Zenprise Zenprise RSA Adapter

Transcription

1 Partner Information RSA Secured Implementation Guide For 3rd Party PKI Applications Last Modified: May 16 th, 2012 Product Information Partner Name Zenprise Web Site Product Name Version & Platform 1.0 Product Description The provides for the ability to sign and revoke certificates for the Zenprise Device Manager, enabling device identity for mobile device management (MDM), mutual authentication and user credential certificates for use in conjunction with WiFi, VPN, and Exchange ActiveSync (EAS) profiles.

2 Solution Summary The provides an interface that allows the Zenprise Device Manager (ZDM) to submit certificate requests for a signature to an RSA Certificate Manager server. The ZDM submits a request to the Zenprise RSA adapter to sign a certificate. The RSA Certificate Manager receives the request, signs the certificate using the RSA Xuda Libraries and returns it to the ZDM. ZDM makes these certificate requests in order to generate device identity for mobile device management mutual authentication, or user credential certificates to be used in conjunction with WiFi, VPN, and Exchange ActiveSync (EAS) profiles for both ios and Android devices. RSA recommends that the be installed on a separate server from the ZDM host, using its own, 32-bit instance of Tomcat

3 Product Configuration The following RSA CA Manager requirements must be met. Please consult your RSA CA Manager Installation guide for the proper configuration. RSA Certificate Manager s installable elements Install RSA CA Manager version 6.8 build 519 or higher Install RSA Certificate Authority Version 6.8 Build 519 or higher Disables special OSI-level privileges RSA Certificate Manager s configurable elements Configure CRL Publishing: Configure OCSP Responder: Configure Certificate Publishing: ZDM s installable elements Tomcat 6.0 or higher, 32 bit Java SDK 1.6 or higher ZDM s configurable elements CRL Checking Mechanism: OCSP Checking Mechanism: Trust Validation: Enrollment: General modifications to the partner product: - 3 -

4 Product Operation Overview The RSA Adapter provides a mechanism for the Zenprise Device Manager to sign and revoke certification against an RSA Certificate Authority Version 6.8. It enables device identity for mobile device management (MDM) mutual authentication and user credential certificates for use in conjunction with WiFi, VPN, and Exchange ActiveSync (EAS) profiles. An overview of tasks that will be completed before installing the are as follows: Set the Java SDK path on the Windows computer where you will install the Configure the correct port (80) on your Tomcat server Copy the installation and configuration files into a target installation directory Edit the properties file with values obtained from the RSA CA Manager Console Copy the RSA CA Manager.cert and.key files to the installation computer Execute the installation executable to install the software Verify the installation in a browser (IE 8) An overview for configuring the requires the following tasks: Create and configure a PKI entity profile in ZDM to be able to connect to the RSA WSDL Create an ios profile to enable use of the certificate authority Add a new logger in the log4j configuration to ensure proper error handling and auditing Configure the new PKI profile so it can be deployed to an ios device and validated Prerequisites Install the following applications prior to installing the ZDM RSA Adapter: RSA CA Manager 6.8 build 519 or higher JAVA SDK 1.6+ Tomcat 6.0 or higher, 32-bit (for the RSA Adapter) Zenprise Device Manager or higher (recommended to be installed on a separate server than the adapter) - 4 -

5 Installing the ZDM RSA Adapter on Windows Note: Before you begin, make sure you have access to the zenadapter.war file that is included as part of the product distribution. Follow the steps below to install the ZDM Adapter. 1. Log on to the ZDM RSA Adapter host and add the Java SDK installation directory to the PATH variable. For example: 2. Follow the steps below to change the Tomcat s server HTTP connector port from 8080 to 80 and its HTTPS port from 8443 to 443. a) Navigate to %TOMCAT_HOME%/conf directory. b) Edit the server.xml file as follows: Change non-ssl to: <!-- Define a non-ssl HTTP/1.1 Connector on port > <Connector port="80" /> - 5 -

