VACMAN, Identikey, axs GUARD and Digipass are registered trademarks of VASCO Data Security International Inc.

Transcription

1 Modify these field values (right-click and select Fields) to change text throughout the document: 2008 Digipass Authentication for OWA 2007 IIS 6 Module Internet Information Services IIS Authentication Server dpauthserver.xml Digipass Authentication for OWA 2007 Exchange OWA Forms Basic Guide 2007 IIS 6 Module Digipass Authentication for OWA 2007 Internet Information Services IIS Authentication Server dpauthserver.xml Digipass Authentication for OWA 2007 Exchange OWA Forms Basic Guide 2007 Digipass Authentication for OWA 2007 Forms Guide 3.2

2 Disclaimer of Warranties and Limitations of Liabilities Disclaimer of Warranties and Limitations of Liabilities The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you. Copyright 2008 VASCO Data Security Inc. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of VASCO Data Security Inc. Trademarks VACMAN, Identikey, axs GUARD and Digipass are registered trademarks of VASCO Data Security International Inc. Microsoft and Windows are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective holders. Digipass Authentication for OWA 2007 Forms Guide 2

3 Table of Contents Table of Contents 1 Digipass Authentication for OWA 2007 Overview IIS 6 Module Overview IIS Module Terminology Authentication Methods Server Connection Management Connection Profiles Connection Options Tracing International Characters Installation System Requirements Server Requirements - Software Pre-Installation Tasks Install Authentication Server IIS Information Needed Licensing Install Digipass Authentication for OWA 2007 Forms Digipass Authentication for OWA 2007 Forms Wizard Configuration IIS 6 Module Configuration Enable/Disable the IIS 6 Module Authentication Server Details Add a Server Modify Server Details Delete a Server Record Modify Connection Settings Turn Tracing On or Off Sites Modify Login Page Details Modify 1-Step Challenge/Response Login Page Details Add a Query String Parameter Modify a Query String Parameter Delete a Query String Parameter Add a Session Variable for the Failed Login Page Edit a Session Variable Remove a Session Variable Delete Site Record...38 Digipass Authentication for OWA 2007 Forms Guide 3

4 Table of Contents 3.2 Configuration File Configuration Settings Modify Character Set Used Configuring Exchange to work with the Authentication Server Modify Authentication Settings Configure Authentication Server Component Record Configure for Windows User Accounts Windows User Name Resolution Case Sensitivity Default Domain Policy Standard Policy Configurations for OWA Step Challenge/Response Post-Installation Tasks Set up 1- Step Challenge/Response Login Modify Authentication Server Policy Settings Set up Outlook Web Access Modify Custom Login Page Troubleshooting Display Login Failure Reason Replace Default Files Modify Existing logon.aspx File Create Challenge/Response Template Copy Challenge/Response Files Troubleshooting IIS 6 Module Installation Problems Check file placement Check Permissions Trace File Directory Configuration file Add the IUSR_<machine name> Account or IIS_WPG Group Set System Environment Variable Register IIS 6 Module Extension Remove IIS 6 Module Extension Check IIS 6 Module Extension Other Troubleshooting Options No Trace File Information from Trace File Authentication Server...68 Digipass Authentication for OWA 2007 Forms Guide 4

5 Table of Contents Licensing Repair Installation Uninstalling the Digipass Authentication for OWA Uninstall the Digipass Authentication for OWA Technical Support Support Contact Information...71 Digipass Authentication for OWA 2007 Forms Guide 5

6 Digipass Authentication for OWA 2007 Overview 1 Digipass Authentication for OWA 2007 Overview The main component of Digipass Authentication for OWA 2007 is the IIS 6 Module. 1.1 IIS 6 Module Overview The IIS 6 Module is an add-on for VACMAN Middleware, Identikey Server and axs GUARD Identifier. It can be configured to intercept authentication requests to a website which uses a login form and redirect them to an Authentication Server. The Authentication Server must be one of the following servers: Identikey Server 3.x Identikey Server component VACMAN Middleware 3.0 Authentication Server component axs GUARD Identifier 3.x The IIS 6 Module is an ISAPI extension specifically designed for use with IIS 6 only. Figure 1 Digipass Authentication for OWA 2007 Forms Overview IIS Module Terminology The following definitions describe how these terms are used in this document. They are also used in other IIS Package manuals. Digipass Authentication for OWA 2007 Forms Guide 6

7 Digipass Authentication for OWA 2007 Overview Basic Authentication A method of authentication that uses the HTTP Basic Authentication mechanism. This uses a login pop-up box provided by the Browser. Forms Authentication The method of authentication where the Web Site provides its own login page. IIS Module/IIS 6 Module General term for a plug-in to IIS to allow Digipass authentication to take place. The IIS 6 module is the IIS Module for IIS version 6. The IIS 6 module takes two forms depending on its application: IIS Extension The IIS Extension is an ISAPI extension used for Forms Authentication. The IIS plug-in is referred to as the IIS Module in manuals for Forms Authentication, unless the text is referring specifically to the IIS Extension. IIS Filter The IIS Filter is an ISAPI filter used for Basic Authentication. The IIS plug-in is referred to as the IIS Module in manuals for Basic Authentication, unless the text is referring specifically to the IIS Filter. Authentication Server The term Authentication Server refers to the component to which the IIS Module sends authentication requests. This component is: For Identikey Server, the Identikey Server service or daemon For axs Guard Identifier, the Identikey Server daemon For VACMAN Middleware 3, the Digipass Authentication Service Client/Component/Client Component The above terms refer to the same thing. The Client Component is the record defined in the Authentication Server's data store, to represent an installed instance of the IIS Module. Different terms are used due to differences in terminology on the server side. i.e. Client for Identikey Server and axs Guard, Component for VACMAN Middleware 3. They are used for the following main purposes: To indicate that the Authentication Server is permitted to process a request from that client To specify a Policy to be used to process the request To hold a License Key for the IIS Module Digipass Authentication for OWA 2007 Forms Guide 7

8 Digipass Authentication for OWA 2007 Overview Authentication Methods See the Product Guide for the authentication server for detailed information on login methods and options. Response Only login Users log in via the current login page with their username and One Time Password (OTP). 1-Step Challenge/Response login A random challenge - of a length configured for all users - is displayed on the login page. Users log in with their username and Digipass response to the displayed challenge. This requires modification of the current login page used by. 2-Step Challenge/Response login After the login page, the IIS 6 Module redirects users to a Challenge page where a random challenge of the length required by the user s Digipass is displayed. The user must enter a response to the challenge in order to complete the login. A Challenge page template must be used with this feature. A default template is provided. It can be used without modification or it can be customized to match your preferred look and feel. Virtual Digipass login Users logging in with a Virtual Digipass use a similar process to the 2-step Challenge/Response login. If the user has a Primary Virtual Digipass assigned, or requests use of the Backup Virtual Digipass feature during the first step, an OTP will be sent to the user s mobile phone via text message. The user is then redirected by the IIS 6 Module to the Challenge page to enter the OTP. This uses the same Challenge template used in the 2-step Challenge/Response login Server Connection Management The IIS 6 Module provides flexibility in managing connections to multiple primary and/or backup Authentication Servers. This allows redundancy and load sharing over multiple Servers Connection Profiles Two connection profiles are available: Primary The Server(s) to which the IIS 6 Module will first attempt to connect. The Primary Authentication Server(s) take the majority of the data load. Load sharing may be implemented over all Primary Authentication Servers. Digipass Authentication for OWA 2007 Forms Guide 8

