Tivoli Access Manager for Enterprise Single Sign-On

Tivoli Access Manager for Enterprise Single Sign-On Version 6.0 Installation and Setup Guide GC23-6349-03

Tivoli Access Manager for Enterprise Single Sign-On Version 6.0 Installation and Setup Guide GC23-6349-03

Note: Before using this information and the product it supports, read the information in Notices, on page 23. This edition applies to version 6.0 of this adapter and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 2005, 2007. All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Preface Table of Contents Preface... 6 Audience... 6 Related Documentation... 6 Conventions and Terminology... 7 Introduction... 9 Installing and Configuring TAM E-SSO...10 Installing the TAM E-SSO Administrative Console...10 Installing the TAM E-SSO Agent...15 Configuring TAM E-SSO...21 Uninstalling TAM E-SSO...22 5

TAM E-SSO Installation and Setup Guide Preface This document describes how to install and set up IBM Tivoli Access Manager for Enterprise Single Sign-On (TAM E-SSO). The Preface contains these topics: Audience Related Documentation Conventions Support Information Audience The TAM E-SSO Installation and Setup Guide is intended for experienced administrators who are responsible for the planning, implementation, and deployment of TAM E-SSO. This document provides step-by-step instructions for installing and configuring the TAM E-SSO Administrative Console and Agent. Administrators are expected to understand single sign-on concepts, such as password policies, logon methods, credential-sharing groups, and application configuration. They should be familiar with configuring directory servers, databases, and repositories. Persons completing the installation and configuration procedure should also be familiar with their organization s system standards. Readers should be able to perform routine security administrations tasks. Related Documentation This product s documentation includes: TAM E-SSO Release Notes TAM E-SSO Installation and Setup Guide TAM E-SSO User Guide TAM E-SSO Administrative Console Help TAM E-SSO Web Viewer Installation and Setup Guide 6

Preface Conventions and Terminology This document uses various conventions and icons to help you identify special terms and important topics quickly. Convention Connotation Bold font Within text, references to the following: Dialog box/gui element names Dialog box/gui section labels Dialog box/gui tab names or labels Dialog box/gui field names Procedures and in GUI any button that is clicked Italic font Variable text within a command or path References to other technical publications Courier New font Registry keys Command line Code examples Icon Connotation Description Important task Note or tip Best Practice Essential to the completion of a procedure. Additional valuable information about task or topic. Not essential to completion of task. Recommended method to perform a procedure. Caution New in this release If step or procedure is not followed exactly, the result could be loss of data or data corruption. Indicates new features introduced in this release. 7

TAM E-SSO Installation and Setup Guide Acronym or Abbreviation SSO Agent SSO Administrative Console TAM E-SSO Full Name TAM E-SSO Logon Manager Agent TAM E-SSO Administrative Console IBM Tivoli Access Manager for Enterprise Single Sign-On TAM E-SSO: Authentication Adapter IBM Tivoli Access Manager for Enterprise Single Sign-On Authentication Adapter TAM E-SSO: Kiosk Adapter TAM E-SSO: Provisioning Adapter TAM E-SSO: DPRA SSO FTU IBM Tivoli Access Manager for Enterprise Single Sign-On Kiosk Adapter IBM Tivoli Access Manager for Enterprise Single Sign-On Provisioning Adapter IBM Tivoli Access Manager for Enterprise Single Sign-On Desktop Password Reset Adapter TAM E-SSO First Time Use 8

Introduction Introduction TAM E-SSO lets you use a single password to log on to any password-protected application on your desktop, your network, and the Internet. It works out-of-thebox (without programming or additional network infrastructure) with virtually all applications, including Windows, Web, proprietary, and host or mainframe applications. TAM E-SSO is intelligent agent software. It remembers your credentials your username/id, password, and other information for each application or website and automatically responds to its logon requests. Use the procedures described in the following pages to install TAM E-SSO. Each procedure is explained in detail in Installing and Configuring TAM E-SSO. Installing the TAM E-SSO Administrative Console Installing the TAM E-SSO Agent 9

TAM E-SSO Installation and Setup Guide Installing and Configuring TAM E-SSO Follow these procedures to install and configure TAM E-SSO. Installing the TAM E-SSO Administrative Console To install and configure the TAM E-SSO Console: 1. Double-click the TAM E-SSO Admin Console.MSI file to begin the installation. Wait while the installer loads. Note:.NET 2.0 must be installed to install the TAM E-SSO Administrative Console. Use the TAM E-SSO Admin Console.EXE file to install.net 2.0. Please note that the installation of.net 2.0 could take up to five minutes. 2. On the Welcome Panel, click Next>. 10

