Digipass Pack for OWA Forms Authentication Guide

Transcription

1 Digipass Pack for OWA Forms Authentication Guide

2 Disclaimer of Warranties and Limitations of Liabilities Disclaimer of Warranties and Limitations of Liabilities The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you. Copyright 2004 VASCO Data Security Inc. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of VASCO Data Security Inc. Trademarks VACMAN and Digipass are registered trademarks of VASCO Data Security International Inc. Microsoft and Windows are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective holders VASCO Data Security Inc. 2

3 Table of Contents Table of Contents 1 Overview VACMAN Middleware Components of VACMAN Middleware IIS 6 Module for OWA Forms Authentication Authentication Methods Server Connection Management Group Lists Tracing Available Reference Guides What is New? Installation System Requirements Server Requirements Client Browser Requirements Pre-Installation Tasks Install VACMAN Middleware IIS Information Needed Licensing Install IIS 6 Module for OWA New Installation Upgrade Installation Configuration IIS 6 Module Configuration GUI Enable/Disable the IIS 6 Module VACMAN Middleware Server Details Turn Tracing On or Off Group Lists Sites Configuration File Configuration Settings Configuring VACMAN Middleware Server Settings Windows Permissions Licensing Post-Installation Tasks Using New Features in VASCO Data Security Inc. 3

4 Table of Contents Set up 1- Step Challenge/Response Login Create Challenge Response Template Copy Challenge Response Files Troubleshooting Configuring IIS 6 to work with VM Check file placement Check Permissions Set System Environment Variable Register IIS 6 Module Extension Register as Wildcard Application Mapping Other Troubleshooting Options No Trace File Information from Trace File VACMAN Middleware Licensing Repair Installation Uninstalling IIS 6 Module Uninstall IIS 6 Module for OWA Technical Support Contact Information Glossary VASCO Data Security Inc. 4

5 Tables Reference Tables Reference Table 1 - Connection Establishment Settings Table 2 - Connection Maintenance Settings Table 3 Allowed Connection Establishment and Maintenance Combinations Table 4 Preset Connection Profiles Table 5 - Typical Connection Settings (Off-site recovery) Table 6 - Possible Connection Setup (Overseas office recovery) Table 7 Configuration Options Table 8 - Headers added to login request string Table of Figures Figure 1 IIS 6 Module Overview... 6 Figure 2 - VACMAN Middleware Components... 8 Figure 3 - Off-site Recovery Figure 4 - Overseas Office Recovery VASCO Data Security Inc. 5

6 Overview 1 Overview Digipass Pack for OWA Forms Authentication contains two main components: VACMAN Middleware Authenticates user logins. IIS 6 Module Intercepts authentication requests from a client s web browser to the Exchange server and re-routes them to VACMAN Middleware. OWA Client (eg. Internet browser) Authentication Request IIS 6 Module Exchange Server UserID and token response (and PIN, for non-keypad tokens) UserID and stored password VACMAN Middleware Figure 1 IIS 6 Module Overview 1.1 VACMAN Middleware VACMAN Middleware (VM), combined with the IIS 6 Module, enables dynamic password authentication for Outlook Web Access. It checks a user s ID and token response and - if they match the expected combination - passes the stored static password to the Exchange server VASCO Data Security Inc. 6

7 Overview Components of VACMAN Middleware VACMAN Middleware Server The VM Server is the central brain of the product. Its primary responsibility is to accept incoming authorization and administrative requests and process them. It also generates and distributes necessary DB replication and audit-trail information to appropriate VM backup servers and connected Audit Consoles. Administration Interfaces Two Administration Interfaces are available for use. An extension of Active Directory Users and Computers allows administration of linked VACMAN Middleware User accounts and Digipass records using the Active Directory Users and Computers interface. The stand-alone Administration MMC Interface allows administration of all VACMAN Middleware data. Admutil The admutil is a command line administrative program. An authorized admin can administer all VACMAN Middleware security objects and corresponding attributes through an encrypted TCP tunnel to the VM server. This utility provides the mechanism to develop a customized administrative interface. For example, admutil can be used as a CGI program for a custom developed web-browser based admin interface. Audit Console The Audit Console is a real-time audit-monitor console for all events. A single Audit Console allows an authorized admin to establish up to 3 simultaneous sessions to the same or different VM servers and implement different message filtering VASCO Data Security Inc. 7

8 Overview Figure 2 - VACMAN Middleware Components 2004 VASCO Data Security Inc. 8

9 Overview 1.2 IIS 6 Module for OWA Forms Authentication The IIS 6 Module is an add-on to VACMAN Middleware which can be configured to intercept authentication requests to the Exchange server and redirect them to VM. Note The IIS 6 Module is specifically designed for use with Outlook Web Access in Forms Authentication mode, for IIS 6 only for IIS 5 installations you will need the IIS 5 version of the Digipass Pack for OWA Authentication Methods See the Logging in with VACMAN Middleware section in the VACMAN Middleware Administration Guide for detailed information on login methods and options. Response Only login Users log in via the current login page with their username and Digipass response. 1-Step Challenge/Response login A random challenge - of a length configured for all users is displayed on the login page. Users log in with their username and Digipass response to the displayed challenge. This requires modification of the current login page used by OWA. 2-Step Challenge/Response login After the login page, the IIS 6 Module redirects users to a Challenge page where a random challenge of the length required by the user s Digipass is displayed. The user must enter a response to the challenge in order to complete the login. A Challenge page must be created if this feature will be implemented. Virtual Digipass login Users logging in with a Virtual Digipass use a similar process to the 2-step Challenge/Response login. If the user has a Primary Virtual Digipass assigned, or requests use of the Backup Virtual Digipass feature during the first step, an OTP will be sent to the user s mobile phone via text message. The user is then redirected by the IIS 6 Module to the Challenge page to enter the OTP. This uses the same Challenge page used in the 2-step Challenge/Response login VASCO Data Security Inc. 9

