About Windows Integrated Security

strongly recommends using the secure protocol https instead of http within the platform to ensure data security and integrity about authentication methods in ivanti neurons for itsm docid\ mjytng xzmzot0dszrh4econfiguring ivanti neurons for itsm and windows integrated security docid\ mjytng xzmzot0dszrh4econfiguring ivanti neurons for itsm and windows integrated security for external authentication docid\ mjytng xzmzot0dszrh4evalidating incoming authentication requests docid\ mjytng xzmzot0dszrh4econfiguring windows integrated security for auto provisioning docid\ mjytng xzmzot0dszrh4econfiguring windows integrated security provider to sign its response with a certificate docid\ mjytng xzmzot0dszrh4econfiguring the server to use windows integrated security docid\ mjytng xzmzot0dszrh4esetting the default authentication provider docid\ mjytng xzmzot0dszrh4econfiguring windows integrated security to work in debug mode docid\ mjytng xzmzot0dszrh4eabout disabling windows integrated security docid\ mjytng xzmzot0dszrh4eabout the encrypted config sections in the web config file docid\ mjytng xzmzot0dszrh4econfiguring your browser to use windows integrated security docid\ mjytng xzmzot0dszrh4e about authentication methods in ivanti neurons for itsm there are two ways to authenticate users in windows integrated security uses windows credentials this option is only available for the on premise version of the user's computer must be a member of the windows domain direct ad authentication uses the identity provider of the customer this option is available for the on premise and cloud versions of users must log in each time, although they can save their credentials within their browser users can access authentication either by going directly to the identity provider (such as active directory, saml, or openid), or by logging into (which then redirects the user to the identity provider) the identity provider authenticates the user but does not share credentials the identity provider session is separate from the session, and must be configured separately the identity provider is configured separately and according to the specific identify provider process the following illustrates how active directory authentication works active directory authentication configuring ivanti neurons for itsm and windows integrated security this topic describes how to configure active directory authentication using windows integrated security (wis) this feature allows users to access without entering their user name and password this procedure is only valid for the on premise version of log in to the configuration database (configdb) and open the tenants workspace the application displays a list of the available tenants refer to the configuration database guide for for information about using the configdb open the tenant workspace for the tenant to use in the login url field, enter the url where users go to log in click save in a separate browser window or tab, log into click configure application to go to the configuration console click configure > security controls > authentication providers to open the authentication providers workspace from the new record menu drop down list, select new windows integrated enter information into the fields new windows integrated page field description default specifies if this authentication provider is called automatically set by the application you change this in the list to make this authentication provider the default, you must first change the default setting for all other authentication providers to false and then change the default setting for this authentication provider to true disabled specifies if this authentication provider is disabled name the provider name, such as wis identity server url the path to your identity server, such as /heat/wis logout url the url to which users are directed when logging out of the authentication provider sort order specifies the sort order of this provider in relation to other providers assigned to a user a value of 1 means that this provider is used first for authentication when logging in if a login failure occurs (such as a server failure or incorrect password), the application uses the next provider in the sort order the last successfully authenticated login is highlighted in the enable external auth area of the employee record use this field only if multiple authentication providers are configured certificate of customer's windows integrated server (public certificates only) only applies to public certificates click browse to navigate to the certificate expiration date specifies the date that the certificate expires this field merely stores the date so that you can see when the current one expires and get another certificate before or when it expires auto provisioning adds new users via authentication you have the option to auto provision the role, status, and team for the new user if selected, the application creates an employee record if a user logs in using authentication and does not already have an employee record auto provision role only displays if you check auto provisioning the role associated with the new user auto provision status only displays if you check auto provisioning the status of the new user auto provision team only displays if you check auto provisioning the team associated with the new user auto provision user business object only displays if you check auto provisioning the type of user record to create can be either employee or external contact set the new authentication provider as the default by highlighting it and clicking set default log into the service desk console open the employee workspace, then open an employee record modify an existing employee by enabling external auth and specifying login for external auth as the newly created windows integrated authentication provider check enable external auth and click add new enter the name of your windows integrated authentication provider click save log out the login page appears with