Configuring Support for VMware True SSO

Configuring Kerberos authentication requires access to the following:

• Domain administrator access to an endpoint computer on which the Imprivata agent is installed.
• The Imprivata Appliance Console.
• The Imprivata Admin Console.

Configuring Network Protocol Time (NTP) servers makes sure that the Kerberos ticket does not expire before the appliance can extract the user identity from the Kerberos ticket.

Complete the following for each appliance in the enterprise to enable time synchronization.

1. In the Imprivata Appliance Console, go to Network > NTP.

2. Enter the IP address for one or more NTP servers.

3. Click Save.

The endpoint computer from which you run the keytab utility and the primary appliance to which the Imprivata agent communicates must be in the same Active Directory domain.

For example, if the fully qualified domain name (FQDN) of the endpoint computer is endpoint.example.com, then the Imprivata appliance FQDN could be server_name.example.com.

1. Log into the endpoint computer.
2. Open the registry editor and go to the ISXAgent registry key:

   • 64–bit — HKLM\SOFTWARE\SSOProvider\ISXAgent

3. Use the IPTXPrimServer value to confirm that the agent's primary appliance is in the same Active Directory domain as the endpoint computer.

Creating and uploading a keytab file establishes a Kerberos trust relationship between Imprivata OneSign and Microsoft Active Directory. You use the Imprivata key tab utility, which is installed with the Imprivata agent, to create and upload a keytab file. After the keytab file is uploaded to the appliance, it is propagated to all other appliances in the enterprise.

1. As a domain administrator, log into an endpoint computer to which the Imprivata agent is installed and open a command prompt.

2. At the command prompt, type:

   • 64–bit — cd \Program Files (x86)\Imprivata\OneSign Agent and press Enter.

3. Type ISXKerbUtil.exe and press Enter. The utility returns the names of domain, domain controller, and the appliance host name in the Service Principal Name (SPN) format.

4. Type the username of the Domain account that has Super Administrator rights in the Admin Console, using the User Principal Name (UPN) format and press Enter.

   Example: username@example.com

5. Enter the password of the Domain Account, with the Super Administrator rights you provided above, and press Enter.

6. Enter a password that meets the Active Directory complexity requirements and press Enter. The utility creates a domain user account named ssoKerberos, sets the password, and creates/uploads the keytab file to the appliance.

   NOTE: If the Imprivata keytab utility detects that a domain user account is already mapped to the SPN, it updates the domain account with the password you entered. If the utility detects that multiple domain user accounts are mapped to the SPN, the utility detects which user it previously created and updates it with the password you entered; the remaining users are removed from the SPN.

The Imprivata keytab utility creates the keytab file with all of the supported cryptographic types supported by Windows Server.

1. In the Imprivata Admin Console, go to the Users menu > Directories page.
2. Click the name of the domain from which you created the keytab file.
3. Go to Kerberos authentication and click 5 keytab files.
4. Verify that the Windows Server keys are using the following cryptographic types:
   • DES cbc mode with CRC-32
   • DES cbc mode with RSA-MD5
   • ArcFour with HMAC/md5
   • AES-256 CTS mode with 96-bit SHA-1 HMAC
   • AES-128 CTS mode with 96-bit SHA-1 HMAC

Identify the computers to which Kerberos authentication applies and configure a computer policy. Configuring the computer policy enables the computers in the policy for Kerberos authentication.

Step 6a: Create a Computer Policy for Endpoint Computers

1. In the Imprivata Admin Console go to the Computers menu > Computer policies page.

   You can select an existing computer policy from the list, or make a copy of the Default Computer Policy as a starting point. If you want to edit an existing computer policy, click the existing computer policy name, and skip to Step 6b: Configure the Computer Policy for Endpoint Computers.

2. To copy the Default Computer Policy, select Default Computer Policy , then click Copy.

3. Click Default Computer Policy (2).

4. Rename the computer policy.

Step 6b: Configure the Computer Policy for Endpoint Computers

1. Click the General tab, go to the Authentication section, and select Accept Kerberos authentication in place of OneSign authentication.

