Nordic Edge Support

Cloud/Service Provider Action Packages

talmstrom — Tue, 08 May 2012 14:05:05 +0000

Here is a short description of a number of action packages with integration to cloud/service providers:

Download article as PDF

NSD1437 How to use TeleSign text-to-speech Nordic Edge OTP Server

mbrostrom — Tue, 08 May 2012 07:40:23 +0000

NSD1437 How to use TeleSign text-to-speech Nordic Edge OTP Server

Fact

Nordic Edge One Time Password Server 3.1 and later verisons
TeleSign phone-based one-time password (Text-to-speech service)

Situation

This document describes how to install and configure TeleSign text-to-speech service as a delivery method in Nordic Edge One Time Password (OTP Server) Server. The TeleSign text-to-speech service is available in 50 different languages and enables the OTP Server to send one-time passwords to all types of phones including landline telephones – something that is not always possible with text messages (SMS).

Before starting installation, the following prerequisites need to be met:

The OTP Server version 3.1 must be installed
The plugin files need to be downloaded (download here)
An account at the TeleSign services needs to be created

More information about TeleSign is available at www.telesign.com

Installation

To install the TeleSign plugin, perform the following steps:

Stop the OTP Server
Extract the installation archive (TeleSign.zip) in your OTP Server installation directory using your favorite unzip tool
Start the OTP Server

The installation adds the following files to your OTP Server directory:

plugins/TeleSign.class
plugins/TeleSignForm.class
plugins/TeleSignForm$1.class
plugins/TeleSignForm$2.class
lib/TeleSign.jar
lib/libphonenumber-4.6.jar

Before the plugin can be used, it must be enabled and configured.

Configuration

1) To configure the TeleSign plugin, launch the OTP Configurator. The OTP Configurator detects that new libraries (jar files) has been added to the installation, and starts to add these to the configuration:

Answer Yes to update the configuration with the new library files.

2) After the configuration has been updated, the OTP Server must be restarted:

Click OK to close the confirmation dialog, and then perform a manual restart of the OTP Server.

Note: The OTPServer will not restart automatically.

3) When the OTP Server has been restarted, relaunch the OTP Configurator and select Delivery Methods/TeleSign:

To enable the TeleSign Plugin, check the Enable TeleSign checkbox.

4) Enter your TeleSign settings and choose Save Config to save:

TeleSign Parameters

Name	Description
Customer ID	The Customer ID string provided by TeleSign. Should be 36 characters long and in format: AAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE
Authentication ID	The Authentication ID string provided by TeleSign. Should be 36 characters long and in format: FFFFFFFF-GGGG-HHHH-IIII-JJJJJJJJJJJJ
Default region	The two-letter country code of the country where users are located. This setting is used for adding country codes to user phone numbers where missing. This parameter is optional. Example: Sweden = SE United States = US
Language	The user message language. This is the language TeleSign will use to read the message from the user.

Disclaimer

The origin of this information may be internal or external to Nordic Edge™. Nordic Edge™ makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Nordic Edge™ makes no explicit or implied claims to the validity of this information. Any trademarks referenced in this document are the property of their respective owners.
Nordic Edge Support – www.nordicedge.se

Download article as PDF

NSD1431 Office365 Provisioning and Synchronization with Nordic Edge AAM

talmstrom — Fri, 04 May 2012 07:43:44 +0000

Use AAM to control and manage user objects in Office 365. The powershell support for Office 365 allows bulk and single creation of user as well as synchronization and reports.

The way the Office 365 works is that it allows to send a number of parameters to a Powershell script file, a ps1-file. The AAM Office 365 action package ships with some common examples and are open for you to modify or create new actions for your specific environment.

Download article as PDF

NSD1436 How to migrate from tokens such as RSA SecureID, Vasco DIGIPASS or other token providers

mbrostrom — Thu, 03 May 2012 12:06:02 +0000

NSD1436 How to migrate from tokens such as RSA SecureID, Vasco DIGIPASS or other token providers.

Fact

Nordic Edge One Time Password Server

Token solution. E.g. RSA SecureID, Vasco DIGIPASS or other token providers

Situation

How can an organisation use the One Time Password (OTP Server) Server concurrently with hardware token solutions such as RSA SecureID or Vasco DIGIPASS, or transparently migrate from them?

Solution

The OTP Server includes a RADIUS forward database function which is meant to be used in migration- or coexistence scenarios with other token solutions.

There are two options for migration scenarios:

- OTP database group with a RADIUS forward database

- OTP client with RADIUS forward database

Prerequisites

- OTP Server installed and configured with OTP via SMS and Pledge.

Option A – Database Group with RADIUS Forward Database

When using this option, the OTP Server will search for an authentication method for each user.