9 Digipass Authentication for OWA 2007 Overview Backup A Backup Server can provide redundancy and failover. It is typically a local machine which, if the Primary Authentication Server is busy or cannot be contacted, will be used until a connection to the Primary Server can be re-established Connection Options Terminology Some of the terms used in configuring server connections are explained below: Maximum Connections The maximum number of connections that the IIS 6 Module may have open to the Authentication Server at one time. Timeout The time that the IIS 6 Module should wait for a reply from the Authentication Server. Reconnect Interval If the IIS 6 Module cannot connect to an Authentication Server, it will make connection attempts at increasing time intervals until it succeeds in establishing a connection. The time period between connection attempts is the Reconnect Interval. Figure 2 Standard Server Connection Configuration This setup uses one main Authentication Server to handle requests from the Web Server, with a backup Authentication Server for use when the main Server is busy or unavailable. Digipass Authentication for OWA 2007 Forms Guide 9

10 Digipass Authentication for OWA 2007 Overview Tracing The IIS 6 Module makes use of a trace file to record information about events that occur on the system, for use in troubleshooting. This could include generic information, changing conditions, or problems and errors that have been encountered. The level of tracing that the IIS 6 Module employs depends on its configuration settings. Caution Enabling Full Tracing should only be done for troubleshooting purposes. There are no limits set on the size of the tracing file, so if the option is left on too long on a high-load system the file may dramatically slow down or crash Windows, due to excessive I/O or filling up the hard drive. Because there are no size limitations set on the trace file, it is not recommended that you have tracing permanently enabled. If your system is set up with Tracing always enabled, ensure that the file size does not cause problems by deleting or archiving it whenever it gets too large. Basic tracing includes: Critical error/warning messages [CRITC] Major error/warning messages [MAJOR] Minor error/warning messages [MINOR] Configuration messages [CONFG] Full tracing includes: Critical error/warning messages [CRITC] Major error/warning messages [MAJOR] Minor error/warning messages [MINOR] Configuration messages [CONFG] Informational messages [INFOR] Data tracing messages [DATA] Debugging messages (useful for support purposes) [DEBUG] Security messages, messages that may contain security sensitive data [SECUR] Note The IIS 6 Module will require permissions for the directory in which the tracing file is kept. See Check Permissions for more information. Digipass Authentication for OWA 2007 Forms Guide 10

11 Digipass Authentication for OWA 2007 Overview International Characters The IIS 6 Module can be configured to use one specific character set when submitting login requests to the Exchange server. For more information, and instructions on configuring international characters in the IIS 6 Module, see Modify Character Set Used. Digipass Authentication for OWA 2007 Forms Guide 11

12 Installation 2 Installation Before installing the IIS 6 Module, check that all system requirements and pre-installation tasks have been met. This will help ensure a smooth, trouble-free installation and integration process. 2.1 System Requirements Server Requirements - Software An authentication server running on another machine. This should be one of the following: Identikey Server 3.x VACMAN Middleware 3.0 Authentication Server axs GUARD Appliance Internet Information Services (IIS) 6.0 or higher Windows Server 2003 Service Pack 2 or higher MS Exchange 2007 using Outlook Web Access in Forms Authentication mode and SSL. The User must have administration rights on the installation machine. Note If Outlook Web Access is not in Forms Authentication mode, this IIS Module will not function. Use the Digipass Authentication for OWA 2007 Basic instead. 2.2 Pre-Installation Tasks Before installing the IIS 6 Module, there are several tasks which need to be completed. Performing these tasks (where applicable) will assist in a quick, smooth installation process. Note Digipass Authentication for OWA 2007 Forms cannot be installed on the same machine as Digipass Authentication for OWA 2007 Basic or other Digipass Authentication packages. To upgrade from Digipass Pack for OWA, uninstall the Digipass Pack and install Digipass Authentication for OWA 2007 Forms. Digipass Authentication for OWA 2007 Forms Guide 12

13 Installation Install Authentication Server An Authentication Server must be installed on the network before the IIS 6 Module is installed. See 2.1 System Requirements for compatible servers and 3.4 Configure Authentication Server for configuration recommendations. Warning On the Windows platform, it is recommended that the Use Windows User Name Resolution feature on the Authentication Server is enabled. This uses Windows functions to identify User IDs as Windows User accounts, including the domain to which the account belongs. This feature is not available on Linux platforms or the axs GUARD Identifier. If the Use Windows User Name Resolution feature is disabled, it is essential that users always use the same login name. If they try to log in using a different form of their Windows account name, their login will be rejected, unless a second Digipass User account has been created IIS Ensure IIS and Exchange are installed and working correctly. The IIS 6 Module must be installed on the IIS server where Outlook Web Access is running Information Needed Before you begin installation of the IIS 6 Module, ensure that you have the following information easily accessible, as you will need to enter this during the installation. IP address and port number of the Authentication Server. To check this, open the Authentication Server Configuration and check the Component location and Port fields. Source IP address on the local machine to use when connecting to the Authentication Server (if multiple IP addresses are configured for this machine, as this affects licensing see below) Licensing The Authentication Server will regard each incoming IP address as a different Client Component. This is the reason for selecting a single IP address in connecting to the Authentication Server if there is more than one IP address for a machine. Digipass Authentication for OWA 2007 Forms Guide 13

14 Installation 2.3 Install Digipass Authentication for OWA 2007 Forms 1. Start the Digipass Authentication for OWA 2007 Forms installation process. If you are not using the CD Autorun interface, locate and double-click on the file. 2. Click Next. Digipass Authentication for OWA 2007 Forms Guide 14

15 Installation 3. Tick the box marked 'I accept the terms in the License Agreement'. 4. Click Next. 5. Enter the destination folder for the module. Digipass Authentication for OWA 2007 Forms Guide 15

16 Installation 6. Click Next 7. Click Install to install the Digipass Authentication for OWA 2007 Forms. The files will be installed to the directory you specified. 8. To finish the install click Finish. The Digipass Authentication for OWA 2007 Forms Wizard will be started. Digipass Authentication for OWA 2007 Forms Guide 16

