5Advanced Installation. Vasco Linux

Advanced Installation

5 Advanced Installation

An advanced installation of Identikey Server allows complete control over software components to be installed, and the configuration to be completed.

Note

If you wish to have a quick, default install and configuration, run the installation in basic mode.

See

4

for instructions.

The installation – and the resultant Identikey Server daemon - runs in a chroot environment, with selinux enabled.

Note

The security settings in the chroot environment may impact on the driver for the ODBC database to be used. Check your database documentation for details on using it with selinux.

5.1

Database Decisions

The following checklist contains the key decisions to make before you start.

Database Location and Setup

A number of decisions may be required for the ODBC database to be used:

The server on which the database will be located.

Will the data for the Identikey Server be stored in a new database, or added to an existing database?

Type of database to be used

Will a new schema be used?

New Database

Decide the collation sequence to be used – for example, case-sensitivity and data encryption options.

Database User Accounts

Create or select database user accounts for:

Modifying the database schema (database administrator account required).

Identikey Server (see the Administrator Reference for details on the permissions required).

Identikey Server Linux Installation Guide

18

5.2

5.3

Advanced Installation

Installation Checklist

Before installing, check that you have:

License file available

Java web server available, if you will not be installing the Apache Tomcat server available with the Identikey

Server installation

ODBC-Compliant database (see 5.1

and 1.3.4

Database

for more information) installed

Start Identikey Server Installation

1.

Open a command line prompt.

2.

Run install.sh

3.

Enter advanced

4.

Press Space to scroll through the Identikey Server EULA

5.

Enter yes to agree to the License conditions

6.

Enter an installation path (default: /opt/vasco/Identikey)

7.

If you wish to use the embedded PostgreSQL database as Identikey Server's data store, enter yes.

If you wish to use another database, enter no.

8.

To install the Identikey Server component on this machine, enter yes.

9.

To install the Administration Web Interface on this machine, enter yes.

10.

To install the OTP Request web site on this machine, enter yes.

11.

To install the User Self Management web site on this machine, enter yes.

12.

To install the Message Delivery Component (used with Virtual Digipass) on this machine, enter yes.

13.

To install the Audit Viewer on this machine, enter yes.

14.

Press Space to scroll through the Java Virtual Machine EULA

15.

Enter yes to agree to the License conditions.

Some initial pre-installation tasks will be performed, then the installation process will pause.

16.

Open a new command prompt to complete the database installation and setup.

Identikey Server Linux Installation Guide

19

5.4

Set Up Database

Advanced Installation

Note

If using the embedded PostgreSQL database, installation and configuration are handled by the installation script. No manual setup is required.

5.4.1

UnixODBC

Note

Note that iODBC is not supported, only unixODBC.

UnixODBC will be installed with Identikey Server. Additional steps must be followed to fully set up your database to work with Identikey Server. More specific instructions are included for PostgreSQL 8.2, Oracle 10g, IBM DB2 9.1 and Sybase Adaptive Server Anywhere 11.0. For other products, follow the generic instructions below:

5.4.2

Acquire and install ODBC driver for the Database

Any ODBC driver used must be Unicode compliant and use 2-byte SQLWCHAR and 8-byte SQLLEN for 64-bit systems. Identikey Server has been tested with the ODBC drivers provided by Oracle, IBM and Sybase in their database systems.

Install the ODBC driver to the Identikey Server chroot environment.

5.4.3

Create an ODBC Data Source

Create the Data Source as required for your database. Follow the instructions provided by the database vendor.

Guidelines are given below for the databases that have been specifically tested.

5.4.4

License File

Copy the Identikey Server license file to the Identikey Server installation directory.

Identikey Server Linux Installation Guide

20

Advanced Installation

5.4.5

SSL Certificate

If you have a commercial SSL certificate that you wish to use with Identikey Server, copy the certificate and the trusted certificate file to the Identikey Server installation directory.

