password manager quick guide - download.fastpasscorp.com · fastpass password manager, version 3.6,...

½

FastPassCorp A/S is a public company registered on Nasdaq/Copenhagen/FirstNorth. Distribution and implementation is done through strong and professional partners internationally We improve productivity and compliance for passwords and other authentication models

PASSWORD MANAGER Version 3.6 (19142)

PASSWORD MANAGER QUICK GUIDE

http://FastPassCorp.com









2/45


Document Title Password Manager Quick Guide

Document Classification Public

Document Revision A

Document Status Final

Document Date April 8, 2019

The specifications and information in this document are subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. This document may not be copied or distributed by any means, in whole or in part, for any reason, without the express written permission of FastPassCorp A/S.

© 2004 - 2019 FastPassCorp A/S All rights reserved. Lyngby Hovedgade 98, 2800 Kongens Lyngby, Denmark. http://www.fastpasscorp.com FastPass Password Manager is a trademark of FastPassCorp A/S. All further trademarks are the property of their respective owners. Limited Warranty No guarantee is given for the correctness of the information contained in this document. Please send

any comments or corrections to [email protected]











mailto:[email protected]


3/45


FastPass Password Manager will give your organization benefits in many different areas:

Through Self Service your users can:

• Reset passwords and unlock accounts 24 hours a day, 365 days a year.

• They will receive the service immediately, and don’t have to wait fo r telephone answers.

• They don’t have to be embarrassed in front of the Service Desk employee!

The Service Desk:

• Calls and incidents related to passwords disappear.

• Attention can be transferred to important incidents and problems

• The service level delivered will be improved

Finance:

• Savings in time for users and the Service Desk will reduce password related cost for the

organization












4/45


Table of Contents

1 Introduction .......................................................................................................................... 5 1.1 Purpose ............................................................................................................................... 5 1.2 Audience ............................................................................................................................. 5 1.3 References .......................................................................................................................... 5 1.4 Windows Server 2012R2 pre-requisite ................................................................................. 5 1.4.1 Installation of AD LDS (ADAM) and IIS on Windows Server 2012R2 ....................................5

1.5 Windows server 2016 pre-requisite ...................................................................................... 9 1.5.1 Installation of AD LDS (ADAM) and IIS on Windows Server 2016 .........................................9

1.6 Creating local service accounts for Password Manager ...................................................... 12 1.7 Preparing ADAM/AD LDS ................................................................................................... 13

2 Install Password Manager ................................................................................................... 23 2.1 Password Manager Server .................................................................................................. 23 2.2 Install Adam Installer .......................................................................................................... 27 2.3 Install ServerInit ................................................................................................................. 30

3 Basic Configuration ............................................................................................................ 35












5/45


1 INTRODUCTION

1.1 PURPOSE

The purpose of this document is to describe the steps included in the process of performing a FastPass

Password Manager – installation and basic configuration. The Password Manager can be installed in

other environments and in different server setup’s, please consult the installation guide for complete

coverage.

Although the document is written as a tutorial for performing a real installation the reader shall expect to

change input values to match the standards and requirements of their own environment.

1.2 AUDIENCE

The intended audience of this document is personnel either responsible for, preparing or performing the

application installation.

1.3 REFERENCES

This document references the following documents:

FastPass Password Manager, Version 3.6, Installation Guide.

FastPass Password Manager, Version 3.6, Administrators Guide.

1.4 WINDOWS SERVER 2012R2 PRE-REQUISITE

1.4.1 INSTLLATION OF .NET FRAMEWORK 4.5.1 OR HIGHER

To meet the Pre-Requisites for version 3.6 .Net Framework 4.5.1 or higher must be installed on the

FastPass Server.

1.4.2 INSTALLATION OF AD LDS (ADAM) AND IIS ON WINDOWS SERVER 2012R2

Login on an administrative account on your server open the Server Manager found under

Administrative Tools. Click Roles in the left part of the windows and activate the Add Roles












6/45


Mark the Web Server (IIS) for installation, and if the “Add required features” pop’s up press the Add

Required Features button. Click Next until you see the Role Service screen for IIS.












7/45


Mark ASP.Net 4.5

IIS 6 Metabase Compatibility and click Next and Install.

After the installation has completed you need to install your SSL certificate on the web server. Do this by

starting Internet Information Services (IIS) Manager under Administrative Tools.












8/45


Select the Server Name in the left screen and click the Server Certificates icon and import your

certificate.

Choose the Default Web Site and click the Bindings.












9/45


Add a new binding of the https type and choose your certificate in the dropdown. Click OK.

Now your server is ready for Password Manager.

You can continue to section 1.6

1.5 WINDOWS SERVER 2016 PRE-REQUISITE

1.5.1 INSTALLATION OF AD LDS (ADAM) AND IIS ON WINDOWS SERVER 2016

FastPass now also supports Windows Server 2016 and things look a bit different.