17 Installation 2.4 Digipass Authentication for OWA 2007 Forms Wizard Note For a definition of the term Authentication Server, please see IIS Module Terminology 1. Enter the IP address for the Authentication Server in the IP Address field. 2. Check the Port field. If the SEAL port on which the primary Authentication Server is listening is not the default provided (20003), enter the correct port number. 3. Select the type of data store that the primary Authentication Server is using. Select either Active Directory or ODBC-compliant or embedded database. If using the embedded PostgreSQL database, select ODBCcompliant or embedded database. 4. Click Next. The Wizard will attempt to connect to the Authentication Server using the IP address and port provided. If the connection fails an error window will appear informing you of the problem. Click OK to take you back to the Authentication Server Connection Details window. To get help identifying the problem, see the 5 Troubleshooting section. Digipass Authentication for OWA 2007 Forms Guide 17

18 Installation 5. Select an IP address from the IP Address drop down list, which will contain IP addresses assigned to the current machine. The IIS 6 Module will use the selected IP address exclusively. As VASCO component licensing operates on IP address, this ensures that the IIS 6 Module will only use up one component license slot. 6. Click Next. Digipass Authentication for OWA 2007 Forms Guide 18

19 Installation 7. Select one of the two option buttons. Create Component record manually The Wizard will not attempt to create a Component record for the IIS 6 Module or load a license for the record. You will need to do this manually instead. This option where a Component record already exists for the IIS 6 Module, with a valid license key loaded. Digipass Authentication for OWA 2007 Forms Guide 19

20 Installation a. Select Do not create the Component record and do not load the license automatically b. Click on Next. c. Jump to Step 10. Create Component record automatically The Wizard will create a Component record in the Authentication Server data store for the IIS 6 Module. You may also load a license for the created record. If the Component record already exists for the IIS 6 Module at the current IP address, a new Component record will not be created. The license key will be loaded into the existing Component record. a. Select Do create the Component record automatically b. Click on Next. c. Continue with the following steps. 8. Enter your login details: Active Directory a. Enter the User ID and password for the Domain Administrator. If you are logged into the current machine as Domain Administrator in the correct Domain, you may leave these fields blank. b. Enter the Fully Qualified Domain Name of the Domain in which the Authentication Server configuration data is kept. Typically this will be Digipass Configuration Domain. This is a mandatory field. Digipass Authentication for OWA 2007 Forms Guide 20

21 Installation c. Enter a preferred server if you wish the Wizard to connect to a specific Domain Controller. The text entered should be the first part of the Fully Qualified Domain Name for the Domain Controller. d. Click on Next. Digipass Authentication for OWA 2007 Forms Guide 21

22 Installation ODBC-Compliant Database a. Enter the User ID and password for an Administrator account on the Authentication Server. This account will need permissions to: view, create and update Components b. Click on Next. view Policies Digipass Authentication for OWA 2007 Forms Guide 22

23 Installation 9. To load a license key: Select a license key file by clicking... Select the license.dat file to load from where you saved it on your machine. Click Open to load the License Key from the file. If you do not already have a license.dat file containing a License Key for the OWA Component at this Location, click on the Request a License Key from button. This will take you to the vasco.com web site, where you can request a license key and save it to a file called license.dat. Digipass Authentication for OWA 2007 Forms Guide 23

24 Installation To load a license key later, simply click on Next. 10. The Summary screen will allow you to review your configuration settings before they are applied. Check the configuration settings carefully and click Back to go back and change a setting if it is incorrect. Click Proceed to apply the configuration settings when they are correct. 11. If the Authentication Server uses Active Directory as its data store, you may need to restart the Authentication Server before it will recognise the new Component record and acknowledge requests from the IIS 6 Module. Digipass Authentication for OWA 2007 Forms Guide 24

25 Configuration 3 Configuration Configuration settings can be modified in two ways. The easiest method is via the IIS 6 Module Configuration a graphical interface that allows you to make changes with a few mouse clicks. Advanced users may prefer to edit the configuration file directly. 3.1 IIS 6 Module Configuration A Graphical User Interface (GUI) is available for use in configuring the IIS 6 Module. This provides a simple, intuitive way to set up the IIS 6 Module to work with your current system. To open the IIS 6 Module Configuration, click on the Start Button and select Programs VASCO Digipass Authentication for OWA 2007 Forms IIS Module Configuration Alternatively, open Windows Explorer and open <IIS 6 Module install directory>\bin\dpiismodcfg.exe. If this is the first time you have opened the IIS 6 Module Configuration and the configuration file has not been edited, the values you will see are those entered when the Wizard was last run. Digipass Authentication for OWA 2007 Forms Guide 25

26 Configuration Enable/Disable the IIS 6 Module This option starts or stops the IIS 6 Module from redirecting authentication requests to the Authentication Server. 1. Click on the General tab. 2. Tick or untick the Enable Digipass Authentication checkbox. 3. Click on the Apply button Authentication Server Details The Server list contains all Authentication Servers which may be utilized by the IIS 6 Module. Authentication Server records can be added, deleted, or their details modified Add a Server 1. Click on the Add button. Digipass Authentication for OWA 2007 Forms Guide 26

27 Configuration The New Server window will be displayed. 2. Enter a name for the Authentication Server in the Display Name field. This name will be used to distinguish the Authentication Server in the Server list, but has no effect on the behaviour of the IIS 6 Module. 3. Enter an IP address and port (typically 20003) for the Authentication Server, in the IP Address and Port fields. 4. Select a Server Type (see Server Connection Management). 5. Enter a timeout period (in seconds) in the Timeout field. 6. Enter the maximum number of concurrent connections to be made from the IIS 6 Module to the Server, in the Max. Connections field. 7. Enter a minimum and maximum amount of time that the IIS 6 Module should wait before attempting to reconnect to the Authentication Server in the Min. Reconnect Interval and Max. Reconnect Interval fields. 8. Click on the OK button Modify Server Details 1. Select the Server to be edited. 2. Click on the Edit button. The Edit Server window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 27

28 Configuration 3. Make required changes. 4. Click on the OK button Delete a Server Record 1. Select the Server record to be deleted. 2. Click on the Delete button. A confirmation window will be displayed. 3. Click on OK to delete the Server record. Digipass Authentication for OWA 2007 Forms Guide 28