5.4.6

Digipass Record Import File

If you wish to import Digipass records during the initial configuration, copy the .dpx file to the Identikey Server installation directory.

Identikey Server Linux Installation Guide

21

Advanced Installation

5.4.7

ODBC Setup for PostgreSQL

When manually setting up a PostgreSQL database for Identikey Server, use the following information as a guide.

No environment variables are required.

ODBC Driver

Most PostgreSQL ODBC drivers provided by Linux distributions and on www.postgresql.org

use 4-byte

SQLWCHAR. However, the one in the Identikey Server CD has been re-built using 2-byte SQLWCHAR. If you are not using the PostgreSQL database provided with Identikey Server, extract the Identikey Server version of the

ODBC driver psqlodbcw.so

from vasco-postgresql-8.2-i386.tgz for 32-bit systems, and vasco-postgresql-8.2amd64.tgz for 64-bit systems, and replace the version of this file found in /usr/lib or /usr/lib64 with the one extracted.

To build both the 32-bit and 64-bit version of PSQLODBC, remove the following line from config.h:

#define SQL_WCHART_CONVERT

For 64 bit UNIXODBC, add the following two lines to sqltypes.h :

#define HAVE_LONG_LONG

#define BUILD_REAL_64_BIT_MODE

Note

The PostgreSQL ODBC driver uses the OpenSSL library to encrypt or hash credentials used to connect to the database. A compatibility issue may occur if your system has a version of

OpenSSL prior to 0.9.8b when connecting to a PostgreSQL database that requires MD5 or other non-plaintext password authentication.

1.

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

:

[PostgreSQL Unicode]

Description = PostgreSQL Unicode

Driver = /usr/lib/psqlodbcw.so

Setup = /usr/lib/psqlodbcw.la

Threading = 0

2.

To configure the database as a data source using the PostgreSQL Unicode driver registered above, add the following lines to /etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc = Identikey Server database

[Identikey-DataSrc]

Identikey Server Linux Installation Guide

22

Advanced Installation

Driver = PostgreSQL Unicode

Description = Identikey Server database

Servername = <IP address>

Port = <port>

Protocol = 6.4

UserName =

Password =

Database = <database name>

ReadOnly = No

RowVersioning = No

ShowSystemTables = No

FakeOidColumn = No

FakeOidIndex = No

ConnSettings =

Trace = No where

<IP address> is the address of the machine on which the database is installed, <port> is the port number on which the database listens for connection requests, and <database name> is the name configured for the database.

Identikey Server Linux Installation Guide

23

Advanced Installation

5.4.8

ODBC Setup for Sybase Adaptive Server Anywhere 11.0

To set up Sybase for use with Identikey Server, base your setup on the following example. This applies to Sybase

Adaptive Server Anywhere 11.0 on 32-bit Linux.

1.

Set the following environment variables:

Environment

Variable

Description Possible Contents

<various>

ODBCINI

ODBCINST

A number of environment variables are set by the sa_config.sh script that is created during installation and setup of Sybase. That script should be run to set the necessary variables. It is located in the Sybase bin directory, eg.

/opt/sqlanywhere11/bin32/sa_config.sh

Add the line

/opt/sqlanywhere11/bin32/sa_config.sh

to

/etc/profile

ODBC.INI file path/name.

ODBCINST.INI file path/name.

<various>

/etc/odbc.ini

/etc/odbcinst.ini

2.

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

:

[ODBC Drivers]

Sybase=Installed

[ODBC]

Trace=No

TraceFile=/var/log.log

[Sybase]

Driver=/opt/sqlanywhere11/lib32/libdbodbc11.so

Threading = 0

3.

