
IBM i User Profile
This is the IBM i user profile used for authentication.
IBM i Password
This is the password of your IBM i user profile.
Login
Click Login to log in to the Access Authenticator Desktop Agent.
Settings
This screen displays your current configuration and allows you to configure your Access Authenticator
Desktop Agent settings. At the top, the HelpSystems Insite server being used for authentication is listed, as well as your status including the user you are logged-in as, and whether you are using an Active Directory account or an IBM i user profile for authentication.
Reference Manual www.helpsystems.com
page: 33
Access Authenticator Desktop Agent
Start Access Authenticator when PC is turned on
Move this slider to the right to indicate that you want the Access Authenticator Desktop Agent to start when your computer is started.
Remember me
Move this slider to the right to indicate you want Access Authenticator to remember your login information.
Play notification sound
Move this slider to the right to indicate you want Access Authenticator to chime when prompted by an authentication request.
Reference Manual www.helpsystems.com
page: 34
Access Authenticator Desktop Agent
Device Management
Click Access User Portal to open the Access Authenticator User Portal, where you can manage the devices you are using as factors of authentication.
Reference Manual www.helpsystems.com
page: 35
Edit Default System
Edit Default System
How to Get There
In the Navigation Pane, choose Agents, then Systems Defaults.
What it Does
The settings on this page allow Access Authenticator administrators to configure the default action to perform (allow or deny) for IBM i user profiles not allocated to an Access Authenticator user on systems that authentication is enabled on.
Upon signing on to a system secured by Access Authenticator with a user profile not attached to an Access
If 'Use Agent Defaults' is set to On, or the user profile is otherwise allowed by the individual system's settings,
Access Authenticator defers to the settings on this screen.
Administrators can then allow or deny access for individual new user profiles as exceptions to the default action.
This page also allows administrators to change the default authentication status (enabled or disabled) for each exit point.
Reference Manual www.helpsystems.com
page: 36
Edit Default System
Options
Default Unassigned Profile Action: Deny users access • Allow users access
Choose 'Deny users access' to reject login attempts by IBM i user profiles unfamiliar to Access Authenticator.
Choose 'Allow users access' to grant access to user profiles unfamiliar to Access Authenticator. Unassigned
Unassigned Profile Action
If any of the profiles in this list come through one of the system's exit points, and Access Authenticator can't find an Access Authenticator user attached to that profile to challenge for authentication, Access
Authenticator will check the Unassigned Profile Action setting for that user profile. If it is set to Allow, the user will not be challenged with an authentication request and will be permitted to sign on. If the user is set to
Deny, they will be denied access.
Add Profile • Remove
Click Add Profile to open the Select Profiles screen, where you can choose a profile on the selected system.
Select a user and click Remove to remove that user from the list.
[profile list]; Deny • Allow
Choose 'Deny' from the drop-down list adjacent to a user to reject login attempts by that user. Choose 'Allow' to grant access to the adjacent user.
Exit Points; Activate • Deactivate
Check the exit points you would like to activate or deactivate. Whether the exit point is set to activated or deactivated initially depends on the system's default settings when added to Access Authenticator. Access
Authenticator supports the TCP Signon Server, REXEC Server Logon, FTP Server Logon, and FTP Server
Requests exit points. Click Activate to secure them with Access Authenticator. Click Deactivate to stop securing them with Access Authenticator.
Reference Manual www.helpsystems.com
page: 37
Email Settings screen
Email Settings screen
How to Get There
In the Navigation Pane, choose Email.
What it Does
Once users have been added to the Authentication Manager database, they can be sent an email to advise them of this fact. The email includes a link to the self-service portal where they can complete the registration process and maintain their account details. Use this screen to configure your email server settings and define the content of the message.
Options
Enabled
Choose this option to enable email.
Host
This is the host name of your email server.
Reference Manual www.helpsystems.com
page: 38
Email Settings screen
Port
This is the port used by your email server.
Use SSL with email
Choose this option to secure email correspondence with SSL.
This is the email address that will appear in the "From" field of the recipient's message.
Username
Enter the username required by mail server (if credentials are required by the mail server).
Password
Enter the password required by the mail server (if credentials are required by the mail server).
Message (optional):
Enter a message to include for new users.
Preview User Portal registration email
Click this button to display a preview of the email that will be sent to users.
Reference Manual www.helpsystems.com
page: 39
Access Authenticator Home
Access Authenticator Home
Share the URL on this screen with users in order for them to access the Access Authenticator User Portal.
Reference Manual www.helpsystems.com
page: 40
Import Users
Import Users
How to Get There
In the Navigation Pane, choose Users. Click Add > Import Users.
What it Does
Use this screen to import users from an Active Directory or IBM i user database. See also Importing Users .
Options
Cancel • Start Import
users based on your settings.
Location
Choose whether you would like to import records from Active Directory or user profiles from one or more
IBM i systems.
[Active Directory]
LDAP Context
Enter the LDAP context to specify the user you would like to import. LDAP Settings can be configured on the
.
Group
editing Groups.