29 Configuration Modify Connection Settings Reconnect Interval If the IIS 6 Module loses contact with the primary Authentication Server(s), it will switch its connection over to a backup Authentication Server. It will try to reconnect with the primary server(s) at increasing intervals until connection with the primary server(s) is re-established. The Minimum Reconnect Interval and Maximum Reconnect Intervalsets the minimum and maximum amounts of time that the IIS 6 Module will leave between attempts to reconnect to the primary Authentication Server(s). Connect from IP Address If a server has multiple IP addresses configured, the IIS 6 Module needs to know which to use in connecting to the Authentication Server(s). 1. Enter the IP address from which to connect to Authentication Servers in the Connect from IP Address field. This may be left blank if there is only one IP address for the machine. 2. Click on the Apply button. Digipass Authentication for OWA 2007 Forms Guide 29

30 Configuration Load Sharing Load sharing allows the IIS 6 Module to connect to multiple Authentication Servers when it has reached the maximum number of concurrent connections for the first primary Authentication Server in the Server list. 1. Tick the Enable Load Sharing checkbox. 2. Click on the Apply button Turn Tracing On or Off 1. Select a Tracing option. See Tracing for more information. 2. If you have selected Basic Tracing or Full Tracing, enter a path and filename for the tracing file into the File Name field. The file path entered must be the full absolute path. 3. Click on the Apply button. Digipass Authentication for OWA 2007 Forms Guide 30

31 Configuration Note If the File Name field is left blank or the file path does not exist, the IIS 6 Module will not output tracing. If the file does exist, tracing will be appended to the file. If the path is valid but the file does not exist, it will be created. If the IIS_WPG group does not have Write permissions for the directory specified, tracing will not be successful. See Trace File Directory for more information. Digipass Authentication for OWA 2007 Forms Guide 31

32 Configuration Sites Each web site to be protected by the IIS 6 Module is displayed in the Sites list. Outlook Web Access supports only one Site, which will be entered into the configuration during installation. This Site record may be modified at anytime. Note The Password Change capture feature is not supported by the Digipass Pack for OWA Forms Authentication Modify Login Page Details 1. Click on the Authentication tab. Digipass Authentication for OWA 2007 Forms Guide 32

33 Configuration 2. Select the Site and click on the Edit button. The Edit Site window will be displayed. 3. Click on the Login tab. 4. Modify the Base URL if required. 5. For information on modifying query string parameters for the login page, see the Add, Modify and Delete a Query String Parameter topics below. 6. Click on the Form Fields tab. 7. Ensure that the correct names for the fields on the login page corresponding to User, Password and Domain are entered into the relevant fields. 8. Click on the Failed Login tab. 9. Modify the Base URL if required. Digipass Authentication for OWA 2007 Forms Guide 33

34 Configuration Tick the Return Failure Reason checkbox if you wish to enable the IIS 6 Module to add information about a login failure to the login page (see Display Login Failure Reason). 10. For information on modifying query string parameters for the login page, see the Add, Modify and Delete a Query String Parameter topics below. 11. If you need to set up 2-step Challenge/Response login or Virtual Digipass login: a. Click on the Two Step C/R tab. b. Enter the location of the Challenge/Response template. 12. Click on OK. Digipass Authentication for OWA 2007 Forms Guide 34

35 Configuration Modify 1-Step Challenge/Response Login Page Details 1. Click on the Authentication tab. 2. Select the Site and click on the Edit button. The Edit Site window will be displayed. 3. Click on the One Step C/R tab. 4. Tick the Enabled checkbox to allow 1-step Challenge/Response logins. 5. Modify the Base URL if required. 6. For information on modifying query string parameters for the change password page, see the Add, Modify and Delete a Query String Parameter topics below. 7. Click on OK. Digipass Authentication for OWA 2007 Forms Guide 35

36 Configuration Add a Query String Parameter The Query String Parameters list contains URL parameters required by OWA when a login is submitted. The IIS 6 Module will only identify a request as a login if these variables are present in the query string. 1. Click on the + button. The Add Login Query String Parameter window will be displayed. 2. Enter the new parameter, exactly as it will appear in the query string eg. page=login 3. Click on OK. 4. Repeat the process for other query string parameters Modify a Query String Parameter 1. Select a Query String Parameter from the list. 2. Click on the button. The Edit Login Query String Parameter window will be displayed. 3. Make the required changes. 4. Click on OK. Digipass Authentication for OWA 2007 Forms Guide 36

37 Configuration Delete a Query String Parameter 1. Select a query string parameter from the list. 2. Click on the button. A confirmation window will be displayed. 3. Click on Yes to delete the query string parameter Add a Session Variable for the Failed Login Page The Session Variables list contains query string parameters from the login submit request which should be included in the failed login URL, such as session identifiers. 1. Click on the + button. The Add Failed Login Session Variable window will be displayed. 2. Enter the name of the query string parameter. 3. Click on OK. Repeat the process for other query string parameters to be included in the failed login URL Edit a Session Variable 1. Select a session variable from the list. 2. Click on the button. The Edit Failed Login Session Variable window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 37

38 Configuration 3. Modify the name of the query string parameter. 4. Click on OK Remove a Session Variable 1. Select a query string parameter from the session variable list. 2. Click on the button. A confirmation window will be displayed. 3. Click on Yes to remove the query string parameter from the list Delete Site Record 1. Click on the Authentication tab. 2. Select the site name from the Sites list. 3. Click on the Delete button. A confirmation window will be displayed. 4. Click on OK to delete the site record. Digipass Authentication for OWA 2007 Forms Guide 38

39 Configuration 3.2 Configuration File The IIS 6 Module Configuration writes to an.xml file named dpextcfg.xml in the installation directory. It is possible to edit this file directly instead of using the IIS 6 Module Configuration. Increment the Revision number by 1 to have your changes take effect. Note This option is recommended only for advanced users. The IIS 6 Module Configuration will prevent most common configuration mistakes, but there are no such checks made when edits are made directly to the configuration file. Incorrect changes to the configuration file may cause the IIS 6 Module to stop working. Example configuration file <VASCO> <Revision type="unsigned" data="12"/> <Enabled type="unsigned" data="1"/> <Default-Component-Type type="string" data="outlook Web Access"/> <Tracing> <Trace-Header type="unsigned" data="15"/> <Trace-Mask type="unsigned" data="0xffffffff"/> <Trace-File type="string" data="c:\program Files\VASCO\Digipass Authentication for 2007 Forms\log\dpiis.trace"/> </Tracing> <AAL3> <SEAL> <Local-Address type="string" data=" "/> <Connection-List> <Load-Balancing type="bool" data="false"/> <Connection00> <Name type="string" data="main_server"/> <Address type="string" data=" "/> <Port type="unsigned" data="20003"/> <Server-Type type="string" data="primary"/> <Nr-Connections type="unsigned" data="10"/> <Min-Reconnect-Interval type="unsigned" data="30"/> <Max-Reconnect-Interval type="unsigned" data="300"/> <Timeout type="unsigned" data="60"/> </Connection00> </Connection-List> </SEAL> </AAL3> <Sites> <Site0> <Name type="string" data="owa Forms Authentication"/> <Component-Type type="string" data="outlook Web Access"/> <Login> Digipass Authentication for OWA 2007 Forms Guide 39