To configure the database as a data source using the Sybase driver registered above, add the following lines to

/etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc=Sybase

[Identikey-DataSrc]

Driver=Sybase

ServerName=<server name>

Identikey Server Linux Installation Guide

24

Advanced Installation

DatabaseFile=<database file>

StartLine=

AutoStart=No

AutoStop=No

Description=SQL Anywhere 11.0

CommLinks=tcpip(IP=<IP address>;PORT=<port>)

LogFile=/var/anywhere.log

where <server name> is the Server Name configured in Sybase, <database file> is the location of the Sybase database file,

<IP address> is the IP address of the database server, and <port> is the port on which the database server listens for connection requests (default: 2638). See your Sybase documentation for further information on these variables.

Identikey Server Linux Installation Guide

25

Advanced Installation

5.4.9

ODBC Setup for Oracle 10g

To set up Oracle for Identikey Server, use the following as a guide.

1.

Create a file /etc/tnsnames.ora

which contains:

ORAC =

(DESCRIPTION =

(ADDRESS_LIST =

(ADDRESS = (PROTOCOL = TCP)(HOST = <IP address>)(PORT =

<Port>))

)

(CONNECT_DATA =

(SERVICE_NAME = IDENTIKEY)

)

) where <IP address> is the address of the database server, and <Port> is the port on which database connections should be made (default 1521).

2.

Add the following line to /etc/ld.so.conf

:

/usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib

3.

Add the following environment variables:

Environment

Variable

Description Possible Contents

TNS_ADMIN

LD_LIBRARY_PATH

ORACLE_SID

ORACLE_BASE

ODBC

ODBCINST

Shared library load path.

/etc

<Oracle installation path>/product/<version>/client_1/lib

<Oracle database SID> (specified during installation of database)

ODBC.INI file path/name.

<Oracle installation path> (typically /u01/app/oracle)

/etc/odbc.ini

ODBCINST.INI file path/name. /etc/odbcinst.ini

4.

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

:

[ODBC Drivers]

Oracle 10g ODBC driver = Installed

[ODBC]

Trace=No

Identikey Server Linux Installation Guide

26

Advanced Installation

TraceFile=/var/anywhere.log

[Oracle 10g ODBC driver]

Description = Oracle ODBC driver for Oracle 10g

Driver = <driver location>

Setup =

FileUsage =

CPTimeout =

CPReuse =

Threading = 0 where

<driver location> is the path to the ODBC driver for the database. For Oracle 10g, this will be typically be /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libsqora.so.10.1

.

5.

To configure the database as a data source using the Oracle driver registered above, add the following lines to /etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc=DataDirect 5.3 Oracle Wire Protocol

[Identikey-DataSrc]

Driver=<driver location>

Description=DataDirect 5.3 Oracle Wire Protocol

AlternateServers=

ApplicationUsingThreads=1

ArraySize=60000

AuthenticationMethod=1

CachedCursorLimit=32

CachedDescLimit=0

CatalogIncludesSynonyms=1

CatalogOptions=0

ConnectionRetryCount=0

ConnectionRetryDelay=3

DefaultLongDataBuffLen=1024

DescribeAtPrepare=0

EnableDescribeParam=0

EnableNcharSupport=0

Identikey Server Linux Installation Guide

27

Advanced Installation

EnableScrollableCursors=1

EnableStaticCursorsForLongData=0

EnableTimestampWithTimeZone=0

EncryptionMethod=0

GSSClient=native

HostName=<IP address>

HostNameInCertificate=

KeyPassword=

KeyStore=

LoadBalancing=0

LocalTimeZoneOffset=

LockTimeOut=-1

LogonID=

Password=

PortNumber=<Port>

ProcedureRetResults=0

ReportCodePageConversionErrors=0

ReportRecycleBin=0

ServerName=<Oracle Server Name>

ServerType=0

ServiceName=<Identikey Service Name>

SID=<Oracle Database SID>

TimestampeEscapeMapping=0

TNSNamesFile=/etc/tnsnames.ora

TrustStore=

TrustStorePassword=

UseCurrentSchema=1

ValidateServerCertificate=1

WireProtocolMode=1 where <IP address> is the address of the database server, <Port> is the port on which the database listens for connection requests, <driver location> is the path to the ODBC driver for the database, <Oracle Server

Name> is the configured name for the Oracle server, <Oracle Database SID> is the configured SID for the

Oracle database and <Identikey Service Name> is the name of the Identikey service. For Oracle 10g, this will be typically be /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libsqora.so.10.1

.

