Microsoft ADRMS Integration Guide for Windows Server 2012 Integration Guide

Transcription

1 Microsoft ADRMS Integration Guide for Windows Server 2012 Integration Guide

2 Contents Chapter 1: Introduction 3 Product configuration 3 Supported ncipher nshield functionality 3 Requirements 3 This guide 4 More information 4 Chapter 2: Procedures 5 Installing the HSM 5 Installing the nshield support software and configuring the security world 5 Setting up the infrastructure? 5 Installing and configuring AD RMS 5 Adding users ADRMSADMIN and ADRMSSRVC to the Enterprise Admins group 6 Installing Active Directory Certificate Services (Standalone root CA) 6 Creating a new alias (CNAME) 6 Installing and configuring AD RMS as a root cluster 7 Verifying AD RMS functionality 7 Uninstalling AD RMS 10 Unregistering AD RMS Service Connection Point (SCP) 10 Chapter 3: Troubleshooting 11 Internet addresses 12 Microsoft ADRMS Integration Guide for Windows Server

3 Chapter 1: Introduction The Hardware Security Module (HSM) secures the AD RMS Cluster Key generated and used by the Active Directory Rights Management Services (AD RMS). Note: Throughout this guide, the term HSM refers to nshield Solo and nshield Connect products. (nshield Solo products were formerly known as nshield.) You can integrate the AD RMS with an HSM by using the ncipher MSCAPI interface. The benefits of using an nshield HSM with the AD RMS are: Secure storage of the AD RMS Cluster Key FIPS level 3 validated hardware Full life cycle management of the keys Failover support Load-balancing between modules. PRODUCT CONFIGURATION We have successfully tested ncipher HSM integration with AD RMS in the following configurations: Operating system AD RMS version Security World Software version nshield Solo support nshield Connect Support nshield Edge support Microsoft Windows Server SUPPORTED NCIPHER NSHIELD FUNCTIONALITY You can access the following ncipher nshield functionality when you integrate an HSM with the AD RMS. REQUIREMENTS Soft cards Key recovery Load balancing Key generation Key management Module-only key Key import FIPS level 3 K-of-N card set Fail over Before installing the software, we recommend that you familiarize yourself with the AD RMS documentation and setup process, and that you have the ncipher documentation available. We also recommend that you have an agreed organizational Certificate Practices Statement and a Security Policy/Procedure in place covering administration of the HSM. Microsoft ADRMS Integration Guide for Windows Server

4 In particular, these documents should specify the following aspects of HSM administration: The number and quorum of Administrator Cards in the Administrator Card Set (ACS), and a policy for managing these cards Whether the application keys are protected by the module or an Operator Card Set (OCS) The number and quorum of Operator Cards in the OCS, and a policy for managing these cards Whether the security world must comply with FIPS Level 3 Key attributes, such as the key size, persistence, and time out. Note: K/N functionality is not currently supported. This means that you must create a 1/N OCS. THIS GUIDE This guide describes how to integrate AD RMS with ncipher nshield HSM. We have thoroughly tested the instructions in this document. They provide a straightforward integration process. There may be other untested ways to achieve interoperability. This document may not describe every step of the software setup process. This guide assumes that you are familiar with the ncipher HSM documentation, and the documentation and setup process for AD RMS. MORE INFORMATION For more information about OS support, contact your Microsoft sales representative or ncipher Support. For more information about contacting ncipher, see Addresses at the end of this guide. For more information on administering an nshield module, see the User Guide. Additional documentation produced to support your ncipher nshield product is in the document directory of the CD-ROM or DVD-ROM for that product. For more information about Active Directory Rights Management Services Overview, see the online documentation at Microsoft ADRMS Integration Guide for Windows Server

