Cloud connector. The system architecture of SCC to integrate with your LDAP is as follows:

Size: px

Start display at page:

Download "Cloud connector. The system architecture of SCC to integrate with your LDAP is as follows:"

Benedict Woods
5 years ago
Views:

Cloud connector Samsung Knox Manage Cloud Connector (SCC) is a service that creates a secure channel for data transfer between your enterprise system and the Knox Manage cloud server.

1 Cloud connector Samsung Knox Manage Cloud Connector (SCC) is a service that creates a secure channel for data transfer between your enterprise system and the Knox Manage cloud server. SCC allows you to connect the user information in a customer's Active Directory/LDAP with CA's certificate on a user's device, and use it safely. SCC allows you to connect the user information in a customer's Active Directory/LDAP with CA's certificate on a user's device, and use it safely. The system architecture of SCC to integrate with your LDAP is as follows: Knox Manage server - This server is installed on the cloud and communicates with a user's device to provide the Knox Manage services. You can establish the severs (separately) per tenant. Connector - This connector is provided for linking with your LDAP and CA server. The Knox Manage server provides the LDAP and CA Connector. You can conduct the connection test when configuring LDAP and CA in the Admin Portal. SCC - SCC provides a secure channel between Knox Manage server connector and your legacy system. This consists of a client, server, and Control Service Server. - SCC Client is installed on your site and makes a secure Transport Layer Security (TLS) channel with SCC server. - SCC Server is installed in the cloud. The SCC server delivers from Knox Manage to SCC client, and response from SCC client toknox Manage server. - SCC Control Service Server(CS server) is installed on the cloud and automatically assigns port number to be used in LDAP and CA service. L4 Switch - The L4 Switch equally distributes the requests from SCC clients. DB - DB save IP/Port of SCC server and LDAP and CA information of the tenant. 360

2 Linked systems - This is your LDAP and CA server to be linked with Knox Manage. Open source license You can check the open source license information used in SCC as below.: Component SCC Client Open source license file Refer to the following file on the directory where SCC Client is installed. {SCC installation location}\scc-client\resources\ SCCClient-OpenSourceLicense.xml Preparing for installation Prior to installing the SCC, the following item must be prepared: License - Register the Knox Manage license in the Admin Portal. A server for installation - SCC Client: Micro Windows Server 2008 R2 (64bit) or 2012 (64bit). Java Development Kit (JDK) - Install Java Development Kit 1.7 (64bit) or 1.8 (64bit). - Patch the JCE module based on JDK version. For more information, see "Installing Java patches" on page 362. Network environment - Open the firewall between the SCC Client and the LDAP server. - Open the firewall between the SCC Client and the CA server. - Open the firewall L4 switch for accessing the SCC Server and SCC Client. : The list below describes the firewall information of L4 domains according to the service regions. Region Asia (Singapore) Domain:Port TCP communication resources scc-ap.manage.samsungknox.com:10000 scclts-ap.manage.samsungknox.com:8080 US (Oregon) scc-us.manage.samsungknox.com: scclts-us.manage.samsungknox.com: 8080 EU (Ireland) scc-eu.manage.samsungknox.com: scclts-eu.manage.samsungknox.com: The SCC Server and SCC Client is connected through TCP communication. To enhance TCP performance of the SCC Client, you must change the registry value. For more information, see "Setting up the TCP communication resource" on page

3 Installing Java patches To operate Cloud Connector, the Java Development Kit (JDK) must be installed in advance. The JCE module must be patched based on the JDK version. For example, if you re using JDK 1.7, apply the Java patch for JDK 1.7 and not the Java patch for JDK 1.8. To install Java Cryptography Extension (JCE) to support TLS v1.2 AES 256, complete the following steps: 1. Download Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy files that match the JDK version. For more information, visit the Oracle homepage. 2. Decompress the downloaded file. A sub-folder named UnlimitedJCEPolicy is created when decompressing the file and the following files are included in the folder. README.txt local_policy.jar: Unlimited strength local policy file US_export_policy.jar: Unlimited strength US export policy file 3. Copy two JAR files (local_policy.jar, US_export_ policy.jar) from the UnlimitedJCEPolicy folder to the %JAVA_HOME% \jre\lib\security folder. Note: If the Java patch isn t installed successfully, the Cloud Connector doesn t operate normally. Setting up the TCP communication resource To enhance TCP performance, change the registry value fort TCP resource in the SCC Client. It is not necessary to configure the resource, but it is recommended. To change the registry value, follow the steps below: 1. Run Start > Run > regedit. 2. Go to HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters. 3. Change each value of the items below. If the value doesn t exist, right-click and select New > DWORD (32- bit) Value to save the value: TcpTimedWaitDelay - This is to convert the disconnected TCP resource rapidly. - Change the default value 240 (4 minutes) into 30 (30 seconds). - For more information, see MaxUserPort - This is to increase the number of concurrent requests delivered to SCC from application. 362