10 Overview Server Connection Management The IIS 6 Module provides flexibility in managing connections to multiple VACMAN Middleware Servers. You can customize connection establishment and maintenance options for each Server to suit the need the Server is meant to fill. This allows redundancy and load sharing over multiple Servers Preset Connection Profiles Three standard connection profiles are available. These combine common connection establishment and maintenance methods. To select other connection combinations, use the Advanced profile option. Primary The Server(s) to which the IIS 6 Module will first attempt to connect. The Primary VACMAN Middleware Server(s) take the majority of the data load. Backup A Backup Server can provide redundancy and also share the load during peak access periods. It is typically a local machine which, if the Primary VACMAN Middleware Server is busy or cannot be contacted, will be used until a connection to the Primary Server can be re-established. Recovery If the Primary and Backup Servers cannot be contacted, the IIS 6 Module will fail-over to a Recovery Server. The connection will be maintained until a connection to a higherpriority Server can be established. A Recovery Server is typically used for additional redundancy eg. an off-site disaster recovery server VASCO Data Security Inc. 10

11 Overview Connection Options Terminology Some of the terms used in configuring server connections are explained below: Maximum Connections The maximum number of connections that the IIS 6 Module may have open to the VACMAN Middleware server at one time. Timeout The time that the IIS 6 Module should wait for a reply from the VACMAN Middleware Server. Idle Period The amount of time a connection should be kept open with no data traffic before being closed by the IIS 6 Module. Retry Interval If the IIS 6 Module cannot connect to a Server, it will make connection attempts at increasing time intervals until it succeeds in establishing a connection. The time period between connection attempts is the Retry Interval. Connection Setting Definitions The tables below explain the various connection establishment and maintenance options. Connection establishment settings determine how connections to a Server will be created, and whether only one or multiple connections will be made at one time. Table 1 - Connection Establishment Settings Setting Name Immediate As required If higher priority servers are busy or unavailable If higher priority servers are unavailable Explanation The maximum number of connections will immediately be opened when the IIS 6 Module is loaded. No connections will be opened when the IIS 6 Module is loaded. As connections are needed to handle requests, they will be opened, up to the maximum number of connections allowable. If servers with Immediate or As required connection establishment settings are busy (the maximum number of connections are already open or in use) or unavailable, establish a connection. If servers with any of the above connection establishment settings are unavailable, establish a connection. Connection maintenance settings determine how, and how long, a connection to a Server will be kept open. Table 2 - Connection Maintenance Settings Setting Name Connections not closed unless they fail Connections closed after idle period Connections closed immediately after use Explanation Connections are only closed if they are broken eg. server stops or a network problem occurs. Connections will be closed when they have been idle for the configured idle time. Connections will be closed as soon as possible. When a request has been finished, the connection will be closed unless another request is using it. This option may be useful if the network link to the Server is very expensive VASCO Data Security Inc. 11

12 Overview Connection Setting Combinations Some connection establishment settings cannot be used with certain connection maintenance settings. The suitable establishment and maintenance combinations are listed in the table below. Table 3 Allowed Connection Establishment and Maintenance Combinations Establishment Options Connections opened immediately Connections opened as required Opened if above connections are unavailable Opened if no connections can be established to other servers Applicable Maintenance Options Connections not closed unless they fail Any Any Connections closed when timeout has expired Connections closed immediately after use The table below lists the connection establishment and maintenance settings used for each preset connection profile. Table 4 Preset Connection Profiles Profile Connection Establishment Setting Connection Maintenance Setting Primary As required Connections not closed unless they fail Backup If higher priority servers are busy or unavailable Connections closed after idle period Recovery If higher priority servers are unavailable Connections closed after idle period 2004 VASCO Data Security Inc. 12

13 Overview Example Server setups Off-site Recovery Server Web Server Main Server link Secondary Server link Recovery Server link Server A Server C Server B Disaster Recovery Site Work Site Figure 3 - Off-site Recovery This setup uses one main VACMAN Middleware Server to handle requests from the Web Server, with a backup Server for use when the main Server is busy or unavailable. A recovery Server is located off-site and is only connected to if the primary and backup servers are both unavailable. This setup would typically use the following connection configurations: Table 5 - Typical Connection Settings (Off-site recovery) Server Profile Establishment Maintenance Server A Primary As required Connections not closed unless they fail Server B Backup If higher priority servers are busy or unavailable Server C Recovery If higher priority servers are unavailable Connections closed after idle period Connections closed after idle period 2004 VASCO Data Security Inc. 13

14 Overview Utilize a Server in another office Web Server 1 Web Server 2 Main Server link Secondary Server link Recovery Server link Server B Server C Server A Server D New York Office Sydney Office Figure 4 - Overseas Office Recovery In this setup, each office uses a primary VACMAN Middleware Server to handle requests from the Web Server, with a backup Server for use when the main Server is busy or unavailable. If both the primary and backup Servers in an office are unavailable, a Server in the other office will be used until the local Servers become available. Each connection is closed immediately after use. This setup might use the following connection configurations: Table 6 - Possible Connection Setup (Overseas office recovery) Server Server A Server B Server C Server D Web Server Web Server 1 Web Server 1 Web Server 2 Web Server 1 Web Server 2 Web Server 2 Profile Establishment Maintenance Backup If higher priority servers are busy or unavailable Connections closed after idle period Primary As required Connections not closed unless they fail Advanced Advanced If higher priority servers are unavailable If higher priority servers are unavailable Connections closed immediately after use Connections closed immediately after use Primary As required Connections not closed unless they fail Backup If higher priority servers are busy or unavailable Connections closed after idle period 2004 VASCO Data Security Inc. 14

15 Overview Group Lists You can provide the IIS 6 Module with a list of Windows Domain groups, and set it to work in one of three ways: Authenticate all groups Ignore the Group List and process all users authentication requests. Authenticate listed groups, pass others through Only process authentication requests for users in a group in the Group List; let requests for other users pass through unmodified to OWA for authentication. Authenticate listed groups, reject others Only permit access for users belonging to a group in the Group List; reject access for other users Tracing The IIS 6 Module makes use of a trace file to record information about events that occur on the system, for use in troubleshooting. This could include generic information, changing conditions, or problems and errors that have been encountered. The level of tracing that the IIS 6 Module employs depends on its configuration settings. Caution Enabling Full Tracing should only be done for troubleshooting purposes. There are no limits set on the size of the tracing file, so if the option is left on too long on a high-load system the file may dramatically slow down or crash Windows, due to excessive I/O or filling up the hard drive. Because there are no size limitations set on the trace file, it is not recommended that you have tracing permanently enabled. If your system is set up with Basic Tracing always enabled, ensure that the file size does not cause problems by deleting or archiving it whenever it gets too large. Basic tracing includes: Critical error/warning messages [CRITC] Major error/warning messages [MAJOR] Minor error/warning messages [MINOR] Configuration messages [CONFG] 2004 VASCO Data Security Inc. 15