40 Configuration <Match-URL> <URL type="string" data="/owa/auth/owaauth.dll"/> </Match-URL> <Failed-URL> <URL type="string" data="/owa/auth/logon.aspx?replacecurrent=1&reason=2"/> </Failed-URL> <User-Field type="string" data="username"/> <Password-Field type="string" data="password"/> <Domain-Field type="string" data=""/> <Submit-Encoding type="string" data="utf-8"/> <Challenge-Template type="string" data="c:\program Files\VASCO\Digipass Authentication for 2007 Forms /Authentication challenge/challenge_template.html"/> <Error-Message type="bool" data="false"/> </Login> <ChgPasswd> <Match-URL> <URL type="string" data=""/> </Match-URL> <Enabled type="bool" data="false"/> <User-Field type="string" data=""/> <Password-Field type="string" data=""/> <NewPassword-Field type="string" data=""/> <PasswordConf-Field type="string" data=""/> <Submit-Encoding type="string" data=""/> </ChgPasswd> <One-Step-CR> <Match-URL> <URL type="string" data="/owa/auth/logon.aspx"/> </Match-URL> <Enabled type="bool" data="false"/> </One-Step-CR> </Site0> </Sites> </VASCO> Caution The configuration file is UTF8 encoded. Non-UTF8 encoded characters should not be added to the configuration file, or it will not load. Digipass Authentication for OWA 2007 Forms Guide 40

41 Configuration Configuration Settings The table below lists the options, their default values, and a brief explanation of each. Table 1 Configuration Options Option Name Default Value Notes Revision 1 The current revision of the configuration. This is incremented each time the configuration is changed and allows the IIS 6 Module to automatically reload its configuration parameters. If you have manually changed configuration settings in the file, increment this setting by 1 so that your changes take effect. Enabled 1 Whether the IIS 6 Module is enabled or disabled. If disabled, does not block access, but does not intercept authentication requests they pass through unmodified. Default-Component-Type Outlook Web Access Default Component type to specify when connecting to an Authentication Server. Trace/Trace-Header 31 The tracing header fields that have been enabled. This is a bitmask constructed by adding the following values: 1 Enable the Date field 2 Enable the Time field 4 Enable the Tracing level field 8 Enable the Thread ID field 16 Enable the File field 32 Enable the Line field eg. for DATE,TIME,LEVEL = = 7 A value of 0 will result in no header being added to the trace output. Trace/Trace-Mask 0x Hexadecimal or decimal values: Trace/Trace-File <installation directory>\ Log\vmiis.trace Hex Decimal 0x No tracing 0x E Configuration and error messages only 0xFFFFFFFF All levels enabled. The absolute path and filename of the file to which internal state tracing will be written. The file but not the path will be created by the filter / extension if it does not exist. If this option is blank, the IIS 6 Module will not output tracing. Sites/Site<number>/ <blank> Text to display in the Sites list on the Configuration GUI. Digipass Authentication for OWA 2007 Forms Guide 41

42 Configuration Name Option Name Default Value Notes Sites/Site<number>/ Component-Type Sites/Site<number>/ Login/ Match-URL/URL Sites/Site<number>/ Login/Match-URL/ Param<number> Sites/Site<number>/ Login/Failed-URL/URL Sites/Site<number>/ Login/User-Field Sites/Site<number>/ Login/Password-Field Sites/Site<number>/ Login/Domain-Field Sites/Site<number>/ Login/Challenge-Template Sites/Site<number>/ Login/Submit-Encoding Sites/ Site<number>/ One-Step-CR/ Match- URL/URL Sites/ Site<number>/ One-Step-CR/ Match-URL/ Param<number> Sites/ Site<number>/ One-Step-CR/ Enabled AAL3/SEAL/ Connection- List/ Connection <number>/ Address Outlook Web Access /owa/auth/owaauth.dll <blank> /owa/auth/logon.aspx?replacecu rrent=1&reason=2 username password <blank> Challenge\challenge_template.ht ml UTF-8 /owa/auth/logon.aspx <blank> Default Component type to specify when connecting to an Authentication Server for this site. If this parameter is not specified the default will be the component type above. The base URL to use in submitting a login. Query string parameter needed in the URL. The base URL to use after a failed login attempt. Name of the field that corresponds to User. Name of the field that corresponds to Password. Name of the field that corresponds to Domain. Location and file name of the template to use in creating a Challenge/Response page. The character encoding to use in submitting a login request to Exchange. This allows the use of international character sets (see International Characters) The base URL to use in making a one-step challenge/response login request. Query string parameter needed in the URL. 0 Whether one-step challenge/response logins are enabled IP Address of the Authentication Server. AAL3/SEAL/Local Address Local IP address. AAL3/SEAL/ Connection- List/ Connection<number>/ Port AAL3/SEAL/ Connection- List/ Port to use in connecting to the Authentication Server. Primary Either Primary or Backup Authentication Server. This setting affects load-balancing. Digipass Authentication for OWA 2007 Forms Guide 42

43 Configuration Option Name Default Value Notes Connection<number>/ Server-Type AAL3/SEAL/ Connection- List/ Connection <number>/ Nr-Connections AAL3/SEAL/ Connection- List/ Connection <number>/min- Reconnect-Interval AAL3/SEAL/ Connection- List/ Connection <number>/max- Reconnect-Interval 10 The maximum number of concurrent connections which the IIS 6 Module may hold open to the Authentication Server. 30 The minimum amount of time that the IIS 6 Module will leave between attempts to reconnect to a higher-priority server after losing connection to it. 300 The maximum amount of time that the IIS 6 Module will leave between attempts to reconnect to a higher-priority server after losing connection to it. Digipass Authentication for OWA 2007 Forms Guide 43

44 Configuration Modify Character Set Used If you are using non-western European characters, the IIS 6 Module may need to be configured to use a specific character set when submitting login requests to the. The character set to be used can be modified in the IIS 6 Module configuration file (vmextcfg.xml) in the <installation directory>\bin directory. Edit the Encoding setting to the desired character set code these are listed in the table below. Caution The IIS 6 Module can only be configured to use a single character set it is not able to handle multiple character sets simultaneously. Table 2 - Character Set Codes Language ISO code Windows code Other code(s) Arabic ISO CP1256 Baltic ISO or ISO CP1257 Central European ISO CP1257 Chinese Simplified ISO-2022-CN GB2312 Chinese Traditional Big5 Cyrillic ISO CP1251 Greek ISO CP1253 Hebrew ISO I CP1255 Japanese Korean ISO-2022-JP ISO-2022-KR Thai ISO CP874 Turkish ISO Vietnamese CP1258 Western European ISO CP1252 Digipass Authentication for OWA 2007 Forms Guide 44

