System configuration

Configuration of internal parameters of Indeed CM web applications:

Management Console

• Display system summary

• Enable custom log

  The custom log is implemented only for system configuration using the Data Storage in Microsoft SQL and PostgreSQL.
• Own organizational structure
• Integration with Indeed Access Manager
• User's password reset in Active Directory
• Viewing card SO PIN

• Publishing certificates in the file storage

  Publishing certificates is not supported for mounted network drives. Set the path to the file storage in the format:

  \\Workstation name\Network directory name

Self-Service

• Viewing card content
• Create TPM Virtual Smart Card (VSC)
• Enrolling Windows Hello for Business (WHfB)
• Enable downloads

Event Log:

• Define the user attribute to search in the Event Log. Default value: CN (Common name)
• Configuration of connection to the Unified Event Log for several Indeed CM servers

Microsoft CA: Configure settings for working with Microsoft Certification Authority.

AirKey Enterprise: Configuring integration with Indeed AirKey Enterprise virtual smart card server.

Client Agent: Configuring Indeed CM Agent.

Definition of the system user catalog. 

Definition user attributes when changing which requires a certificate update.

The list of tracked user attributes in the settings of Microsoft CA certificate templates includes the following attributes by default:

• Common name
• E-mail
• User principal name

Definition an account to initially configure user privileges in the Roles section of Indeed CM Management Console.

The Card Monitor service is intended for control of smart card usage. The service performs:

• • Revocation of expired temporary cards
  • Deactivation (optional) of cards and revocation of certificates for the users whose Active Directory accounts have been disabled
  • Removing accounts (optional) from the Indeed CM user catalog whose Active Directory accounts have been disabled
  • Revocation and withdrawal (optional) of cards of users whose accounts have been removed from the Indeed CM user catalog
  • Setting/resetting a card content status (about to expire/expired)
  • Update of card contents

• • Event registration There is no connection from the agent for a long time in the system log

  • Sending of the following email notifications to the system administrators and users:
    – User certificate expiration
    – Card issuance approval/rejection
    – Approval or rejection of renewal for certificates
    – Approval or rejection of card replacement
    – Change of Indeed CM policy applying to user
    – Changing user attributes in the user directory 

    To perform tasks for the regular launch of the Card Monitor service, the account specified in the setup wizard must be in the Administrators group on the Indeed CM server and have permission to Log on as a batch job.

For the Card Monitor service to work correctly, create a service role (say, Card Monitor service) in Roles section, include an account in it, on behalf of which Card Monitor will work with and define the flowing privileges for named role:

• Disabling card
• Updating card
• Revoking card
• Cleaning card
• Unassigning card
• Removing card

• Removing AirKey

• Removing record from custom log

  If integration with AirKey Enterprise is configured, then set privileges for working with these virtual smart cards.

This contains combined information on settings of all Wizard sections, as well as an opportunity to create a backup copy of Indeed CM configuration.

When installed Indeed CM Server for the first time, set up the required parameters and make a backup copy of those (option Backup current configuration settings in the Confirmation section).

The backup copy of Indeed CM settings contains all the parameters defined for all services during installation, as well as encryption key and algorithm. To use the backup to deploy new Indeed CM servers, specify it in the Restore configuration section of Setup Wizard.