Log on to your Windows 2016 Server → Choose Server Manager → Choose Local Server and go to the

Menu → Open Manage → Add Roles and Features.

Select/install Server Roles Active Directory Lightweight Directory Services (AD LDS)












10/45


Select/install Web Server (IIS)

Mark ASP.NET 4.6












11/45


Preparing the IIS on Server 2016 – Select/install IIS 6 Metabase Compatibility

After the installation has completed you need to install your SSL certificate on the web server. Do this by

starting Internet Information Services (IIS) Manager.

Select the Server Name in the left screen and click the Server Certificates icon. Import certificate.












12/45


Choose the Default Web Site and click the Bindings.

Add a new binding of the https type and choose your certificate in the dropdown . Click OK.

1.6 CREATING LOCAL SERVICE ACCOUNTS FOR PASSWORD MANAGER

We need to create some accounts and one group for use with Password Manager. Open the Computer

Management console found under Administrative Tools and create the following users FPAdamUser,

FastPassGWUser – Note: This user must be allowed to “Log on locally”. If not the ServerInit

installation part will fail not being able to authenticate the user . (You can test this by logging on the

machine using this user)












13/45


Creation of the FPAdamUser and the FPGWUser

Then create a group called FPGWGroup and add the newly created FPGWUser user to it. The last step

is to create a group that will hold the AD or local users that will be able to login to the FastPass

Administration Client. Here I created a group with access for the local user “MyUserAccount” and the

users in the AD groups “Domain Admins” and “FastPass Admins”.

1.7 PREPARING ADAM/AD LDS

The next step is to install an AD LDS database instance. Do this by opening Administrative Tools and

chose Active Directory Lightweight Directory Services Setup Wizard .












14/45


After the Installing ADLDS you must configure the AD LDS.

Run the Active directory Lightweight Directory Service Setup Wizard → Click the Next button.












15/45


Select the A unique instance radio button and click the Next button.

Give the instance a name and click the Next button.












16/45


Enter LDAP port number and SSL port number where 50000 and 50001 is typically used numbers.

Select the Yes, create an application directory partition radio button and click on the Next button.












17/45


Specify where to place the Data files and Data recovery files. Typically, production servers use the D:

drive for data but accept the default values if acceptable for your installation.

NOTE: The ADAM data storage can grow relatively large in size. Our measures have been that a d ata

repository holding 10000 users requires about 1 GB of disk space the first year of operation. Click on the

Next button.

Select the Network Services account radio button. If the popup Windows appears:












18/45


Choose Locations → Local Server → Advanced → Find Now












19/45


Choose the fpadamuser created before the Setup → click OK

Click → Next












20/45


Select the Do not import LDIF files for this instance of ADAM and click on the Next button.

Check that the information is as expected and correct them if they are wrong.

When verified click on the Next button.












21/45


Now the ADAM Instance is created and imported.

When the actual import starts, you will be prompted to enter the username and password for the ADAM

administrator account specified in the ADAM Administrators screen.












22/45


Finally the completion status screen is displayed and the Finish button is clicked.












23/45


2 INSTALL PASSWORD MANAGER

2.1 PASSWORD MANAGER SERVER

There are a few steps to complete the installation of Password Manger – after you have unpacked your

Password Manager Package it looks like this:

To start the installation open the folder: 1. Password Manager Server, and under that folder open the 1.

Installer folder.

Now run the PasswordManagerServer.exe by right clicking that installation file and selecting “Run as

Administrator”. Click Next, read and accept the license agreement, click Next.

Fill in a User name and company name and click Next. For the next screen:












24/45


Please enter <machine name>\FPIISUser and issue a password. This user will be created by the installer, giving only minimum rights to the user. The following popup emerges:

Answer yes to let the installation create the user. Now click Next and Install












25/45


Accept the default installation folder by clicking → next or click the Change button to change the folder












26/45


Click Install to install the FastPass Manager












27/45


Upon successful completion of all installation tasks the installer will show this screen and the Finish

button can be clicked.

If the Installer does not show this screen but instead an error screen the messages shall be noted and

the specified reasons shall be examined and solved if possible.

2.2 INSTALL ADAM INSTALLER

Return to the installation directory and enter the directory 2. ADAMInstaller, there execute the ADAMInstaller.exe. Click the Next button and enter the following values: ! Important note “Every time you execute an installation package right click the package and choose

“Run as administrator”.












28/45


Click the Next button to continue.

Enter the information that reflects to the AD LDS installation as performed when preparing the AD LDS

installation Click the Next button to continue.

Click Next and enter the following values, changing the server name “server875” to match your machine name in the Username.












29/45


Enter the authentication information that reflects to the ADAM installation as performed whe n preparing

the ADAM installation. Click the Next button to continue. After clicking the Next button the connection is

verified and if succeeded the next screen will be shown.