Reference Manual www.helpsystems.com
page: 41
Import Users
[IBM i]
System
Choose the system that includes the user profiles you would like to import.
Filter
Narrow import results based on input string. 10 character max limit.
Smart Match; On • Off
Smart Match cross-references the IBM i profiles that are being imported against the existing Access
l
The first and last name with a space.
l
The first and last name with no space.
l
The first initial followed by the last name with no space.
The match looks for these strings in the IBM i profile's name and description fields. For example, for Access
Authenticator user "Shirley Matchwell," Access Authenticator will match IBM i profiles that contain the following in either the user profile Name or Text description fields: "shirley matchwell," "shirleymatchwell," and "smatchwell."
NOTE:
Smart Match disregards case during its comparison.
TIP:
If network users have both Active Directory accounts and IBM i user profiles, import the Active
Directory accounts first to create the Access Authenticator users, then import the IBM i user profiles using Smart Match to match them to the existing Access Authenticator users imported from Active
Directory.
Start Import
Click this button to begin the import process.
Reference Manual www.helpsystems.com
page: 42
Import Users
Assign Users to IBM i Profiles
Use this screen to link the imported IBM i users with existing Access Authenticator users, or add them as new
Access Authenticator uses.
Reference Manual www.helpsystems.com
page: 43
LDAP Settings screen
LDAP Settings screen
How to Get There
In the Navigation Pane, choose LDAP.
What it Does
Use these settings to configure Lightweight Directory Access Protocol (LDAP) settings in order to prepare
Access Authenticator for profile import from Active Directory.
NOTE:
These settings are specific to the Access Authenticator module, and do not pertain to the Insite authentication settings configured on Insite's Authentication page.
Options
LDAP Host
This is the host name of your LDAP server.
LDAP Port
This is the port number used to communicate with the LDAP server. The default value, 389, is the standard number used for communicating with an LDAP server in plain text mode. Do not change this unless you communicate with your LDAP server on a non-standard port.
Reference Manual www.helpsystems.com
page: 44
LDAP Settings screen
Use SSL with LDAP
Select On to use SSL (Secure Socket Layer). SSL provides cryptographically secure communication.
LDAP Administrator
Enter the username of the LDAP administrator.
Administrator Password
Enter the LDAP administrator's password.
Default Context
This is the command used by Access Authenticator to query LDAP directory records during import.
User ID Field Name
Enter the LDAP field used for the User ID.
Reference Manual www.helpsystems.com
page: 45
New/Edit Group
New/Edit Group
How to Get There
In the Navigation Pane, choose Users. To add a new Group, choose Add > Add Group. To edit an existing
Group, click for a Group and select Edit.
What it Does
These settings allow Access Authenticator administrators to define Groups to use for different subsets of users. Each group can have its own authentication settings.
Administrators can select a Group for a user in the New/Edit User screen
.
Options
Authentication Methods
Here, specify authentication settings for the Group. All users in the Group will inherit these
options are available.) l
Inherit. Choose this option to use the setting configured in Settings for the authentication method.
l
Disabled. Choose this option to turn the authentication method off for all users in the group.
Reference Manual www.helpsystems.com
page: 46
New/Edit Group
l
Enabled. Choose this option to turn the authentication method on for all users in the group.
Users
This is a list of users in the Group.
Delete • Cancel • Save
Choose Delete to remove the Group from Access Authenticator. Choose Cancel to dismiss the screen
without making changes. Click Save to save the Group's settings and return to the Users screen
.
Reference Manual www.helpsystems.com
page: 47
New/Edit Manager
New/Edit Manager
How to Get There
To add a new Manager, in the Navigation Pane, choose Managers, then click Add.
To edit an existing Manager, in the Managers screen, double-click a Manager, or, click for a Manager and choose Edit.
What it Does
This screen allows Access Authenticator administrators to add an Authentication Manager or edit an existing one. Access Authenticator does not limit the number of Authentication Managers that can be added.
Options
Address
This is the IP address or name of the Manager system.
Port
This is the port number used to communicate with the Manager system.
Primary
Choose On to select this instance as the Primary Authentication Manager. The Primary Authentication
Manager is used for configuration. See Settings screen
. Choose Off if you would not like to assign this instance as the Primary Authentication Manager.
Reference Manual www.helpsystems.com
page: 48
New/Edit Manager
UseSSL
Choose On to use SSL encryption for this connection. Choose Off if you do not intend to use SSL encryption for this connection. In order to use TLS security to encrypt an Authentication Manager Connection from
Authentication Manager Connection .
License
Hardware ID
This is the manager's unique ID.
License Key
This is the license key provided by HelpSystems. Contact [email protected]
if you need to request a new license key.
Reference Manual www.helpsystems.com
page: 49
New/Edit System
New/Edit System
How to Get There
In the Navigation Pane, choose Agents, then IBM i Agent, then click Add.
What it Does
Use these settings to add a system to be authenticated with the IBM i agent. The system needs to have been added to Insite (see Product Connections ), and have Access Authenticator installed.
The settings on this page allow Access Authenticator administrators to configure the action to perform (allow or deny) for IBM i user profiles on the system that are not allocated to an Access Authenticator user.