4 - Change the default value from 5000 to the maximum value For more information, see Downloading SCC client To use SCC, download the SCC Client, and install it on a customer's website. The SCC Client can be downloaded from Settings > Integrations > Directory or Certificates > Certificate Authority (CA). The following describes how to download the SCC Client from the Directory menu. To download the SCC Client from the Admin Portal, follow the steps below: 1. Go to Settings > Integrations > Directory in the Admin Portal. 2. Click, and select TRUE in Cloud Connector item on the bottom of the Add Directory window. 3. Click the Cloud Connector Client Download link activated at the bottom, and download the SCC Client installation file, SCC_{Region}.zip. 4. Move to the server on which you need to install the downloaded.zip file. Installing the SCC client The administrator has to install the SCC Client to use the SCC. To install the SCC Client on your site with LDAP and CA installed, follow the steps below. The IP address and port number of the L4 switch for accessing SCC server is configured in the configuration file: 1. Decompress the SCC_{Region}.zip file. 2. Execute the SCC_Setup_{Version}_{Builddate}.exe file. 3. Select the language to install and click OK. 363

5 4. When the InstallShield Wizard starts, click Next. 5. Read the Samsung Knox Manage License Agreement carefully, select I have read and agree to these terms and conditions, and click Next. 364

Note: If the message "The selected directory is not a Java directory" appears, specify the

6 6. Set the directory of JDK Home. Click Browse and specify the directory path where JDK is installed. Click Next. Note: If the message "The selected directory is not a Java directory" appears, specify the directory path where the JDK is installed. 7. Specify the installation directory path and click Next. The default installation path is C:\SamsungSDS\ and you can change the path if necessary. 365

7 8. Enter the Tenant ID and click Install. The Tenant ID is the Client ID for logging in to the Admin Portal. 9. Installation has been complete. If you select Register for Windows Service, the SCC client service is registered automatically to Windows the background service. 10. Click Finish. Executing SCC client To execute the SCC Client, you can manually execute the batch file or automatically execute the SCC Client by registering Windows background service. To execute the batch file manually, execute the file below: {SCC installation directory}/scc-client/bin/sccclientstart.bat When you close the command window, the SCC client service is terminated. Registering Windows background service To register the SCC client to the Windows background services, execute the file below: {SCC installation directory}/scc-client/bin/scc_service_install.bat Starting or stopping the Windows background service To start or stop the registered SCC client, follow the steps below: 1. Check the service below in Start > Administrative Tools > Services. Samsung Knox Manage Cloud Connector Client(1) Background Service 2. To run the service, right-click the service and click Start. 366

$Disabling Windows background service To disable the SCC client background service, stop the service and execute the file below: {SCC installation path}/scc-client/bin/scc_service_uninstall.$

8 3. To stop the service, right-click the service and click Stop. Disabling Windows background service To disable the SCC client background service, stop the service and execute the file below: {SCC installation path}/scc-client/bin/scc_service_uninstall.bat Integrating services in Knox Manage A customer's IT administrator accesses the Knox Manage Admin Portal, and configures the service settings as shown below to integrate the LDAP or CA service. Integrating LDAP in Knox Manage When the customer's LDAP is ready, the IT administrator enters LDAP server information in the Knox Manage Admin Portal. The entered information is then sent to the SCC CS server with the tenant s information, and the SCC CS server assigns an IP and Port for the LDAP service to the SCC server. From then on, Knox Manage will not connect directly with the LDAP server, but will use the LDAP service using the IP and Port provided from the SCC server. In the Admin Portal, configure the LDAP connection in Settings > Integrations > Directory as below. For more information regarding LDAP settings, see "chapter 7, AD/LDAP Sync services" on page 82. IP/HOST: Enter the host name of LDAP service. (ldap.customer.com) Port: The default value is 389 port and it can be modified. Cloud Connector: Enter TRUE. 367

Integrating CA in Knox Manage To integrate the Knox Manage server with the customer's CA server via SCC, the IT administrator have to register the CA server in the Knox Manage Admin Portal.

9 Integrating CA in Knox Manage To integrate the Knox Manage server with the customer's CA server via SCC, the IT administrator have to register the CA server in the Knox Manage Admin Portal. The following example shows how to register an ADCS, one of the available CA types, in Certificates > Certificate Authority (CA) in the Knox Manage Admin Portal. This is applicable when HTTPS is used for CA. For more information regarding CA settings, see "chapter 7, AD/LDAP Sync services" on page 82. Host Name: Enter the host name of SCC server. WSUrl: Enter the Certificate Enrollment Web Service (CES) address of the actual CA server registered for the web service. Cloud Connector: Enter TRUE. Note: Although every CA type supported by Knox Manage is available, ADCS CA's Windows certification type is not available. Configuring SCC client After installing SCC Client, if the L4 domains in the service region are changed, modify the batch file as below and restart the SCC client. Modify SERVER_IP and SERVER_PORT in {SCC installation path}\sccclient\bin\sccclientstart.bat file. 368

Enabling Microsoft Outlook Calendar Notifications for Meetings Scheduled from the Cisco Unified MeetingPlace End-User Web Interface

Enabling Microsoft Outlook Calendar Notifications for Meetings Scheduled from the Cisco Unified MeetingPlace End-User Web Interface Release 7.1 Revised: March 5, 2013 1:53 pm This document describes the