The instructions provided in this section apply to the configuration of the ADAM instance stored and administered on a separate server from the Active Directory server domain controller. Follow the same instructions even if your configuration does not separate the Active Directory server and the ADAM instance server.
SecureLogin supports deployment in an AD LDS instance. Active Directory is responsible for network authentication, while AD LDS is responsible for storing and providing the SecureLogin configuration data, setting, policies, and application definitions. For example, if a user logs in to the network and authenticates successfully to Active Directory, the user can then access AD LDS for the user’s single sign-on data.
For more information on AD LDS, see Microsoft Web site.
You can download the ADAM application from the Microsoft Web site.
Also read the ADAM release notes from the ADAM Service Pack 1 available at the Microsoft Knowledge Base article KB902838.
Following are the tasks involved in configuring SecureLogin in an ADAM environment:
A service account is an user account that is created explicitly to provide a security context for services running on Microsoft Windows Server 2003. The application pools use service accounts to assign permissions to Web sites and applications running on Internet Information Services (IIS). You can manage service accounts individually to determine the level of access for each of the application pool in a distributed environment.
Creating a Network Service Account enables the ADAM instance. To create a Network Service Account:
Click Start > All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers page is displayed.
Select View > Advanced Features. The Advanced Features option is enabled by default.
Select the Domain Controllers folder and locate the Domain Controller of your single sign-on enabled domain.
Right-click the Domain Controller and select Properties. The [Domain] Properties page is displayed.
Select the Security tab.
If the Network Service account is not on the list of Group or user names, add it.
Select the Network Service account.
In the Permissions for Administrators section, select Allow to Create All Child Objects.
In the Permissions for Administrators field, select Allow to Delete All Child Objects.
NOTE:Selecting Delete All Child Objects has no effect for SecureLogin, but allows the ADAM instance to be cleaned properly when it is uninstalled.
Click OK to close the [Domain] Properties dialog box.
SecureLogin leverages the directory to store and manage SecureLogin data. Six schema attributes are added to the directory schema. After the ADAM schema has been extended with these attributes the relevant containers, organizational units (ou) and user objects must be permitted to Read and Write SecureLogin data. The SecureLogin ADAM Configuration Wizard automatically extends the ADAM instance schema and assigns directory access permissions to selected objects.
Following are the attributes added to the schema:
Protocom-SSO-Auth-Data
Protocom-SSO-Entries
Protocom-SSO-SecurityPrefs
Protocom-SSO-Profile
Protocom-SSO-Entries-Checksum
Protocom-SSO-Security-Prefs-Checksum
Browse to the ADAM set up file that you downloaded from the Microsoft Web site.
Double-click to run the ADAMredistX86.exe file. The Active Directory Application Environment Setup Wizard is displayed.
Click the Next button. The License Agreement dialog box is displayed.
Accept the license agreement, then click Next. The Installation Options dialog box is displayed.
Select the ADAM and ADAM administration tools option.
Click Next. The Setup Options dialog is displayed.
Select A unique instance. The Instance Name page is displayed.
In the Instance name field, specify a name for the ADAM instance.
Click Next. The Ports page is displayed.
In the LDAP port number field, specify the ADAM instance port number.
In the SSL port number, specify the ADAM instance SSL port number.
NOTE:The default LDAP port number is 50000 and the SLL port number is 50001. However if Active Directory is not installed on your workstation, the default LDAP port number is 389. The default SSL port number is, 636.
We recommend the default values. However if required, the values can be manually changed.
IMPORTANT:Ensure to make a note of the LDAP port number and the SSL port number because this information is required for further configuration.
Click Next.The Application Partition Directory page is displayed.
Select No, do not create an application directory partition.
Click Next. The File Locations page is displayed.
Accept the default locations for ADAM files in the Data files and Data recovery files fields or click Browse to select an alternate location.
Click Next. The Service Account Selection page is displayed.
Select the Network service account.
or
Select This account and provide the credentials for the selected service account.
We recommend you to select Network service account. Nevertheless, you can specify an account with a static password.
NOTE:The selected service account must have permissions to register a Service Connection Point (SCP) and permission to install SecureLogin.
Click Next. The ADAM Administrators page is displayed.
Select the Currently logged on user: SECURELOGIN\Administrator option.
NOTE:The selected account must have administrator level permissions. In this example, the default is selected as the current user. So, the administrator administers this ADAM instance.
or
If an alternative account or group is preferred, select This account and specify the account or group name and credentials.
