Oracle Enterprise Single Sign-on Logon Manager

Transcription

1 Oracle Enterprise Single Sign-on Logon Manager User s Guide Release E November 2007

2 Oracle Enterprise Single Sign-on Logon Manager User s Guide, Release E Copyright , Oracle. All rights reserved. The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited. The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose. If the Programs are delivered to the United States Government or anyone licensing or using the Programs on behalf of the United States Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the Programs, including documentation and technical data, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement, and, to the extent applicable, the additional rights set forth in FAR , Commercial Computer Software--Restricted Rights (June 1987). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA The Programs are not intended for use in any nuclear, aviation, mass transit, medical, or other inherently dangerous applications. It shall be the licensee's responsibility to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such applications if the Programs are used for such purposes, and we disclaim liability for any damages caused by such use of the Programs. Oracle, JD Edwards, PeopleSoft, and Siebel are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. The Programs may provide links to Web sites and access to content, products, and services from third parties. Oracle is not responsible for the availability of, or any content provided on, third-party Web sites. You bear all risks associated with the use of such content. If you choose to purchase any products or services from a third party, the relationship is directly between you and the third party. Oracle is not responsible for: (a) the quality of third-party products or services; or (b) fulfilling any of the terms of the agreement with the third party, including delivery of products or services and warranty obligations related to purchased products or services. Oracle is not responsible for any loss or damage of any sort that you may incur from dealing with any third party.

3 Preface Table of Contents Preface... 4 Audience... 4 Related Documentation... 4 Conventions and Terminology... 5 Introduction... 7 ESSO-LM Features... 9 Getting Started...10 Setting up ESSO-LM...10 Using ESSO-LM...13 Starting ESSO-LM...13 Using the System Tray Icon Menu Options...14 Shutting Down ESSO-LM...15 Using the Title Bar Button Menu...15 Language Settings...16 Your Primary Logon Method...17 Changing Your Primary Logon Method...18 Confirming Your Primary Logon Method...20 Installing Primary Logon Methods...21 Creating and Using Logons...22 Logon Manager...22 Creating New Logons...25 Managing Logons...34 Settings...39 Settings Dialog Box: Passwords Tab...39 Settings Dialog Box: Logons Tab...41 Settings Dialog Box: Excluded Web Sites Tab...42 Settings Dialog Box: Excluded Applications Tab...43 Managing Passwords...44 Changing Your Application Password...45 Backing Up and Restoring...47 Backing Up Your Passwords and Settings...47 Restoring Your Passwords or Settings...48 Glossary

4 ESSO-LM User s Guide Preface This document describes how to install and set up Oracle Enterprise Single Sign-on Logon Manager (ESSO-LM). The Preface contains these topics: Audience Related Documentation Conventions Support Information Audience The ESSO-LM User s Guide is intended for anyone using ESSO-LM to manage logon credentials for Windows, Web, and host or mainframe applications. You should be familiar with Windows conventions (for example, resizing application windows) and with the logon procedures for the applications that you will access with ESSO-LM. Related Documentation This product s documentation includes: ESSO-LM Release Notes ESSO-LM Installation and Setup Guide ESSO-LM User s Guide ESSO-LM Administrative Console Help ESSO-LM Web Viewer Installation and Setup Guide 4

5 Preface Conventions and Terminology This document uses various conventions and icons to help you identify special terms and important topics quickly. Convention Connotation Bold font Within text, references to the following: Dialog box/gui element names Dialog box/gui section labels Dialog box/gui tab names or labels Dialog box/gui field names Procedures and in GUI any button that is clicked Italic font Variable text within a command or path References to other technical publications Courier New font Registry keys Command line Code examples Icon Connotation Description Important task Essential to the completion of a procedure. Note or tip Best Practice Additional valuable information about the task or topic. Not essential to the completion of the task. Recommended method to perform a procedure. Caution New in this release If step or procedure is not followed exactly, the result could be loss of data or data corruption. Indicates new features introduced in this release. 5

6 ESSO-LM User s Guide Acronym or Abbreviation SSO Agent SSO Administrative Console ESSO-LM ESSO-AM ESSO-KM ESSO-PG ESSO-PR SSO FTU SSO Agent Full Name ESSO Logon Manager Agent ESSO Administrative Console Oracle Enterprise Single Sign-on Logon Manager Oracle Enterprise Single Sign-on Authentication Manager Oracle Enterprise Single Sign-on Kiosk Manager Oracle Enterprise Single Sign-on Provisioning Gateway Oracle Enterprise Single Sign-on Password Reset ESSO-LM First Time Use ESSO Logon Manager Agent 6

