KB 120135
How to force IDENTIKEY Authentication Server 3.3
AD configuration wizard to ask encryption key again?
Creation date: 15/09/2011 Last Review: 11/12/2012 Revision number: 4
Document type: How To Security status: EXTERNAL
Summary
When the Procedure from KB 120134 to migrate from VM3.0 AD to IDENTIKEY
Authentication Server 3.3 AD has not been followed correctly, you will need to import the correct encryption key (.esf file) again. This KB explains the procedure to do this.
Details.
1. Stop Apache Tomcat service
2. Stop IDENTIKEY Authentication Server Service
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 1 of 12
3. Stop Virtual Digipass MDC Service
4. Remove the Digipass Support from the first admin user that was created during the previous installation of IDENTIKEY Authentication Server 3.3 that failed
4.1. Open the Active Directory Users and Computers MMC from Start Æ All
Programs Æ VASCO Æ Identikey Server 3.3
4.2. Open the properties of the first administrator used during the failed installation by selecting the TAB Digipass User Account and press the button “Disable
Digipass”
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 2 of 12
Verify that the checkbox is not ticked anymore:
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 3 of 12
5. Use the Microsoft tool ADSIEDIT.MSC to remove a number of object from AD
5.1. Remove the object CFG:DefaultSensitiveKey from the Digipass-Configuration container.
CN=CFG:defaultSensitiveKey,CN=Digipass-Configuration,DC=X
(where DC=X is your configurationdomain name)
Browse to the container Digipass-Configuration, right-click the object and select Delete from the drop-down menu.
Press the Yes button to confirm you want to delete the object
5.2. Remove the object CFG:defaultStorageKey from the Digipass-Configuration container.
CN=CFG:defaultStorageKey,CN=Digipass-Configuration,DC=X
Use the same method as shown in 5.1
5.3. Remove the object KEY:SSMINSTALLSENSITIVEKEY from the Digipass-
Configuration container.
CN=KEY:SSMINSTALLSENSITIVEKEY,CN=Digipass-Configuration,DC=X
Use the same method as shown in 5.1
5.4. Remove the object KEY:SSMINSTALLSTORAGEKEY from the Digipass-
Configuration container.
CN=KEY:SSMINSTALLSTORAGEKEY,CN=Digipass-Configuration,DC=X
Use the same method as shown in 5.1
6. Backup the following files from <Identikey Installation Directory>\ bin directory
(Default installation directory is C:\Program Files\VASCO\Identikey 3.3)
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 4 of 12
- ikey_tomcat_serverca.pem
- ikey_tomcat_cert.pem
- radius.dct
These files will have to copied back later in the procedure
7. Remove the following files from <Identikey Installation Directory>\bin directory
(Default installation directory is C:\Program Files\VASCO\Identikey 3.3)
- reports.xml
- reportfields.xml
- dpadmincmd.xml
- reportformats.xml
- identikeyconfig.xml
- mdcconfig.xml
- ikey_soap_serverca.pem
- ikey_soap_cert.pem
- ikey_seal_serverca.pem
- ikey_seal_cert.pem
- ikey_radius_serverca.pem
- ikey_radius_cert.pem
- ikey_mdc_serverca.pem
- ikey_mdc_cert.pem
8. Remove the deployed webadmin
Remove the following files from
<Identikey Installation Directory>\tomcat\Tomcat 6.0\webapps
- webadmin.war
- the complete directory webadmin
9. Remove the webadmin cache directory
Remove the directory
<Identikey Installation Directory>\tomcat\Tomcat 6.0\work\Catalina\localhost\webadmin
10. Remove the truststore
Remove the file <Identikey Installation Directory>\webadmin\truststore.jks
11. Start the configuration wizard in AD install mode
11.1. Open a DOS box and change to the directory
<Identikey Installation Directory>\bin
11.2. Run the command: ikconfigwizardgui.exe --advanced_ad
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 5 of 12
11.3. This will launch the configuration wizard.
Leave the configuration wizard in this state and move on to step 12.
DO NOT PROCEED THROUGH THE WIZARD UNTIL THE NEXT STEP IS
PERFORMED.
12. Restore the backed up files in step 6 copy the following files back into <Identikey Installation Directory>\ bin
- ikey_tomcat_serverca.pem
- ikey_tomcat_cert.pem
- radius.dct
13. Run through the wizard as if you were doing a full install.
13.1. Do NOT check the checkbox “this is not the first Identikey Sever to be installed”
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 6 of 12
13.2. Ensure that "Use Legacy Mode" is selected
13.3. Ensure to load the VM3.0 encryption file (.esf file)
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 7 of 12
13.4. The wizard will attempt to re-create the key data in the schema. o
If the wizard completes successfully, press the Finish button and proceed to step 16. o
If the wizard fails to complete, DO NOT EXIT THE WIZARD.
Press the previous button and proceed with the next step (step 14)
14. Open ADSIEDIT.MSC and modify a number of objects in the Digipass-Configuration container.
14.1. Modify the CFG:defaultSensitiveKey object
( CN=CFG:defaultSensitiveKey,CN=Digipass-Configuration,DC=X )
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 8 of 12
Set the attribute vasco-Value = SSMINSTALLSENSITIVEKEY
Right-click the CFG:defaultSensitiveKey object and select properties from the drop-down menu
Select the Attribute vasco-Value and press the Edit button
Change the Value to SSMINSTALLSENSITIVEKEY and press the OK button
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 9 of 12
14.2. Rename the "KEY:Legacy Sensitive Key" object to
KEY:SSMINSTALLSENSITIVEKEY
Right-Click the object KEY:Legacy Sensitive Key and select Rename from the drop-down menu
Type the new name KEY:SSMINSTALLSENSITIVEKEY
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 10 of 12
14.3. Modify the KEY:SSMINSTALLSENSITIVEKEY object
( CN=KEY:SSMINSTALLSENSITIVEKEY,CN=Digipass-Configuration,DC=X )
Set the attribute vasco-ID = SSMINSTALLSENSITIVEKEY
14.4. Modify the CFG:defaultStorageKey object
( CN=CFG:defaultStorageKey,CN=Digipass-Configuration,DC=X )
Set the attribute vasco-Value = SSMINSTALLSTORAGEKEY
14.5. Rename the "KEY:Legacy Storage Key" object to
KEY:SSMINSTALLSTORAGEKEY
14.6. Modify the KEY:SSMINSTALLSTORAGEKEY object
( CN=KEY:SSMINSTALLSTORAGEKEY,CN=Digipass-Configuration,DC=X )
Set the attribute vasco-ID = SSMINSTALLSTORAGEKEY
15. Continue on with the wizard and let it complete.
16. Redeploy the webadmin
16.1. open The Identikey Server Configuration Wizard from the Windows Start menu (Start Æ All Programs Æ Vasco Æ Identikey Server Æ Identikey Server
Configuration Wizard)
16.2. select Re-Deploy Web Administration and press the Next button
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 11 of 12
16.3. Follow the prompts of the wizard to complete the re-deployment
Applies to: IDENTIKEY Authentication Server 3.3
KB 120135 – 11/12/2012
© 2011 VASCO Data Security. All rights reserved.
Page 12 of 12