5 Chapter 2: Procedures Integration procedures include: Installing the HSM. Installing the Security World Software and configure the nshield HSM. Setting up the infrastructure. Installing and configuring AD RMS. Verifying AD RMS functionality. Uninstalling AD RMS. This chapter describes these procedures. INSTALLING THE HSM Install the HSM using the instructions in the Quick Start Guide for the HSM. We recommend that you install the HSM before configuring nshield support software. INSTALLING THE NSHIELD SUPPORT SOFTWARE AND CONFIGURING THE SECURITY WORLD To install the nshield support Software and create the security world: 1. Install the latest version of the nshield support software as described in the User Guide. Note: We recommend that you always uninstall any existing nshield support software before installing the new nshield support software. 2. Initialize a security world using MSCAPI wizard with module protection or 1/N OCS without passphrase as key protection method. Note: Do not select the option Always use the wizard when creating or importing keys option while creating security world. SETTING UP THE INFRASTRUCTURE To prepare your AD RMS test environment in your domain, you must complete the following tasks: 1. Configure the domain controller on <your domain>-dc. 2. Configure the AD RMS database computer on RMS-DB. 3. Configure the AD RMS root cluster computer on RMS-SRV. 4. Configure the AD RMS client computer on RMS-CLNT. For more information about setting up the infrastructure, see the online documentation at cc aspx. INSTALLING AND CONFIGURING AD RMS Service Manager handles the installation and configuration of AD RMS. The first server in an AD RMS environment is the root cluster. An AD RMS root cluster is composed of one or more AD RMS servers configured in a load-balancing environment. These stepby-step instructions describe how to install and configure a singleserver AD RMS root cluster. The installing user account must be a member of the Active Directory Enterprise Admins group to register an AD RMS service connection point (SCP). Microsoft ADRMS Integration Guide for Windows Server

6 Adding users ADRMSADMIN and ADRMSSRVC to the Enterprise Admins group To add user ADRMSADMIN to the Enterprise Admins group: 1. Log on to <your domain>-dc with the Administrator account (or another user account in the Domain Admins group). 2. From the Start menu, select Active Directory Users and Computers. 3. In the console tree, expand <your domain>.com, right-click Users and select New > User. 4. Enter the first name and full name adrmsadmin and click Next. 5. Enter the password for user, click Next and click Finish. 6. Right-click adrmsadmin and go to Properties. 7. Enter the address domain>.com and click OK. 8. Double-click Enterprise Admins. 9. Click the Members tab, and click Add. 10. Type domain>.com, and click OK. To add user ADRMSSRVC to the Enterprise Admins group, repeat the steps above, replacing adrmsadmin with adrmssrvc. Installing Active Directory Certificate Services (Standalone root CA) To install Active Directory Certificate Services: 1. Log on to RMS-SRV as <your domain>\adrmsadmin. 2. From the Start menu, select Server Manager. 3. Click Manage, then click Add Roles and Features. 4. In the Add Roles and Features window, click Next. 5. Select the installation type as Role based or Feature based installation and click Next. 6. Select a server from the server pool and click Next. The Add Roles wizard is displayed. 7. On the Select Server Roles page, select the Active Directory Certificate Services check box, and click Next. Follow the online instructions to complete the installation. Creating a new alias (CNAME) To create a new alias: 1. Log on to <your domain>-dc as Administrator. 2. Open DNS Manager from Start > DNS. 3. Click RMS-SRV Machine name and expand Forward Lookup Zones, and right-click <your domain>.com. 4. Select New Alias, and enter the alias name as rmsncp. 5. In Fully qualified domain name (FQDN) for the target host field, browse to the RMS-SRV machine. Click OK. Microsoft ADRMS Integration Guide for Windows Server

7 Installing and configuring AD RMS as a root cluster To add the AD RMS Server Role: 1. Log on to RMS-SRV as <your domain>\adrmsadmin. 2. From the Start menu, select Server Manager. 3. Click Manage and then click Add Roles and features. 4. In the Add Roles and Features window, click Next. 5. Select the installation type Role based, and click Next. 6. Select a server from the server pool and click Next. The Add Roles wizard is displayed. 7. On the Select Server Roles page, select the Active Directory Rights Management Services check box and click Add Features. The Role Services page appears, displaying the AD RMS dependent role services and features. 8. On the Feature page, ensure that Web Server (IIS), Windows Process Activation Service (WPAS), and Message Queuing are listed, and click Add Required Role Services. Click Next. 9. Read the AD RMS introduction page, and click Next. 10. On the Select Role Services page, ensure you have selected the Active Directory Rights Management Server check box, and click Next. 11. On the confirmation page, click Install. 12. After the successful installation, the Result page is displayed. Click Perform an additional configuration. 13. The ADRMS Configuration Window opens. Click Next. 14. Select Create a new AD RMS cluster, and click Next. 15. On Select configuration database server, select Specify a database server and a database instance. 16. Click Select, type RMS-DB in the Select Computer dialog box, and then click OK. 17. In Database Instance, click List and select Default Instance, then click Next. 18. Click Specify, type <your domain>\adrmssrvc, type the password for the account, click OK, and then click Next. 19. Select Cryptographic mode and click Next. 20. Ensure that Use CSP key storage is selected, and click Next. 21. On the Specify AD RMS Cluster key page, select ncipher Cryptographic service provider from the menu, and click Next. 22. Select the web site where AD RMS is to be installed, and click Next. Note: In an installation that uses default settings, the only available web site should be Default website. 23. Select Use an SSL-encrypted connection ( 24. In the Fully-Qualified Domain Name box, type rmsncp.<your domain>.com. Click Next. Note: Ensure Fully Qualified Domain Name and CNAME are the same. 25. Select Choose a certificate for SSL encryption later, and click Next. 26. Type rmsncp in the Name field of the Licensor certificate, and click Next. 27. Ensure that Register the AD RMS service connection point now is selected, and then click Next. This registers the AD RMS service connection point (SCP) in Active Directory during installation. 28. Click Install to provision AD RMS on the computer. 29. When the process is complete, click Close. Microsoft ADRMS Integration Guide for Windows Server