6 Change SSL to: <!-- Define a SSL HTTP/1.1 Connector on port > <Connector port="443" /> 3. Create a new directory named C:\Zenprise on the installation computer. 4. Unzip the contents of the RSA Adapter zip package and copy it to the C:\Zenprise directory. 5. Log into the RSA Adapter host as a Service Account user and create a file to store a passphrase that will be used by the RSA Adapter. Note: The Service Account user is the same user who runs the Tomcat server. 6. Open a Windows command prompt, navigate to the C:\Zenprise folder and execute the following command: java -jar WinDPHarness <passphrase filename> <passphrase> For example: Note: Remember the file pathname used in this command <passphrase filename> above, because you will need it when you edit the prop.txt file in the following step. java -jar WinDPHarness.jar c:\zenprise\passcode.txt mypassword Open the C:\Zenprise\prop.txt file in a text editor and set the following attributes in the file, for example: a) ldapport=636 b) ldaphost= rsa1.kqe.zenprise.com c) camd5= a2064dd584c7025f03ceb0443ca0fe9e d) keyfile=c:\\zenprise\\admin.key e) certfile=c:\\zenprise\\admin.cert f) protectflag=0 g) juriid=fe109c4d64430faf6d614c08b75312b0b7e31226 h) passphrasefile=c:\\zenprise\\passcode.txt i) profileflag-1 j) profileid=ac1e02d427c3d8 k) keepldapopen=1 Note: These properties are available in your RSA CA Manager console. Please check your RSA CA Manager guide for instructions to access them. 8. Copy the two RSA CA Manager files (.cert and.key) from the RSA CA Manager server to the C:\Zenprise folder on the computer where you are installing the. 9. Copy the zenadapter.war to the %TOMCAT_HOME%\webapps folder. (This file is located in the Zenprise RSA Adapter package distribution). 10. Open a command prompt, navigate to the %TOMCAT_HOME\webapps directory and execute the following command: a) cd to %TOMCAT_HOME%\webapps b) jar -xvf zenadapter.war c) Stop the Tomcat server d) Start Tomcat 11. Verify that the installation was successful: a) In Internet Explorer 8+, navigate to: WITH_ADAPTER_TOMCATINSTANCE/zenadapter.war - 6 -

7 b) A page with the adapter s WDSL and link should be shown if installation was successful. Contact Zenprise support at: support@zenprise.com if the WDSL wasn t displayed

8 Configuring RSA ZDM Adapter in the ZDM Console Important: Please ensure that you have successfully installed the RSA ZDM Adapter before attempting to configure it in the ZDM Console. 1. Open IE 8+ and enter the URL of the ZDM Console and log in. For example: 2. Click the Options button in the ZDM Console, select the PKI entity and click the New button. 3. Click the New button in the PKI entities configuration screen to add a new entity: - 8 -

9 4. Enter a unique name for the entity in the Add a PKI entity dialog box (e.g. Zenadapter1). 5. Enter the URL for the RSA Adapter WSDL (e.g

10 6. If the adapter is available over HTTPS / SSL, then upload the SSL client certificate. Otherwise continue to the next step. 7. Click the Load button. 8. Click the Ping button to test the configuration. If you see a Ping Successful message, then the certificate loaded successfully

11 9. Next, you will need to create the ios profiles to enable use of the certificate authority. Navigate to the Policies tab in the ZDM console. 10. On the left side, click Configuration Profiles. If you are performing this task using version 6.5 of the ZDM console, click Configuration. 11. Create a new policy for the PKI authority that you installed by clicking New Profile. (If you are performing this task using version 6.5 of the ZDM console, click New Configuration Profiles and Settings PKI credential)

12 12. Enter the appropriate parameters in the dialog based on your configuration: 13. Next, on the same server running the ZDM, you must add a new logger in the log4j configuration to ensure proper error handling and auditing. In IE, navigate to the following URL based on your installation: Navigate to the bottom of the table and Add New Logger entry for the com.sparus.nps.pki 15. Set the logging level for to TRACE

13 16. Test the deployment profile on a new ios device by moving the new PKI package into the Resources to Deploy section so it can be deployed to an ios device. 17. Register a new device that is targeted with the package and verify that you see the new certificate on the ios device. 18. If the package does not successfully deploy, please check the log file you configured and contact Zenprise support at: support@zenprise.com

14 Certification Checklist for 3 rd Party Applications Date Tested: April 9 th, 2012 Product Tested Version Operating System RSA Certificate Manager 6.8 Build 519 Microsoft Windows 2008 R2 Zenprise Device Manager Microsoft Windows 2008 R2 1.0 Microsoft Windows 2008 R2 Test Case Certificate Enrollment P10 Certificate Request P7 Response installed correctly CMP Certificate Request CMP Response installed correctly SCEP Certificate Request SCEP Response installed correctly Import Certificate Import PKCS#12 envelope Import via cut & paste Install Root Certificate via cut/paste Install SubCA Certificate via cut/paste Install Root Certificate via SCEP Install SubCA Certificate via SCEP Verify Certificate chain is installed Results Certificate Usage Sign Encrypt SSL S/MIME Document and Files SSL Client Authentication LDAP Support Name lookup Certificate retrieval Results Status Check of Certificate OCSP CRL Other Success with a valid certificate Fails with a revoked certificate Fails with a suspended certificate Pass with a re-instated certificate RSA Remote Authentication Client RAC Access certificates via MS CAPI (Internet Explorer) JJO / PAR = Pass = Fail = Non-Available Function