Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

During system deployment stage it is necessary to set up configuration files of each service

...

. Configuration files of all system services

...

are located in the root

...

directory of IIS web applications (default path is %SystemDrive%\inetpub\wwwroot). 

Info

Card Monitor service configuration files are located in %ProgramFiles%\

...

Axidian CertiFlow\CardMonitor.

Setup of configuration files is carried out using Indeed CM Setup Wizard. The latter runs automatically upon completion of Indeed CM Server Installation Wizard, if the corresponding checkbox is activated.
However, you also can run the Wizard manually at any time (Start - All ProgramsIndeed IdentityIndeed CM).

Image RemovedFigure 9 – Access control selection.

Table 4 features the section of Setup Wizard, along with description of their parameters.

Configuration files are set up viaAxidian CertiFlow Configuration Wizard, a component which is installed separately.

Tip

System requirements for Axidian CertiFlow Configuration Wizard are the same as for Axidian CertiFlow server

Installing Axidian CertiFlow Configuration Wizard

Run the AxidianCertiFlow.Wizard-<version number>.x64.en-us.msi from Axidian CertiFlow installation package and follow the wizard instructions to complete the installation.  

Note

For security reasonswe recommend that you disable the Axidian CertiFlow Configuration Wizard after you complete the system configuration:

  1. Open the Internet Information Services Manager (IIS).
  2. Select Application Pools in the IIS server component tree.
  3. Select Axidian CertiFlow Configuration Wizard in Application Pools list.
  4. Go to Actions menu on the right side of the window and select Stop.

Authentication in Axidian CertiFlow Configuration Wizard

Use a temporary authentication code to access Axidian CertiFlow Configuration Wizard. The authentication code is generated when you start the IIS Axidian CertiFlow Wizard application pool. The code is saved in the wizard_authentication_code.txt file in logs subfolder (C:\inetpub\wwwroot\cm\wizard\logs).

  1. Open wizard_authentication_code.txt and copy the authentication code.

    Code Block
    titleExample:
    2023-09-20 09:40:06.1557|AuthenticationCode: "YoQZdL2mJC4pYmKJmC7YT8mXDv3FPj2v"


  2. Open https://<FQDN name of the server>/cm/wizard page in your browser.Enter the authentication code and log in.

Scroll Pagebreak

Configuring the system

Here are the Axidian CertiFlow Configuration Wizard parameters:

...

SectionDescription
Before starting work

...

Axidian CertiFlow Setup Wizard purpose and features

...

Restore configuration

...

Uploading a backup copy of

...

Axidian CertiFlow configuration.

System features

  • Common features
  • Event Log
  • Microsoft CA

...

  • AirCard Enterprise
  • Client Agent

...

Configuring internal settings for Axidian CertiFlow web applications:

Management Console

...

Self-Service


Event Log:


Microsoft CA: Configure settings for working with Microsoft Certification Authority.

AirCard Enterprise: Configure integration with Axidian AirCard

...

Enterprise virtual smart card

...

server.

Agent: Configure Axidian CertiFlow Agent.

Users

...

catalog

  • Active Directory

...

  • Tracked attributes

Information about users catalog and user attributes . 

The list of tracked user attributes in Microsoft CA certificate templates settings includes the following attributes by default:

  • Common name
  • E-mail
  • User principal name
Warning
You can track changes in user attributes only in Subject and Subject Alternative Name fields of the certificate.


Access control

  • Role administrator

...

Defining access settings to system services.

Specify an account to configure user

...

privileges in Roles of Axidian CertiFlow Management Console. 

Warning

The specified account must have a User Principal Name (UPN) and belong to the specified users directory.


Database

...

  • Microsoft SQL
  • PostgreSQL
  • Encryption key

...

Information about the system's data storage and encryption algorithm.

...

Creating an encryption key

...

, a backup copy or a key recovery

...

from backup.

...

Storage connection settings depend on selected storage type.

Card Monitor service

...

Card Monitor service

...

controls smart card usage.

...

Operations:

...

    • Revoking expired temporary cards

...

    • Deactivating cards

...