For example, when users log in with username and password, the OTP Server will first investigate if the user is enabled for OTP via SMS. Second, the OTP Server will verify if the user has a Pledge software token. If none of these methods are enabled, the OTP Server will forward the authentication request to the other token solution.

In the steps below we will configure the OTP Server with two-factor authentication via SMS, Pledge and other token solutions (RSA, Vasco or other token service). The service requesting two-factor authentication is a VPN gateway. See more integration guides on http://nordicedge.com/products/one-time-password-server/integrations

1. Connect the VPN Gateway with the OTP Server.

Enter a name as Client Display name, in this case, My SSL VPN Gateway
Enter the IP address used by the VPN gateway
Enter a Shared Secret. This must be added in the VPN gateway as well

Note, User Database will be selected later.

2. Add a LDAP group for users that are going to use OTP via SMS

Create a group in Active Directory (or any LDAP directory) and add users that are going to use SMS for receiving one-time passwords. In this guide, the LDAP group name is "OTP-via-SMS".
Add the LDAP group to the search filter in the OTP database for SMS.

Enter ")(objectclass=user)(memberOf=CN=OTP-via-SMS,CN=Users,DC=ad,DC=nordicedge,DC=se))" in Filter End

The OTP Server will now search for all users that are members of the LDAP group CN=OTP-via-SMS,CN=Users,DC=ad,DC=nordicedge,DC=se

Note: If no LDAP group is used, the OTP Server will send an OTP via SMS to all users that has a mobile number set. With a LDAP group, administrators can control which users are enabled for OTP via SMS.

3. The Nordic Edge Pledge software token can be used with a standard configuration. When a user is enrolled (activated with Pledge) the OTP Server will automatically find the OATH key and use this method for authentication.

4. Setup OTP database for other tokens

Select Databases and click on RADIUS Forward Database
Enter a name in Database Display Name
Click Add RADIUS server and enter the IP address and port to the other token service
Enter a Shared Secret, this should be added in the other token service as well

The OTP Server will now act as a RADIUS client to the RADIUS server on the other token service.

5. Create a OTP Database group

The OTP Database Group function automatically uses the different authentications in order, until it finds a method that a end user is enabled with.

Select Databases and click on Database Group
Enter a Database Display name
Click on Add Database and select SMS, Pledge and RSA tokens
Change the order with the Up and Down buttons

Note, the database corresponding to the other token service must be last in the list.

6. Assign the OTP Database group to the OTP client corresponding to the VPN Gateway

Select Clients and My SSL VPN Gateway
Select "DB Group – VPN Gateway" as the User Database

Setup is now complete. The next step is to restart the OTP Server. The OTP Server will use the OTP database group during authentication, which will use the different authentication methods in order. If a user is not in the OTP-via-SMS LDAP group and does not have Pledge, the authentication will be forwarded to the other token service.

Option B – OTP Client with RADIUS forward database

With this option, the service which is protected by the OTP Server will present different options for two-factor authentication. For example, an end user enters username/password and selects OTP via SMS, Pledge or other token in a drop-down menu.

This option is supported for services that are able to provide information about which authentication method that is required during authentication to the OTP Server. Manufacturers that are supporting this is Juniper and Citrix NetScaler.

1. Connect the other token service with the OTP Server

Select Databases and click on RADIUS Forward Database
Enter a name in Database Display Name
Click the Add RADIUS server button and enter the IP address and port to the other token service
Enter a Shared Secret, this must be added in the other token service as well

The OTP Server will now act as a RADIUS client to the other token service that is a RADIUS Server.

2. Connect the VPN Gateway with the OTP Server

Create OTP client's for each specific authentication method, SMS, Pledge and other token service.

Enter a name as Client Display name, In this case My SSL VPN Gateway
Enter the IP address used by the VPN gateway
Enter a Shared Secret. This must be added in the VPN gateway as well.
Select the OTP Database used for SMS
Click on the Advanced-button

Select the RADIUS attribute number used by the VPN gateway to provide authentication method information with. In this case no 32.
Enter the name of the authentication method (set by the VPN gateway). In this example "SMS".

Note, NetScaler uses no 32 and Juniper no 44.

Save the configuration.

2.1 Repeat steps section 2 above for Pledge and other token services.

Example from OTP client for the Pledge method:

Example from the OTP client for other token method:

The setup should look like this after all methods are configured.

Setup is now complete. Restart the OTP Server. The VPN Gateway will send an authentication request to the OTP Server with information about the requested authentication methods, SMS, Pledge and other token services. If another token method is requested, the OTP forward database will forward the request to the other token service via RADIUS. Below is an example for Citrix NetScaler.

Disclaimer

Nordic Edge Support – www.nordicedge.se

Download article as PDF

NSD1435 Nestled Group Report with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 13:00:18 +0000

With AAM it is an easy task to create and generate reports from various data sources. Once a report have been created it can be scheduled to send a new copy e.g. every week or last day in month.