7 Introduction Introduction ESSO-LM lets you use a single password to log on to any password-protected application on your desktop, your network, and the Internet. It works out-of-the-box (without programming or additional network infrastructure) with virtually all applications, including Windows, Web, proprietary, and host-to-mainframe applications. ESSO-LM is intelligent agent software. It remembers your credentials your username or ID, password, and other information for each application or Web site and automatically responds to an application s logon requests. Here is an example of how ESSO-LM works: ESSO-LM automatically detects when you have encountered a password-protected application or Web site. If you already provided credentials (username or ID, password, and other information) for that application or Web site, ESSO-LM automatically enters your credentials in the appropriate fields and logs you on. Suppose that you have already provided credentials for your Lotus Notes account. When you open Lotus Notes, ESSO-LM recognizes the logon screen request for credentials. ESSO- LM enters your password in the appropriate field and clicks OK, logging you on to Lotus Notes. Suppose that you have opened the logon screen for an application or Web site for which you have not yet provided credentials. If the Auto Prompt feature is active, ESSO-LM offers to store your credentials for this application. If you click Yes, the New Logon wizard appears, prompting you to set up credentials for this application or Web site. 7

8 ESSO-LM User s Guide To establish your new credential, enter your username or ID for the application, your password (enter a second time for confirmation), and then click Finish. ESSO-LM logs you on. From now on, whenever you start this application, ESSO-LM will recognize the application s logon prompt and supply your credentials automatically. 8

9 Introduction ESSO-LM Features ESSO-LM offers the following features: Single sign-on: You use just one password to log on to applications, networks, and Web sites. Auto Prompt: ESSO-LM learns your credentials as you work. When it detects a new logon request, the agent prompts you to provide your username or ID, password, and other sign-on data. The next time this application asks for your logon, ESSO-LM recognizes it and logs you on automatically. Automatic backup and restore: ESSO-LM automatically backs up your credentials to a portable storage device, a remote file, or a directory server, and automatically restores your credentials, if necessary. Custom logon configuration: In addition to logons defined by your administrator, you can add your own logons to other applications and Web sites. Mobility support: If you work at multiple workstations, ESSO-LM makes it easy for your administrator to store your credentials on a remote server. That lets you use ESSO-LM to manage your identity and passwords with complete security on any computer on your network. 9

10 ESSO-LM User s Guide Getting Started If the ESSO-LM software is already installed on your workstation, begin by following the procedure for Setting up ESSO-LM. This procedure is performed the first time you start the program. You will provide your primary logon the password you will use for all other logons and select preconfigured applications, if they are provided. The remainder of this guide covers these topics: Starting and shutting down ESSO-LM and setting general program preferences Changing your Primary Logon Method Configuring and using application logons Procedures and options for adding or changing passwords Backing up and restoring your passwords and settings Setting up ESSO-LM Before you begin using ESSO-LM, the Setup Wizard verifies that ESSO-LM has all the information it needs. The Setup Wizard is also called the First Time Use Wizard (FTU). You must provide the information requested in the following tasks in order to use ESSO-LM. If you cancel the Setup Wizard, it will re-appear each time you try to start ESSO-LM until you complete the Wizard. The Setup Wizard might skip any or all of the following tasks, depending on the installation options that you selected, your network configuration, and the settings that your ESSO-LM administrator makes. Completing the Setup Wizard Tasks 1. Restore an existing backup? If you have backed up any pre-existing ESSO-LM settings, select the I want to restore an existing backup of my settings check box. If you choose this option, ESSO-LM will complete the setup process from your stored settings. Click Next> to continue. See Backing Up and Restoring for more information. 2. Setup tasks to perform. This page lists the Setup tasks necessary for your local installation of ESSO-LM. Click Next> to begin setup. 3. Choose a logon method. From the drop-down list box, choose the authenticator that you will use for your primary logon method. In a typical installation, this method is Windows Logon. This choice indicates that you will use your Windows password to access password-protected applications. 10

11 Getting Started Depending on your network resources and administration, you might have other primary logon methods to choose from, such as: Windows Logon v2 HID ISO Prox Card LDAP LDAP v2 Authentication Manager Smart Card Entrust SAFLINK SAFauthenticator for ESSO-LM DigitalPersona Authenticator Xyloc When you have made your selection, click Next> to continue. See Your Primary Logon Method for more information. 4. Enter your primary logon. If you have chosen Windows Authentication as your primary logon method, a Windows network logon prompt appears. Enter your Windows Network password for the displayed username and domain, then click OK. 5. Insert a Smart Card. If you choose Smart Card as your primary logon method, a smart card prompt appears. Insert the smart card and then enter your PIN. Click OK. 6. Enter a passphrase answer. If you chose Windows Authentication v.2, you will have to supply answers to one or more passphrase questions as an additional security measure. Type the answer to the displayed question or questions (note the minimum length) and click OK. You can change your passphrase any time later by selecting the Change Passphrase option whenever you confirm your primary logon. 7. Add applications logons. This page appears if your ESSO-LM administrator has provided a list of configured applications. This feature lets you store your logon credentials for each application. Enter your Username/ID, Password, and any other requested information for each application that you use. You might need to retype one or more items to confirm. Click Next> to continue. 11