8 30. Open the IIS Manager by selecting Internet Information Service Manager from the Start menu. 31. Click the IIS Server. 32. Double-click the Server Certificates icon. 33. On the right-hand side of the IIS Manager window, click the Create Certificate Request link. 34. Fill out the certificate properties page. In the common name field, enter the same name that you entered for server licensor certificate (rmsncp), and click Next. 35. On the Cryptographic Service Provider Properties page, select Microsoft RSA SChannel Cryptographic Provider from the menu, and click Next. Note: Because of a certificate licensing issue, you cannot use ncipher CSPs for requesting certificates. 36. Enter the certificate request file name, and click Finish. 37. Send the certificate request to Microsoft CA ( SRV.<your domain>.com/certsrv), and download the certificate. 38. On the right-hand side of the IIS Manager window, click the Complete Certificate Request link. 39. Show the path of the signed certificate, enter the Friendly name, and click OK. Note: The Friendly Name must be the same as the server licensor certificate name. 40. On the left-hand side of the IIS Manager window under Sites, click Default website. 41. On the right-hand side of the IIS Manager window, click the Bindings link. 42. In Site Bindings, click Add. 43. Select the protocol as HTTPS, and select the certificates from the menu. Click OK to complete the certificate binding for SSL connection. 44. Click Restart to restart the IIS server. 45. Log off from the server, and then log on again to update the security token of the logged-on user account. The user account that is logged on when the AD RMS server role is installed is automatically made a member of the AD RMS Enterprise Administrators local group. A user must be a member of that group to administer AD RMS. The AD RMS root cluster is now installed and configured. Verifying AD RMS functionality The AD RMS client is included in the default installation of Windows Vista and Windows Server Before you can consume rights-protected content, you must add the AD RMS cluster URL to the Local Intranet security zone. Add the AD RMS cluster URL to the Local Intranet security zone for all users who are to consume rights-protected content. Microsoft ADRMS Integration Guide for Windows Server

9 Adding AD RMS cluster to the Local Intranet security zone 1. Log on to RMS-CLNT as user_fin (<your domain>\user_fin). 2. From the Start menu, select All Programs > Internet Explorer. 3. Select Tools > Internet Options. 4. Click the Security tab, click Local intranet, and then click Sites. 5. Click Advanced. 6. In the Add this website to the zone field, enter rmsncp.<your domain>.com, and click Add, then click Close. 7. Repeat the preceding steps for user_mar (<your domain>\user_ mar) and user_eng (<your domain>\user_eng). Adding Microsoft Root certificate to the trusted store 1. Download Microsoft CA root certificate. 2. Open Microsoft Management Console. 3. Select File > Add/Remove Snap-in > Add. 4. Select Certificates > Add > My User Account > Finish. 5. Select Add Standalone Snap-in. and click OK. 6. Expand Certificates > Current-User, then expand Third-Party Root Certification Authorities. 7. Right-click Certificates > All Tasks > Import. The Certificate Import Wizard opens. Click Next to display the path of the Microsoft CA root certificate. Click Next. 8. Keep the default selection, and click Next, then click Finish. 9. Repeat the preceding steps for user_mar (<your domain>\ user_mar) and user_eng (<your domain>\user_eng). Restricting permissions on a Microsoft Word document To verify the functionality of the AD RMS deployment, you log on as user_fin, and then restrict permissions on a Microsoft Word 2007 document so that user_mar can read the document but cannot change, print, or copy it. You then log on as user_mar, and verify that the proper permission to read the document has been granted, but no permissions to change, print, or copy it have been granted. 1. Log on to RMS-CLNT as user_fin (<your domain>\user_fin). 2. From the Start menu, select All Programs > Microsoft Office > Microsoft Office Word On the blank document page, type: user_mar can read this document, but cannot change, print, or copy it. 4. Click the Microsoft Office Button, then select Prepare > Restrict Permission > Restricted Access. 5. Select the Restrict permission to this document checkbox. 6. In the Read box, type user_mar@<your domain>.com, and then click OK to close the Permission dialog box. 7. Click the Microsoft Office Button, click Save As, and then save the file as \\RMS-DB\Public\RMS-TST.docx. 8. Log off as user_fin. Microsoft ADRMS Integration Guide for Windows Server