Identikey Server Linux Installation Guide

28

Advanced Installation

5.4.10 ODBC Setup for IBM DB2 9.1

To set up DB2 for Identikey Server, use the instructions below as a guide.

1.

Extract/install DB2 client libraries.

2.

As root, enter the following commands: groupadd db2das groupadd db2admin groupadd db2fence useradd db2das -m -d /home/db2das db2das useradd db2admin -m -d /home/db2admin db2admin useradd db2fence -m -d /home/db2fence db2fence passwd db2admin cd /opt/ibm/db2/V9.1/instance

./db2icrt -a server -u db2fence db2admin

3.

Enter the following commands to source the db2admin profile: cd /home/db2admin/sqllib

../db2profile

4.

As user db2admin, enter the following commands: db2 catalog tcpip node dbnode remote <IP address> server 50000 catalog database <database name> at node <database node> connect <database name> user <User ID>

5.

To register the driver and setup libraries, add the following lines to /etc/odbcinst.ini

:

[ODBC]

Trace=No

TraceFile=/var/db2.log

[DB2]

Driver=/opt/ibm/db2/....../libdb2.so

Description=DB2 ODBC Driver

Fileusage=1

Dontdlclose=1

Threading=0

Identikey Server Linux Installation Guide

29

Advanced Installation

6.

To configure the database as a data source using the DB2 driver registered above, add the following lines to

/etc/odbc.ini:

[ODBC Data Sources]

Identikey-DataSrc=IBM DB2 ODBC DRIVER

[Identikey-DataSrc]

Driver=DB2

Description=DBNAME DB2 ODBC DRIVER

7.

Set the following environment variables:

Possible Contents Environment

Variable

ODBC

ODBCINST

DB2INSTANCE

Description

ODBC.INI file path/name.

ODBCINST.INI file path/name.

DB2 instance name.

/etc/odbc.ini

/etc/odbcinst.ini

db2admin

Note

Please note that when setting up a DB2 database the page size should be set to at least 8192k.

A smaller page size will create an error when Identikey Server attempts to connect to the database.

Identikey Server Linux Installation Guide

30

5.5

Advanced Installation

Continue Identikey Server Installation

1.

Return to the original Identikey Server installation command prompt.

2.

Enter yes .

This will enter the Identikey Server chroot environment.

Finish Database Setup

3.

Add any environmental variables required for the database connection in the /etc/profile file.

4.

Copy /opt/vasco/Identikey/etc/odbc.ini

to <IK installation directory>/root/.odbc.ini

.

Test Database

5.

Enter the following command to test the database connection: isql <DSN> <username> <password> where <DSN> is the Data Source Name set up earlier in the Database Setup stage – our instructions used a

DSN of Identikey-Data – and <username> and <password> are the User ID and password for a database administrator account.

If the database connection attempt is not successful, an error message will be displayed – check the setup instructions above to ensure all necessary steps have been followed.

Modify Database Schema

6.

To set up the required schema in the database to be used for Identikey Server, enter the following command:

/usr/sbin/dpdbadmin addschema –u <username> –p <password> -d <DSN> where <DSN> is the Data Source Name set up earlier in the Database Setup stage (our instructions used a

DSN of Identikey-Data ), < username> is the User Name for a database administrator with schema modification privileges, and <password> is the password for that administrator account.

If you want to specify your own Master Domain name and/or lower or upper case conversion for User IDs and

Domain names, specify the -domain and/or -case options.

For further details on DPDBADMIN, see 9

.