12 ESSO-LM User s Guide Completing Setup If you want to make changes before completing the Setup Wizard tasks, click <Back to return to a previous Setup Wizard page. Otherwise, click Finish to complete setup. You can now begin using ESSO-LM. 12

13 Using ESSO-LM Using ESSO-LM This section provides an introduction to the features and functions available via the ESSO- LM user interface. For more information on these and other features, see the online help. To access the online help: Click the Help button within any program dialog box. OR Click the ESSO-LM tray icon on your Windows system tray and select Help from the shortcut menu. Starting ESSO-LM The first time you start ESSO-LM, the Setup Wizard appears to guide you through the procedure for providing your primary logon information. After ESSO-LM is installed, the ESSO-LM tray icon appears on your Windows system tray in the lower-right corner of your screen. If you do not see this icon, start ESSO-LM: 1. Click Start, then Programs. 2. Point to Oracle, then ESSO-LM. 3. Click ESSO-LM. The ESSO-LM Tray Icon now appears in your Windows system tray. Also see the Using the System Tray Icon Menu Options. 13

14 ESSO-LM User s Guide Using the System Tray Icon Menu Options Click the ESSO-LM tray icon in your Windows system tray to display a shortcut menu of program functions, which are described below. The System Tray Icon Menu options are as follows: Configuration Shut Down Pause Help Displays a submenu of program controls and options. Each of these is detailed later in this guide: Language Logon Manager Backup/Restore Settings Shuts down the program. Turns off ESSO-LM logons, including the Auto-Prompt and Auto- Recognize features, and the Logon using ESSO-LM menu option, below. Displays the online help system. About ESSO-LM Displays version information about the program. Logon using ESSO-LM Engages ESSO-LM to supply information to a logon request. You can use this option to engage ESSO-LM when Auto-Recognize is turned off. If Auto-Recognize is enabled, ESSO-LM automatically recognizes logon requests and supplies your stored logon information. If you have not already set up the application or Web site logon, ESSO-LM prompts you to do so. 14

15 Using ESSO-LM Shutting Down ESSO-LM To shut down ESSO-LM, click the tray icon and select Shutdown from the shortcut menu. Using the Title Bar Button Menu You can put the ESSO-LM Title Bar Button on all application window title bars. The Title Bar Button lets you log on quickly to applications and Web sites that you have already configured and add new logons as you work. You can set the Title Bar Button to display a shortcut menu for using or adding logons or you can omit the menu and use the Title Bar Button as a one-click logon command. To show or hide the Title Bar Button: 1. Click the ESSO-LM tray icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Settings. The Settings dialog appears. 2. On the Settings dialog, click the Logons tab: a. Select the Title Bar Button check box to show the Title Bar Button or clear the check box to hide the icon. OR b. Click the Display Dropdown check box to activate the Title Bar Button shortcut menu or clear the check box to deactivate the menu. If you select this option, clicking the Title Bar Button initiates a logon to the active application. 3. Click OK. To hide the Title Bar Button and menu at any time, click the Title Bar Button on any application title bar and select Hide Title Bar Button. 15

16 ESSO-LM User s Guide Language Settings The ESSO-LM Agent can run in many different languages, depending on which version you are running and which language packs are installed. Depending on your configuration, you can change the language of the Agent through the ESSO-LM tray icon menu located in your Windows system tray. 1. Click the ESSO-LM tray icon to display the shortcut menu. Point to Configuration, then click Language. The available languages are displayed with a checkmark next to the currently selected language. 2. Click the desired language for the ESSO-LM Agent. All ESSO-LM Agent dialogs and help screens are displayed in the selected language. 16

17 Your Primary Logon Method Your Primary Logon Method When you first set up ESSO-LM, you are prompted to choose your primary logon method, also known as an authenticator. The credentials you provide to the authenticator your username or ID, password, and other information identify you as an authorized user of your workstation and network. In most cases, your primary logon is Windows, and your primary logon credentials are your Windows username or ID, password, and network domain. ESSO-LM lets you use your primary logon method for any other situation in which you need a password, including most Windows applications, host or mainframe applications, and password-protected Web sites. It uses your primary logon information to verify that you are the same user that initially logged on. Depending on your installation and resources, your primary logon can be any of the following: Windows password LDAP password Smart card authenticator logon information Entrust authenticator logon information SAFLINK authenticator logon information DigitalPersona authenticator logon information Xyloc authenticator logon information HID ISO Prox Card authenticator logon information 17

18 ESSO-LM User s Guide Changing Your Primary Logon Method You can change your primary logon method at any time and you can install or remove authenticators as needed. To change your primary logon method: 1. Click the ESSO-LM tray icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Change Logon Method. 2. The Setup Wizard appears with a list of steps that you follow to change your primary logon. Click Next> to continue. 3. You are prompted for your current primary logon. Enter your primary logon password, then click OK. 4. The Setup Wizard displays the primary logon selection page. Select a primary logon method from the drop-down list, then click Next to continue. 18