Installing and Configuring TAM E-SSO 3. On the License Agreement panel, read the license agreement carefully. If you agree to the terms in the license agreement, select I accept the terms in the license agreement and click Next> to continue. 4. Select a setup type. The Complete type installs all program features. The Custom option allows you to choose which program features to install and where they will be installed. If you will be performing a custom installation, go to Step 5. If not, go to Step 6. 11

TAM E-SSO Installation and Setup Guide 5. If you are performing a custom setup, choose from the following installation options: 12

Installing and Configuring TAM E-SSO SSO Administrative Console (requires 1225KB of space): This installs all necessary files and settings that serve as the core foundation of the application. Templates (requires 88KB of space): Add-on templates that include additional supported application templates, configurations and settings that can be included in the console. Change Click this button to change the current installation destination folder for the Console. Select the location and click OK. Help Click the Help button to display the Custom Setup tips. Each icon indicates the state of the available feature. Space Click Space to display the Disk Space Requirements for installing the selected features on the local servers. Click OK. Icon Means the feature Will be completely installed to the local hard drive. Will have some subfeatures installed to the local hard drive. Will not be installed. Will be installed on first use. Will be installed to run from the network. 13

TAM E-SSO Installation and Setup Guide 6. The InstallShield Wizard is ready to begin the installation. Click Install. 7. Wait for the installation to complete. When Completed screen appears, click Finish. 14

Installing and Configuring TAM E-SSO Installing the TAM E-SSO Agent To install and configure the TAM E-SSO Agent: 1. Double-click the TAM E-SSO.MSI file to begin the installation. Wait while the installer loads. 2. On the Welcome Panel, click Next>. 3. On the License Agreement panel,read the license agreement carefully. If you agree to the terms in the license agreement, select I accept the terms in the license agreement and click Next> to continue. 15

TAM E-SSO Installation and Setup Guide 4. Select a setup type. The Standalone type installs commonly used program features. The Custom option allows you to choose which program features to install. If you will be performing a custom installation, go to Step 5. If not, go to Step 6. 16

Installing and Configuring TAM E-SSO 5. If you are performing a custom setup, choose from the following installation options: Applications (requires 1740KB of space): This option installs all necessary files and settings that serve as the core foundation of the application. Logon Methods (requires 512 bytes of space): The logon methods are plug-ins that provide different methods for logging onto TAM E-SSO. By default, Windows Logon is installed. The plug-ins available are: Windows Logon Windows Logon v2 GINA LDAP LDAP v2 Authenticatio n Manager Plug-in that enables logging onto TAM E-SSO by logon to Windows. (73KB) Plug-in that enables logging onto TAM E-SSO by logon to Windows. This plug-in also includes secure passphrase and GINA support. (93KB) GINA module that works with the Windows Domain logon method. (104KB) Plug-in that enables logging onto TAM E-SSO by logon to an LDAP directory. (116KB) Plug-in that enables logging onto TAM E-SSO by logon to an LDAP directory. This plug-in also includes secure passphrase support. (93KB) This feature adds the capability to allow multiple logon methods to authenticate the user. (61KB) Extensions (requires 1762 KB of space): The extensions are plug-ins that enhance and extend functionality of the SSO application. By default, Backup\Restore Manager, Logon Manager, and Setup Manager are installed. The plug-ins available are: Backup\Restore Manager Logon Manager Setup Manager Synchronization Manager Event Manager This plug-in provides a simple file-based, backup-and-restore mechanism via a wizard interface. (76KB) This plug-in provides the main credential management, request and delivery interfaces. (209KB) See below for the list of Logon Manager plug-ins. This plug-in provides the initial, first-time-user experience when setting up the SSO application. (53KB) This plug-in provides for the management of synchronization extensions to the application. See below for the list of Synchronization Manager plug-ins. This plug-in provides for the management of event- logging extensions to the application. See below for the list of Event Manager plug-ins. 17