Click the Next button to continue












30/45


A progress bar and detail progress information will be shown.

On completion, review the status and click the Next button to continue.

Click the Finish button to end the program.

2.3 INSTALL SERVERINIT

After the installation wizard is completed, we need to enter the 3. ServerInit directory and execute the ServerInit.exe. Click Next, and follow the instructions on the screen.












31/45


! Important note for Server 2012R2, Server 2016 Users: “Every time you execute an installation

package right click the package and choose “Run as administrator”.


Enter a name and description for your Organization. The name will be shown in the Administration Client

as well as in the Self-Service Client.













32/45


Verify the value written into the hostname field and verify that this name is the same as used in the IIS

Certificate implemented on the server. When the Next button is activated the settings are verified

against the server.

Verify that all IP addresses of the server are listed in the IP Address List field.

Now specify the group that shall be used for authorization of administrators trying to login to the

FastPass Administration Client, by using the AD group selector as shown in













33/45


Specify the group that shall be used for authorization of Gateway Administrators and specify an Account

and a Password for a user that is member of that group. This group and account is used internally by the

FastPass Password Manager and shall not be used again unless other components like FastPass

Password Sync is implemented and integrated into the solution.

Click the Next button to continue. After clicking the Next button the entered information is verified and if valid the next screen will be

shown.













34/45


Click the Finish button to end the program.

You have completed the installation of Password Manager successfully.












35/45


3 BASIC CONFIGURATION

Open your browser to access the Password Manager administrative part by opening the following URL

on a browser:

https://<ServerName>/FastPassAdministrationClient/

(Note: If you are using the browser on the server, be sure to add the site to “trusted sites”)

To Log in on the FastPass Password Manager you must be member of t he Server Administration Group

you have typed in the ServerInit setup and you must have user rights to log on locally. The first thing

you need to do after logging in is to configure a user repository – that is the connection to your AD. This

is done by choosing the Add button under User Repositories:












36/45


In the upcoming screen, define the basic settings. The Name will be shown on the webpage the client’s

access. The number of users is equal to the number of AD users to allow for this particular User

Repository.












37/45


Click Save, and activate the Connection Settings and add the following information:

1. Domain Name: The full name of the domain we are accessing

2. NetBIOS name of the domain

3. The FQDN to your Active Directory server (Domain Controller)

4. Leave the connection mode on secure mode and enter an account name and password with

Domain Admin rights for the domain.

5. The FastPass account name and password for the account with Domain Admin or delegated

rights in the AD.












38/45


To verify the data, press the verify button to make sure all the information is correct.

Now we need to tell Password Manager which groups it can operate with – this is done using the icon in

the Security Settings panel.












39/45


Under the icons Security Settings, you will find a page similar to this:












40/45


The Security Settings defines which groups are available from the Active Directory, and to be used later

to configure Password Manager Administration Client. At the opening of the Security Settings Page

Password Manager collects the Security Groups from Active Directory. The Group for Roles (User

Repository) contains two boxes; one for Selected Groups (to the left) and one for the Available Groups

(to the right). Search hint is enabled to find the group names matching the typed characters.

Select the groups from your AD that fit your needs and Click Save.

For test, you can use the same group for all the operations. Look in the Administration Guide for further

details on these group settings.












41/45


Now we need to configure which users has access to what from where. This is done the Authentication

settings part. Activate the Home link in the left side of your screen and click the “Authentication

Settings” icon and the following page is shown:

These are the different operations; in this guide, we will complete the enrollment and the reset password

operations only.

Defining the Enrollment operation activate the Enroll User icon and fill in the data as seen below.












42/45


Click the add button to create a new profile.












43/45


The above picture grants access to the users in the FPBasicUsers groups from any network, to enroll

using their Password as authentication. Click save and activate the Reset Password operation icon to

define the access for the reset password operation. Click add to add a profile for this operation.












44/45


Now the client is configured for basic operation. To verify start a browser pointing at

https://<ServerName>/FastPassClient/













45/45


You will see the clients screen:

Now activate the Enroll User operation and follow the instructions on screen. After you have answered

the Challenge response questions you will be able to reset the password of the user , using the Reset

Password operation.

Now you have completed the Quick guide – however we strongly advise you to do the following

operations at a minimum:

1. Define the other Authentication Settings

2. Create a Discovery profile to let Password Manager fetch the data for your users

3. Define a mail server

4. Define an enrollment profile – this feature sends emails to users that has not enrolled yet

5. Before operation, be sure to schedule the service restart script found under the

<INSTALLPATH>\FastPassCorp\tools\ folder to ensure continuous operation

For an in-depth description and guide in setting up these features we refer to the Administration Guide.

In the package, you will find the Windows Client and instructions on how to install the client in enterprise

architecture.











password manager quick guide - download.fastpasscorp.com · fastpass password manager, version 3.6,...

Documents