19 Your Primary Logon Method 5. You are prompted for your new primary logon credentials. Type your user ID and password, enter or select any additional information, then click OK. If your new primary logon is a smart card, you are prompted to insert the card into the reader and enter your personal identification number (PIN). If your new primary logon is a biometric device, you are prompted to place your finger on the fingerprint reader. 6. The Setup Wizard displays a message that your new authentication is successful. You can either: a. Click Cancel to cancel the change and restore your previous primary logon method. OR b. Click Finish to complete your primary logon change. The Primary Logon Method dialog box appears. Click Close to close it. 19

20 ESSO-LM User s Guide Confirming Your Primary Logon Method ESSO-LM can be configured to verify periodically that you are the same user who initially logged on to your workstation. When you start a password-protected application, if a specific interval of time has passed since the last automatic logon (the default is 15 minutes), ESSO-LM asks for your primary logon password. If you are using a logon method other than a password (smart card, token, biometric) as your primary logon, you are prompted for the appropriate authentication method (such as a PIN or fingerprint). ESSO-LM also automatically performs this check when you modify your application passwords, perform other logon management tasks, or if the application logon itself requires it. You can change the interval, or turn this feature off, by changing the Timer setting in the Logons tab of the Settings dialog box. Depending on which primary logon you use and which settings your ESSO-LM administrator applies, you might be prompted for the passphrase answer you provided when you first set up ESSO-LM. If are using a passphrase, you have the option of changing your passphrase answer. To do this, select the I want to change the answer to my verification question checkbox. 20

21 Your Primary Logon Method Installing Primary Logon Methods When you installed ESSO-LM, you had the option of installing one or more authenticators. If you did not install all of the authenticators, you can use this procedure to install them. Currently installed authenticators are listed in the Primary Logon Method dialog box. See Your Primary Logon Method. The following procedures for installing and removing primary logon methods are typically performed by your ESSO-LM administrator. To install additional primary logon methods: 1. Open the Control Panel and select Add/Remove Programs. 2. Select ESSO-LM. 3. Click Change or Add/Remove, depending upon the operating system on your computer. The ESSO-LM Install Wizard appears. 4. Read the screen, then click Next. 5. Select the Modify option, then click Next. 6. Click the + next to Authenticators to expand the list. 7. Click the X icon next to the password window that you want to install. 8. From the shortcut menu, select This feature will be installed on the local hard drive. 9. Repeat steps 7 and 8 to install additional authenticators. 10. Click Next. 11. Read the screen, then click Next. 12. Follow the screen prompts. 21

22 ESSO-LM User s Guide Creating and Using Logons ESSO-LM provides two ways to create application logons: You can create logons with Logon Manager, which lets you configure, edit, and manage logons for most secure applications. You can create logons on the fly, using the Auto-Prompt feature, which detects an application's logon request and lets you store your credentials as you log on. Logon Manager Logon Manager displays your stored logons. It also enables you to modify properties of each logon (for example, your user IDs and passwords) and update your settings with changes applied by your ESSO-LM administrator. To display Logon Manager, click the ESSO-LM tray icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Logon Manager. The Logon Manager dialog appears. As you add or create logons for Windows applications or Web sites, and add logons for host or mainframe applications, the available logons are displayed in Logon Manager. Logons that appear in gray, italicized text require activation by the ESSO-LM administrator. See Credentials Without a Configured Logon. 22

23 Creating and Using Logons Logon Manager Options View Sort by Reveal All Refresh Add Properties Copy Delete Close Help Display logons as Icons, as a List, or with full Details (similar to Windows Explorer View options) Sort logons by a selected column; you can also sort the logons by clicking on the column heading itself. In Details View. display username/ids and passwords. (This feature is only available if the ESSO-LM administrator has activated it.) Update logon settings with changes from your ESSO-LM administrator. (This feature is only available if the ESSO-LM administrator has activated it.) Display the New Logon dialog to set up a new application logon. If pre-configured logons are available the Add Multiple Application option appears. See Adding Multiple Application Logons. Modify logon settings, including the user ID, password, applications specifics, and automatic behavior for a selected logon. Duplicate a selected logon. Remove a selected logon from Logon Manager. Exit Logon Manager. Display Logon Manager help file. Applications that Share Credentials Your ESSO-LM administrator might configure two or more applications to share the same username and password in a password group. If the credentials for one application change, the credentials for the other applications in the group also change. In some cases, where you need multiple credentials for a single application (for example having multiple mail accounts in Microsoft Outlook), you might need to exclude those additional identities (each with different credentials) from this feature. If this applies to a new logon you are creating for an application you have already added, you will have the option to Exclude the new logon. Adding Multiple Application Logons If your ESSO-LM administrator has provided a new list of pre-configured application logons, the Logon Manager s Add button displays a drop-down option to Add Multiple Applications. Choose this option to add these new logons and supply your credentials. 23