45 Configuration 3.3 Configuring Exchange to work with the Authentication Server Authentication settings in Exchange must be compatible with the IIS 6 Module. The following section will explain how to configure Exchange for use with the IIS 6 Module Modify Authentication Settings Exchange must have Forms Authentication enabled, and Windows Integrated Authentication disabled, to allow the IIS 6 Module to intercept authentication requests and, where appropriate, pass them to the Authentication Server. 1. Open Exchange Management Console. 2. Expand the Server Configuration heading. 3. Click on Client Access. 4. Right click on OWA and click on Properties. 5. The OWA Properties window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 45

46 Configuration 6. Click on the Authentication tab. 7. Ensure that the Use Forms Based authentication option is set. 8. You may choose from any of the options below the Use Forms Based authentication button as you require. 9. Click on the OK button Digipass Authentication for OWA 2007 Forms Guide 46

47 Configuration 3.4 Configure Authentication Server Component Record A Client Component record must be configured in the Authentication Server for the IIS 6 Module. The wizard can create the required record if: The Authentication Server is using an ODBC database (including the embedded PostgreSQL database) as its data store, or The Authentication Server is using Active Directory and the wizard can successfully connect to Active Directory from the web server. To create the Client Component record manually: 1. Create a Client Component record for the IIS 6 Module. a. The Component Type should be set to OWA. b. The Location should be set to the same IP address as in the Connect from IP Address setting in IIS 6 Module Configuration. c. Select a Policy for the Authentication Server to use when processing authentication requests from the IIS 6 Module. See Policy for more information. 2. A valid license key must be obtained for the IIS 6 Module and loaded in to the Component record Configure for Windows User Accounts Windows User Name Resolution If the Authentication Server is installed on a Windows platform and is using an ODBC database (including the embedded database) as its data store, it is recommended that you enable Windows User Name Resolution. This allows the Authentication Server to use Windows functionality to resolve a User ID as entered during a login into a User ID and Domain. It is highly recommended if Dynamic User Registration will be enabled. This setting is not required where the Authentication Server is using Active Directory as its data store - name resolution will occur automatically. This setting is not available on Identikey Server on Linux, or axs GUARD Identifier. If the Use Windows User Name Resolution feature is disabled or unavailable, it is essential that users always use the same login name. If they try to log in using a different form of their Windows account name, their login will be Digipass Authentication for OWA 2007 Forms Guide 47

48 Configuration rejected, unless a second Digipass User account has been created. This is essential for enabling the change password facility to work Case Sensitivity Windows User names are not case-sensitive. If the ODBC database used by the Authentication Server is casesensitive, ensure that User ID case is converted to lower case. Upper case may also be used, but will involve extra configuration steps. The embedded PostgreSQL database is set to convert to lower case by default. See the Encoding and Case Sensitivity topic in the Administrator Reference for more information Default Domain Where Users log in without entering a domain name or UPN, the Authentication Server will need to be configured to use the correct domain. There are two basic scenarios that might apply: Change Master Domain If Users will only ever be logging in to one domain via the Authentication Server, the simplest solution is to set the Master Domain name to the Fully Qualified Domain Name of the required domain. This option is not available for axs GUARD Identifier. Set Default Domain in Policy This strategy should be used if: You wish to keep the Master Domain strictly for administration accounts and separate from User accounts The Authentication Server may be required to handle a different default domain for different IIS 6 Modules or other clients Each Policy may be configured with a Default Domain, to be used if a User does not enter a domain on login. Typically, you will need to modify the Policy used by each IIS 6 Module. Digipass Authentication for OWA 2007 Forms Guide 48

49 Configuration Policy The Component record created during installation of the IIS 6 Module uses the default Password Replacement Policy for the package. It will be named: VM3 Windows Password Replacement (VACMAN Middleware) Identikey Windows Password Replacement (Identikey Server) Identikey Microsoft AD Password Replacement (axs GUARD Identifier) These Policies are configured with the following settings: Note These settings are all available on Windows but the VM3 Windows Password Replacement policy is not available on Identikey Server on Linux or the axs GUARD Identifier, so the corresponding settings are not available on those platforms Back-End Authentication is set to If Needed (used for DUR, Password Autolearn etc, not all logins). Windows is used as the back-end authenticator in the VM3 Windows Password Replacement and Identikey Windows Password Replacement Policies. Dynamic User Registration, Password Autolearn and Stored Password Proxy are enabled. Group Check Mode is set to Pass Back and Digipass Users is placed in the Group List. This will mean that any logins by Users not in the Digipass Users group will be ignored not rejected by the Authentication Server in the VM3 Windows Password Replacement and Identikey Windows Password Replacement Policies. If you will need different settings, either select a different Policy (eg. Self-Assignment or Auto-Assignment) for the IIS 6 Module Component or copy the Password Replacement Policy to a new record, modify the new Policy as required, and use the new Policy for the IIS 6 Module Component Standard Policy Configurations for OWA Digipass Users login with OTP only (Windows user accounts) The following settings are recommended for this scenario: Back-End Authentication Back-End Authentication: If Needed Back-End Protocol: Windows (Identikey Server and VACMAN Middleware) or Microsoft AD (axs GUARD Identifier) These settings allow the Authentication Server to check user login details with Windows or Active Directory in case of DUR, Password Autolearn and Self-Assignment logins through the IIS 6 Module. Digipass Authentication for OWA 2007 Forms Guide 49

50 Configuration Digipass User Account Handling Dynamic User Registration: Enabled Password Autolearn: Enabled Stored Password Proxy: Enabled These settings allow the Authentication Server to create an account for an unrecognized User based on a successful Windows or Active Directory authentication. The Authentication Server can then store the User s Active Directory password and replay it to the IIS 6 Module in place of the One Time Password entered by the User on future logins. Digipass Assignment Mode Either Self-Assignment or Auto-Assignment would typically be used in this scenario, although manual assignment may also be used. Local Authentication The typical setting for local authentication would be Digipass/Password, meaning that Users usually need to use an OTP when logging in, but are not required to in some circumstances (eg. in Grace Period). Digipass Users login with Password and OTP (Windows user accounts) The following settings are recommended for this scenario: Back-End Authentication Back-End Authentication: If Needed Back-End Protocol: Windows (Identikey Server and VACMAN Middleware) or Microsoft AD (axs GUARD Identifier) These settings allow the Authentication Server to check user login details with Windows or Active Directory in case of DUR and Self-Assignment logins through the IIS 6 Module. Digipass User Account Handling Dynamic User Registration: Enabled Password Autolearn: Disabled Stored Password Proxy: Disabled These settings allow the Authentication Server to create an account for an unrecognized User based on a successful Windows or Active Directory authentication. The Authentication Server will not store or replay a User s Windows or Active Directory password. Digipass Authentication for OWA 2007 Forms Guide 50