This document will use an example policy to create a nestled group report from Active Directory into a Excel sheet.

Download article as PDF

NSD1433 Create Home Directory with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 12:57:59 +0000

Use AAM to automatically create home directory for users in a shared folder. After creation set explicit NTFS right to the user.

Download article as PDF

NSD1432 List all Users with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 12:56:18 +0000

With AAM it is an easy task to create and generate reports from various data sources. Once a report have been created it can be scheduled to send a new copy e.g. every week or last day in month.

This document will use an example policy to list all users from Active Directory and almost every attribute that exist into a Excel sheet.

Download article as PDF

NSD1430 Supervise Modifications of High Security Groups with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 12:53:59 +0000

One usage of AAM is that the service can use functionality to have events sent from domain controllers in almost the same second it occurs.

This document will use an example policy to describe how it is possible to send notifications when modification is performed on high security groups, e.g Domain Admins, Enterprise Admins.

Download article as PDF

NSD1428 Certificate Control with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 12:50:30 +0000

In the new internet era companies must implement many web services. In many cases these and other services has to be protected by certificates to secure communication between clients and server.
It is vital to have control on how long a certificate is valid, especially if using self signed certificates.

This document will use an example policy to get certificate information from specified URL’s. From each certificate information is collected and written to a Excel report.

Download article as PDF

NSD1427 Provisioning from Active Directory to OpenDJ with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 12:38:11 +0000

Automating the provisioning process enables your IT administrators to efficiently create new accounts for their users. This will allow you to quickly onboard new users making them productive more rapidly, and significantly reduce the amount of time and effort your administrators spend on creating and managing accounts.

This document will use an example policy to create or update accounts in OpenDJ with information from Active Directory.

Download article as PDF

NSD1426 Provisioning from Active Directory to ADLDS with Nordic Edge Automatic Account Manager

pjeriksson — Wed, 02 May 2012 08:52:43 +0000

This document will use an example policy to create or update accounts in Microsoft ADLDS (Active Directory Lightweight Directory Services) with information from Active Directory.

Download article as PDF

NSD1434 Get Provisioning Data from Procapita with Automatic Account Manager

pjeriksson — Mon, 30 Apr 2012 09:08:16 +0000

NSD1434 Get Provisioning Data from Procapita with Automatic Account Manager

Fact

Product: Nordic Edge Automatic Account Manager
Action: Get Procapita Data, version 0.91
Category: Input
Platform: Any supported
Revision History

Situation

How to use the Action Get Procapita Data

System Requirements

Nordic Edge Automatic Account Manager 3.1 or later

Overview

This is an Action which gets input data from Procapita. Includes several read methods via the IMS Enterprise Services Web Service API for Procapita BoU.

Read more about IMS Enterprise Services Procapita BoU integration.

The Action rely on a session attribute that contains a Procapita identifier exists in the session when the Action is triggered.

Figure 1: The AAM Studio

Settings

Mandatory Settings

These settings are mandatory and must always contain a value.

Label	Description/Example
Procapita Host	Example: http://procapita.tietoenator.com:23112
Read Method	Example: 1 (there are 1-6, see the examples belofor more info)
Identifier	Example: Unit=TIET&Domain=GY Supports SESSION(identifier)

Optional Settings

Label	Description/Example
[OPTIONAL] Membership Endpoint Address	Endpoint for the membership web service. Default value=/HCW.Welfare.CustomSolutions.Integration.IISHost/V1/ imsbasicservice.svc/MembershipManagementServiceSync
[OPTIONAL] Person Endpoint Address	Endpoint for the person web service. Default value=/HCW.Welfare.CustomSolutions.Integration.IISHost/V1/ imsbasicservice.svc/PersonManagementServiceSync
[OPTIONAL] Group Endpoint Address	Endpoint for the group web service. Default value=/HCW.Welfare.CustomSolutions.Integration.IISHost/V1/ imsbasicservice.svc/GroupManagementServiceSync
[OPTIONAL] Domain ID	If no domain is specified, the domain id may be specified here. Example: Hudiksvall

Examples

Example 1 - UpdateGroupObject

Input: Single valued SESSION attribute as identifier, example, Unit=TIET&Domain=GY

Output: Attributes are added to current session objects

Used settings:

Setting	Value
Procapita Host	http://procapita.tietoenator.com:23112
[OPTIONAL] Membership Endpoint Address
[OPTIONAL] Person Endpoint Address
[OPTIONAL] Group Endpoint Address
[OPTIONAL] Domain ID
Read Method	1
Identifier	SESSION(identifier)

Example 2 - CreateGroupMemberObject (configured in figure 1)

Input: Identifier example, Unit=123&Domain=456&StudentClass=901. Supports SESSION parameters.