24 ESSO-LM User s Guide Credentials Without a Configured Logon Some logons might appear in Logon Manager in gray, italicized text with a gray icon. If you attempt to use such a logon or view its properties (by selecting it and clicking Properties), this message appears: Credential corresponds to an application that is not currently configured in ESSO-LM. This message typically appears when ESSO-LM has been upgraded from a previous version. It means that your credentials are safely stored, but the application logon configuration (that tells ESSO-LM where to put the credentials) needs to be upgraded as well. Contact your ESSO-LM administrator to acquire the updated logons. 24

25 Creating and Using Logons Creating New Logons Setting Up Logons with Logon Manager In the Logon Manager, Click Add to set up a new logon. The New Logon dialog box appears. The following procedures describe how to use the New Logon dialog box to add logons for each application type. The procedure is similar for each type. You identify the application and then provide your credentials: username or ID, password, and any other information that the application requires you to enter. If you add a logon for a Windows application that ESSO-LM is not configured for, you are asked to identify the username or ID and password fields by pointing and clicking on the logon fields. You are also given the option to create more than one logon for a single application. This is useful for applications for which you have more than one set of credentials; for example, if you have multiple accounts from one provider. When ESSO-LM detects a logon for which you have more than one credential set, it displays the Logon Chooser dialog box, which lets you select which credentials to use. 25

26 ESSO-LM User s Guide To add a logon for a Windows application: 1. In the New Logon dialog box, select the Windows option and select an application from the drop-down list box. If the application you want to add is not listed, see To configure a logon for an unlisted Windows application on page Click Next>. The New Logon dialog appears requesting credentials. 3. Type your Username/ID for the application, type your Password, and retype your password in Confirm Password. You can display the password by clicking Reveal. Depending on the requirements of the application you re setting up, you may be prompted for additional fields, such as Domain Name for Microsoft Outlook. Similarly, some applications may not require a username/id. In such cases, the Username/ID box will be grayed out. 4. Do one of the following: a. Click Finish. ESSO-LM returns you to the Logon Manager, which now lists the logon you've just created. OR b. If the setting is available, select Add another set of credentials, then click Finish. ESSO-LM adds the logon to the Logon Manager and re-displays the New Logon dialog box. 26

27 Creating and Using Logons If you are adding a new logon for an existing application that is part of a password group, select Exclude from password sharing group. If this is the first logon you have created for this application, leave this check box unselected. See Applications that Share Credentials. To configure a logon for an unlisted Windows application: 1. Open the Windows application that you want to set up a logon for. This is the target application. If the target application requires more than two fields for authentication, this procedure requires an ESSO-LM administrator to set it up for you. Contact your ESSO-LM administrator for assistance. 2. When the target application s logon dialog box displays, switch back to ESSO-LM. Arrange the windows so that ESSO-LM and the target application s logon dialog are both visible. 3. In the New Logon dialog box, select the Windows option and select Application not in list (the default) from the drop-down list box. 4. Type the Application Name of the target application and (optionally) a Description. 5. Click Next>. 6. The New Logon dialog box displays two icons. 27

28 ESSO-LM User s Guide 7. Click on the Username/ID icon, then click in the username or user ID field of the target application s logon dialog box. A green check mark appears over the icon. 8. Click the Password icon, then click in the password field of the target application s logon dialog box. A green check mark appears over the icon. 9. Click Next>. The New Logon dialog appears requesting credentials. 28

29 Creating and Using Logons 10. Type your Username/ID for the application, type your Password, and retype your password in Confirm Password. You can display the password by clicking Reveal. 11. Do one of the following: a. Click Finish. ESSO-LM returns you to the Logon Manager, which now lists the logon you ve just created. OR b. If the setting is available, select Add another set of credentials, then click Finish. ESSO-LM adds the logon to the Logon Manager and re-displays the New Logon dialog box. 29

30 ESSO-LM User s Guide To add a logon for a Web site: 1. In the New Logon dialog box, select the Web option, then select a Web site from the drop-down list box. If the Web site you want to add is not listed, see To add a logon for an unlisted Web Site. 2. Click Next>. The New Logon dialog appears requesting credentials. 3. Type the Username/ID for the Web site, type the Password, and retype the password in Confirm Password. You can display the password by clicking Reveal. 4. Do one of the following: a. Click Finish. ESSO-LM returns you to the Logon Manager, which now lists the logon you ve just created. OR b. If the setting is available, select Add another set of credentials, then click Finish. ESSO-LM adds the logon to the Logon Manager and re-displays the New Logon dialog box. If you are adding a new logon for an existing application that is part of a password group, select Exclude from password sharing group. If this is the first logon you have created for this application, leave this check box unselected. See Applications that share credentials. To add a logon for an unlisted Web Site: 1. In the New Logon dialog box, select the Web option, then select Web application not in list (the default option) from the drop-down list box. A text box for entering a Web address appears. If the target Web site requires more than two fields for authentication, this procedure requires ESSO-LM administrator resources. Contact your ESSO-LM administrator for assistance. 2. Type the URL - (address) of the Web site you want to set up a logon for. 3. Type the Application Name and (optionally) a Description. 30