51 Configuration Digipass Assignment Mode Either Self-Assignment or Auto-Assignment would typically be used in this scenario, although manual assignment may also be used. Local Authentication The typical setting for local authentication would be Digipass/Password, meaning that Users usually need to use an OTP when logging in, but are not required to in some circumstances (eg. in Grace Period). Non-Windows User accounts The following settings are recommended for this scenario: Back-End Authentication Back-End Authentication: None The Authentication Server will not use back-end authentication. Digipass User Account Handling Dynamic User Registration: Disabled Password Autolearn: Disabled Stored Password Proxy: Disabled As these settings are used with Windows back-end authentication, they will not be used. Digipass Assignment Mode As Self-Assignment and Auto-Assignment are both reliant on back-end authentication,only manual assignment will be available. Local Authentication The typical setting for local authentication would be Digipass, meaning that Users are required to use an OTP when logging in Step Challenge/Response If you use 1-Step Challenge/Response, you will need these Policy settings: 1-Step Challenge/Response Permitted: Yes Server Challenge Challenge Length as required Add Check Digit as required Digipass Authentication for OWA 2007 Forms Guide 51

52 Configuration Challenge Check Mode: 0 For more information, see the Policies section of the Product Guide. Digipass Authentication for OWA 2007 Forms Guide 52

53 Post-Installation Tasks 4 Post-Installation Tasks 4.1 Set up 1- Step Challenge/Response Login Implementing 1-step Challenge/Response login requires the login page used by OWA to be modified. The standard OWA 2007 login page has been modified and placed in the <install directory>\challenge directory. To use a login page which has been customized for your company eg. colours and graphics used follow the instructions in Modify Custom Login Page Modify Authentication Server Policy Settings To use 1-Step Challenge/Response, the Authentication Server(s) accessed by the IIS 6 Module must apply a Policy in which 1-Step Challenge/Response is enabled and the correct configuration made Set up Outlook Web Access Login page 1. Backup <exchange-directory>\logon.aspx to a suitable place. 2. Copy modified login page from <installation-directory>\logon.aspx (or other location if using a custom login page) to <exchange-directory>\logon.aspx. 3. Enable 1-Step Challenge/Response in the IIS 6 Module Configuration. 4. Enable One-Step Challenge/Response in the Policy. See Step Challenge/Response, which lists the Policy settings required for 1-Step Challenge/Response. 5. Install the "Flash" Challenge Applet for the Challenge/Response pages. 6. Copy <installation-directory>\flash.class to <exchange-directory>\flash.class 7. Check the permissions of the /owa/auth/flash.class file from the IIS 6 Management Console. Ensure that read access is allowed. 8. Enable the applet in the Challenge/Response code. For One-Step Challenge/Response, un-comment applet code in <exchange-directory>\logon.aspx (as copied over in step 2). To edit the file, open in a text editor (eg. Notepad). <!-- This part adds the FLASH challenge. --> <!-- commented out by default <tr> <td nowrap></td> <td align="center" class="txtpad"><%= VascoFlash %></td> Digipass Authentication for OWA 2007 Forms Guide 53

54 Post-Installation Tasks </tr> --> 9. Save and close the file Modify Custom Login Page If you have a current login page in use which differs from the standard OWA login page, you may need to modify it rather than replacing it with the login page provided with the Digipass Pack. When the IIS 6 Module detects a request for the login page, it adds three headers to the request before passing it on. The headers added are: Table 3 - Headers added to login request string Header Explanation VASCO-Challenge Contains the string challenge to be displayed to the user. ie "1234" VASCO-State VASCO-FlashCode Contains data that needs to be passed as the field "VMExtState" on the login request. Contains the html code needed to include the challenge flash applet in the login page. This requires the applet be copied to the appropriate location in the website. A piece of code must be inserted into the login page to include 1-step Challenge/Response functionality. The code required can be found below or taken directly from the login page added to the <install directory>\challenge directory during installation. <!-- Digipass Authentication for OWA Forms modifications : START --> <!-- The following code is for 1-step challenge/response. If you --> <!-- want the flash applet as well as the text challenge, un- --> <!-- comment out the section marked FLASH. --> <!-- This code will not do anything unless 1-step challenge/ --> <!-- response is enabled in the configuration settings. --> <% string VascoChallenge = Request.ServerVariables["HTTP_VASCO_CHALLENGE"]; string VascoFlash = Request.ServerVariables["HTTP_VASCO_FLASHCODE"]; string VascoState = Request.ServerVariables["HTTP_VASCO_STATE"]; if (VascoState!= null) { %> <!-- This part adds the text challenge. --> <tr> <td nowrap><label for="challenge">challenge:</label></td> <td class="txtpad"><input id="challenge" name="challenge" type="text" class="txt" value='<%= VascoChallenge %>' readonly='true'></td> </tr> <!-- This part adds the FLASH challenge. --> Digipass Authentication for OWA 2007 Forms Guide 54

55 Post-Installation Tasks <!-- commented out by default <tr> <td nowrap></td> <td align="center" class="txtpad"><%= VascoFlash %></td> </tr> --> <!-- This part is needed always. --> <input name='vmextstate' type='hidden' value='<%= VascoState %>'> <% } %> <!-- Digipass Authentication for OWA Forms modifications : END --> Troubleshooting If the challenge flash applet is not functioning, ensure that: The applet file (flash.class) is in the correct directory The applet code has been referred to correctly in the login page code. Read permissions have been applied to the flash.class file. 4.2 Display Login Failure Reason The IIS 6 Module may be configured to pass information to OWA 2007 when it fails an authentication request. This information may be used to provide Users with an explanation of why their login failed, and steps that they may be able to take to rectify the problem. The Authentication Server will pass the error or status code and message text for the Authentication Server to OWA 2007, which may then display the message verbatim or interpret the code to provide the User with a clear explanation or set of instructions Replace Default Files A simple option is to replace the default OWA 2007 login page with the one provided with the Digipass Authentication for OWA This will allow OWA 2007 to display a Authentication Server error or status code and message on the User s screen. This process will be the same as steps 1 and 2 in section Set up Outlook Web Access. If you have already followed those instructions there is no need to repeat them. If you have not followed those instructions the relevant parts are listed below: 1. Backup <exchange-directory>\logon.aspx to a suitable place. Digipass Authentication for OWA 2007 Forms Guide 55