Upon signing on to a system secured by Access Authenticator with a user profile not attached to an Access
Authenticator user, Access Authenticator first consults the settings on this screen to determine whether to allow or deny the user access. If 'Use Agent Defaults' is set to On, or the user profile is otherwise allowed by
.
In other words, here, Access Authenticator administrators can allow or deny access to specific user profiles as exceptions to the default action specified on the Edit Default System screen.
This page also allows administrators to change the default authentication status (enabled or disabled) for each exit point.
Reference Manual www.helpsystems.com
page: 50
New/Edit System
Options
System; Select System (New System only)
Click Select System to open the Select System screen
, where you can choose the system to be added.
Default Unassigned Profile Action
Choose Deny users access to reject login attempts by IBM i user profiles not connected to an Access
Authenticator user. Choose Allow users access to grant access to user profiles not connected to an Access
Authenticator user. Unassigned users that have been granted access will inherit the user settings of the
setting defined in the Edit Default System page .
Unassigned Profile Action
Use Agent Defaults; On • Off
Off to use the Unassigned Profile Action settings defined on this page for this system.
Exit Points; Activate • Deactivate
Check the exit points you would like to activate or deactivate. Click Activate to secure them with Access
Authenticator. Click Deactivate to stop securing them with Access Authenticator. For example, if the system is enabled, and you set an exit point to Deactivate and click Save, Access Authenticator sends a message to deregister the exit point program with Access Authenticator. If the system is not currently enabled in Access
Authenticator, and this setting is changed, the setting is stored in the database so that when the system is enabled within Access Authenticator, Access Authenticator will apply the activate/deactivate setting as appropriate, and register/deregister the exit point program accordingly.
Reference Manual www.helpsystems.com
page: 51
New/Edit User
New/Edit User
Reference Manual www.helpsystems.com
page: 52
New/Edit User
How to Get There
To add a new User, in the Navigation Pane, choose Users, then click Add > Add User.
To edit an existing user, in the Users screen, double-click a user, or, click for a User and choose Edit.
What it Does
This screen allows Access Authenticator administrators to edit the properties of a user enrolled in the authentication manager. There is some overlap with some of the features provided by the self service portal for the user to edit their own profile. The administrator is able to edit some details that the user can't edit, though (and vice versa). The administrator is able to: l
Add/Edit/Remove IBM i profiles assigned to the user l
Add/Remove devices registered by the user
Options
Delete
Click this button to delete the user in Access Authenticator.
Send Email
Click this button to send the user an email. See Email Settings
for details.
NOTE:
You can also send an email to several users at once, or groups of users, from the Users screen
.
Access Authenticator Name
The user profile name. This is the name that will be emailed to users so that they can access the User Portal.
Active Directory Username
The username of the User in Active Directory.
Full Name
The name of the person to be associated with the profile.
The email address of the User. Access Authenticator sends users account and device registration emails.
Group
The Group the User is assigned to.
Reference Manual www.helpsystems.com
page: 53
New/Edit User
User Status
Enabled
Choose Yes to enable the user within Access Authenticator. Choose No to disable the user. Yes must be selected in order for the user to log in.
Authenticate User
If Yes is selected, (and the user is enabled), the user will be challenged to provide the second authentication factor. If No is selected, the user will be able to log in without providing a second authentication factor.
Registered Devices
Devices registered by the user that can be used for authentication are listed here. An administrator can enable, disable, or delete any of the user's devices.
Authentication Methods
For each of the authentication methods, one of the following three settings is possible: l
Disabled. Choose Disabled to turn the authentication method off.
l
Enabled. Choose Enabled to turn the authentication method on.
l
Group setting for an authentication method is set to Inherit, the user will acquire the setting specified
.
NOTE:
Descriptions of the authentication methods are available in the Settings topic.
IBM i Profiles and Systems
Click Add to begin the process of importing profiles from an IBM i system.
Cancel • Save
Click Cancel to dismiss the screen without making changes. Click Save to create or update the user.
Reference Manual www.helpsystems.com
page: 54
Promoting a Secondary Authentication Manager to Primary
Promoting a Secondary Authentication
Manager to Primary
If the Primary Authentication Manager is down due to a system failure, you can use the steps in this section to resume authentication services by promoting a Secondary Authentication Manager to Primary. These steps can also be used if a Primary system needs to be taken offline for some reason, such as for maintenance.
NOTE:
These steps require that you have installed the Access Authenticator Authentication Manager and
Data Services on both a Primary and Secondary system, and initiated replication of the Primary on the
Secondary (see Installing the Authentication Manager and Data Services ).
Promoting a Manager to Primary on Windows
1. If the Primary system has crashed, and the purposes of promotion are for recovery, skip to step 2. If the Primary database needs to be taken offline, on the system running the Primary database, stop the service HSAccessAuthenticatorDB.
2. Login to the system running a/the Secondary Authentication Manager. (You will need to know its
IP address.)
3. Run the following command in C:\Program Files\Help Systems\Access
Authenticator
:
standby2master
This command sets postgres to stop replicating data and become the Primary Manager.