31 Creating and Using Logons 4. Click Next>. The New Logon dialog appears requesting credentials. 5. Type the Username/ID for the Web site, type the Password, and retype the password in Confirm Password. You can display the password by clicking Reveal. 31

32 ESSO-LM User s Guide 6. Do one of the following: a. Click Finish. ESSO-LM returns you to the Logon Manager, which now lists the logon you ve just created. OR b. If the setting is available, select Add another set of credentials, then click Finish. ESSO-LM adds the logon to the Logon Manager and re-displays the New Logon dialog box. 32

33 Creating and Using Logons To add a logon for a host or mainframe application: 1. In the New Logon dialog box, select the Mainframe option. 2. Type the Application Name of the target application and (optionally) a Description. 3. Click Next>. The New Logon dialog appears requesting credentials. 4. Type the Username/ID for the Web site, type the Password, and retype the password in Confirm Password. You can display the password by clicking Reveal. 5. Do one of the following: a. Click Finish. ESSO-LM returns you to the Logon Manager, which now lists the logon that you just created. OR b. If the setting is available, select Add another set of credentials, then click Finish. ESSO-LM adds the logon to the Logon Manager and re-displays the New Logon dialog box. 33

34 ESSO-LM User s Guide Managing Logons Setting Up Logons Using Auto-Prompt To begin using Auto-Prompt, make certain that the feature is activated within Settings: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. 2. Point to Configuration, then click Settings. 3. Click the Password tab and make sure that the Auto-Prompt check box is selected. If not, select it, then click OK. The Auto-Prompt feature is enabled by default upon installing ESSO- LM. Your ESSO-LM administrator may enable or disable Auto-Prompt for all users. Let's say you have enabled the Auto-Prompt feature and you open the logon screen for an Application or Web site for which you have not set up a logon. ESSO-LM prompts you to set up a logon for this application or Web site with this message: Would you like ESSO-LM to remember your logon information for this application? You can re-enable this application by selecting Logon using ESSO-LM from the ESSO-LM tray icon. You have these options: Click Yes to set up a logon. Click Not now if you do not want to set up a logon for this application right now. Click Disable if you do not want to set up a logon for this application and do not want to be asked again. If you decide in the future that you do want ESSO-LM to automatically prompt you for your credentials the next time you launch the application, use the Excluded Web Sites or Excluded Applications tab on the Settings dialog. To set up a logon for this application, open the application s logon screen, click the ESSO-LM Tray Icon and select Logon using ESSO-LM from the shortcut menu. You can also tell ESSO-LM to set up a logon by holding down the Windows key and typing L (on non-windows XP systems only). If the target application requires more than two fields for authentication, this procedure requires ESSO-LM administrator resources. Contact your ESSO-LM administrator for assistance. 34

35 Creating and Using Logons o o o If you click Yes, the New Logon dialog appears, prompting you to set up a new logon for this application or Web site. Enter your username/id, enter your password, and confirm your password. Click Finish. ESSO-LM logs you on to the application or Web site and stores this new logon for future use. Logon Properties The Logon Properties dialog box lets you modify account information or automatic behavior for individual logons. You can: Change the Username/ID, Password or other fields that the logon sends to the application. Restore a previous password. Edit the Application Name and Description information for the application as it appears in Logon Manager and other dialog boxes. Turn on or off the Auto-Prompt and Auto Recognize features for selected logons. In a network installation, the availability of the Auto Prompt and Auto-Recognize features depends on administrative settings. Contact your ESSO-LM administrator for details. If you change a logon password, the next time you open the Logon Properties dialog for the logon, the Restore Previous Password button appears. This gives you have the option of reverting to the password used before the most recent change. To turn Auto Prompt on or off for all logons, use the Auto Prompt option in the Passwords tab of the Settings dialog. To turn Auto-Recognize on or off for all logons, use the Auto- Recognize option in the Logons tab of the Settings dialog. 35

36 ESSO-LM User s Guide Modifying a Logon s Properties To modify a logon s properties 1. In the Logon Manager, highlight an application logon from the list, then click Properties. The Properties dialog box for the selected application appears. If the application logon is displayed in grey text, this message appears when you click Properties: Credential corresponds to an application that is not currently configured in ESSO-LM. See Credentials without a configured logon for more information. 2. Modify the displayed information as needed. 3. When you have completed your changes, click OK. Logon Chooser You might have two or more different logon accounts for the same application or Web site. If so, you can set ESSO-LM to recognize all of those accounts, then prompt you to choose which one to log on with. To do this, create a separate ESSO-LM logon for each account. 36