Click Next. The Importing LDIF Files page is displayed.
Select Do not import LDIF files for the instance of ADAM.
Click Next. The Ready to Install page is displayed.
Review the setup options in the Selections window to confirm that the required options are selected.
Click Next to continue with the installation.
or
Click Back to change selected options and continue the installation.
Click Next after confirming the ADAM instance creation settings.
Click Finish to create the ADAM instance. The Completing the Active Directory Application Environment Setup Wizard page is displayed after the ADAM instance is created.
If required, you can review the Windows Event log to ensure the ADAM instance is created without errors.
From the Windows Start menu, select Programs > Administrative Tools > Event Viewer. The Windows Event Viewer displays with the ADAM (Instance#) displayed in the Event Viewer hierarchy.
Double-click ADAM (Instance#) to view the Event log.
If an error icon is displayed, double-click to view the error details.
After the ADAM instance is successfully created, execute the instructions provided Extending the Schema by Using ADAM Configuration Wizard to automatically extend the ADAM instance schema and assign Read and Write Rights to directory user objects.
The SecureLogin ADAM configuration wizard extends the ADAM directory schema with SecureLogin attributes, creates ADAM partitions, and assigns selected directory objects read and write permissions to the SecureLogin attributes. The wizards creates corresponding user proxy objects in Active Directory. This includes the directory hierarchy to the ADAM instance. This can be used to synchronize user object structure after the initial configuration of SecureLogin.
The ADAM schema can be extended manually at the command line using the MSUserProxy. LDF and sso-adam-schema.LDF files. These files are located in the \SecureLogin\Tools\Schema\ADAM folder of the SecureLogin installer package. We recommend that you perform this procedure with the assistance of our Technical Support.
Before running the SecureLogin ADAM Configuration Wizard:
Copy the AdamConfig.exe file found in \SecureLogin\Tools\Schema\ADAM to server or the administrator workstation.
Copy dsacls.exe from Windows Support Tools to the ADAM folder on the server or Administrator workstation.
The ADAM Configuration Wizard extends the ADAM directory schema with SecureLogin attributes, creates ADAM partitions, and assigns selected directory objects with read and write permissions to the SecureLogin attributes.
The wizard creates corresponding user proxy objects for user objects in Active Directory, including the directory hierarchy to the ADAM instance and can be used to synchronize user object structure after initial configuration of SecureLogin.
To run the ADAM configuration wizard:
Log in to the ADAM instance, server, or the administration workstation (if it is separate) as an administrator or an user with administrator permissions.
Browse to the AdamConfig.exe file, double-click to run it. The Welcome to the SecureLogin ADAM Configuration Wizard page is displayed.
Ensure that you have all the Active Directory and ADAM administrator account details required.
NOTE:The ADAM schema can be extended manually at the command line using the MS-UserProxy.ldf and sso-adam-schema.ldf files. These files are located in the Tools folder of the installer package.
Click Next.
Configure ADAM instance for NetIQ SecureLogin.
Select this option during the first instance of configuration. Although the ADAM configuration is required only once, selection of this option on subsequent executions does not have any adverse effects.
The ADAM configuration wizard copies across the selected Active Directory user data to the ADAM instance, including the directory hierarchy.
NOTE:Directory synchronization for a large number of users can adversely affect the network performance. You can delay the directory synchronization to a more convenient time.
You can run the ADAM configuration wizard at any time to synchronize the updated Active Directory user data.
Select the Configure Microsoft Active Directory synchronization option.
(Optional) Select Synchronize now option.
NOTE:Each time a new organizational unit or user object is created in Active Directory, the ADAM configuration wizard or the SyncAdam.cmd command file must be executed to synchronize with the ADAM instance and assigned read and write permissions.
The SyncAdam.cmd cannot be run before running the ADAM configuration wizard.
Click Next. The Microsoft Active Directory user account page is displayed.
Select Current Microsoft Active Directory, the click Next.
or
Select Select Microsoft Active Directory user account and specify the account details in the User, Password, and Domain fields, then click Next. The ADAM instance location page is displayed.
NOTE:The account selected in this page is used to access and copy the Active Directory object data for synchronization with the ADAM instance, so it must have Read permission. This account must not have Write permission.
By default, the current account (that is, the one to which you are logged in) is selected. However, any user account that has Active Directory read permission is valid.
Click Next. The ADAM instance location page is displayed.
Accept the default values or specify the alternative Server and Port values as required, then click Next.