16 Overview Full tracing includes: Critical error/warning messages [CRITC] Major error/warning messages [MAJOR] Minor error/warning messages [MINOR] Configuration messages [CONFG] Informational messages [INFOR] Data tracing messages [DATA] Debugging messages (useful for support purposes) [DEBUG] Security messages, messages that may contain security sensitive data [SECUR] Note The IIS 6 Module will require permissions for the directory in which the tracing file is kept. See Check Permissions - Trace File Directory for more information. 1.3 Available Reference Guides Digipass Pack for OWA Forms Authentication Guide (this document) Overview of the Digipass Pack, and specifics relating to OWA. VACMAN Middleware Installation Guide Comprehensive installation instructions and explanations. VACMAN Middleware Active Directory Guide Pre-install tasks, installation instructions and setup guide for Middleware installations using Active Directory. VACMAN Middleware Administration Guide Instructions for using the Administration Interfaces and Admutil for administrative tasks. VACMAN Middleware Virtual Digipass Guide Introduction to Virtual Digipass functionality, instructions for setup and use of Virtual Digipass features, including the Message Delivery Component. VACMAN Middleware Audit Console Guide Introduction and instructions for using the Audit Console VASCO Data Security Inc. 16

17 What is New? 2 What is New? One-Step Challenge/Response Login A challenge may be displayed on the login page, allowing a single step login for users. A two-step login setup is still available. Server Management Enhanced VACMAN Middleware Server connection configuration allows greater control over when and how the IIS 6 Module will connect to each VACMAN Middleware Server. More than two VACMAN Middleware Servers can now be entered in the configuration GUI or file. New Configuration GUI The configuration GUI has been modified to integrate the new features. VACMAN Middleware Enhancements Virtual Digipass Virtual Digipass allows a text message containing a One Time Password to be sent to a User on request, for use in logging on through VACMAN Middleware. This can be used instead of physical Digipass tokens or as a backup mechanism when a User has mislaid their physical Digipass. For more information, see the VACMAN Middleware Virtual Digipass Guide. New Administration Interfaces The Java-based Admin GUI has been replaced with two MMC (Microsoft Management Console) administration interface options: an extension for Active Directory and a main Administration MMC Interface VASCO Data Security Inc. 17

18 Installation 3 Installation Before installing the IIS 6 Module for OWA Forms Authentication, check that all system requirements and pre-installation tasks have been met. This will help ensure a smooth, trouble-free installation and integration process. 3.1 System Requirements Server Requirements Software VACMAN Middleware 2.3 on the same or another machine the IIS 6 Module for VACMAN Middleware 2.3 will not function with VACMAN Middleware 2.2. See the VACMAN Middleware Installation Guide for VM s system requirements. Internet Information Services (IIS) 6.0 or higher (requires Windows Server 2003) MS Exchange 2003 using Outlook Web Access in form-based authentication mode and SSL User must have admin rights on installation machine Note If Outlook Web Access is not in forms-based authentication mode, this Digipass Pack will not function. Use the Digipass Pack for OWA Basic Authentication instead. Outlook Mobile Access and ActiveSync cannot be set up to use form-based authentication and therefore will not be protected by the IIS 6 Module for OWA Forms Authentication Client Browser Requirements Any browser capable of using OWA VASCO Data Security Inc. 18

19 Installation 3.2 Pre-Installation Tasks Before installing or upgrading the IIS 6 Module, there are several tasks which need to be completed. Performing these tasks (where applicable) will assist in a quick, smooth installation process. Note Digipass Pack for OWA Forms Authentication cannot be installed on the same machine as Digipass Pack for OWA Basic Authentication or Digipass Pack for Citrix Web Interface Install VACMAN Middleware VACMAN Middleware 2.3 must be installed on the network before the IIS 6 Module is installed. If you have VACMAN Middleware 2.2, upgrade to version 2.3. See the VACMAN Middleware Installation Guide for more information on installing or upgrading to VACMAN Middleware 2.3. Warning If you are using Windows authentication (the Local and Windows Authenticator) in conjunction with Dynamic User Registration, it is essential that users always use the same login name. If they try to log in using a different form of their Windows account name, their login will be rejected, unless a second VACMAN Middleware user account has been created IIS Ensure IIS and Exchange 2003 are installed and working correctly. The IIS 6 Module must be installed on the IIS server Information Needed Before you begin installation of the IIS 6 Module, ensure that you have the following information easily accessible, as you will need to enter this during the installation. IP address and TCP port number of the VM server. IP of the local machine to use when connecting to the VM server (if multiple IP addresses are configured for this machine, as this affects licensing see below) Licensing Your VM license must include sufficient Web Servers, or the IIS 6 Module will not function correctly. Licensed applications must include Web VASCO Data Security Inc. 19

20 Installation The VACMAN Middleware Server will regard each incoming IP address as a different Web Server. This is the reason for selecting a single IP address in connecting to the VACMAN Middleware Server if there is more than one IP address for a machine VASCO Data Security Inc. 20

21 Installation 3.3 Install IIS 6 Module for OWA New Installation 1. Start the IIS 6 Module for OWA Forms installation process. If you are not using the CD Autorun interface, locate and double-click on the DP_Pack_for_OWA_Forms_230_setup.exe file. If this is a new installation, the License Agreement screen will be displayed. 2. Read the License Agreement carefully. If you agree to the conditions, click on the I Agree button. If you do not accept the License Agreement, and click Cancel, the install will terminate. 3. IP Address If the installation program detected more than one IP address for the installation machine, the Licensed IP Address dialog will be displayed. a. Enter the IP address that you wish the IIS 6 Module to use. b. Click Next. The Server Location dialog will be displayed. 4. Enter the IP address of the VM server. If you have a backup VM server, enter its IP address. Enter the ports you wish the primary VM server and the backup VM server to use (these default to port 20003). Note The installation process does not include a check for correct port numbers. If a port number is entered incorrectly, the IIS 6 Module will not be able to connect to the VM server. This can be fixed using the Configuration GUI. 5. Select an installation directory: To install the IIS 6 Module to the default location (C:\Program Files\VASCO\Digipass Pack for OWA Forms Authentication if Windows is installed on the C: drive), click on the Next button. If you wish to install the IIS 6 Module in a location other than the default: a. Enter the full path in the appropriate field or click on the Browse button to select the desired installation location. b. Check that the Space Required does not exceed the space available on the drive selected. If there is insufficient space to install the IIS 6 Module, an error will occur and installation will terminate VASCO Data Security Inc. 21

