Migration from VACMAN Middleware 3.0 AD to IDENTIKEY Authentication Server 3.3 AD.

Transcription

1 KB Migration from VACMAN Middleware 3.0 AD to IDENTIKEY Authentication Server 3.3 AD. Creation date: 05/09/2011 Last Review: 11/12/2012 Revision number: 7 Document type: How To Security status: EXTERNAL Summary Due to a problem with encryption key formats, the migration from VACMAN Middleware (VM) 3.0 with AD datastore to IDENTIKEY Authentication Server 3.3 with AD datastore needs a few additional steps as described in this article below. Read this article carefully before starting the IDENTIKEY Authentication Server 3.3 installation. Problem details / Solution. In IDENTIKEY Authentication Server 3.3 the encryption of sensitive data has been modified to improve the security. Due to these changes, the encryption key used in VM3.0 has to be exported into a file (an.esf file) and imported in IDENTIKEY Authentication Server 3.3 during installation (even if you are using the default embedded encryption key in VM3.0). During the installation of IDENTIKEY Authentication Server 3.3.0, you MUST apply the IDENTIKEY Authentication Server Patch BEFORE the configuration wizard has been executed. 1. Export the encryption key from VM 3.0 to a file. This step is also required if you are using the standard embedded encryption key in VM Open the VM 3.0 Authentication Server Configuration tool from the Windows Start menu. Select the Active Directory Settings tab; press the button Configure Encryption Settings. Page 1 of 5

2 1.2. Press the Export button in the Configure Encryption Settings Window Provide a location and file name for the file. The type must be Encryption Settings File (*.esf). Press the Save Button. Page 2 of 5

3 1.4. You will be requested to enter a password to protect the.esf file. This password will be required to open the.esf file in the next steps. Enter a password of your choice and press the OK button You will get a confirmation that the encryption settings have been successfully exported. Press the OK button to finalize the operation. Remark: The.esf file must NOT be exported from the VM3.0 administration MMC. 2. Install IDENTIKEY Authentication Server and apply IDENTIKEY Authentication Server Patch during the installation Execute the IDENTIKEY Authentication Server installation steps up to Page 3 of 5

4 and including Apache Tomcat 6.0 as shown in the screenshot below. Do NOT Run Configuration Wizard Apply the patch or by executing the file identikey_patch_3.3.1.exe or identikey_patch_3.3.2.exe. Be sure to use the executable that matches your CPU architecture. Patches are available from the my maintenance webpage: Return to the screen from step 2.1 and execute the configuration wizard by pressing the button Run Configuration Wizard button. 3. Import the.esf file from step 1 in IDENTIKEY Authentication Server 3.3 During the installation of IDENTIKEY Authentication Server 3.3, in the Configuration wizard step, you can import the encryption key file from step 1 The.esf file MUST be imported during the first run of the configuration wizard; it will not be requested anymore during consecutive runs of the configuration wizard Be sure to select Legacy encryption Tick the checkbox Use Legacy sensitive data encryption mode Page 4 of 5

5 3.2. Load the.esf file from step 1 and provide the password used to protect the.esf file. Press the Next button Remark. There is no easy way to import the.esf again in case you made a mistake during this procedure. In KB you can find a procedure to force the IDENTIKEY Authentication Server 3.3 configuration wizard to ask for the.esf file again. Page 5 of 5