Page History

Indeed PAM Gateway

The Indeed PAM Gateway component is installed onto Remote Desktop Session Host server. If there are several RDSH servers, then the Indeed PAM Gateway has to be installed onto each of them.

Switch to C:\Program Files\Indeed PAM\Gateway\ProxyApp folder and edit Pam.Proxy.App.exe.config file:<pamProxy ... />:

Api section

• ApiUrl - URL of Indeed PAM Core

  Code Block
  language js
  "Api": { "ApiUrl": "https://pam.domain.local/pam/core"

  
  

Auth section

• IdpUrl - URL of Indeed PAM IdP

• GatewaySecret - Secret for client keys for additional component authentication
  

  Note
  icon false
  The secret and its hash are is generated by the console utility Pam.ConsoleApp.exe (located in \Misc\ConsoleApp folder). Run the command prompt, go to the "ConsoleApp" folder and run the command " Pam.ConsoleApp.exe generate-secret"

  
  

  themeRDark

  Code Block
  language	js
  D:\ConsoleApp>Pam.ConsoleApp.exe generate-secret Secret: OClhdGA1M6wWFcYflCfF1qINX8dYbvTrU0Aad4cb7piASoMEEiB2yM0I8N6zq7T/FSQunLyYzsRcm3PhQzqM9w== Hash: bQAl17Y58+Htv982eadHmFaDguAPNrjd+Bl9vN0Uw5c= Done.

  Warning
  icon false
  The hash will need to be specified when setting up Indeed PAM IdP.

• IdpRequiresHttps - to require secure connection
• Leave the rest unchanged
  

  Code Block
  language xml
  <pamProxy ApiUrl="Auth": { "IdpUrl": "https://pam.indeed-iddomain.local/api" IdpUrl="https://pam.indeed-id.local/idp", GatewaySecret="OClhdGA1M6wWFcYflCfF1qINX8dYbvTrU0Aad4cb7piASoMEEiB2yM0I8N6zq7T/FSQunLyYzsRcm3PhQzqM9w==" IdpRequiresHttps="true" AgentConnectionTimeout="60" AgentHeartbeatTimeout="20" VideoTempPath="C:\ProgramData\Indeed\Pam\VideoTemp\" FileCopyMaxPercentToIgnore="1" FileCopyEnoughPercentToSave="50" FileCopyMinBytesToSave="1048576" />

<appSettings>...</appSettings>

• "IdpRequiresHttps": true, "GatewaySecret": "m0Kvn2YdIAivB2UeILq65y5Qio2eijY+kmbjyn8istcQLU/xRLUowkCR5WEFSaagrv/s7Dc+Nm9pn09NAA0xVA==" },

  
  

Media section

• VideoTempPath - path to the temporary files folderEdit the "Culture" value to change the user interface language:

  Code Block
  language xmljs
  <appSettings> <add key="Culture" value="en" /> </appSettings>"Media": { "VideoTempPath": "C:\\ProgramData\\Indeed\\Pam\\VideoTemp\\" },

  
  

Configuration of session collection

1. Log in to the server that performs Remote Desktop Connection Broker role and run Server Manager
   
2. Switch to Remote Desktop Services - Collections
3. In the Collections section click Tasks and select the Create session collections item
   
4. Create a collection with parameters you need using the wizard
5. Click Tasks in the RemoteApp Programs section and select Publish RemoteApp Programs item
   
6. Click Add, select the C:\Program Files\Indeed PAM\Gateway\ProxyApp\Pam.Proxy.App.exe application, click Next and then Publish
   
7. Open the context menu of the published application in the RemoteApp Programs section and select Edit Properties item
   
8. Switch to Parameters, mark the Allow any command-line parameters option and click ОK
   

Configuration of access to web applications

Installation of Indeed-Id ESSO Agent/Admin Pack

To access web applications through Indeed PAM, you will need to install additional Indeed-Id components:

• Indeed-Id Admin Pack
• Indeed-Id ESSO Agent
• Browser extensions
  

Configuring the Internet Explorer extension via group policies

After Indeed-Id ESSO Agent is installed, the extension is automatically added to Internet Explorer, but it is disabled. To enable and configure extension automatically, proceed as follows:

Switch to

Image Removed

Switch to

Image Removed

Switch to

Configuring the Google Chrome extension via group policies

1. Log in to Internet Information Services (IIS) role server, switch to C:\inetpub\wwwroot\ and create a folder named ChromeExtension
2. Run Internet Information Services (IIS) Manager and open Sites item in the Connections section
3. Open the context menu of Default Web Site or any other site and click Add Application
Specify ChromeExtension in the Alias field. Enter C:\initpub\wwwroot\ChromeExtension to Physical path field, then save the changes
Image Removed

4. Select the site where ChromeExtension application is created,  open MIME Types item in the IIS section, then click Add in the Actions section
Specify .crx in the File name extension field. Specify application/chrome in the MIME Type field and save the changes
Image Removed

Send the URL of ChromeExtension application to support@indeed-id.com

Note
icon false
Example: https://server.indeed-id.local/ChromeExtension

5. Open the C:\initpub\wwwroot\ChromeExtension folder and place the files received from the support service to it:
   • Update.xml
   • icpjelgegalmjjkfoilkbeeodgfbcaam.crx
6. Install the ADMX templates to domain controller. The templates are included to installation package and located in the IndeedPAM\IESSO\IndeedID.SSO.Agent\Chrome\PolicyTemplates\ADMX
7. Run the Group Policy Management snap-in, select the domain, then open the context menu of Group Policy Objects item and click New or use an existing group policy object
8. Switch to Group Policy Objects, open the context menu of an object and click Edit

Switch to


Tip
icon false
Computer Configuration/Administrative Templates/Google/Google Chrome/Extensions

9. Open the Configure the list of force-installed apps and extensions, set the switch to Enabled and click Show in the Options section
Specify the ID of icpjelgegalmjjkfoilkbeeodgfbcaam extension in the Value name field, as well as URL of update.xml file and save the changes
Image Removed


Note
icon false
The separator between the application ID and the URL is a semicolon. icpjelgegalmjjkfoilkbeeodgfbcaam;https://server.indeed-id.local/ChromeExtension/Update.xml

10. Open the Configure extension, app, and user script install sources, set the switch to Enabled and click Show in the Options section

Specify the URL of the host In the Value name field where ChromeExtension web application is located and save the changes
Image Removed


Note
icon false
The URL must end with an asterisk https://server.indeed-id.local/*

11. Close the Group Policy Management Editor
12. Open the context menu of domain or unit, click Link an Existing GPO, select a group policy object and configure it to work with Indeed PAM Gateway server