sign in with wis sign in with windows integrated security next to login for external auth , click add new the application displays the new external login dialog box if the dialog box does not appear, then windows authentication is disabled for windows integrated security click sign in with wis the application displays the windows sign in dialog box enter your user name and password, then click ok the application authenticates the user using windows integrated security if auto provisioning is enabled in the new authentication provider, you can skip steps 12 14 creates a new employee with external authentication enabled and the login for external authentication is specified as the windows integrated authentication provider configuring ivanti neurons for itsm and windows integrated security for external authentication to set up users for authentication via the , refer to setting up itsm users for authentication via the neurons platform docid\ wnkkhhscs2a4b5njr5ng4 and authentication https //help ivanti com/ht/help/en us/cloud/vnow/authentication htm this feature is early access only and may not be available in your environment for more information, please contact your customer success manager the lifecycle for external authentication using a windows integrated security provider is as follows windows integrated security receives an authentication saml request from windows integrated security validates the request and checks the certificates windows integrated security creates the saml response windows integrated security signs the saml response with the certificate specified in the web config file windows integrated security enables auto provisioning in the saml response using ldap configuration from the web config file windows integrated security posts the saml response back to you can configure windows integrated security in the web config file you can specify whether an external authentication request from should be validated and its certificate checked to skip the authentication request validation, do not specify the heatcertificatepath application setting in the web config file validating incoming authentication requests the tenant may be marked with an adfs private certificate to check or specify it, do the following a log in to the configdb and open the tenants workspace the application displays a list of available tenants see the configuration database guide for for information about using the configdb b open the tenant workspace for that tenant c click add certificate to add the adfs private certificate for this tenant d browse to the certificate, highlight it, and click open e enter the password for the certificate f specify the adfs private certificate and its password for each corresponding tenant set the adfs certificate for each tenant open the web config file with a text editor (such as notepad), and set the heatcertificatepath setting to a path relative to the public certificate this is used on the windows integrated security side for validating requests \<configuration> \<appsettings> \<add key="heatcertificatepath" value="certificate\heatcertificate cer" /> \</appsettings> \</configuration> if the heatcertificatepath setting is specified incorrectly or if there is no such directory or file, the application throws an unhandled exception during the validation process for example \<add key="heatcertificatepath" value="certificate\heatcertificate cer incorrect name" /> produces server error example if you do not see an error message, the validation of the external authentication succeeded configuring windows integrated security for auto provisioning the windows integrated security web config file may contain the ldap server and active directory ldap queries used for retrieving data needed for auto provisioning first name last name email loginid after windows integrated security performs the ldap search with parameters given in the web config file \<configuration> \<configsections> \<section name="ldapconfiguration" type="system configuration namevaluesectionhandler, system, version=4 0 0 0, culture=neutral, publickeytoken=b77a5c561934e089" requirepermission="false" /> \</configsections> \<ldapconfiguration> \<add key="server" value="someserver boo yah" /> \<add key="username" value="someserverusername" /> \<add key="password" value="internalpassword" /> \<add key="rootnode" value="ou=personnel,dc=someserver,dc=boo,dc=yah" /> \<add key="filter" value="(\&amp;(objectclass=person)(samaccountname= ))" /> \</ldapconfiguration> \<configuration> all ldapconfiguration parameters are required ldapconfiguration should contain the server , username and password parameters for an ldap connection also, it should contain the rootnode and filter parameters for ldap search if you do not specify an option, the ldap connection or search fails and auto provisioning does not work for the windows integrated security authentication provider as a result, cloud cannot create a new employee on external authentication the ldapconfiguration parameter is a custom configuration section, so it should be added to the configsections collection configuring windows integrated security provider to sign its response with a certificate the authentication provider may be marked with a public certificate refer to configuring ivanti neurons for itsm and windows integrated security docid\ mjytng xzmzot0dszrh4e this reduces the ability of external sites to send the authentication requests to and successfully authenticate it also means that only requests signed with the corresponding private certificate result in a successful authentication you can configure the windows integrated security provider with a private certificate, by doing the following open the web config configuration file for the windows integrated security site specify the wiscertificatepath application setting and name of the private certificate specify the wiscertificatepassword secure application setting for the certificate password for example \<configuration> \<configsections> \<section