Output: Session objects with group attributes

Used settings:

Setting	Value
Procapita Host	http://procapita.tietoenator.com:23112
[OPTIONAL] Membership Endpoint Address
[OPTIONAL] Person Endpoint Address
[OPTIONAL] Group Endpoint Address
[OPTIONAL] Domain ID
Read Method	2
Identifier	SESSION(identifier)

Example 3 - UpdatePersonObject

Input: Single valued SESSION attribute as identifier, example, 19880202TF08

Output: Attributes are added to current session objects

Used settings:

Setting	Value
Procapita Host	http://procapita.tietoenator.com:23112
[OPTIONAL] Membership Endpoint Address
[OPTIONAL] Person Endpoint Address
[OPTIONAL] Group Endpoint Address
[OPTIONAL] Domain ID
Read Method	3
Identifier	SESSION(identifier)

Example 4 - UpdatePersonMemberships

Input: Single valued SESSION attribute as identifier

Output: Attributes are added to current session objects

Used settings:

Setting	Value
Procapita Host	http://procapita.tietoenator.com:23112
[OPTIONAL] Membership Endpoint Address
[OPTIONAL] Person Endpoint Address
[OPTIONAL] Group Endpoint Address
[OPTIONAL] Domain ID
Read Method	4
Identifier	SESSION(identifier)

Example 5 - CreateCareholderObject

Input: Single or multivalued session attribute as identifier, example a multivalue attribute called 'personNumbers'. Supports SESSION parameters.

Output: Session objects for careholders and the current person attributes including it's children (students)

Used settings:

Setting	Value
Procapita Host	http://procapita.tietoenator.com:23112
[OPTIONAL] Membership Endpoint Address
[OPTIONAL] Person Endpoint Address
[OPTIONAL] Group Endpoint Address
[OPTIONAL] Domain ID
Read Method	5
Identifier	SESSION(identifier)

Example 6 - CreatePersonsObject

Input: A multivalued session attribute as identifier, example a multivalue attribute called 'personNumbers'. Supports SESSION parameters.

Output: Session objects containing persons and associated attributes.

Used settings:

Setting	Value
Procapita Host	http://procapita.tietoenator.com:23112
[OPTIONAL] Membership Endpoint Address
[OPTIONAL] Person Endpoint Address
[OPTIONAL] Group Endpoint Address
[OPTIONAL] Domain ID
Read Method	6
Identifier	SESSION(identifier)

Revision History

Version/Date	Note
Version 0.91 30th April	First release
30th April 2012	Initial document

DISCLAIMER
However, the information provided in this document is for your information only. Nordic Edge™ makes no explicit or implied claims to the validity of this information. Any trademarks referenced in this document are the property of their respective owners.

The origin of this information may be internal or external to Nordic Edge™. Nordic Edge™ makes all reasonable efforts to verify this information.

Nordic Edge Support - support.nordicedge.se

Download article as PDF

NSD1429 Create a Report of Users who Have Not Logged in During the Last 90 Days with Nordic Edge AAM

pjeriksson — Fri, 27 Apr 2012 12:37:02 +0000

This document will use an example policy which creates a report (Excel) containing user accounts that haven’t been used during the last 90 days.

IT administrators may be commissioned to find out which users that haven’t logged into a system during some time, let’s say 90 days. If so, these accounts shall be deactivated for one reason or another. These accounts may belong to people who probably has left the company, are consultants or are long-term vacancies.

Download article as PDF

NSD1424 Provisioning from SQL to Active Directory with Nordic Edge Automatic Account Manager

gpedersen — Fri, 20 Apr 2012 13:50:45 +0000

This document will use an example policy to create accounts in Active Directory with information from SQL. The table “ADM_PERSON” in the database “Employee” will be used as example.

The policy will create a unique userid for each person and then create the object in Active Directory. After the object is created in Active Directory the table in SQL is update with new Active Directory specific values.

Download article as PDF

NSD1417 New Certificate Authority

johant — Thu, 19 Apr 2012 08:11:33 +0000

NSD1417 New Certificate Authority

Fact

Nordic Edge Certificate Services
SSL based authentication

Situation

New Certificate Authority has been setup by issuer.

The root certificate for this new CA must be configured in Certificate Services.

The services needs to be restarted after adding the certificates to the configuration.

Solution

On FrontEnd servers (Apache HTTPD) certificates for CA's are placed in the file ca-bundle.

This file can be located by the parameter SSLCACertificateFile in /extra/httpd-ssl.conf.

Add the new CA's certificate in Base64 format after the last —–END CERTIFICATE—– in ca-bundle.

Restart Apache.

On BackEnd servers (NECS) the CA certificates are placed in the folder /trustedcerts.

So add the certificate file for the new CA to this folder.

Restart NECS.

Disclaimer

Download article as PDF