4. Run the following command in C:\Program Files\Help Systems\Access
Authenticator\consul
:
set_ds_primary -ip current ip -port discovery port
NOTE:
The default discovery port is 8500.
This command sets some internal variables that tells Access Authenticator where the new postgres master (Primary) is located.
5. Start the service 'HSAccessAuthenticatorDB' on the new Primary system.
6. If one or more additional Secondary installations are available, they need to be instructed to begin replicating from the new Primary system. Login to those systems and run the following command (in
C:\Program Files\Help Systems\Access Authenticator
):
switchmaster new Primary system ip
If no additional Secondary system is available, you can install the Authentication Manager and Data
Services (as described in Installing the Authentication Manager and Data Services ) on one or more
Secondary systems, and run master2standby, to restore failover/recovery capability.
Next, the new Primary system needs to be identified in Insite.
7. Open Insite and select Access Authenticator from the Navigation Pane, then choose Managers.
Reference Manual www.helpsystems.com
page: 55
Promoting a Secondary Authentication Manager to Primary
9. Set Primary to On.
10. Click Save.
Promoting a Manager to Primary on Linux
1. If the Primary system has crashed, and the purposes of promotion are for recovery, skip to step 2. If the Primary database needs to be taken offline, on the system running the Primary database, stop the service 'HelpSystemsAccessAuthenticatorDatabase'.
2. Login to the system running a/the Secondary Authentication Manager. (You will need to know its
IP address.)
3. Run the following command in opt\helpsystems\AccessAuthenticator:
standby2master
This command sets postgres to stop replicating data and become the Primary Manager.
4. Run the following command in opt\helpsystems\AccessAuthenticator\consul:
set_ds_primary -ip current ip -port discovery port
NOTE:
The default discovery port is 8500.
This command sets some internal variables that tells Access Authenticator where the new postgres master (Primary) is located.
5. Start the service 'HelpSystemsAccessAuthenticatorDatabase' on the new Primary system.
6. Start the service 'HelpSystemsAccessAuthenticatorManager' on the new Primary system.
7. If one or more additional Secondary installations are available, they need to be instructed to begin replicating from the new Primary system. Login to those systems and run the following command (in opt\helpsystems\AccessAuthenticator
):
switchmaster new Primary system ip
If no additional Secondary system is available, you can install the Authentication Manager and Data
Services (as described in Installing the Authentication Manager and Data Services ) on one or more
Secondary systems, and run master2standby, to restore failover/recovery capability.
Next, the new Primary system needs to be identified in Insite.
8. Open Insite and select Access Authenticator from the Navigation Pane, then choose Managers.
10. Set Primary to On.
11. Click Save.
Reference Manual www.helpsystems.com
page: 56
Select Systems
Select Systems
Use this screen to select one or more IBM i systems.
Options
[Search box]
Enter a value in the search field to quickly identify systems that have been added. The list is filtered as you type. In order for systems to appear in this list, they must first be added in Insite. See Product Connections in the Insite User Guide.
Cancel • Next
Click Cancel to dismiss this screen without selecting one or more systems. Click Next to advance. See also
Select IBM i profiles .
Reference Manual www.helpsystems.com
page: 57
Settings screen
Settings screen
How to Get There
In the Navigation Pane, choose Settings. At least one Authentication Manager must exist before settings can
be configured. See Managers screen
.
What it Does
Use these settings to allow an Access Authenticator administrator to define which authentication methods are authorized, and configure other settings pertaining to Access Authenticator's user interactions.
Options
Authentication Methods
Choose the authentication methods available to network users.
Reference Manual www.helpsystems.com
page: 58
Settings screen
l
One-Time Password (OTP). The Access Authenticator agent software prompts the user to enter a one-time password. Network users use their mobile app to generate the one-time password and they enter the value generated . This value is authenticated with the authentication manager.
l
Mobile Push Notification. A push notification is sent to the network user's mobile app, which displays a notification on-screen. The user is presented with the profile that is attempting to sign in, information about the system that’s being signed into, and a prompt to confirm or deny whether the sign-in attempt is legitimate. If the user confirms that the sign-in attempt is legitimate, a message is returned to the authentication manager to authenticate and the user is allowed to sign in. If the user denies the sign-in attempt, authentication fails and the user is not allowed to sign in. The authentication manager alerts an administrator to a possible hacking attempt.
l
Biometrics (Mobile Fingerprint Scan). This feature is available on mobile devices that contain a fingerprint scanner (e.g. the Google Nexus 5X and 6P, or the iPhone 5S and up). Similar to the push notification processing, a notification is sent to the mobile device prompting the user to authenticate using the fingerprint scanner. If the sign-in attempt is legitimate, the user can authenticate using the fingerprint scanner. If it isn’t, they will have the option to deny the request (as per push notifications). l
YubiKey. The YubiKey is a FIDO certified U2F USB authentication devicethat can be used as an alternative to the Access Authenticator mobile app. When the Access Authenticator agent software prompts for the second factor, the user selects the YubiKey authentication option, inserts the YubiKey into a USB port on their PC/laptop, and presses a button on the YubiKey. l
Printed List of OTPs. This is a printed list of one-time passwords, and is a backup authentication method for the user if they lose their smart phone.