name="secureappsettings" type="system configuration namevaluesectionhandler, system, version=4 0 0 0, culture=neutral, publickeytoken=b77a5c561934e089" requirepermission="false" /> \</configsections> \<appsettings> \<add key="wiscertificatepath" value="certificate\wiscertificate pfx" /> \</appsettings> \<secureappsettings> \<add key="wiscertificatepassword" value="heatsoftware1" /> \</secureappsettings> \</configuration> specify the wiscertificatepassword parameter in the secureappsettings custom configuration section it contains the password for the private certificate so that it can be encrypted to reduce the possibility of a password leak the secureappsettings parameter is a custom configuration section that you should addto the configsections collection in the web config file as shown in the example above if the authentication provider is marked with a public certificate and the windows integrated security site is not configured with a private certificate, the following occur and the external authentication fails the private certificate password wiscertificatepassword is not specified in the web config file the private certificate password is incorrect the private certificate name wiscertificatepath is not specified in the web config file the private certificate name is specified incorrectly failed external authentication at same time, if the authentication provider is not marked with a public certificate and windows integrated security configured with the private certificate, then the external authentication succeeds and the user is redirected to the default page configuring the server to use windows integrated security by default, the windows server and the local server of the windows operating system are not configured to use windows integrated security therefore, you cannot use windows integrated security to perform windows authentication for external authentication enabling windows integrated security on the microsoft iis web server docid\ mjytng xzmzot0dszrh4eenabling windows integrated security on the windows server microsoft iis web server docid\ mjytng xzmzot0dszrh4eenabling the server for windows integrated security docid\ mjytng xzmzot0dszrh4etesting the server configuration docid\ mjytng xzmzot0dszrh4e enabling windows integrated security on the microsoft iis web server to enable windows integrated security on the microsoft iis web server, do the following within windows, go to control panel > programs > turn windows features on or off turn window features on or off the application displays a list of features expand internet information services, then go to world wide web services > security , then check windows authentication windows integrated security web click ok , then close the window enabling windows integrated security on the windows server microsoft iis web server to enable windows authentication on the windows server microsoft iis web server, do the following within windows, right click computer , then choose manage the application opens the server manager expand roles , right click web server (iis) , then choose add role services the application opens the add role services window expand security , select windows authentication , then click install windows integrated security server enabling the server for windows integrated security after windows authentication is enabled on the server, enable it for windows integrated security in the windows search box, enter inetmgr the application opens the iis manager window go to machinename > sites > default web site > heat > wis in features view, select authentication right click windows authentication , then choose enable disable all other authentication types enabling windows integrated security testing the server configuration to test, log into with external authentication using the windows integrated security authentication provider if windows integrated security was installed correctly, the application displays the default window successful windows integrated security installation setting the default authentication provider designate an authentication provider as the default to ensure that users access the correct configuration you can only designate one provider as the default from the configuration console, click configure > security controls > authentication providers to open the authentication providers workspace select the provider to make the default click set default from the toolbar configuring windows integrated security to work in debug mode about configuring windows integrated security to work in debug mode docid\ mjytng xzmzot0dszrh4eenabling debug mode for windows integrated security docid\ mjytng xzmzot0dszrh4eabout the saml request validation error message docid\ mjytng xzmzot0dszrh4eabout the ldap configuration error message docid\ mjytng xzmzot0dszrh4eabout the saml response signature docid\ mjytng xzmzot0dszrh4e about configuring windows integrated security to work in debug mode using windows integrated security in debug mode shows you all configurations used in windows integrated security, and errors that occurred during validation of a saml request or construction of a saml response you can easily determine the cause of failed external authentication using this method windows integrated security in debug mode shows the following information request validation information saml request in xml format ldap server information auto provisioning block, ldap search result parameters and attributes saml response certificate saml response in xml format enabling debug mode for windows integrated security to enable debug mode for windows integrated security authentication provider, do the following from the configuration console, click configure > security controls > authentication providers to open the authentication providers workspace open the windows integrated security authentication provider record refer to working with adfs/saml docid\ m7 6vn8mfoe0h9e8bu a3 add a debug parameter to the identity server url for example, the url might be /heat/wis/default aspx?debug=true