TAM E-SSO Installation and Setup Guide Logon Manager (requires 1762 KB of space) The helper plug-ins available are: Internet Explorer Helper Mozilla Browser Helper Extension helper that adds SSO support for Internet Explorer. (105KB) Extension helpers that add SSO support for Mozilla-based browser. (872KB) Mainframe Emulator Helper Extension helpers that add SSO support for HLLAPI-based emulators. (109KB) The Mainframe helper extensions are: Console Window Support Legacy Emulator Support Java Helper SAP Helper Support for Console windows (command prompt) within the TAM E-SSO mainframe plug-in. (56KB) Support for 16-bit legacy HLLAPI-based emulators. (295KB) Extension helpers that add SSO support for Java applications natively. (144KB) Extension helpers that add SSO support for SAP applications. (209KB) Note: SAP must be configured to work with TAM E-SSO. Please see the Technical Notes in the TAM E-SSO 6.00 Release Notes. Synchronizer Manager The synchronizer plug-ins available are: Active Directory Synchronizer LDAP Synchronizer Synchronization plug-in that supports storage and retrieval of credentials and settings from an Active Directory server. (88KB) Plug-in that supports storage and retrieval of credentials and settings from an LDAP-compliant directory, such as SUN Java System Directory Server or edirectory. (116KB) ADAM Synchronizer Synchronization plug-in that supports storage and retrieval of credentials and settings from an ADAM server. (85KB) File System Synchronizer Database Synchronizer Roaming Profile Synchronizer Synchronization plug-in that supports storage and retrieval of credentials and settings from a file share. (69KB) Synchronization plug-in that supports storage and retrieval of credentials and settings from a database. (64KB) Synchronization plug-in that supports roaming profiles. (73KB). 18

Installing and Configuring TAM E-SSO Event Manager The plug-ins available are: XML File Windows Event Extension Event Management plug-in that supports logging of events to a local XML file. (36KB) Event Management plug-in that supports logging of events to the Windows Event Manager. (57KB) Languages The localized language support packages that allow the Agent to be displayed in other languages. Change Click this button to change the current installation destination folder for the Agent. Select the location and click OK. Help Click the Help button to display the Custom Setup tips. Each icon indicates the state of the available feature. Icon Means the feature Will be completely installed to the local hard drive. Will have some subfeatures installed to the local hard drive. Will not be installed. Will be installed on first use. Will be installed to run from the network. 19

TAM E-SSO Installation and Setup Guide Space Click Space to display the Disk Space Requirements for the installation of the selected features on local servers. Click OK. 6. The InstallShield Wizard is ready to begin the installation. Click Install. 20

Installing and Configuring TAM E-SSO 7. Wait for the installation to complete. When the Completed screen appears, click Finish. 8. The TAM E-SSO installation does not require a reboot, unless the Windows Authentication v2 SSO GINA has been installed. If the SSO GINA was installed, you will be prompted to reboot your machine when you click Finish. 9. After the workstation or server has been restarted, you will be presented with the TAM E-SSO Welcome Screen/First Time Use (FTU) Wizard. Follow the instruction on the screen and complete the FTU wizard. After the FTU is complete, an Icon will appear in the tool tray. Please refer to the TAM E-SSO User s Guide and online help for information on completing the FTU Wizard and using the TAM E-SSO Agent. Configuring TAM E-SSO Please refer to the TAM E-SSO Administrative Console online Help for information on using the Administrative Console to configure TAM E-SSO. 21

TAM E-SSO Installation and Setup Guide Uninstalling TAM E-SSO To uninstall TAM E-SSO: 1. Click Start, point to Settings, and then click Control Panel. 2. Open Add/Remove Programs. 3. To remove the TAM E-SSO Agent, select IBM Tivoli Access Manager for Enterprise Single Sign-On and click Remove. The following dialog appears: 4. Click Yes. 5. Follow the prompts to uninstall TAM E-SSO. 6. To uninstall the TAM E-SSO Administrative Console, select IBM Tivoli Access Manager for Enterprise Single Sign-On Administrative Console and click Remove. 7. Repeat steps 4 and 5. 22

Appendix. Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user s responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106-0032, Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Copyright IBM Corp. 2005, 2007 23

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact: IBM Corporation 2ZA4/101 11400 Burnet Road Austin, TX 78758 U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Trademarks The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: AIX DB2 developerworks eserver IBM iseries Lotus Passport Advantage pseries RACF Rational Redbooks Tivoli WebSphere zseries Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. 24 IBM Tivoli Access Manager for Enterprise Single Sign-On: Installation and Setup Guide

Intel, Intel Inside (logos), MMX and Pentium are trademarks of Intel Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Linux is a trademark of Linus Torvalds in the U.S., other countries, or both. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Other company, product, and service names may be trademarks or service marks of others. Appendix. Notices 25

26 IBM Tivoli Access Manager for Enterprise Single Sign-On: Installation and Setup Guide

Printed in USA GC23-6349-03