The following procedures apply to the standard configuration of a server managed through an administration workstation. It also applies if your configuration does not separate the server from the administration workstation.
In Active Directory’s MMC, the current datastore version (displayed in the Advanced Settings page) might not update immediately when the directory database version is changed. To update, click OK, then exit the MMC Properties dialog box.
Ensure that you meet the hardware and software requirements listed in the NetIQ SecureLogin Quick Reference Guide.
A minimum of 128 MB is required in the Windows directory. An additional 55 MB is required for temporary files, which is deleted after installation is complete.
You must have administrator-level access to the server and the administration workstations.
Ensure that the LDAP certificate file is saved in the default certificate location of the LDAP log, for example, securelogin\rootcert.der.
Back up the existing directory.
You must install JRE version 1.4 or later to enable single sign-on to Java applications or JavaScript logins on the workstation.
For multiple-directory environments:
Identify the domain controller to determine the directory where you will install SecureLogin and the order of replication.
Have access to the domain controller.
The following information applies to the configuration of a server in a Microsoft Windows Server 2003 or Windows Server 2008 operating system environment.
By default, Microsoft Windows Server 2003 and 2008 install the Internet Explorer Enhanced Security Configuration, which is designed to decrease the exposure of enterprise servers to potential attacks that might occur through the Web content and application scripts.
If you are using Internet Explorer, some Web sites might not display or perform as expected when SecureLogin is installed. Add-ons and Browser Help Objects (BHOs) such as single sign-on might not be fully functional.
For more information on enhanced security, see the Microsoft Support Web site for knowledge base article 815141.
To enable single sign-on for Internet Explorer, disable the Microsoft’s Internet Explorer Enhanced Security Configuration before deploying SecureLogin.
You can do this by:
On both Windows Server 2003 and 2008: Go to Internet Options > Advanced > Browsing, then select the Enable Third party web browser extension (requires restart) option.
On Windows Server 2003: Go to Start > Control Panel > Add/Remove Windows Component.
On Windows Server 2008: Go to Start > Service Manager, Security Manager > Configure IE ESC.
In Internet Explorer 8: Open Internet Explorer, go to Tools > Internet Options > Advanced > under Browsing section, select Enable third party web browser extensions option.
After SecureLogin is installed, open Internet Explorer, go to Tools > Manage Add-ons > Tools and Extensions and check if the IESSO Secure Login Helper object Class entry is displayed as Enabled.
In Internet Explorer 7: Lauch Internet Explorer, go to Tools > Internet Options > Advanced > under Browsing section select Enable third party web browser extensions (requires restart) option.
After SecureLogin is installed, open Internet Explorer, go to Tools > Manage Add-ons > Enable or Disable Add-ons and check if the IESSOObj Class entry is displayed as Enabled.
In Internet Explorer 6: Lauch Internet Explorer, go to Tools > Internet Options > Advanced > under Browsing section select Enable third party web browser extensions (requires restart) option.
After SecureLogin is installed, open Internet Explorer, go to Tools > Manage Add-ons and from the Add-ons currently loaded in Internet Explorer, check if the IESSOObj Class entry is displayed as Enabled.
NetIQ recognizes Microsoft Windows Vista as a Citrix or Terminal Services client. Citrix and Terminal Services support is always installed when SecureLogin is deployed to a Vista client or workstation and the Install Citrix and terminal services support option is not displayed.
Microsoft Windows Vista is not supported as a Citrix or Terminal Services server.
Uninstall any SecureLogin version prior to 3.5.x.
Ensure that Microsoft Management Console (MMC) Active Directory plug-ins are installed on the administration workstation.
Extend the directory schemas for SecureLogin versions prior to 6.0.
If the application type is enabled for single sign-on, install Citrix or Terminal Services clients.
Install Sun Java Runtime Engine version 1.3 or later, or Oracle JInitiator 1.3.1 or later on the server and workstations, if single sign-on to Java applications is required.
NOTE:SecureLogin uses the pre-installed Oracle JInitiator or JRE to support Web enabled Oracle form applications. If any of these Java components is added in the machine after installing (or upgrading to) SecureLogin, you need to enable SecureLogin to use the newly added Java component. To enable support to the new Java component, run the repair option of the SecureLogin installer.
Install SecureLogin 8.1 on the administration workstation.
On Microsoft Windows Vista, write access requires administrator privileges.
Create test users on the administration workstations.
Define and configure the SecureLogin user environment, including enabling the required applications for single sign-on.
Copy the test users’ configuration to relevant objects.
Install the SecureLogin application on user workstations.
Secure Workstation is not supported in an Active Directory installation of SecureLogin.
If an error appears during an attempted login immediately after you install SecureLogin on an Active Directory server, click OK in the error message, wait for a few minutes, then try again. This error occurs because Active Directory takes time to synchronize. If the error continues, you might need to restart the server.
SecureLogin supports Microsoft Active Directory operating in an LDAP environment. There are no additional installation or configuration requirements. The only variation to the install is that you select LDAP and not Microsoft Active Directory as the installation platform. For details, see Section 6.3.1, Extending the LDAP Directory Schema and Assigning Rights on the Server
SecureLogin supports deployment in an ADAM instance. For more information, see Section 4.0, Configuring, Installing, and Deploying In Active Directory LightWeight Directory Services.