22 Installation c. Click Install. The Installation Progress screen will be displayed, showing the progress of your install. This process will install all files needed for the IIS 6 Module and register the Module in IIS. The IIS 6 Module Configuration GUI will be launched. 6. If changes to the configuration of the IIS 6 Module are required, adjust the configuration settings and click on the Apply button or OK button. If no changes are required, click on the Cancel button. 7. After installation and configuration, the system must be restarted for some settings to take effect. A screen will be displayed, asking whether you want to restart the machine now or later. If you have other tasks to complete before the machine restarts, select the No, I will restart my machine later radio button. Otherwise, select the Yes, restart the machine now radio button (selected by default). 8. Click on the Finish button VASCO Data Security Inc. 22

23 Installation Upgrade Installation 1. Start the IIS 6 Module for OWA Forms installation process. If you are not using the CD Autorun interface, locate and double-click on the DP_Pack_for_OWA_Forms_230_setup.exe file. A message box will be displayed, asking if you wish to upgrade. Click on Yes to upgrade to the latest IIS 6 Module for OWA. The Installation Progress screen will be displayed, showing the progress of your install. This process will install all files needed for the IIS 6 Module and register the Module in IIS. The IIS 6 Module Configuration GUI will be launched. 2. If changes to the configuration of the IIS 6 Module are required, adjust the configuration settings and click on the Apply button or OK button. If no changes are required, click on the Cancel button. 3. After the upgrade and configuration, the system must be restarted for some settings to take effect. A screen will be displayed, asking whether you want to restart the machine now or later. If you have other tasks to complete before the machine restarts, select the No, I will restart my machine later radio button. Otherwise, select the Yes, restart the machine now radio button (selected by default). 4. Click on the Finish button. Note The challenge template file (challenge_template.html) will not be modified during upgrade if it exists in the <install directory>\challenge directory. To upgrade this file, delete or move it to a different directory before running the upgrade VASCO Data Security Inc. 23

24 Configuration 4 Configuration Configuration settings can be modified in two ways. The easiest method is via the IIS 6 Module Configuration GUI a graphical interface that allows you to make changes with a few mouse clicks. Advanced users may prefer to edit the configuration file directly. 4.1 IIS 6 Module Configuration GUI A Graphical User Interface (GUI) is available for use in configuring the IIS 6 Module. This provides a simple, intuitive way to set up the IIS 6 Module to work with your current system. To open the IIS Configuration GUI, click on the Start Button and select Programs VASCO Digipass Pack for OWA Forms Authentication VACMAN Middleware IIS 6 Module Configuration Alternatively, open Windows Explorer and open <IIS 6 Module install directory>\bin\vmiiscfg.exe. If this is the first time you have opened the IIS 6 Module Configuration GUI and the configuration file has not been edited, the values you will see in the IIS 6 Module Configuration GUI are those entered during installation of the IIS 6 Module VASCO Data Security Inc. 24

25 Configuration Enable/Disable the IIS 6 Module This option starts or stops the IIS 6 Module from redirecting authentication requests to VACMAN Middleware. 1. Click on the General tab. 2. Tick or untick the Enable VACMAN Middleware Authentication checkbox 3. Click on the Apply button 2004 VASCO Data Security Inc. 25

26 Configuration VACMAN Middleware Server Details The Server list contains all VACMAN Middleware Servers which may be utilized by the IIS 6 Module. Server records can be added, deleted, or their details modified. The IP address to use when connecting to a Server and the maximum time to wait between failback retries must also be entered. Server Profile A Server s profile contains connection information for the Server and defines how the IIS 6 Module will establish and maintain connections to the Server. See Server Connection Management for more information Add a Server 1. Click on the Add button. The New Server window will be displayed. 2. Enter a name for the Server in the Name field. This name will be used to distinguish the Server in the Server list, but has no effect on the behaviour of the IIS 6 Module. 3. Enter an IP address and port for the Server, in the IP Address and Port fields. 4. Enter a timeout period (in seconds) in the Timeout field VASCO Data Security Inc. 26

27 Configuration 5. Enter the maximum number of concurrent connections to be made from the IIS 6 Module to the Server, in the Max. Connections field. 6. Select a Profile Option (see above for an explanation of each option). If you selected Advanced, select connection establishment and maintenance options from the Establishment and Maintenance drop down lists, and enter an idle period time (in seconds) in the Idle Period field, if applicable. 7. Click on the OK button Modify Server Details 1. Select the Server to be edited. 2. Click on the Edit button. The Edit Server window will be displayed. 3. Make required changes. 4. Click on the OK button Delete a Server Record 1. Select the Server record to be deleted VASCO Data Security Inc. 27

28 Configuration 2. Click on the Delete button. A confirmation window will be displayed. 3. Click on OK to delete the Server record VASCO Data Security Inc. 28

29 Configuration Modify Connection Settings Retry Interval If the IIS 6 Module loses contact with the primary VM Server(s), it will switch its connection over to a backup or recovery server. It will try to reconnect with the primary server(s) at increasing intervals until connection with the primary server(s) is reestablished. The Maximum Retry Interval sets the maximum amount of time that the IIS 6 Module will leave between attempts to reconnect to the primary VM Server(s). Connect from IP Address If a server has multiple IP addresses configured, the IIS 6 Module needs to know which to use in connecting to the VACMAN Middleware Server. 1. Enter the IP address from which to connect to VACMAN Middleware Servers in the Connect from IP Address field. This may be left blank if there is only one IP address for the machine. 2. Set the Maximum Retry Interval if needed. 3. Click on the Apply button VASCO Data Security Inc. 29

30 Configuration Turn Tracing On or Off 1. Select a Tracing option. 2. If you have selected Basic Tracing or Full Tracing, enter a path and filename for the tracing file into the File Name field. The file path entered must be the full absolute path. 3. Click on the Apply button. See Check Permissions - Trace File Directory for information on setting up permissions for the trace file directory. Note If the File Name field is left blank or the file path does not exist, the IIS 6 Module will not output tracing. If the file does exist, tracing will be appended to the file. If the path is valid but the file does not exist, it will be created VASCO Data Security Inc. 30

