View source for UniToken Integration Guide Windows 2008 Server Smart Card Configuration

[[Category:UniToken Integration Guide]]

== Network Configuration ==

From the Start Menu, and click on [Server Manager].

[[Image:tokensmart img01.jpg|370px]]

Click on [View Network Connections]on the right-hand side of the window under "Server Summary", "Computer Information".

[[Image:tokensmart img02.jpg|370px]]

Right-click on the connection interface used between clients and the server and select [Properties].

[[Image:tokensmart img03.jpg|370px]]

In the properties window of the connection, highlight [Internet Protocol (TCP/IPv4)] and click on [Properties] below.

[[Image:tokensmart img04.jpg|370px]]

In the "Internet Protocol Version 4 (TCP/IPv4) Properties" window, select [Use the following IP address] and input a static IP address, subnet mask and default gateway for your server.

Select [Use the following DNS server addresses] and input the same IP address as your static IP address. This server will be used as the main DNS server.

Click on [OK] on all windows to finish.

[[Image:tokensmart img05.jpg|370px]]

== Active Directory Installation ==

From the Start Menu, click [Run...] or in the search box from the Start Menu, type "dcpromo", without quotation marks, and press [Enter].

[[Image:tokensmart img06.jpg|370px]]

Wait while the binaries for Active Directory Services are being installed.

[[Image:tokensmart img07.jpg|370px]]

On the "Active Directory Domain Services Installation Wizard" welcome screen, click on [Next].

[[Image:tokensmart img08.jpg|370px]]

On "Operating System Compatibility" step, click on [next].

[[Image:tokensmart img09.jpg|370px]]

On the "Choose a Deployment Configuration" step, verify that [Create a new domain in a new forest] is selected and click [Next].

[[Image:tokensmart img10.jpg|370px]]

On the "Name the Forest Root Domain" step, input a name for the domain and click on [Next].

[[Image:tokensmart img11.jpg|370px]]

On the "Set Forest Functional Level" step, keep the default settings and click on [Next].

[[Image:tokensmart img12.jpg|370px]]

On the following "Set Forest Functional Level" step, keep the default settings and click on [Next].

[[Image:tokensmart img13.jpg|370px]]

In the screen [Additional Domain Controller Options], check the option [DNS Server] and click on [Next]

[[Image:tokensmart img14.jpg|370px]]

In the dialog box "Active Directory Domain Services Installation Wizard", click on [Yes] when asked "Do you want to continue?" to continue.

Please note, in this tutorial, we are assuming the preferred DNS on the local network is our server and that DNS information is distributed to clients by the DHCP service installed on this server.

[[Image:tokensmart img15.jpg|370px]]

On the "Location for Database, Log Files, and SYSVOL" step, click on [Next].

[[Image:tokensmart img16.jpg|370px]]

On the "Directory Service Restore Mode Administrator Password" ste[, set the password for the administrator of restore mode and click on [Next].

[[Image:tokensmart img17.jpg|370px]]

In the "Summary" screen , verify the settings up to now are correct, then click [Next] to continue.

[[Image:tokensmart img18.jpg|370px]]

Wait until the configuration of Active Directory is completed.

[[Image:tokensmart img19.jpg|370px]]

Click [Finish] to close the wizard.

[[Image:tokensmart img20.jpg|370px]]

== Certification Authority Installation ==

From the Start Menu, click on [Server Manager].

[[Image:tokensmart img21.jpg|370px]]

From the left-hand side pane, click on [Roles].

[[Image:tokensmart img22.jpg|200px]]

In the right-hand side of the window, click on [Add Roles].

[[Image:tokensmart img23.jpg|370px]]

Click [Next] on the screen [Before You Begin] to begin.

[[Image:tokensmart img24.jpg|370px]]

On the "Select Server Roles" step, select [Active Directory Certificate Services], then click [Next].

[[Image:tokensmart img25.jpg|370px]]

On the "Introduction to Active Directory Certificates Services" page, click on [Next]

[[Image:tokensmart img26.jpg|370px]]

On the "Select Role Services" page, check [Certification Authority] and [Certification Authority Web Enrollment], then click [Next].

[[Image:tokensmart img27.jpg|370px]]

In the "Add Roles Wizard" dialog box, click on [Add Required Role Services].

[[Image:tokensmart img28.jpg|370px]]

Make sure that [Certification Authority Web Enrollment] and click on [Next].

[[Image:tokensmart img29.jpg|370px]]

On the "Specify Setup Type" page, select [Enterprise], then click [Next].

[[Image:tokensmart img30.jpg|370px]]

On the "Specify CA Type" page, select [Root CA], and click [Next].