The default server value is localhost. Select an alternate server if you are hosting your ADAM instance on another computer.
The default port value is 50000. Specify an alternate port number if this is not the ADAM instance server port.
Click Next. The Microsoft Active Directory containers/organizational units page is displayed.
All containers and organizational units that include SecureLogin users are specified here, so you can assign SecureLogin rights and select for Microsoft Active Directory synchronization.
Click the Add.The Domain, Container or Organizational unit dialog box is displayed.
Specify the full distinguished name in the Enter distinguished name of domain, container or organizational unit field.
Click OK.
If the specified distinguished name of the domain, container, or organizational unit is invalid, an error message is displayed. In that case, click OK. You return to the dialog box. Specify the correct distinguished name of the domain, container, or organizational unit.
Click OK when the required objects are added to the list. The Configuration summary page is displayed.
Review the selected configuration options.
Click Back to change details or click Finish finish the configuration.
The SecureLogin ADAM Configuration - Termination dialog box is displayed if the configuration was not able to complete successfully. If this occurs, review the text box to investigate cause of termination. If a solution to the problem is determined, click Close and repeat execution of the SecureLogin ADAM Configuration Wizard.
After the configuration is complete, the SecureLogin ADAM configuration - Finished dialog box is displayed.
Click Close.
The ADSI Edit Tool is a Microsoft Management Console (MMC) snap-in which you can use to view all objects in the directory, including the schema and configuration information, modify objects, and set access control lists on the objects.
You can use the ADSI Edit tool to check and review SecureLogin ADAM configuration. To do this:
Click Start > Programs > ADAM > ADAM ADSI Edit. The ADAM ADSI Edit tool is displayed.
Select ADAM ADSI Edit in the hierarchy pane to view the ADAM Instance details.
Select Connect to from the Action menu. The Connection Settings dialog box is displayed.
Specify a name for the connection in the Connection name field.
Specify the ADAM instance server name in the Server name field.
Specify the ADAM instance port name in the Port name field.
Select Distinguished name (DN) or naming context.
Specify the Distinguished Name in the Distinguished name (DN) or naming context field.
Select Connect using these credentials. This is the account through which you wish to connect to the ADAM instance.
In this example, The account of the currently logged on user is selected
Click OK. The ADSI Edit tool displays the selected ADAM instance.
Right-click on the Users container to display the context menu.
Select Properties. The CN=Users Properties dialog box is displayed.
To confirm if the schema attributes are added successfully or not, scroll down the Attributes table window and verify if the six attributes in Configuring ADAM Schema are listed or not. Repeat this for each container and or organizational unit containing SecureLogin users.
If the attributes are not displayed, run the ADAM configuration wizard again and ensure that you specify the correct container, organizational unit, and user objects.
The Active Directory to ADAM Synchronizer is a command-line tool that synchronizes data from Active Directory forest to a configuration set of an ADAM instance. You can use this to ensure that new users are added to Active Directory have objects representing their SecureLogin data created in the ADAM instance.
To synchronize data from Active Directory to an ADAM instance:
Navigate to SecureLogin\Tools of the SecureLogin installation package.
Double-click the syncadam.cmd file.
After the synchronization is complete, you can look at the log file - SyncAdam.log, to ensure that the synchronization process is complete.
It is recommended that you synchronize regularly, when new organizational units are created or when Active Directory user are changed. You can add the process to the Windows Schedules Tasks.
During the synchronization, the following processes are automatically synchronized:
A new container or organizational unit in Active Directory is created as a corresponding container in ADAM.
A new user in Active Directory is created as ADAM user proxy.
A renamed user object in Active Directory causes the corresponding user proxy to be renamed in ADAM.
A moved user object in Active Directory causes the corresponding user proxy to be moved in ADAM. This requires both user object source container and destination container in synchronization scope.
However, the following processes are not automatically synchronized:
Deleted user objects in Active Directory are not deleted in ADAM by default. This is because od security concerns. You can override this by manually editing SyncAdam.config. However, this is not recommended unless there is a good reason because username might conflict with a ‘zombie’ user, or performance issues.
Deleted, moved, or renamed containers and organizational units in Active Directory are not synchronized to ADAM. Changes to existing container or OU objects in Active Directory must be manually synchronized to ADAM by using the ADSI Edit tool or any other directory editor. For example, if an OU is renamed in Active Directory, it must be renamed in ADAM. Because of security concerns, synchronization does not run if existing containers and OUs do not match in Active Directory and ADAM.