37 Creating and Using Logons When you open the application or Web site, ESSO-LM prompts you with the Logon Chooser dialog box. Do one of the following: Select the account you want to log on with and click OK. Click Add to add another logon for this application. Click Cancel to close this dialog. ESSO-LM will not log you onto the application. 37

38 ESSO-LM User s Guide Logon Error When you enable the Auto-Recognize function, ESSO-LM automatically detects and responds to logon and password-change requests from applications and Web sites you ve set up. If you entered the wrong password when you set up the logon, or perhaps changed the application s password from another computer, ESSO-LM will supply an incorrect password. When this happens, the application repeats the logon request and ESSO-LM displays the Logon Error dialog. The Logon Error dialog asks you to review the accuracy of your Username/ID, Password and, if necessary, any additional logon fields. Do one of the following: You can reveal the password you ve entered by clicking Reveal. Edit your logon information as needed and click OK to try logging on again. The Save Changes check box ensures that ESSO-LM uses the same credentials next time ESSO-LM logs you on to this application or Web site. Uncheck this option if you do not want to save the new credentials you entered for future use. Click Cancel to stop any further logon attempts for the application or Web site until you either restart ESSO-LM or modify the logon s properties in Logon Manager. 38

39 Settings Settings The Settings option in the Logon Manager lets you control ESSO-LM password features, logon features, and excluded Web sites and applications. Your ESSO-LM administrator can enable, disable, or override any of the settings described below. To view or modify ESSO-LM settings: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Settings. The Settings dialog appears. 2. Select the tab to display the settings: o Password tab o o o Logons tab Excluded Web Sites tab Excluded Applications tab Settings Dialog Box: Passwords Tab The Passwords tab of the Settings dialog lets you control ESSO-LM password features. Your ESSO-LM administrator can enable, disable, or override any of the settings described below. 39

40 ESSO-LM User s Guide Password Settings Auto-Prompt Auto-Enter Select the Auto-Prompt check box to have ESSO-LM automatically recognize password-protected applications and Web sites, and prompt you with the message, Would you like ESSO-LM to remember your logon information for this (web) application? Select the Auto-Enter check box to have ESSO-LM immediately enter an application or Web site once you have set up a logon for that application or Web site. To view or modify password settings: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Settings. The Settings dialog appears. 2. On the Settings dialog, click the Password tab to display the password settings. 3. When you have completed your changes, do one of the following: a. Click OK to confirm your changes and close the Settings dialog box. OR b. Click Apply to confirm your changes (without closing the Settings dialog box), then select another Settings tab. 40

41 Settings Settings Dialog Box: Logons Tab The Logons tab of the Settings dialog lets you control ESSO-LM logon features for all logons. To change the settings for individual logons, see Logon Properties. Your ESSO-LM administrator can enable, disable, or override any of the settings described below. Logon Settings Title Bar Button Display Dropdown Auto- Recognize Timer Select the Title Bar Button check box to display the ESSO-LM Title Bar Button in the upper-right corner of any new window opened on the desktop. Select the Display Dropdown check box to have a drop-down menu display when you click the ESSO-LM Title Bar Button. Select the Auto-Recognize check box to enable ESSO-LM to recognize applications and Web sites and log you on automatically. Enter a time limit (in minutes); after this interval, ESSO-LM asks for your password before performing any credential-related task. If the Timer setting is set to zero, ESSO-LM always asks for your password before each credential-related task. Click Clear Timer to enter your password immediately, without waiting for the expiration time. To view or modify logon settings: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Settings. The Settings dialog box appears. 2. On the Settings dialog, click the Logons tab to display the logon settings. 3. When you have completed your changes, do one of the following: a. Click OK to confirm your changes and close the Settings dialog box. OR b. Click Apply to confirm your changes (without closing the Settings dialog box), then select another Settings tab. 41

42 ESSO-LM User s Guide Settings Dialog Box: Excluded Web Sites Tab The Excluded Web Sites tab of the Settings dialog lets you review and restore Auto-Prompt capability for Web site logons that you have previously told ESSO-LM to ignore. When you visit a password-protected Web site that you do not have a ESSO-LM logon for, ESSO-LM asks you if you want to create a new logon and gives you the choices: Yes: Create my logon now Not Now: Ask me next time Disable: Do not ask me again. If you choose Disable, ESSO-LM adds the logon page to the Excluded Web Sites list. You can remove a Web site from this list by clearing its checkbox, and thereby allow ESSO-LM to prompt you to create a logon the next time you visit the site. See Setting Up Logons Using Auto-Prompt for more information about using Auto-Prompt. You can turn Auto-Prompt on or off by its setting in the Password tab of the Settings dialog. To restore Auto-Prompt for an excluded Web site: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. 2. Point to Configuration, then click Settings. 3. Click the Excluded Web Sites tab to view the list of sites that ESSO-LM is currently set to ignore. 4. Click to clear the check boxes of the Web sites for which you want Auto-Prompt restored, then click OK. The next time you visit the logon page of Web site(s) that you cleared, ESSO-LM will ask if you want to create a logon. 42