    • and revoking certificates for users with disabled Active Directory accounts (optional)
    • Deleting disabled Active Directory accounts from Axidian CertiFlow users catalog (optional)
    • Revoking and withdrawing cards for deleted users (optional)
    • Setting/resetting a

...

    • card content status (about to expire/expired)

...

Info

If the device was updated through the Agent Indeed CM without automatic approval of certificates by the CA operator.

    • Sending of the following email notifications to the system administrators and users:
      – Expiration of user certificates stored on user card
      – Card issuance approval/rejection
      – Approval or rejection of renewal for certificates on card
      – Card replacement approval/rejection
      – Change of policy applied to user

    • Updating card contents (available if a card is updated through Axidian CertiFlow Agent and the CA operator does not approve certificates automatically)
    • Registering There is no connection from the agent for a long time event in the system log
    • Removing inactive agents (you can set the time when an agent is considered inactive)
    • Sending email notifications to system administrators and users about the following events:
      • Expiring user certificates
      • Approve/reject to issue a card
      • Approve/reject to renew a certificate
      • Approve/reject to replace a card
      • Modifying a system policy applied to a user
      • Changing user attributes in users catalog 
Warning

For the Card Monitor service to run regularly, the account specified in Configuration Wizard must be part of Administrators group on the CertiFlow server and have permission to Log on as a batch job.

For Card Monitor service to work properly, create a service role with an account for Card Monitor in Roles section and define the following privileges for the role:

  • Disabling a card
  • Updating a card
  • Canceling a card update
  • Revoking a card
  • Cleaning a card
  • Unassigning a card
  • Removing a card
  • Removing AirCard

  • Removing an agent
  • Removing a record from custom log

    Note

    Set privileges to work with virtual smart cards, if AirCard integration is configured.


Confirmation

Summary of all Configuration Wizard settings.

After you click Apply, the specified values for all settings will be saved in configuration files for all applications and stored in the C:\inetpub\wwwroot\cm\wizard\configs folder.

Results

Information about saving the specified values to the service configuration files.

You can upload the configuration files to an archive (Save configuration files option) to transfer and apply the settings to the system server.

When installing Axidian CertiFlow for the first time, save a copy of your configuration settings (Backup current configuration settings option).

To deploy new system servers, upload the backup file in Restore configuration section of the wizard. 

Warning

Configuration backup file includes all settings, as well as the database encryption algorithm and encryption key, and all service accounts data. Keep the backup file in a secure place.


Applying configuration files to the CertiFlow server

Apply the configuration files to the CertiFlow server:

  1. Run PowerShell as administrator and go to C:\inetpub\wwwroot\cm\wizard\configs.
  2. Run the PowerShell script deploy_configuration.ps1

    .\deploy_configuration.ps1


  3. Specify the password of the account that is used to launch the Card Monitor service.
Tip

We recommend that you specify a local account that is used to launch the rest of the CertiFlow web applications.



Divbox

Table of Contents

...

This contains combined information on settings of all Wizard sections, as well as an opportunity to create a backup copy of Indeed CM configuration.

...

This displays the Wizard progress in writing the defined values to configuration files of Indeed CM services.

For the Card Monitor service to work correctly, create a service role (say, Card Monitor service) in Roles section (see the Indeed CM Operation Manual), include an account in it, on behalf of which Card Monitor will work with and define the flowing privileges for named role:

  • Updating card
  • Disabling card
  • Revoking card
  • Unassigning card
  • Cleaning card
Warning

To perform tasks for the regular launch of the Card Monitor service, the account specified in the setup wizard must have permissions to Log on locally to the Indeed
CM server, or permission to Log on as a batch job.

When installed Indeed CM Server for the first time, set up the required parameters and make a backup copy of those (option Backup current configuration settings in the Confirmation section).

The backup copy of Indeed CM settings contains all the parameters defined for all services during installation, as well as encryption key and algorithm. To use the backup to deploy new Indeed CM servers, specify it in the Restore configuration section of Setup Wizard.

Warning

The backup also contains the data of service accounts (the one for user directory and for data storage), encryption key and algorithm. Be sure to store the backup copy file in a safe place.

...