New User Action
This drop-down menu allows you to configure Access Authenticator's authentication settings upon user creation.
When a new user is created:
l
Set User to Authenticate Immediately. If you choose this option, new users enrolled in Access
Authenticator will be required to authenticate using a registered device the first time they sign on. This means they will need to register a device with Access Authenticator prior to their next sign on attempt in order to gain access.
WARNING:
If this option is selected, users will be locked out of the system until they have registered a device with Access Authenticator.
l
Set User to Authenticate only after Device Registration. If you choose this option, new users enrolled in Access Authenticator will not be prompted to authenticate upon sign on until after they have registered a device.
l
Manually Set Authentication Option for User. Administrator is responsible for activating or
for each new user (regardless of whether a device has been registered or not).
Reference Manual www.helpsystems.com
page: 59
Settings screen
User Portal
User Portal Session Timeout
Enter the number of minutes an idle User Portal session will remain active before timing out and requiring the user to sign on again.
Printed Backup OTP Expiration
Allowed Attempts
Enter the number of days a printed list of one-time passwords will be valid.
Reference Manual www.helpsystems.com
page: 60
Troubleshooting Authentication with your Mobile Device
Troubleshooting Authentication with your
Mobile Device
The Access Authenticator mobile app uses features of your mobile device to facilitate authentication, including: l
Your biometric touch sensor (required for biometric authentication) l
Your camera (required to scan QR code) l
Push Notifications (required for One-Time Passwords)
Do the following to ensure these features are active and available for use with Access Authenticator.
NOTE:
If your mobile device is configured properly, connected to the Internet (or, if required, your organization's private wi-fi network), and you are still unable to authenticate, contact your administrator for assistance.
Enable your fingerprint touch sensor
Your touch sensor must be configured and enabled in order to authenticate with Access Authenticator. In order to do this, your mobile device must learn your unique fingerprint and store this information for comparison later. If you already use your touch sensor for security (e.g. to unlock your phone), your touch sensor is functional and is ready for use with Access Authenticator. Otherwise, refer to the following to learn how to enable your biometric touch sensor on your device.
Enabling Touch ID on your iPhone or iPad
Refer to Use Touch ID on iPhone and iPad .
Enabling Fingerprint Security on your Android device
Refer to the instructions that pertain to your device. If your device is not listed below, refer to the device's manufacturer's documentation.
For Samsung Galaxy
1. Go to the Settings menu.
2. Slide over the Personal tab.
3. Select Lock screen and security.
4. Under the Security category, choose Fingerprints.
5. Select Add fingerprint.
6. Place your finger on the Home button. You’ll need to place your finger on the home button multiple times in order for Samsung to learn your fingerprint from multiple angles.
Reference Manual www.helpsystems.com
page: 61
Troubleshooting Authentication with your Mobile Device
For Pixel or Nexus
1. Open your device's Settings app
.
2. Under Personal, tap Security and then Pixel Imprint or Nexus Imprint.
3. Follow the on-screen directions.
4. If you don't already have a screen lock, you'll be asked to add a backup PIN, pattern, or password to unlock your device.
5. Scan your first fingerprint.
TIP:
Place your finger on your device's sensor (not its screen). Hold your phone in the same way that you'd normally hold it when unlocking. For example, hold your phone with its screen facing you.
See Unlock with your fingerprint for more details.
Allow Access Authenticator to use your camera
Access Authenticator needs access to your mobile device's camera in order to scan the QR code used to sync your device with the Authentication Manager.
Granting Access Authenticator access to your camera on iPhone or iPad
1. Go to Settings > Privacy > Camera.
2. Ensure Access Authenticator is allowed access.
Granting Access Authenticator access to your camera on your
Android device
Refer to the instructions that pertain to your device. If your device is not listed below, refer to the device's manufacturer's documentation.
For Samsung Galaxy
1. From a Home screen, navigate: Apps > Settings > Applications.
2. Tap the Access Authenticator app.
3. If available, tap Permissions.
4. Tap Camera to turn it on.
For Pixel or Nexus
1. Open your device's Settings app .
2. Tap App permissions.
Reference Manual www.helpsystems.com
page: 62
Troubleshooting Authentication with your Mobile Device
3. Tap the Access Authenticator app.
4. Tap Camera.
Allow Access Authenticator to send push notifications
Access Authenticator needs access to your mobile device's messaging capabilities in order to send One-Time
Passwords.
Enabling push notifications on your iPhone or iPad
To get notifications, connect to a Wi-Fi or cellular network. Then do the following:
1. Go to Settings > Notifications, select the Access Authenticator app, and make sure that Notifications are turned on.
2. If you have notifications turned on, but you're not receiving alerts, the alert style might be set to None.
Go to Settings > Notifications and check that your Alert Style is set to Banners or Alerts.
3. Make sure that you’re signed in to your Apple ID. Go to Settings > iTunes & App Stores and enter your Apple ID and password.
