How to force IDENTIKEY Authentication Server 3.3 AD configuration wizard to ask encryption key again?

Transcription

1 KB How to force IDENTIKEY Authentication Server 3.3 AD configuration wizard to ask encryption key again? Creation date: 15/09/2011 Last Review: 11/12/2012 Revision number: 4 Document type: How To Security status: EXTERNAL Summary When the Procedure from KB to migrate from VM3.0 AD to IDENTIKEY Authentication Server 3.3 AD has not been followed correctly, you will need to import the correct encryption key (.esf file) again. This KB explains the procedure to do this. Details. 1. Stop Apache Tomcat service 2. Stop IDENTIKEY Authentication Server Service Page 1 of 12

2 3. Stop Virtual Digipass MDC Service 4. Remove the Digipass Support from the first admin user that was created during the previous installation of IDENTIKEY Authentication Server 3.3 that failed 4.1. Open the Active Directory Users and Computers MMC from Start All Programs VASCO Identikey Server Open the properties of the first administrator used during the failed installation by selecting the TAB Digipass User Account and press the button Disable Digipass Page 2 of 12

3 Verify that the checkbox is not ticked anymore: Page 3 of 12

4 5. Use the Microsoft tool ADSIEDIT.MSC to remove a number of object from AD 5.1. Remove the object CFG:DefaultSensitiveKey from the Digipass-Configuration container. CN=CFG:defaultSensitiveKey,CN=Digipass-Configuration,DC=X (where DC=X is your configurationdomain name) Browse to the container Digipass-Configuration, right-click the object and select Delete from the drop-down menu. Press the Yes button to confirm you want to delete the object 5.2. Remove the object CFG:defaultStorageKey from the Digipass-Configuration container. CN=CFG:defaultStorageKey,CN=Digipass-Configuration,DC=X Use the same method as shown in Remove the object KEY:SSMINSTALLSENSITIVEKEY from the Digipass- Configuration container. CN=KEY:SSMINSTALLSENSITIVEKEY,CN=Digipass-Configuration,DC=X Use the same method as shown in Remove the object KEY:SSMINSTALLSTORAGEKEY from the Digipass- Configuration container. CN=KEY:SSMINSTALLSTORAGEKEY,CN=Digipass-Configuration,DC=X Use the same method as shown in Backup the following files from <Identikey Installation Directory>\ bin directory (Default installation directory is C:\Program Files\VASCO\Identikey 3.3) Page 4 of 12

5 - ikey_tomcat_serverca.pem - ikey_tomcat_cert.pem - radius.dct These files will have to copied back later in the procedure 7. Remove the following files from <Identikey Installation Directory>\bin directory (Default installation directory is C:\Program Files\VASCO\Identikey 3.3) - reports.xml - reportfields.xml - dpadmincmd.xml - reportformats.xml - identikeyconfig.xml - mdcconfig.xml - ikey_soap_serverca.pem - ikey_soap_cert.pem - ikey_seal_serverca.pem - ikey_seal_cert.pem - ikey_radius_serverca.pem - ikey_radius_cert.pem - ikey_mdc_serverca.pem - ikey_mdc_cert.pem 8. Remove the deployed webadmin Remove the following files from <Identikey Installation Directory>\tomcat\Tomcat 6.0\webapps - webadmin.war - the complete directory webadmin 9. Remove the webadmin cache directory Remove the directory <Identikey Installation Directory>\tomcat\Tomcat 6.0\work\Catalina\localhost\webadmin 10. Remove the truststore Remove the file <Identikey Installation Directory>\webadmin\truststore.jks 11. Start the configuration wizard in AD install mode Open a DOS box and change to the directory <Identikey Installation Directory>\bin Run the command: ikconfigwizardgui.exe --advanced_ad Page 5 of 12

6 11.3. This will launch the configuration wizard. Leave the configuration wizard in this state and move on to step 12. DO NOT PROCEED THROUGH THE WIZARD UNTIL THE NEXT STEP IS PERFORMED. 12. Restore the backed up files in step 6 copy the following files back into <Identikey Installation Directory>\ bin - ikey_tomcat_serverca.pem - ikey_tomcat_cert.pem - radius.dct 13. Run through the wizard as if you were doing a full install Do NOT check the checkbox this is not the first Identikey Sever to be installed Page 6 of 12

7 13.2. Ensure that "Use Legacy Mode" is selected Ensure to load the VM3.0 encryption file (.esf file) Page 7 of 12

8 13.4. The wizard will attempt to re-create the key data in the schema. o If the wizard completes successfully, press the Finish button and proceed to step 16. o If the wizard fails to complete, DO NOT EXIT THE WIZARD. Press the previous button and proceed with the next step (step 14) 14. Open ADSIEDIT.MSC and modify a number of objects in the Digipass-Configuration container Modify the CFG:defaultSensitiveKey object ( CN=CFG:defaultSensitiveKey,CN=Digipass-Configuration,DC=X ) Page 8 of 12

9 Set the attribute vasco-value = SSMINSTALLSENSITIVEKEY Right-click the CFG:defaultSensitiveKey object and select properties from the drop-down menu Select the Attribute vasco-value and press the Edit button Change the Value to SSMINSTALLSENSITIVEKEY and press the OK button Page 9 of 12

10 14.2. Rename the "KEY:Legacy Sensitive Key" object to KEY:SSMINSTALLSENSITIVEKEY Right-Click the object KEY:Legacy Sensitive Key and select Rename from the drop-down menu Type the new name KEY:SSMINSTALLSENSITIVEKEY Page 10 of 12

11 14.3. Modify the KEY:SSMINSTALLSENSITIVEKEY object ( CN=KEY:SSMINSTALLSENSITIVEKEY,CN=Digipass-Configuration,DC=X ) Set the attribute vasco-id = SSMINSTALLSENSITIVEKEY Modify the CFG:defaultStorageKey object ( CN=CFG:defaultStorageKey,CN=Digipass-Configuration,DC=X ) Set the attribute vasco-value = SSMINSTALLSTORAGEKEY Rename the "KEY:Legacy Storage Key" object to KEY:SSMINSTALLSTORAGEKEY Modify the KEY:SSMINSTALLSTORAGEKEY object ( CN=KEY:SSMINSTALLSTORAGEKEY,CN=Digipass-Configuration,DC=X ) Set the attribute vasco-id = SSMINSTALLSTORAGEKEY 15. Continue on with the wizard and let it complete. 16. Redeploy the webadmin open The Identikey Server Configuration Wizard from the Windows Start menu (Start All Programs Vasco Identikey Server Identikey Server Configuration Wizard) select Re-Deploy Web Administration and press the Next button Page 11 of 12

12 16.3. Follow the prompts of the wizard to complete the re-deployment Page 12 of 12