Permissions

7.

If the database user account used by the Identikey Server is not the owner of the tables and is not a database administrator account, it must be granted permissions for the tables, or ownership of the tables transferred.

See your database documentation for information on how to do this. The modifications to the database permissions should be made using a separate command prompt.

Identikey Server Linux Installation Guide

31

Advanced Installation

Note

Ensure that it is possible for the account(s) mentioned to reference the tables by name without a schema prefix. If this cannot be done, see the Administrator Reference for advanced setup instructions.

8.

Enter the following command in the original Identikey Server installation command prompt: exit

The installation program will ask if you wish to proceed with the Identikey Server installation.

9.

Enter yes .

Identikey Server and other selected components will be installed.

10.

Enter DSN, database administrator User ID and password for the database that Identikey Server will use as its data store.

11.

If required, select an IP address to use for Identikey Server.

12.

Enter a name for the Master Domain, or hit enter to use the default name of master .

13.

Select a User ID and Domain name conversion option

14.

Enter a User ID and password for the first Identikey Server administrator. This gives you an initial login, to allow User import and creation.

15.

Select data encryption option(s)

16.

Enter the location and filename of the Identikey Server license file – this must be relative to

/opt/vasco/identikey .

17.

Select the scenarios to be enabled by entering yes when queried on each. Entering no will disable that specific scenario for that Identikey Server.

18.

Enter 1 to generate and install a new test SSL certificate, or 2 to install your own commercial SSL certificate.

If you enter 1 :

a.

Enter a private key password to be used for the new SSL certificate.

If you enter 2 :

a.

Enter the path and filename for the SSL certificate.

b.

Enter a private key password to be used for the SSL certificate.

c.

Enter the path and filename for the trusted certificate file.

d.

Enter the password for the trusted certificate file.

e.

Enter y to proceed.

19.

Enter the IP address for an Administration Web Interface, if available. If you are installing the Administration

Web Interface on the current machine, enter the IP address of the current machine. This will create a client

Component record with the type Administration Client in the data store.

Identikey Server Linux Installation Guide

32

Advanced Installation

20.

If the Identikey Server SDK Sample Web Client has been installed, enter the IP address of that machine. A client Component record will be created for the machine.

A summary of the configuration will be displayed.

21.

Enter y to accept the configuration options shown.

Identikey Server will be configured and the daemon started.

Identikey Server Linux Installation Guide

33

Advanced Installation

5.6

Identikey Server Configuration File

When Identikey Server has been configured the settings are stored in the configuration file.

<?xml version="1.0" ?>

<VASCO>

<Server-Config>

<Server-Location type=" string" data="10.2.10.100" />

</Server-Config>

<ProductInfo />

<Tracing>

<Trace-Header type="

unsigned" data="47" />

<Trace-Mask type=" unsigned" data="0x3FFFFFFF" />

<Trace-File type="

string" data="/var/vasco/identikey/ikeyserver.trace" />

</Tracing>

<Encryption>

<Storage-Key type="

string" data="" />

<Cipher-Name type=" string" data="des_ede" />

<Cipher-Module type=" string" data="" />

<Enable-Engine type="

bool" data="false" />

<Engine-Module type=" string" data="" />

<Engine-Parameters />

</Encryption>

<Storage>

<Storage-Engine type="

string" data="ODBC" />

<ODBC>

<Library-Path type=" string" data="/usr/lib/libikstorageodbc.so" />

<Load-Balancing type="

bool" data="false" />

<Connection-Timeout type=" unsigned" data="5000" />

<Domain-Cache>

<Max-Age type="

unsigned" data="900" />

<Max-Size type="

unsigned" data="200" />

<Clean-Threshold type="

unsigned" data="100" />

<Min-Clean-Interval type=" unsigned" data="60" />

</Domain-Cache>

<Data-Sources>

<Data-Source00>

<Display-Name type="