10 Viewing a rights-protected document 1. Log on to RMS-CLNT as user_mar (<your domain>\user_mar). 2. From the Start menu, select All Programs > Microsoft Office > Microsoft Office Word Click the Microsoft Office Button, and then click Open. 4. In the File name box, type \\RMS-DB\Public\RMS-TST.docx, and then click Open. The following message appears: Permission to this document is currently restricted. Microsoft Office must connect to rmsncp.<your domain>.com:443/_wmcs/licensing to verify your credentials and download your permission. 5. Click OK. The following message appears: Verifying your credentials for opening content with restricted permissions. 6. When the document opens, click the Microsoft Office button. Note: The Print option is not available. 7. Close Microsoft Word. 8. Log off as user_mar. You have successfully installed and demonstrated the functionality of AD RMS, by simply applying restricted permissions to a Microsoft Word 2007 document. Uninstalling AD RMS 1. Open Server Manager. 2. Click Roles > Remove Roles. The Remove Roles Wizard opens. Click Next. 3. Deselect Active Directory Rights Management Services, and click Next. 4. When the wizard prompts you, reboot the machine. Unregistering AD RMS Service Connection Point (SCP) To unregister AD RMS SCP: 1. Download the RMS SP2 Administration Toolkit from: aspx?familyid=bae62cfc-d5a7-46d f6885c26b98&displaylang=en. 2. Install the RMS SP2 Administration Toolkit. 3. Open a command prompt, and navigate to the C:\Program Files\RMS SP2 Administration Toolkit\ADScpRegister folder. 4. Run the command: ADScpRegister.exe unregisterscp Microsoft ADRMS Integration Guide for Windows Server

11 Chapter 3: Troubleshooting Problem While installing AD RMS, you see the error: Attempt to configure Active Directory Rights Management Server failed. Fail to generate enrollee certificate public key. While installing AD RMS, you see the error: Attempt to configure Active Directory Rights Management Server failed. The AD RMS installation could not determine the certificate hierarchy. If the AD RMS service connection point (SCP) you need to use is registered in Active Directory but is not valid, revise it to make it valid, or create a new SCP, and install AD RMS again. While installing AD RMS, you see the error: Attempt to configure Active Directory Rights Management Server failed. Provisioning of AD RMS timed out without any specific error. Remove and re-install AD RMS to attempt provisioning again. When the recipient tries to open the restricted document, they see the error in RMS Client machine (Microsoft VISTA, SP1): This Service is temporarily unavailable. Microsoft Internet Explorer may be set to Work offline. In Internet Explorer, verify that Work Offline on the File menu is not selected, and try again. Resolution Ensure Microsoft SQL Server is working properly, or reboot the ADRMS-DB machine. Unregister ADRMS Service Connection Point (SCP) using RMS SP2 Administration Toolkit, and install again. Recreate security world by unselecting the Always use the wizard when creating or importing keys option, and reinstall AD RMS. Note: Ensure the key protection method is neither Softcard nor K-of-N cardset protection, because AD RMS does not support these methods. Import the Microsoft CA root certificate into the Third-Party Root Certification Authorities store of My User Account, and try again. Microsoft ADRMS Integration Guide for Windows Server

12 Internet addresses WEB SITE: SUPPORT: ONLINE DOCUMENTATION: INTERNATIONAL SALES OFFICES: Microsoft ADRMS Integration Guide for Windows Server

13 ABOUT NCIPHER SECURITY Today s fast moving digital environment enhances customer satisfaction, gives competitive advantage and improves operational efficiency. It also multiplies the security risks. ncipher Security empowers world-leading organizations by delivering trust, integrity and control to their business critical information and applications. Our cryptographic solutions secure emerging technologies cloud, IoT, blockchain, digital payments and help meet new compliance mandates, using the same proven technology that global organizations depend on today to protect against threats to their sensitive data, network communications and enterprise infrastructure. We deliver trust for your business critical applications, ensuring the integrity of your data and putting you in complete control today, tomorrow, at all times. Search: nciphersecurity TRUST. INTEGRITY. CONTROL. ncipher - January 2019 PLBnCipher Shield Microsoft ADRMS Windows Server-V2