56 Post-Installation Tasks 2. Copy modified login page from <installation-directory>\logon.aspx (or other location if using a custom login page) to <exchange-directory>\logon.aspx. 3. Enable Return Failure Reason in the Authentication Server IIS 6 Module Configuration Modify Existing logon.aspx File If you have a custom logon.aspx page in use, you may need to modify it rather than replacing it with the logon.aspx page provided with the IIS 6 Module The modification to the logon.aspx page consists of javascript code which displays information from the Authentication Server about a login error which has occurred. The code required can be found below or taken directly from the logon.aspx page added to the <install directory>\challenge directory during installation. Note The logon.aspx page found in the challenge directory will also be set up for 1-step Challenge/Response. However, these portions of the page will be ignored by the IIS 6 Module unless 1-step Challenge/Response is enabled in the configuration. 4.3 Create Challenge/Response Template The example challenge-template.html is found in the <install directory>\challenge directory. You may create your own based on this template, or use the example template as is. The template must contain a number of key words which the extension will replace with the appropriate html code. (Note: These fields may appear more than once in the file, and each instance will be replaced) These fields are: DPEXT_FORM_METHOD - This will be replaced with the correct form method DPEXT_FORM_ACTION - This must be the action specified for the form DPEXT_PASSWORD_FIELD_NAME - This must be the name for field into which the response will be written DPEXT_CHALLENGE_TEXT - This string will be replaced with the Challenge issued. DPEXT_HIDDEN_FIELDS - This will be replaced with any fields submitted from login page DPEXT_CHALLENGE_FLASH - This optional field will include the digipass flash applet html Digipass Authentication for OWA 2007 Forms Guide 56

57 Post-Installation Tasks 4.4 Copy Challenge/Response Files If challenge response logins will be used and the challenge flash applet will be used, the flash.class file must be copied from <install directory>\challenge to the <exchange web directory>\bin\auth directory under the Program Files directory (typically c:\program files\microsoft\exchange Server\ClientAccess\Owa). Digipass Authentication for OWA 2007 Forms Guide 57

58 Troubleshooting 5 Troubleshooting 5.1 IIS 6 Module Installation Problems The installation program for the IIS 6 Module will usually complete the following tasks automatically. However, if it fails in these tasks for some reason, an error message will be displayed during installation. These steps can then be followed to complete the installation manually. If you are having trouble running the Authentication Server and the IIS 6 Module for the first time, following these steps may help you track down the problem and fix it manually Check file placement The following files must be placed in the directory they are listed under. If they have been moved to another directory, or incorrectly copied, the IIS 6 Module will not function correctly. <install directory> version.txt <install directory>\bin dpmodulecfg.xml dpiisext.dll dpiismodcfg.exe ikaal3ldap.dll ikaal3seal.dll libeay32.dll libxml2.dll openssl.exe owaformswiz.exe ssleay32.dll stlport.5.1.dll wxmsw28u_vc_custom.dll addext.vbs Digipass Authentication for OWA 2007 Forms Guide 58

59 Troubleshooting rem-ext.vbs <install directory>\challenge logon.asp challenge_template.html flash.class readme_challenge.txt Check Permissions Trace File Directory Permissions need to be set to allow the IIS 6 Module to access and write to the trace file. By default, the trace file is stored in <install directory>\log. Follow these steps for the folder the trace file will be written to. 1. Open Windows Explorer and browse to the directory that the trace file will be written to (<install directory>\log by default). 2. Right-click on the relevant directory. 3. Select Properties. The <directory name> Properties window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 59

60 Troubleshooting 4. Click on the Security tab. 5. Ensure that the IUSR_<computer name> account has Read and Write permissions ticked 6. Ensure that the IIS_WPG group has Write permissions ticked. 7. If changes need to be made to the permissions, make changes and click on the Apply button. If the IIS_WPG group is not listed, see Add the IUSR_<machine name> Account or IIS_WPG Group Configuration file 1. Open Windows Explorer and browse to the installation directory. 2. Right-click on the dpmodulecfg.xml file. 3. Select Properties. The dpmodulecfg.xml Properties window will be displayed. 4. Click on the Security tab. 5. Ensure that the IIS_WPG group has the Read permission ticked. Digipass Authentication for OWA 2007 Forms Guide 60

61 Troubleshooting 6. If changes were made to the permissions, click on the Apply button. If the IIS_WPG group is not listed for the configuration file, see Add the IUSR_<machine name> Account or IIS_WPG Group for instructions on adding the account manually Add the IUSR_<machine name> Account or IIS_WPG Group If the IUSR_<machine name> account or IIS_WPG group is not listed for the trace file directory or configuration file, you will need to add it 1. Click on the Add button. The Select Users, Computers, or Groups window will be displayed. 2. Click on the Advanced button. 3. Enter search criteria (see example below) and click on the Find Now button. Digipass Authentication for OWA 2007 Forms Guide 61

62 Troubleshooting 4. If no search criteria are entered, a list of all users and groups in the selected location will be returned. 5. Select the IIS_WPG group. 6. Click on the OK button. 7. Check that the IIS_WPG group is listed. 8. Click on the OK button. 9. The account should now be listed in the Security group and user list Set System Environment Variable 1. Right-click on My Computer. 2. Click on Properties. The System Properties window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 62

63 Troubleshooting 3. Click on the Advanced tab. 4. Click on the Environment Variables button. The Environment Variables window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 63

64 Troubleshooting If DPIISModuleDirectory is not displayed in the System variables list, create it manually: 5. Click on the New button. 6. Enter the following values: Variable Name: DPIISModuleDirectory Variable Value: <IIS 6 Module installation path> 7. Click on the OK button 8. Click on the OK button again. The new System variable should now appear in the System variables list. Digipass Authentication for OWA 2007 Forms Guide 64

65 Troubleshooting Register IIS 6 Module Extension You must run a script to add the new IIS 6 Module Extension. The script is installed in the <install-dir>\bin directory at install time. 1. Open up a DOS command prompt and navigate to the <install-dir>\bin directory 2. Enter cscript add-ext.vbs and press enter. 3. Your new IIS 6 Module Extension will be registered by the script Remove IIS 6 Module Extension Run the following script to remove the IIS 6 Module Extension. The script is installed in the <install-dir>\bin directory at install time. 1. Open up a DOS command prompt and navigate to the <install-dir>\bin directory 2. Enter cscript rem-ext.vbs and press enter. 3. Your IIS 6 Module Extension will now be removed Check IIS 6 Module Extension You can use the following method to check that your new Web Service extension exists, but you will not be able to see if the Wildcard Application Mapping exists. Digipass Authentication for OWA 2007 Forms Guide 65

66 Troubleshooting 1. Right-click on My Computer 2. Click on Manage. The Computer Management window will be displayed 3. Expand the Services and Applications heading. 4. Expand the Internet Information Services heading Digipass Authentication for OWA 2007 Forms Guide 66

67 Troubleshooting 5. Click on Web Services Extensions. The Web Service Extensions window will be displayed. Digipass Authentication for OWA 2007 Forms Guide 67