31 Configuration Group Lists Set Authentication Behaviour for Groups The IIS 6 Module needs to know how to utilize the Group List whether it should use it, and whether it should pass through or reject authentication requests for users not belonging to a group in the Group List. 1. Click on the Authentication tab. 2. Select an Authentication behaviour option. 3. Click on the Apply button VASCO Data Security Inc. 31

32 Configuration Add a Group to the Group List 1. Click on the Add Group button. A pop up window will be displayed. 2. Enter the name of the Windows Domain group into the Group field. 3. Click on the OK button. The new group will be added to the Group List. 4. Click on the Apply button. Note Group names may not contain any of these characters: / \ [ ] : ; < > + =,? * Remove a Group from the Group List 1. Select the group to be removed from the Group List. 2. Click on the Delete Group button. A pop up confirmation window will be displayed. 3. Click on the Yes button. The group will be removed from the Group List. 4. Click on the Apply button. Note Editing groups can only be done when the Authenticate listed groups, pass others through or Authenticate listed groups, reject others options are selected VASCO Data Security Inc. 32

33 Configuration Sites Each web site to be protected by the IIS 6 Module is displayed in the Sites list. Outlook Web Access supports only one Site, which will be entered into the configuration during installation. This Site record may be modified at any time. Note Password Change capture and autolearn is not supported for OWA Forms Authentication VASCO Data Security Inc. 33

34 Configuration Modify Login Page Details 1. Click on the Authentication tab. 2. Select the Site and click on the Edit button. The Edit Site window will be displayed. 3. Click on the Login tab. 4. Modify the Base URL if required. 5. For information on modifying query string parameters for the login page, see the Add, Modify and Delete a Query String Parameter topics below. 6. Click on the Form Fields tab. 7. Ensure that the correct names for the fields on the login page corresponding to User, Password and Domain are entered into the relevant fields. 8. Click on the Failed Login tab VASCO Data Security Inc. 34

35 Configuration 9. Modify the Base URL if required. 10. For information on modifying query string parameters for the login page, see the Add, Modify and Delete a Query String Parameter topics below. 11. If you need to set up 2-step Challenge/Response login or Virtual Digipass login: a. Click on the Two Step C/R tab. b. Enter the location of the Challenge/Response template. 12. Click on OK Modify 1-Step Challenge/Response Login Page Details 1. Click on the Authentication tab. 2. Select the Site and click on the Edit button. The Edit Site window will be displayed. 3. Click on the One Step C/R tab VASCO Data Security Inc. 35

36 Configuration 4. Tick the Enabled checkbox to allow 1-step Challenge/Response logins. 5. Modify the Base URL if required. 6. For information on modifying query string parameters for the change password page, see the Add, Modify and Delete a Query String Parameter topics below. 7. Ensure that the Challenge Length required by all Digipass in use is correct. 8. If a check digit is required, tick the Add Check Digit checkbox. 9. Click on OK Add a Query String Parameter The Query String Parameters list contains URL parameters required by OWA when a login is submitted. The IIS 6 Module will only identify a request as a login if these variables are present in the query string. 1. Click on the + button. The Add Login Query String Parameter window will be displayed. 2. Enter the new parameter, exactly as it will appear in the query string eg. page=login 3. Click on OK. 4. Repeat the process for other query string parameters Modify a Query String Parameter 1. Select a Query String Parameter from the list. 2. Click on the button. The Edit Login Query String Parameter window will be displayed. 3. Make the required changes. 4. Click on OK VASCO Data Security Inc. 36

37 Configuration Delete a Query String Parameter 1. Select a query string parameter from the list. 2. Click on the button. A confirmation window will be displayed. 3. Click on Yes to delete the query string parameter Add a Session Variable for the Failed Login Page The Session Variables list contains query string parameters from the login submit request which should be included in the failed login URL, such as session identifiers. 1. Click on the + button. The Add Failed Login Session Variable window will be displayed. 2. Enter the name of the query string parameter. 3. Click on OK. Repeat the process for other query string parameters to be included in the failed login URL Edit a Session Variable 1. Select a session variable from the list. 2. Click on the button. The Edit Failed Login Session Variable window will be displayed. 3. Modify the name of the query string parameter. 4. Click on OK VASCO Data Security Inc. 37

38 Configuration Remove a Session Variable 1. Select a query string parameter from the session variable list. 2. Click on the button. A confirmation window will be displayed. 3. Click on Yes to remove the query string parameter from the list Delete Site Record 1. Click on the Authentication tab. 2. Select the site name from the Sites list. 3. Click on the Delete button. A confirmation window will be displayed. 4. Click on OK to delete the site record VASCO Data Security Inc. 38

39 Configuration 4.2 Configuration File The IIS 6 Module Configuration GUI writes to an.xml file named vmextcfg.xml in the installation directory. It is possible to edit this file directly instead of using the IIS 6 Module Configuration GUI. Increment the Revision number by 1 to have your changes take effect. Note This option is recommended only for advanced users. The IIS 6 Module Configuration GUI will prevent most common configuration mistakes, but there are no such checks made when edits are made directly to the configuration file. Incorrect changes to the configuration file may cause the IIS 6 Module to stop working. Example configuration file <VASCO> <Revision type="unsigned" data="1"/> <Enabled type="unsigned" data="1"/> <Local-IP type="string" data=" "/> <Group-Option type="unsigned" data="0"/> <Groups type="string" data=""/> <Trace-Header type="unsigned" data="31"/> <Trace-Mask type="unsigned" data="0x "/> <Trace-File type="string" data="c:\program Files\VASCO\Digipass Pack for OWA Forms Authentication\log\vmiis.trace"/> <Max-Retry-Interval type="unsigned" data="15"/> <Sites> <Site0> <Name type="string" data="outlook Web Access - Forms Authentication"/> <One-Step-CR> <Enabled type="bool" data="false"/> <Match-URL> <URL type="string" data="/exchweb/bin/auth/owalogon.asp"/> </Match-URL> <Challenge-Length type="unsigned" data="4"/> <CheckBit type="bool" data="false"/> </One-Step-CR> <Login> <Match-URL> <URL type="string" data="/exchweb/bin/auth/owaauth.dll"/> </Match-URL> <Failed-URL> <URL type="string" data="/exchweb/bin/auth/owalogon.asp?reason=2"/> </Failed-URL> <User-Field type="string" data="username"/> <Password-Field type="string" data="password"/> <Domain-Field type="string" data="domain"/> <Challenge-Template type="string" data="c:\program Files\VASCO\Digipass Pack for OWA Forms Authentication\challenge\challenge_template.html"/> </Login> <ChgPasswd> <Enabled type="bool" data="false"/> <Match-URL> <URL type="string" data="/iisadmpwd/achg.asp"/> </Match-URL> <User-Field type="string" data="acct"/> <Password-Field type="string" data="old"/> <NewPassword-Field type="string" data="new"/> <PasswordConf-Field type="string" data="new2"/> </ChgPasswd> </Site0> </Sites> <Servers> <Server0> 2004 VASCO Data Security Inc. 39