43 Settings Settings Dialog Box: Excluded Applications Tab The Excluded Applications tab of the Settings dialog lets you review and restore Auto- Prompt capability for application logons that you have previously told ESSO-LM to ignore. When you launch a password-protected application that you don t have an ESSO-LM logon for, ESSO-LM asks you if you want to create a new logon and gives you the choices: Yes: Create my logon now Not Now: Ask me next time Disable: Do not ask me again. If you choose Disable, ESSO-LM adds the logon page to the Excluded Applications list. You can remove an application from this list by clearing its checkbox, and thereby allow ESSO-LM to prompt you to create a logon the next time you launch the application. See Setting Up Logons Using Auto-Prompt for more information about using Auto-Prompt. You can turn Auto-Prompt on or off by its setting in the Password tab of the Settings dialog. To restore Auto-Prompt for an excluded application: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. 2. Point to Configuration, then click Settings. 3. Click the Excluded Applications tab to view the list of applications that ESSO-LM is currently set to ignore. 4. Click to clear the check boxes of the applications for which you want Auto-Prompt restored, then click OK. The next time you launch the password-protected application that you cleared, ESSO-LM will ask if you want to create a logon. 43

44 ESSO-LM User s Guide Managing Passwords The ESSO-LM automated password change increases security by eliminating the potential for poor password selection and poor password management. It also increases usability by saving you the trouble of creating, changing, and remembering passwords. ESSO-LM detects when an application requests a password change, then automatically generates a new password that conforms to a password policy (the rules that govern what a valid password can be) set by your administrator. Most applications allow you to change your logon password at any time; some require you to change passwords periodically, for example, every 30 days. You can use ESSO-LM to apply and keep track of these changes. When an application like Lotus Notes requests a password change, ESSO-LM prompts with the Change Password dialog. If your ESSO-LM administrator has configured an application logon for automatic password change, ESSO-LM detects the application s password-change reminder and automatically displays the Change Password dialog to help you. Related Topics Changing Your Application Password Settings Dialog Box: Passwords Tab 44

45 Managing Passwords Changing Your Application Password 1. Open the application s Change Password window. The Change Password dialog appears (see screen shot on previous page). 2. You have two options: a. Select Automatically pick a new password for me, then click OK. ESSO-LM will generate a new, randomly generated password for the application. You will never need to remember this password because ESSO-LM will enter it for you automatically the next time you log on. OR b. Select I will create my new password below, then: i. When this option is selected, the New Password, Confirm and Password Policy Status fields become active. Enter your new password in the New Password and Confirm text boxes. Click Reveal to see the password you have entered. ii. Note the list of rules under Password Policy Status: Your new password must comply with each of these rules in order to be valid. As you type your password, the rules it complies with are automatically checked. When all of the rules are checked, your password is valid. The Special Characters Allowed policy indicates the specific special characters that are allowed to be used in a password. If special characters are not allowed, this policy states: Special characters allowed: None. iii. Click OK. The OK button does not become active until all password policies have been met. 45

46 ESSO-LM User s Guide 3. On the application s password window, ESSO-LM submits your password change request. Check the application s message to make certain that it has accepted the new password. 4. Do one of the following: a. If the application accepted the new password, you are finished. OR b. If the application did not accept the new password, the Change Password dialog will appear again. Attempt to enter another password or click Cancel. 46

47 Backing Up and Restoring Backing Up and Restoring ESSO-LM allows you to back up your passwords and settings to a file and restore them if needed. The Backup and Restore feature is available only if ESSO-LM is installed using the Complete option or if the Backup/Restore extension is selected using the Custom installation option. Backing Up Your Passwords and Settings To back up or restore your passwords or settings: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Backup/Restore. The Backup/Restore Wizard appears. 2. Select the Backup radio button and click Next>. 3. ESSO-LM prompts you for your primary logon. Enter your primary logon password and click OK. 4. Click Browse to select the location of the backup file and click Next. 47

48 ESSO-LM User s Guide 5. Enter a password to encrypt the backup file. The Password and Confirm fields are pre-filled with your primary logon s password. You will need to use this password to restore the backup file, even if the password is changed later. Enter the password and click Finish to complete. 6. A confirmation message appears indicating that your logon information and settings were successfully backed up. Click OK. Restoring Your Passwords or Settings To restore your passwords or settings: 1. Click the ESSO-LM Tray Icon on the Windows system tray to display the shortcut menu. Point to Configuration, then click Backup/Restore. The Backup/Restore Wizard appears. 2. Select the Restore radio button and click Next>. 3. ESSO-LM may prompt you for your primary logon. Enter your primary logon password and click OK. 4. Click Browse to select the location of the backup/restore file and click Next. 5. Enter the password that was used to secure the backup file, then click Finish to complete. If the password is not correct, ESSO-LM will prompt you to enter your password again. 6. A confirmation message appears. Click OK. 48