2. Click Save.

Step 6c: Assign the Computer Policy to Endpoint Computers

Manually Assigning the Computer Policy

To manually assign the computer policy:

1. Go to the Computers menu > Computers page.

2. Select the computers to which you want to apply the computer policy.

3. Select Change policy

4. Select Choose a policy and the name of the policy configured for Kerberos authentication.

5. Click Change Policy.

Automatically Assigning the Computer Policy

Use computer policy assignment rules to assign a computer policy to existing endpoint computers and to automatically assign the policy to endpoint computers added in the future.

1. Go to the Computers menu > Computer policy assignment page.

2. Click Add new rule.

3. Enter a Name for the assignment rule.

4. Select one of the following:

• Computer IP address, and then enter the range of IP addresses to include in the computer policy.

• Computer host name to match the computer policy to a specific computer.

• Imprivata agent type to apply the computer policy to all computers with a specific Imprivata agent.

Disabling (unregistering) the Imprivata OneSign module prevents Imprivata OneSign from authenticating users, ensuring that Kerberos authentication is enforced on the endpoint computer.

1. As a domain administrator, log into an endpoint computer that is enabled for Kerberos authentication and open a command prompt.
2. At the command prompt, type:
   • 64–bit — cd \Program Files (x86)\Imprivata\OneSign Agent\x64 and press Enter
3. Type:
   • 64–bit — regsvr32 /u ISXCredProv.dll and press Enter.
4. Type:
   • 64–bit — ISXCredProvDiag.exe /unwrapall and press Enter.
5. Close the command prompt window.

The Imprivata OneSign login module is disabled on the endpoint computer.

While the Imprivata OneSign login module remains disabled, enabling (registering) the Imprivata credential manager module ensures that Imprivata OneSign continues to manage application single sign–on after users change their password.

1. As a domain administrator, log into an endpoint computer that is enabled for Kerberos authentication and open a command prompt.
2. At the command prompt, type:
   • 64–bit — cd \Program Files (x86)\Imprivata\OneSign Agent\x64 and press Enter.
3. Type:
   • 64–bit — regsvr32 ISXCredMan.dll and press Enter.

1. In the Imprivata Admin Console, go to the Computers menu > Computer policies page.
2. You can select an existing computer policy from the list, or make a copy of the Default Computer Policy as a starting point. If you want to edit an existing computer policy, click the existing computer policy name, and configure the computer policy.
2. To copy the Default Computer Policy, select Default Computer Policy , then click Copy.
3. Click Default Computer Policy (2).
4. Rename the computer policy in the Name field.

1. Go to the General tab > Authentication section.
2. Select Accept Kerberos authentication in place of OneSign authentication.
3. Click Save.

Computer policy assignment rules let you assign a policy to existing virtual machines and make sure that the policy is automatically assigned to virtual machines that are added later.

To use a rule to assign the computer policy:

1. Go to the Computers menu > Computer policy assignment page.
2. Click Add new rule.
3. Name the rule and select the assignment criteria.
4. Select the policy you created and click Save.

1. In the Imprivata Admin Console, go to the Users menu > User policies page.
2. You can select an existing user policy from the list, or make a copy of the Default User Policy as a starting point. If you want to edit an existing user policy, click the existing user policy name, and configure the user policy.
2. To copy the Default User Policy, select Default User Policy , then click Copy.
3. Click Default User Policy (2).
4. Rename the user policy in the Policy Name field.

1. Go to the Authentication tab > Desktop Access authentication section.
2. Select Smart Card or USB token using Active Directory certificate.
3. Click Save.

1. Go to the Users menu > Users page.
2. Use Search for Users to locate the users to which you want to assign the policy.
3. Select the users from the search results.
4. Click Apply Policy. The Apply Policy dialog box opens.
5. Choose the policy from the drop-down list, and click OK.