string" data="Identikey Server" />

<DSN type=" string" data="identikey server" />

<Username type="

string" data="digipass" />

<Password type="

string" data="hXRzkAU8HIsQpKpelZwAT4k=" />

<Control-Table type="

string" data="vdsControl" />

<Min-Reconnect-Interval type="

unsigned" data="0" />

<Max-Reconnect-Interval type=" unsigned" data="10" />

</Data-Source00>

</Data-Sources>

</ODBC>

Identikey Server Linux Installation Guide

34

Advanced Installation

</Storage>

<VDPClient>

<MDC-IP type=" string" data="127.0.0.1" />

<MDC-Port type="

unsigned" data="20007" />

</VDPClient>

<Replication>

<Library-Path type="

string" data="/usr/lib/libikreplication.so" />

<Enabled type=" bool" data="false" />

<Repl-Server type=" string" data="10.2.10.100" />

<Allow-Loopback type="

bool" data="true" />

<Connection-Timeout type=" unsigned" data="60" />

<Min-Reconnect-Interval type="

unsigned" data="1" />

<Max-Reconnect-Interval type=" unsigned" data="60" />

<Dead-Item-Cleanup-Threshold type="

unsigned" data="60" />

<Queue>

<File-Path type=" string" data="/var/vasco/repldata/" />

<Max-Retry-Count type="

unsigned" data="3" />

<Retry-Interval type=" unsigned" data="60" />

<Max-File-Size type="

unsigned" data="100" />

</Queue>

<Server-List />

</Replication>

<Audit>

<Libraries>

<ODBC type="

string" data="/usr/lib/libdpauditodbc.so" />

<live type=" string" data="/usr/lib/libdpauditlive.so" />

</Libraries>

<Plugins>

<Profile00>

<Enabled type="

bool" data="true" />

<Type type="

string" data="utf8file" />

<Display-Name type=" string" data="Text File" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type=" bool" data="false" />

<Error type="

bool" data="true" />

<Warning type=" bool" data="true" />

<Info type=" bool" data="true" />

<Success type="

bool" data="true" />

<Failure type=" bool" data="true" />

<Plugincfg>

<Log-File type="

string" data="/var/vasco/identikey/ikeyserver{year}{month}.audit" />

<Keep-Open type="

bool" data="true" />

<Use-GMT type="

bool" data="false" />

<Allow-Newlines type=" bool" data="false" />

</Plugincfg>

</Profile00>

<Profile01>

Identikey Server Linux Installation Guide

35

<Enabled type=" bool" data="true" />

<Type type="

string" data="syslog" />

<Display-Name type=" string" data="Linux Syslog (errors only)" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type=" bool" data="false" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="false" />

<Info type="

bool" data="false" />

<Success type="

bool" data="false" />

<Failure type=" bool" data="false" />

<Plugincfg>

<Syslog-Facility type=" string" data="local0" />

</Plugincfg>

</Profile01>

<Profile02>

<Enabled type="

bool" data="true" />

<Type type="

string" data="syslog" />

<Display-Name type=" string" data="Linux Syslog (fall-back)" />

<Fail-On-Error type="

bool" data="true" />

<Unhandled-Only type=" bool" data="true" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="true" />

<Info type=" bool" data="true" />

<Success type="

bool" data="true" />

<Failure type=" bool" data="true" />

<Plugincfg>

<Syslog-Facility type="

string" data="local0" />

</Plugincfg>

</Profile02>

<Profile03>

<Enabled type=" bool" data="true" />

<Type type="

string" data="live" />

<Display-Name type=" string" data="Live Audit Viewer" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type=" bool" data="false" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="true" />