4. Make sure that Do Not Disturb is turned off. Go to Settings > Do Not Disturb and tap Manual if it's turned on.
Enabling push notifications on your Android Device
Refer to the instructions that pertain to your device. If your device is not listed below, refer to the device's manufacturer's documentation.
For Samsung Galaxy
1. From the home screen, tap Apps.
2. Scroll to and tap Settings.
3. Scroll to and tap Notifications.
4. Tap to enable for the Access Authenticator app.
For Pixel or Nexus
1. Open your device's Settings app
.
2. Tap Notifications.
3. Tap Access Authenticator.
4. Tap the options that will allow you to see notifications for Access Authenticator. For example: l
Disable Block all l
Override Do Not Disturb
Reference Manual www.helpsystems.com
page: 63
Users screen
Users screen
How to Get There
In the Navigation Pane, choose Users.
What it Does
Use these settings to view, add, and remove Access Authenticator users and user groups.
A Default Group is always available to house users that do not belong to any other group. Administrators can create multiple groups for different subsets of users.
Options
Add
Use the options here to add users, import user profiles, or add user groups. l
Click Add User to open the New User page where you can define a new user to add.
l
Click Import Users to open the Import Users screen where you can import user profiles from Active
Directory database or IBM i system. l
Click Add Group to open the New Group
screen where you can add a new User Group.
Reference Manual www.helpsystems.com
page: 64
Users screen
[user list]; Delete • Enable Selected • Disable Selected • Authenticate on • Authenticate off •
Add to group
Check the box to the left of one or more Users and/or Groups and additional buttons appear at the top of the screen.
l
Delete. Click Delete to remove the selected Users from Access Authenticator.
l
Enable. Click Enable to begin authentication for the selected Users.
l
Disable.Click Disable to end authentication for the selected Users. l
Authenticate on. Click Authenticate on to set the Authenticate User status to Yes.
l
Authenticate off. Click Authenticate off to set the Authenticate user status to No.
l
Add to group. Click Add to group to open the Select a group screen, where you can choose a Group in which you would like to include the selected users.
Click the icon for a User to display the following context menu.
You can use these options to make changes to the system.
l
Edit. Click Edit to open the Edit User
screen, where you can make changes to the system's settings.
l
Delete. Click Delete to remove the User from Access Authenticator.
l
Authentication off/on. Click Authenticate off or Authenticate on to toggle the User's authentication status.
l
Enable/Disable. Click Enable or Disable to enable or disable the user within Access Authenticator.
l
Add to Group. Click Add to Group to add the User to an Access Authenticator User Group.
l
Close. Click Close to dismiss the context menu.
Reference Manual www.helpsystems.com
page: 65
IBM i Agent Reference
IBM i Agent Reference
The topics in this section include descriptions of Access Authenticator's IBM i Agent options and controls.
Reference Manual www.helpsystems.com
page: 66
Deactivate Authentication Verification panel
Deactivate Authentication Verification panel
How to Get There
On the Access Authenticator Main Menu , choose option 3.
What it Does
The Deactivate Authentication Verification panel allows you to deactivate authentication on the system.
Options
No, do not deactivate Authentication • Yes, deactivate Authentication.
Choose No, to continue authenticating. Choose Yes to deactivate authentication on this system.
Command Keys
F12=Cancel
Cancels this panel.
Reference Manual www.helpsystems.com
page: 67
Emergency Override Setup panel
Emergency Override Setup panel
How to Get There
On the Access Authenticator Main Menu , choose option 4.
What it Does
The Emergency Override Setup panel allows you to configure options for the Emergency Override.
Options
Allow Emergency Override
Option which pertain to allow the Emergency Overrride.
Emergency override Users
The Users that are allowed to bypass Authentication in case of an Emergency.
Command Keys
F12=Cancel
Cancels this panel.
Reference Manual www.helpsystems.com
page: 68
Insite Server Configuration panel
Insite Server Configuration panel
How to Get There
On the Access Authenticator Main Menu , choose option 1.
What it Does
The Insite Server Configuration panel allows you to configure options for email notifications.
Options
SMTP Server Options
Options which pertain to communicating with an SMTP Server.
Address
The IP address or DNS name for the Insite Server.
Port
The port number on the Insite server that will be used for communications.
Timeout
Number of seconds before a timeout occurs.
SSL
Indicates whether SSL (Secure Sockets Layer) is used.
Reference Manual www.helpsystems.com
page: 69
Command Keys
F12=Cancel
Cancels this panel.
Insite Server Configuration panel
Reference Manual www.helpsystems.com
page: 70
Powertech Access Authenticator Main Menu
Powertech Access Authenticator Main Menu
How to Get There
Enter command wrkptma.
What it Does
This menu allows you to configure the IP of the Insite server and Authentication Manager used with Access
Authenticator. It also allows you to deactivate authentication.
Options
1. Insite Server Configuration
The Insite Server Configuration allows maintaining the Insite Server settings.
2. Authentication Mananger Configuration
The Authentication Mananger Configuration allows maintaining the Authentication Manager settings.