40 Configuration <Name type="string" data="primary Server"/> <IP type="string" data=" "/> <Port type="unsigned" data="20003"/> <Timeout type="unsigned" data="30"/> <ConnIdlePeriod type="unsigned" data="300"/> <EstProfile type="unsigned" data="2"/> <MaintProfile type="unsigned" data="1"/> <MaxConnections type="unsigned" data="5"/> </Server0> </Servers> </VASCO> Caution The configuration file is UTF8 encoded. Non-UTF8 encoded characters should not be added to the configuration file, or it will not load VASCO Data Security Inc. 40

41 Configuration Configuration Settings The table below lists the options, their default values, and a brief explanation of each. Table 7 Configuration Options Option Name Default Value Notes Revision 1 The current revision of the configuration. This is incremented each time the configuration is changed and allows the IIS 6 Module to automatically reload its configuration parameters. If you have manually changed configuration settings in the file, increment this setting by 1 so that your changes take effect. Enabled 1 Whether the IIS 6 Module is enabled or disabled. If disabled, does not block access, but does not intercept authentication requests they pass through unmodified. Local-IP IP address automatically detected by the install program. If more than one IP address was detected, this value will be the IP address selected during installation. The local IP address to be used when connecting to the VM servers. Group-Option 0 0 Ignore Group List and process all users requests. 1 Only process requests for users in a group in Group List; let requests for other users pass through unmodified. 2 Only permit access for users in a group in Group List; reject access for other users. Groups <blank> A comma-separated list of Windows Domain groups that the filter should process. This string must not contain spaces between commas and group names. Trace-Header 31 The tracing header fields that have been enabled. This is a bitmask constructed by adding the following values: 1 Enable the Date field 2 Enable the Time field 4 Enable the Tracing level field 8 Enable the Thread ID field 16 Enable the File field 32 Enable the Line field eg. for DATE,TIME,LEVEL = = 7 A value of 0 will result in no header being added to the trace output. Trace-Mask 0x Hexadecimal or decimal values: Hex Decimal 0x No tracing 0x E Configuration and error messages only 0xFFFFFFFF All levels enabled VASCO Data Security Inc. 41

42 Configuration Option Name Default Value Notes Trace-File Max-Retry- Interval Servers/ Server<number>/ IP Servers/ Server<number>/ Port Servers/ Server<number>/ Name Servers/ Server<number>/ Timeout Servers/ Server<number>/ ConnIdlePeriod Servers/ Server<number>/ MaxConnections Servers/ Server<number>/ EstProfile Servers/ Server<number>/ MaintProfile Sites/ Site<number>/ Name Sites/ Site<number>/ Login/ Match-URL/URL Sites/ Site<number>/ Login/ Match-URL/ Param<number> Sites/ Site<number>/ Login/ Failed-URL/URL Sites/ Site<number>/ Login/ Failed-URL/URL <installation directory>\ Log\vmiis.trace The absolute path and filename of the file to which internal state tracing will be written. The file but not the path will be created by the filter / extension if it does not exist. If this option is blank, the IIS 6 Module will not output tracing. 15 Maximum amount of time that the IIS 6 Module will leave between attempts to reconnect to a higherpriority server after losing connection to it. 0 - fail-back is disabled. IP Address entered during installation. Port number entered during installation. <blank> IP Address of the VM server. Port to use in connecting to the VM server. Text to display in the Servers list on the Configuration GUI. 30 Number of seconds the IIS 6 Module should wait for a response. 300 Number of seconds the IIS 6 Module should keep an idle connection open. 5 The maximum number of concurrent connections to hold open to the Server. <blank> /exchweb/bin/auth/ owaauth.dll <blank> exchweb/bin/auth/ owalogon.asp <blank> Method of establishing a connection to the Server. Method of maintaining a connection to the Server. See Server Connection Management. Text to display in the Sites list on the Configuration GUI. The base URL to use in submitting a login. Query string parameter needed in the URL. The base URL to use after a failed login attempt. Query string parameter to use in the URL VASCO Data Security Inc. 42

43 Configuration Option Name Default Value Notes Sites/ Site<number>/ Login/User-Field Sites/ Site<number>/ Login/ Password-Field Sites/ Site<number>/ Login/ Domain-Field Sites/ Site<number>/ Login/Challenge- Template Sites/ Site<number>/ ChgPasswd/ Match-URL/URL Sites/ Site<number>/ ChgPasswd/ Match-URL/ Param<number> Sites/ Site<number>/ ChgPasswd/ Enabled Sites/ Site<number>/ ChgPasswd/ User- Field Sites/ Site<number>/ ChgPasswd/ Password-Field Sites/ Site<number>/ ChgPasswd/ NewPassword- Field Sites/ Site<number>/ ChgPasswd/ PasswordConf- Field Sites/ Site<number>/ One-Step-CR/ Match-URL/URL Sites/ Site<number>/ One-Step-CR/ Match-URL/ Param<number> User Password Domain Challenge\challenge_templa te.html <not used> <blank> Name of the field that corresponds to User. Name of the field that corresponds to Password. Name of the field that corresponds to Domain. Location and file name of the template to use in creating a Challenge/Response page. The base URL used in changing a User s password. Query string parameter needed in the URL. 0 Whether the IIS 6 Module will capture password changes. User Password NewPassword /exchweb/bin/auth/ owalogon.asp <blank> Name of the field that corresponds to User. Name of the field that corresponds to Password. Name of the field that corresponds to New Password. Name of the field that corresponds to Confirm New Password. The base URL to use in making a one-step challenge/response login request. Query string parameter needed in the URL VASCO Data Security Inc. 43