[[Image:tokensmart img31.jpg|370px]]

On the "Set Up Private Key" page, click [Next].

[[Image:tokensmart img32.jpg|370px]]

On the "Configure Cryptography for CA" page, click [Next].

[[Image:tokensmart img33.jpg|370px]]

On the "Configure CA Name" page, accept the proposed CA Name or otherwise input a new CA name. Click on [Next].

[[Image:tokensmart img34.jpg|370px]]

On the "Set Validity Period" page, click on [Next].

[[Image:tokensmart img35.jpg|370px]]

On the "Configure Certificate Database" page, click on [Next].

[[Image:tokensmart img36.jpg|370px]]

On the "Web Server(IIS)" page, click on [Next]

[[Image:tokensmart img37.jpg|370px]]

On the "Select Role Services", verify that the required services have been selected and click on [Next].

[[Image:tokensmart img38.jpg|370px]]

On the "Confirm Installation Selections" page, verify installation information is correct, then click on [Install] to begin the installation.

[[Image:tokensmart img39.jpg|370px]]

On the "Installation Results" page, verify that the installation has been completed successfully, then click on [Close] to complete.

[[Image:tokensmart img40.jpg|370px]]

== Secure Access to Certsrv with SSL ==

From the Start Menu, click [Administrative Tools], [Internet Information Services (IIS) Manager].

[[Image:tokensmart img41.jpg|370px]]

In the left pane, select the corresponding server under "Connection", then in the main window double-click on [Server Certificates].

[[Image:tokensmart img42.jpg|370px]]

On the [Server Certificates] page, from the "Actions" menu on the right, click on [Create Self-Signed Certificate...].

[[Image:tokensmart img43.jpg|370px]]

In the "Create Self-Signed Certificate" window, on the "Specify Friendly Name" step, enter a name for the certificate and click on [OK].

[[Image:tokensmart img44.jpg|370px]]

In the left pane, under "Sites", right-click on [Default Web Site] and click [Edit Bindings...].

[[Image:tokensmart img45.jpg|370px]]

On the [Site Bindings] window, click [Add].

[[Image:tokensmart img46.jpg|370px]]

Modify the following settings:

* Type: https
* IP address: All Unassigned
* Port: 443
* Certificate: (the certificate created earlier)

Click [OK].

[[Image:tokensmart img47.jpg|370px]]

Click on [CertSrv] within [Default Web Site] from the left pane. Double-click on [SSL settings].

[[Image:tokensmart img48.jpg|370px]]

On the "SSL Settings" page, check [Require SSL] and [Require 128-bit SSL]. Under "Client certificates", select [Ignore] and click on [Apply] to save changes.

[[Image:tokensmart img49.jpg|370px]]

== Create Users in Active Directory ==

From the Start Menu, click [Administrative tools], [Active directory Users and Computers].

[[Image:tokensmart img50.jpg|370px]]

From the tree list on the left under the "Active Directory Users and Computers" window, right click on [(Domain)], [Users], then from the popup menu [New], [User].

[[Image:tokensmart img51.jpg|370px]]

Complete the form on the new user and click [Next].

[[Image:tokensmart img52.jpg|370px]]

Fill in the [Password] and [Confirm password] fields. Choose the corresponding options as needed and click on [Next].

[[Image:tokensmart img53.jpg|370px]]

Verify information about the new user is correct and click [Finish] to close the window.

[[Image:tokensmart img54.jpg|370px]]

== Set Access Rights for Certificate Templates ==

From the Start Menu, click [Run...] or in the search box from the Start Menu, type "certtmpl", without quotation marks, and press [Enter].

[[Image:tokensmart img55.jpg|370px]]

In the "Certificate Templates Console" window, right-click [Smartcard User] from the list on the right and click [Properties].

[[Image:tokensmart img56.jpg|370px]]

Under the [Security] tab, click on [Add] to add a new user to the list.

[[Image:tokensmart img57.jpg|370px]]

Select the user previously created (UniTokenPRO in this example) and click [OK] to apply.

[[Image:tokensmart img58.jpg|370px]]

Back on the [Security] tab, select the newly added user and check [Read] and [Enroll] for the user's permissions. Click on [OK] to finish.

[[Image:tokensmart img59.jpg|370px]]

From the Start Menu, click on [Administrative Tools], [Certification Authority].

[[Image:tokensmart img60.jpg|370px]]

On the "Certification Authority" window, right-click on [Certificate Template], and select [New], [Certificate Template to Issue].

[[Image:tokensmart img61.jpg|370px]]

Under the "Enable Certificate Templates" window, select [Smartcard User] and click [OK] to finish.

[[Image:tokensmart img62.jpg|370px]]