<Info type=" bool" data="true" />

<Success type="

bool" data="true" />

<Failure type=" bool" data="true" />

<Plugincfg>

<IP-Address type="

string" data="10.2.10.100" />

<Server-Port type=" unsigned" data="20006" />

<Auth-Timeout type="

unsigned" data="60" />

<Max-Connections type=" unsigned" data="3" />

</Plugincfg>

</Profile03>

Identikey Server Linux Installation Guide

Advanced Installation

36

<Profile04>

<Display-Name type="

string" data="odbc" />

<Type type=" string" data="odbc" />

<Fail-On-Error type="

bool" data="false" />

<Unhandled-Only type="

bool" data="false" />

<Error type="

bool" data="true" />

<Warning type="

bool" data="true" />

<Info type=" bool" data="true" />

<Success type="

bool" data="true" />

<Failure type=" bool" data="true" />

<Plugincfg>

<DSN type="

string" data="identikey server" />

<Username type=" string" data="digipass" />

<Password type="

string" data="vSMkx1JrS9xHUfpvDctsd_Y=" />

</Plugincfg>

<Enabled type="

bool" data="true" />

</Profile04>

</Plugins>

</Audit>

<Component-Cache>

<Max-Age type=" unsigned" data="900" />

<Max-Size type="

unsigned" data="1000" />

<Clean-Threshold type=" unsigned" data="800" />

<Min-Clean-Interval type="

unsigned" data="60" />

</Component-Cache>

<Policy-Cache>

<Max-Age type="

unsigned" data="900" />

<Max-Size type=" unsigned" data="200" />

<Clean-Threshold type=" unsigned" data="100" />

<Min-Clean-Interval type="

unsigned" data="60" />

</Policy-Cache>

<Challenge-Cache>

<Max-Age type="

unsigned" data="60" />

<Max-Size type=" unsigned" data="1200" />

<Clean-Threshold type="

unsigned" data="1000" />

<Min-Clean-Interval type=" unsigned" data="5" />

</Challenge-Cache>

<BackEnd-Cache>

<Max-Age type=" unsigned" data="900" />

<Max-Size type="

unsigned" data="200" />

<Clean-Threshold type=" unsigned" data="100" />

<Min-Clean-Interval type="

unsigned" data="60" />

</BackEnd-Cache>

<DPX-Cache>

<Max-Age type="

unsigned" data="86400" />

<Max-Size type=" unsigned" data="200" />

<Clean-Threshold type="

unsigned" data="100" />

Identikey Server Linux Installation Guide

Advanced Installation

37

Advanced Installation

<Min-Clean-Interval type=" unsigned" data="60" />

</DPX-Cache>

<Admin-Session-Cache>

<Max-Concurrent-Sessions type="

unsigned" data="10" />

<Max-Session-Time type="

unsigned" data="86400" />

<Session-Timeout type=" unsigned" data="3600" />

</Admin-Session-Cache>

<Report-Cache>

<Max-Age type=" unsigned" data="86400" />

<Max-Size type="

unsigned" data="400" />

<Clean-Threshold type=" unsigned" data="100" />

<Min-Clean-Interval type="

unsigned" data="60" />

</Report-Cache>

<Task-Manager>

<Max-Workers type="

unsigned" data="30" />

</Task-Manager>

<BackEndAuthenticators>

<RADIUS>

<Enabled type=" bool" data="true" />

<Library-Path type="

string" data="/usr/lib/libikcommradius.so" />

</RADIUS>

<Engines />

</BackEndAuthenticators>

<Communicators>

<SealCommunicator>

<Enabled type="

bool" data="false" />

<Library-Path type=" string" data="/usr/lib/libikcommseal.so" />

<IP-Address type="

string" data="10.2.10.100" />

<IP-Port type="

unsigned" data="20003" />

<Require-Client-Component type=" bool" data="false" />

</SealCommunicator>

<SoapCommunicator>

<Enabled type=" bool" data="true" />

<Library-Path type="

string" data="/usr/lib/libikcommsoap.so" />

<DPX-Upload-Location type=" string" data="/usr/share/vasco/identikey/dpx/" />

<IP-Port type="