3. Deactivate Authentication
The Deactivate Authentication allows you to Deactivate Authentication in the event that Insite cannot communicate.
Selection or Command Entry
Selection or Command entry allows you to enter menu options or commands to be processed by the system.
To run a command, type the command and press Enter. For assistance in selecting a command, press F4
(Prompt) without typing anything. For assistance in entering a command, type the command and press F4
(Prompt). To see a previous command you entered, press F9 (Retrieve).
Reference Manual www.helpsystems.com
page: 71
Powertech Access Authenticator Main Menu
Command Keys
F1=Help
Provides additional information about using the display or a specific field on the display.
F3=Exit
Ends the current task and returns to the display from which the task was started.
F9=Retrieve
Displays the last command you entered on the command line and any parameters you included. Pressing this key once, shows the last command you ran. Pressing this key twice, shows the command you ran before that and so on.
Reference Manual www.helpsystems.com
page: 72
Work with Authentication Managers panel
Work with Authentication Managers panel
How to Get There
On the Access Authenticator Main Menu , choose option 2.
What it Does
The Work with Authentication Managers panel allows you to view the IP addresses for the Authentication
Manager.
Options
IP Address
The IP address or DNS name for the Authentication Manager.
Port
The port number that will be used. for communications.
SSL
Indicates whether SSL (Secure Sockets Layer) is used.
Timeout
Number of seconds before a timeout occurs.
Option
Enter a valid option from the list of options provided on the panel.
Reference Manual www.helpsystems.com
page: 73
Appendix
The topics in this section include additional information about Access Authenticator.
Appendix
Reference Manual www.helpsystems.com
page: 74
Promoting a Secondary Authentication Manager to Primary
Promoting a Secondary Authentication
Manager to Primary
If the Primary Authentication Manager is down due to a system failure, you can use the steps in this section to resume authentication services by promoting a Secondary Authentication Manager to Primary. These steps can also be used if a Primary system needs to be taken offline for some reason, such as for maintenance.
NOTE:
These steps require that you have installed the Access Authenticator Authentication Manager and
Data Services on both a Primary and Secondary system, and initiated replication of the Primary on the
Secondary (see Installing the Authentication Manager and Data Services ).
Promoting a Manager to Primary on Windows
1. If the Primary system has crashed, and the purposes of promotion are for recovery, skip to step 2. If the Primary database needs to be taken offline, on the system running the Primary database, stop the service HSAccessAuthenticatorDB.
2. Login to the system running a/the Secondary Authentication Manager. (You will need to know its
IP address.)
3. Run the following command in C:\Program Files\Help Systems\Access
Authenticator
:
standby2master
This command sets postgres to stop replicating data and become the Primary Manager.
4. Run the following command in C:\Program Files\Help Systems\Access
Authenticator\consul
:
set_ds_primary -ip current ip -port discovery port
NOTE:
The default discovery port is 8500.
This command sets some internal variables that tells Access Authenticator where the new postgres master (Primary) is located.
5. Start the service 'HSAccessAuthenticatorDB' on the new Primary system.
6. If one or more additional Secondary installations are available, they need to be instructed to begin replicating from the new Primary system. Login to those systems and run the following command (in
C:\Program Files\Help Systems\Access Authenticator
):
switchmaster new Primary system ip
If no additional Secondary system is available, you can install the Authentication Manager and Data
Services (as described in Installing the Authentication Manager and Data Services ) on one or more
Secondary systems, and run master2standby, to restore failover/recovery capability.
Next, the new Primary system needs to be identified in Insite.
7. Open Insite and select Access Authenticator from the Navigation Pane, then choose Managers.
Reference Manual www.helpsystems.com
page: 75
Promoting a Secondary Authentication Manager to Primary
9. Set Primary to On.
10. Click Save.
Promoting a Manager to Primary on Linux
1. If the Primary system has crashed, and the purposes of promotion are for recovery, skip to step 2. If the Primary database needs to be taken offline, on the system running the Primary database, stop the service 'HelpSystemsAccessAuthenticatorDatabase'.
2. Login to the system running a/the Secondary Authentication Manager. (You will need to know its
IP address.)
3. Run the following command in opt\helpsystems\AccessAuthenticator:
standby2master
This command sets postgres to stop replicating data and become the Primary Manager.
4. Run the following command in opt\helpsystems\AccessAuthenticator\consul:
set_ds_primary -ip current ip -port discovery port
NOTE:
The default discovery port is 8500.
This command sets some internal variables that tells Access Authenticator where the new postgres master (Primary) is located.
5. Start the service 'HelpSystemsAccessAuthenticatorDatabase' on the new Primary system.
6. Start the service 'HelpSystemsAccessAuthenticatorManager' on the new Primary system.
7. If one or more additional Secondary installations are available, they need to be instructed to begin replicating from the new Primary system. Login to those systems and run the following command (in opt\helpsystems\AccessAuthenticator
):
switchmaster new Primary system ip
If no additional Secondary system is available, you can install the Authentication Manager and Data
Services (as described in Installing the Authentication Manager and Data Services ) on one or more
Secondary systems, and run master2standby, to restore failover/recovery capability.
