Setting up Windows Integrated Authentication for the web console

You can use Windows authentication when your IIS server runs on a corporate network that is using Microsoft Active Directory service domain identities or other Windows accounts to identify users.

  • The Windows server that Trust Protection Platform is installed on and hosts the Web Console needs to be a member of the Active Directory Forest that you want to support for Windows Integrated Authentication.
  • Windows Authentication must be installed as a role service of the web server role on the Windows machine.
  1. In Windows, click Start, and then click Administrative Tools, and then click Server Manager.
  2. In Server Manager, click the Manage menu, and then click Add Roles and Features.
  3. In the Add Roles and Features wizard, click Next.
  4. Select the installation type and click Next.
  5. Select the destination server and click Next.

  6. On the Server Roles page, expand Web Server (IIS), expand Web Server, expand Security, and then select Windows Authentication.

  7. Click Next.
  8. On the Select features page, click Next.
  9. On the Confirm installation selections page, click Install.
  10. On the Results page, click Close.
  1. Open the Internet Information Services (IIS) Manager.
  2. In the Connections pane, navigate to the Venafi server.
  3. Select the console you want to configure (VEDAdmin, VEDAuth, or Aperture)

  4. Under Management, click Configuration Editor.

  5. In the Configuration Editor Window, in the Section drop-down, make sure system.web/authentication is selected.

  6. In the Deepest Path group, Forms node, mode entry, use the drop-down to change the mode from None to Windows.

  7. Click Apply.
  8. Repeat until this process has been done for both VEDAdmin, VEDAuth, and Aperture.
  1. Open the Internet Information Services (IIS) Manager.
  2. In the Connections pane, navigate to the Venafi server.

  3. Under IIS, click Authentication.

  4. You will need to modify two sites: Venafi, and Aperture. For each of the highlighted sites:

    • Right click Anonymous Authentication and choose Disabled.
    • Right click Windows Authentication and choose Enabled.

     

    For example:

IMPORTANT  Be sure to restart IIS after setup.

NOTE  This step is not necessary if you are only configuring Venafi Platform to enable the MMC Snap-In Collection.

First, you need to configure your machine's internet options to allow it to use your username and password for integrated authentication.

  1. On the user's local Windows Control Panel, open Internet Options.

  2. Click the Security tab, then click Trusted sites, then click the Sites button.

  3. Enter the FQDN for your Trust Protection Platform server, then click Add. If you are using a load balancer, enter the FQDN to connect to the cluster, then click Add. For example:

    https://venafi-server.example.com

  4. Click Close.

    You'll return to the Security tab.

  5. Click Local intranet, then click the Custom Level... button.

  6. Scroll to the bottom of the Settings list.

  7. Under User Authentication > Logon, click Automatic logon with current user name and password, then click OK.

  8. Click OK on the confirmation window.

    You'll return to the Security tab.

  9. Click Trusted sites, then click the Custom Level... button.

  10. Scroll to the bottom of the Settings list.

  11. Under User Authentication > Logon, click Automatic logon with current user name and password, then click OK.

  12. Click OK on the confirmation window.

    You'll return to the Security tab.

  13. Click OK to save the configuration changes and close the Properties window.

Now configure your web browser for automatic login.

  1. For Edge, Google Chrome (and other Chromium browsers), see https://sites.google.com/a/chromium.org/dev/developers/design-documents/http-authentication.
  2. For Firefox, see https://support.mozilla.org/en-US/kb/Firefox.