unsigned" data="8888" />

<SSL>

<Enabled type="

bool" data="false" />

<Server-Certificate type="

string" data="/etc/vasco/ikeypvk.pem" />

<Private-Key-Password type=" string" data="LOeH9$Q5YOa0" />

<CA-Certificate-Store type="

string" data="/etc/vasco/ikeycerts.pem" />

<Client-Authentication-Method type=" string" data="none" />

<Reverify-Client-On-Reconnect type="

bool" data="false" />

</SSL>

</SoapCommunicator>

<RadiusCommunicator>

<Enabled type="

bool" data="true" />

Identikey Server Linux Installation Guide

38

<Library-Path type=" string" data="/usr/lib/libikcommradius.so" />

<Authentication-Port type="

string" data="1812" />

<Accounting-Port type=" string" data="1813" />

<Request-Cache>

<Max-Age type="

unsigned" data="5" />

<Max-Size type="

unsigned" data="0" />

<Clean-Threshold type="

unsigned" data="200" />

<Min-Clean-Interval type=" unsigned" data="30" />

</Request-Cache>

<Proxy-Cache>

<Max-Age type=" unsigned" data="99999999" />

<Max-Size type="

unsigned" data="0" />

<Clean-Threshold type=" unsigned" data="200" />

<Min-Clean-Interval type="

unsigned" data="30" />

</Proxy-Cache>

</RadiusCommunicator>

</Communicators>

<Scenarios>

<ScenarioModule00>

<Enabled type="

bool" data="true" />

<Display-Name type=" string" data="Authentication Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenauth.so" />

</ScenarioModule00>

<ScenarioModule01>

<Enabled type="

bool" data="true" />

<Display-Name type=" string" data="Signature Validation Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscensign.so" />

</ScenarioModule01>

<ScenarioModule02>

<Enabled type="

bool" data="true" />

<Display-Name type="

string" data="Provisioning Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenprovision.so" />

<Reactivation>

<Min-Time-Before-Reactivation type=" unsigned" data="1440" />

<Max-Nbr-Attempts type="

unsigned" data="3" />

<Max-Nbr-Locations type=" unsigned" data="5" />

</Reactivation>

</ScenarioModule02>

<ScenarioModule03>

<Enabled type="

bool" data="true" />

<Display-Name type="

string" data="Administration Scenario" />

<Library-Path type=" string" data="/usr/lib/libikscenadmin.so" />

</ScenarioModule03>

<ScenarioModule04>

<Enabled type=" bool" data="true" />

<Display-Name type="

string" data="Reporting Scenario" />

<Library-Path type=" string" data="/usr/lib/libikscenreport.so" />

Identikey Server Linux Installation Guide

Advanced Installation

39

Advanced Installation

<Report-Location type=" string" data="/usr/share/vasco/identikey/reports/" />

<Audit>

<Plug-ins>

<Plugin01 type="

string" data="/usr/lib/libdpauditodbc.so" />

</Plug-ins>

<Source type=" string" data="utf8file" />

<ODBC>

<Username type=" string" data="test" />

<Password type=" string" data="O9jfPKmQsCe8TkQkdQ1H8Zs=" />

<DSN type="

string" data="postgres" />

</ODBC>

<UTF8>

<Path type="

string" data="/var/vasco/identikey/" />

<Extension type=" string" data=".audit" />

</UTF8>

</Audit>

</ScenarioModule04>

<ScenarioModule05>

<Enabled type=" bool" data="true" />

<Display-Name type="

string" data="Audit Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenaudit.so" />

</ScenarioModule05>

<ScenarioModule06>

<Enabled type=" bool" data="true" />

<Display-Name type=" string" data="Replication Scenario" />

<Library-Path type="

string" data="/usr/lib/libikscenrepl.so" />

</ScenarioModule06>

</Scenarios>

</VASCO>

Identikey Server Linux Installation Guide

40