Next, the new Primary system needs to be identified in Insite.
8. Open Insite and select Access Authenticator from the Navigation Pane, then choose Managers.
10. Set Primary to On.
11. Click Save.
Reference Manual www.helpsystems.com
page: 76
Securing an Authentication Manager Connection on Windows
Securing an Authentication Manager
Connection on Windows
In order to use TLS security to encrypt an Authentication Manager Connection from Insite, you must create and configure a Digital Certificate (also called a Certificate Authority). To do so requires the following steps: l
Create a Certificate. Create the certificate on the Windows server running the Authentication
Manager.
l
Enable the Certificate. Enable the Certificate on the Authentication Manager server.
l
Import the Certificate into Insite. Import the Certificate into Insite's Java Runtime Environment.
Creating a Certificate on a Windows Server
You must first generate a .keystore file. Make sure to note the password you enter, as you’ll need this later.
The Authentication Manager comes packaged with its own JVM. To generate the .keystore file on Windows, do the following:
1. On the Server that the Authentication Manager is installed, open the Command Prompt and go to the following directory:
C:\Program Files\Help Systems\Access Authenticator\jvm\bin
2. Enter the following command to generate the key using the keytool: keytool -keysize 2048 -genkey -alias FullDomainName -keyalg RSA keystore authmgr.keystore
After creating a password, you’ll be prompted for your organization's information. When asked for your first and last name, specify the domain name of the server that users will enter in order for their
Authentication Manager name to help ensure that their certificates are valid when connecting to the server. We recommend not using an IP Address.
3. After you have filled in the requested fields, press Enter. The resulting authmgr.keystore file is located in your working directory (C:\Program Files\Help Systems\Access Authenticator\jvm\bin).
4. Export the certification from the keystore you just created so that you can import it into your Insite server’s cacerts file in a later step.
keytool -export -alias FullDomainName -file Domain.crt -keystore authmgr.keystore
5. Copy the .crt file to the Insite Server system.
Enabling the Certificate
1. Stop the Access Authentication Manager service. On Windows, run services.msc to open the Services
Manager. Right-click Access Authenticator Manager and choose Stop.
2. Still on the Authentication Manager sever, open the Command Prompt and go to the following directory:
C:\Program Files\Help Systems\Access
Authenticator\AuthenticationManager\conf
Reference Manual www.helpsystems.com
page: 77
Securing an Authentication Manager Connection on Windows
3. Copy the authmgr.keystore file created into this directory.
4. Open and edit the server.xml file as follows. This file’s location depends on the directory where the portal server is installed (see step 2).
NOTE:
You can edit the server.xml file with any text editor. Be sure to create a backup a copy of the original file before editing. If you are not familiar with the XML format, we recommend using an
XML-aware editor such as XML Notepad or Notepad++.
5. Comment out the code block for protocol="HTTP/1.1"
Connector SSLEnabled="false" compression="force" connectionTimeout="20000" port="3040" protocol="HTTP/1.1" scheme="http" secure="false"/
6. Add in code block :
Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
SSLEnabled="true" scheme="https" secure="true" keystoreFile="conf/authmgr.keystore" keystorePass="password used when creating the keystore" sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2" ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_
AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_
RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_
WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_
AES_256_CBC_SHA" /
Import the Certificate Authority into Insite
1. On the Insite server, stop the HelpSystems Insite service.
a. On Windows, run services.msc to open the Services Manager.
b. Right-click Access HelpSystems Insite Server and choose Stop.
2. Open a command prompt in java 'bin' folder: c:\Program Files (x86)\Help Systems\HelpSystems Insite\jvm\bin
3. Run the import command:
keytool -import -alias Server Alias -file Certificate Path keystore Keystore Path
EXAMPLE:
keytool -import -alias Server2012RAuth.domain.com -file c:\helpsys\Server2012RAuth.crt -keystore "C:\Program Files
(x86)\Help Systems\HelpSystems Insite\jvm\lib\security\cacerts
4. Enter the keystore password, "changeit" by default.
5. Type yes and press Enter.
6. Restart the Insite server
Reference Manual www.helpsystems.com
page: 78
Securing an Authentication Manager Connection on Windows
new Authentication Manager. Set UseSSL to On in the New Managers screen when adding a New
Authentication Manager.
NOTE:
The Insite Sever needs to “see” the full domain name of the Authentication Manager server. The windows Hosts file may need to be updated.
Reference Manual www.helpsystems.com
page: 79
Other Help
For help with the other components of HelpSystems Insite, see these user guides:
HelpSystems Insite User Guide
AutoMate Ops Console User Guide
Robot SCHEDULE for Insite User Guide
Robot NETWORK for Insite User Guide
Network Security for Insite User Guide
Password Self Help for Insite User Guide
Webdocs for Insite User Guide
Other Help
Reference Manual www.helpsystems.com
page: 80
Stáhnout
Veřejný odkaz aktualizován
Veřejný odkaz na váš chat byl aktualizován. You may view and manage your chat links after registration here.
Veřejný odkaz na dokument
Reklama