44 Configuration Option Name Default Value Notes Sites/ Site<number>/ One-Step-CR/ Enabled Sites/ Site<number>/ One-Step-CR/ Challenge-Length Sites/ Site<number>/ One-Step-CR/ CheckBit 0 Whether one-step challenge/response logins are enabled. 4 The length of the Challenge required for Challenge/Response Digipass Applications being used. False Indicates whether a check digit is used by the Digipass Challenge/Response Applications VASCO Data Security Inc. 44

45 Configuration 4.3 Configuring VACMAN Middleware Server Settings Set Authenticator to Local and Windows. If you are using RADIUS with Local and Proxy authentication, this will be treated as Local and Windows. See the Administer Server topic in the VACMAN Administration Guide for instructions on setting the VM Authenticator Windows Permissions When the IIS 6 Module is in use, additional permissions are required for the user account under which the Middleware Server runs. This user account must be a member of either the Administrators or the Account Operators group on the Middleware Server machine. To grant the VACMAN Middleware service group membership, you have two choices: If the service is running as the LocalSystem account, you can add LocalSystem ( System ) to one of these two groups. If you do not wish to do this, change the service to run as a named account, then add this to one of these groups. If the service is running as a named account, add this account to one of these groups. See the Permissions section of the VACMAN Middleware Administration Guide for more information Licensing Your VACMAN Middleware license must cover the number of web servers you are wanting to run an IIS Module from. This includes Digipass Pack for OWA, Digipass Pack for OWA Forms Authentication and Digipass Pack for Citrix Web Interface. Licensed Applications must include Web VASCO Data Security Inc. 45

46 Post-Installation Tasks 5 Post-Installation Tasks 5.1 Using New Features in Set up 1- Step Challenge/Response Login Implementing one-step Challenge/Response login requires the login page used by OWA to be modified. The standard OWA login page has been modified and placed in the <install directory>\challenge directory. To use a login page which has been customized for your company eg. colours and graphics used follow the instructions in Modify Custom Login Page Set up for OWA Login page 1. Backup <exchange web directory>\bin\auth\<country>\logon.asp to a suitable place. 2. Copy modified login page from <install directory>\challenge\logon.asp (or other location if using a custom login page) to <exchange web directory>\bin\auth\<country>\logon.asp. 3. Enable one-step Challenge/Response in the Configuration GUI. Modify the base URL and/or query string parameters as required. See the Modify 1-Step Challenge/Response Login Page Details topic in the Error! Reference source not found. section for more information. Challenge Flash Applet 4. Copy <install directory>\challenge\flash.class to <exchange web directory>\bin\auth\flash.class. 5. Remove commenting (the greyed-out lines in the example below) for the applet code in the login page <exchange web directory>\bin\auth\<country>\logon.asp. To edit the file, open in a text editor (eg. Notepad). <!-- This part adds the FLASH challenge. --> <!-- commented out by default <TR> <TD height="5"></td> <TD valign="top" height="5"><img title="" alt="" src="/exchweb/img/spacer.gif" width=25 height=5></td> <TD height=5></td> </TR> <TR> <TD NOWRAP width="1%"><p></p></td> <TD width="98%"><%=request("http_vasco_flashcode")%></td> <TD rowspan=4> </TD> <TD width="1%"> </TD> </TR> --> 6. Save the file and close. 7. Using the IIS Management Console, check that permissions for the <exchange web directory>\bin\auth\flash.class file allow read access VASCO Data Security Inc. 46

47 Post-Installation Tasks Modify Custom Login Page If you have a current login page in use which differs from the standard OWA login page, you may need to modify it rather than replacing it with the login page provided with the Digipass Pack. When the IIS 6 Module detects a request for the login page, it adds three headers to the request before passing it on. The headers added are: Table 8 - Headers added to login request string Header Explanation VASCO-Challenge Contains the string challenge to be displayed to the user. ie "1234" VASCO-State VASCO-FlashCode Contains data that needs to be passed as the field "VMExtState" on the login request. Contains the html code needed to include the challenge flash applet in the login page. This requires the applet be copied to the appropriate location in the website. A piece of code must be inserted into the login page to include 1-step Challenge/Response functionality. The code required can be found below or taken directly from the login page added to the <install directory>\challenge directory during installation. <!-- Digipass Pack for OWA Form Authentication modifications : START --> <!-- The following code is for 1-step challenge/response. If you --> <!-- want the flash applet as well as the text challenge, un- --> <!-- comment out the section marked FLASH. --> <% If Request("HTTP_VASCO_CHALLENGE") <> "" Then %> <!-- This part adds the text challenge. --> <TR> <TD height="5"></td> <TD valign="top" height="5"><img title="" alt="" src="/exchweb/img/spacer.gif" width=25 height=5></td> <TD height=5></td> </TR> <TR> <TD NOWRAP width="1%"><p><label for="challenge">challenge:</label></p></td> <TD width="98%"><input type="text" id="challenge" name="challenge" style="width:100%" size="25" maxlength="256" value='<%=request("http_vasco_challenge")%>' readonly='true'></td> <TD rowspan=4> </TD> <TD width="1%"> </TD> </TR> <!-- This part adds the FLASH challenge. --> <!-- commented out by default <TR> <TD height="5"></td> <TD valign="top" height="5"><img title="" alt="" src="/exchweb/img/spacer.gif" width=25 height=5></td> <TD height=5></td> </TR> <TR> <TD NOWRAP width="1%"><p></p></td> <TD width="98%"><%=request("http_vasco_flashcode")%></td> <TD rowspan=4> </TD> <TD width="1%"> </TD> </TR> --> <!-- This part is needed always. --> <input name='vmextstate' type='hidden' value='<%=request("http_vasco_state")%>'> <% End If %> <!-- Digipass Pack for OWA Form Authentication modifications : END --> 2004 VASCO Data Security Inc. 47