click save log out log in using windows integrated security authentication provider, using the windows user name and password the application displays the windows integrated security debug mode page windows integrated security debug mode page the following links appear on this page more hides and shows the saml request or saml response private certificate used for the signature of the saml response this downloads the corresponding public certificate post posts the saml response to to the corresponding assertionconsumerhandler about the saml request validation error message if the authentication request validation fails, the application disables the post button and you cannot perform external authentication with the windows integrated security provider an error message appears saml authentication request error message about the ldap configuration error message if you do not specify the ldapconfiguration parameter in the web config file, auto provisioning does not work for the windows integrated security provider and the application displays an error message in the debug log for detailed information, refer to configuring windows integrated security for auto provisioning docid\ mjytng xzmzot0dszrh4e users can still log in externally without auto provisioning and post saml responses to ldap authentication request error message about the saml response signature if you configure windows integrated security in the web config file to sign the saml response with the private certificate and you specify the wrong certificate password, the application displays an error message in the debug log the application still creates a saml response, but it does not have a signature posting this saml response back to fails saml response failed authentication about disabling windows integrated security if you do not configure microsoft iis to perform windows integrated security or if you do not enable windows authentication for windows integrated security, external authentication with the windows integrated security provider fails windows integrated security fails about the encrypted config sections in the web config file the web config file of the windows integrated security application may contain passwords for the following ldap server configuration private certificate password to reduce the possibility of a password leak at the servers where windows integrated securityis deployed, some config sections in web config may be encrypted for detailed information, refer to http //msdn microsoft com/en us/library/zhhddkxy(v=vs 100) aspx http //msdn microsoft com/en us/library/zhhddkxy(v=vs 100) aspx encryptwebconfig bat uses rsaprotectedconfigurationprovider for encryption so once the web config section is encrypted at one computer or server, it cannot be used in another server the windows integrated security application throws an unhandled exception in this case configuring your browser to use windows integrated security windows integrated security works differently depending on the browser that you use mozilla firefox asks you to log in each time that you access the site, while microsoft internet explorer and google chrome browsers only ask you to log in the first time microsoft internet explorer docid\ mjytng xzmzot0dszrh4egoogle chrome docid\ mjytng xzmzot0dszrh4emozilla firefox docid\ mjytng xzmzot0dszrh4e microsoft internet explorer do one of the following if the windows integrated security site is not located on a local microsoft iis web server, you must add it to the list of trusted sites go to tools > internet options > security > trusted sites > sites and add the site if the windows integrated security site is located on a local microsoft iis web server, you do not need to make changes in the security options, since local intranet sites use the automatic logon in intranet zone option by default google chrome google chrome takes its trusted site settings from the same internet options as microsoft internet explorer open google chrome go to settings > show advanced settings > change proxy settings > security > trusted sites > sites click show advanced settings click change proxy settings the application displays the internet properties dialog box click the security tab click trusted sites click sites add the site click close and then click apply the application now asks you to log in the first time that you access the trusted site mozilla firefox there are two methods that you can use configuration method docid\ mjytng xzmzot0dszrh4eextension method docid\ mjytng xzmzot0dszrh4e configuration method mozilla firefox provides a configuration string that you can modify to enable this functionality open a new tab in firefox in the address bar, enter about\ config firefox displays a message that this is not recommended click i'll be careful, i promise! the configuration page loads in the search box, enter network automatic double click the row that contains network automatic ntlm auth trusted uris the application opens the enter string value dialog box enter http //your intranet server name or http //www your site com you can add multiple sites separated by commas, such as https //your intranet server name, https //www your site com to specify all subdomains, enter your site com instead of www your site com click ok extension method you can use the mozilla firefox extension instead of configuring the about\ config file when you need to work with a site with nt lan manager (ntlm) authentication this extension is called integrated authentication for firefox install the extension by doing the following in firefox, search for integrated authentication for firefox the application displays the results and the first one should be the extension click add to firefox click install restart firefox the application displays a new option that lets you add or remove entries as with the configuration method, only enter the http // prefix and host name of the server there is no trailing slash nor a path to any particular page the application enables authentication on a per site basis