48 Post-Installation Tasks Troubleshooting If the challenge flash applet is not functioning, ensure that: The applet file (flash.class) is in the correct directory The applet code has been referred to correctly in the login page code. Read permissions have been applied to the flash.class file. 5.2 Create Challenge Response Template The example challenge-template.html is found in the <install directory>\challenge directory. You may create your own based on this template, or use the example template as is. The template must contain a number of key words which the extension will replace with the appropriate html code. (Note: These fields may appear more than once in the file, and each instance will be replaced) These fields are: VMEXT_FORM_METHOD - This will be replaced with the correct form method VMEXT_FORM_ACTION - This must be the action specified for the form VMEXT_PASSWORD_FIELD_NAME - This must be the name for field into which the response will be written VMEXT_CHALLENGE_TEXT - This string will be replaced with the Challenge issued. VMEXT_HIDDEN_FIELDS - This will be replaced with any fields submitted from login page VMEXT_CHALLENGE_FLASH - This optional field will include the digipass flash applet html 5.3 Copy Challenge Response Files If challenge response logins will be used and the challenge flash applet will be used, the flash.class file must be copied from <install directory>\challenge to the <exchange web directory>\bin\auth directory under the Program Files directory (typically c:\program files\exchsrvr\exchweb\bin\auth) VASCO Data Security Inc. 48

49 Troubleshooting 6 Troubleshooting 6.1 Configuring IIS 6 to work with VM The installation program for the IIS 6 Module will usually complete the following tasks automatically. However, if it fails in these tasks for some reason, an error message will be displayed during installation. These steps can then be followed to complete the installation manually. If you are having trouble running VM and the IIS 6 Module for the first time, following these steps may help you track down the problem and fix it manually Check file placement The following files must be placed in the directory they are listed under. If they have been moved to another directory, or incorrectly copied, the IIS 6 Module will not function correctly. <install directory> vmextcfg.xml filteruninst.exe <install directory>\bin vmiisext.dll ssapi.dll vmiiscfg.exe <install directory>\challenge logon.asp challenge_template.html flash.class readme_challenge.txt 2004 VASCO Data Security Inc. 49

50 Troubleshooting Check Permissions Trace File Directory Permissions need to be set to allow the IIS 6 Module to access and write to the trace file. By default, the trace file is stored in <install directory>\log. Follow these steps for the folder the trace file will be written to. 1. Open Windows Explorer and browse to the directory that the trace file will be written to (<install directory>\log by default). 2. Right-click on the relevant directory. 3. Select Properties. The <directory name> Properties window will be displayed. 4. Click on the Security tab. 5. Ensure that the IUSR_<computer name> account has Read and Write permissions ticked. 6. Ensure that the IIS_WPG group has Read and Write permissions ticked. 7. If changes need to be made to the permissions, make changes and click on the Apply button. If the IUSR_<computer name> account or IIS_WPG group is not listed, see Add the IUSR_<machine name> Account or IIS_WPG Group VASCO Data Security Inc. 50

51 Troubleshooting Configuration file 1. Open Windows Explorer and browse to the installation directory. 2. Right-click on the vmextcfg.xml file. 3. Select Properties. The <directory name> Properties window will be displayed. 4. Click on the Security tab. 5. Ensure that the IIS_WPG group has the Read permission ticked. 6. If changes were made to the permissions, click on the Apply button. If the IIS_WPG group is not listed for the configuration file, see Add the IUSR_<machine name> Account or IIS_WPG Group for instructions on adding the account manually VASCO Data Security Inc. 51

52 Troubleshooting Add the IUSR_<machine name> Account or IIS_WPG Group If the IUSR_<machine name> account or IIS_WPG group is not listed for the trace file directory or configuration file, you will need to add it. 1. Click on the Add button The Select Users, Computers, or Groups window will be displayed. 2. Click on the Advanced button VASCO Data Security Inc. 52

53 Troubleshooting 3. Enter search criteria (see example below) and click on the Find Now button. If no search criteria are entered, a list of all users and groups in the selected location will be returned. 4. Select the IUSR_<machine name> account or IIS_WPG group. 5. Click on the OK button. 6. Check that the IUSR_<machine name> account or IIS_WPG group is listed. 7. Click on the OK button. 8. The account should now be listed in the Security group and user list VASCO Data Security Inc. 53

54 Troubleshooting Set System Environment Variable 1. Right-click on My Computer. 2. Click on Properties. The System Properties window will be displayed. 3. Click on the Advanced tab. 4. Click on the Environment Variables button VASCO Data Security Inc. 54

55 Troubleshooting The Environment Variables window will be displayed. If VMIISModuleDirectory is not displayed in the System variables list, create it manually: 5. Click on the New button. 6. Enter the following values: Variable Name: VMIISModuleDirectory Variable Value: <IIS 6 Module installation path> 7. Click on the OK button 8. Click on the OK button again. The new System variable should now appear in the System variables list VASCO Data Security Inc. 55

56 Troubleshooting Register IIS 6 Module Extension 1. Right-click on My Computer. 2. Click on Manage. The Computer Management window will be displayed. 3. Expand the Services and Applications heading. 4. Expand the Internet Information Services heading. 5. Click on Web Service Extensions VASCO Data Security Inc. 56

57 Troubleshooting The Web Service Extensions window will be displayed. If the VM IIS6 Extension is not included in the list, add it manually: 6. Right-click on Web Service Extensions. 7. Click on Add a new Web service extension. The New Web Service Extension window will be displayed. 8. Enter VM IIS6 Extension in the Extension name field. 9. Click on the Add button. 10. Browse to <install directory>\bin\vmiisext.dll. 11. Click on the OK button. 12. Tick the Set extension status to Allowed checkbox. 13. Click on the OK button. The VM IIS6 Extension should now appear in the list of Web service extensions VASCO Data Security Inc. 57

58 Troubleshooting Register as Wildcard Application Mapping 1. Right-click on My Computer. 2. Click on Manage. The Computer Management window will be displayed. 3. Expand the Services and Applications heading. 4. Expand the Internet Information Services heading. 5. Click on ExchWeb. 6. Right-click on bin. 7. Click on Properties VASCO Data Security Inc. 58

59 Troubleshooting The Web Sites Properties window will be displayed. 8. Click on the Virtual Directory tab. 9. Click on the Configuration button. The Application Configuration window will be displayed VASCO Data Security Inc. 59

60 Troubleshooting If the vmiisext.dll is not included in the list, add it manually: 10. Click on the Insert button. 11. Browse to <install directory>\bin\vmiisext.dll (surround with double quotes if there are spaces in the file path). 12. Click on the OK button. The extension should now appear in the Wildcard application maps list. If the extension is not at the top of the Wildcard application maps list: 13. Select the vmiisext.dll extension. 14. Click on the Move Up button until the extension is at the top of the list. 15. Click on the OK button to exit the Application Configuration window VASCO Data Security Inc. 60