Setting up End Users

Providing support for remote or travelling users will likely occasionally be required, although i-Planet's design and browser-based interface will keep your support requirements to a minimum. Setting up end users involves both the technical setup process and providing your users with the information they need to access the system remotely.

To Set Up an End User

1. Verify that the user is correctly set up and fully functional on your local network.

2. Verify that each end user has a UNIX password.

   End users must have a UNIX password so that they can use i-Planet.

3. Add S/Keys for the end user or activate any other authentication module you chose to use.

   At this point, the end user is technically set up and ready to go. Before the end user can access the system and use it effectively, you must provide several key pieces of information:

   1. Fully qualified URL for the i-Planet system. For example, this will look something like:

      https://i-Planet.acmecorp.com/

   2. If your end users are new to remote access to your corporate system, you will likely need to remind them that the protocol is https, not http.

   3. You will likely have to tell them that they must provide a fully qualified domain name--that is, xyz.acmecorp.com, not just xyz, as they can likely do from within the local network. You can use available redirection technology.

End users can generate their own set of passwords so that they can use the S/Key authentication module before they become remote. They can only use this procedure over the intranet.

For End Users to Generate Passwords

End users can use this procedure to generate their own S/Key passwords over the intranet before they become remote.

1. They start the web browser that they want to use.

2. They type the following as the URL in the browser:

   http://i-Planet_server:8080/cgi-bin/skey/skeylogin.cgi

   8080 is the (default) port for the i-Planet server.

If SSL is being used between the i-Planet server and the i-Planet gateway, they must type the following as the URL in the browser:

https://i-Planet_server/cgi-bin/skey/skeylogin.cgi

Once remotely logged into the i-Planet Desktop, end users can generate more one-time passwords by clicking the Generate SKEYs link on the i-Planet Desktop.

If an end user uses the last password and logs out before generating a new list of passwords. then a new list for that user can only be generated using one of the other two methods. Generating more S/Key passwords supersedes the previously generated list. Also, their UUID will change.

Reinstalling the i-Planet software will delete all S/Key user password information.

Access information. The remote end user access information could be:

• Secure Computing's SafeWord token

• Security Dynamics' SecurID token

• RADIUS login and password

• S/Key list of passwords, unique userid, and PIN

• Other authentication tools that you have configured for your users

Connectivity requirements--End users must have full TCP/IP connectivity, either through their own ISPs, through a corporate dialup modem pool, or through some other means (Kinko's, hotels, or any other TCP/IP hookup). Your remote end users will not be able to access your i-Planet installation through non-TCP/IP networks.

Browser requirements--End users must access i-Planet through Internet Explorer 4.0 or higher, Netscape Navigator 4.04 or higher with equivalent SSL, JavaScript, and Java support. Your end users can check their browser versions by choosing Help|About in any browser and reading the version number in the resulting dialog box. Netscape browsers must be set to accept all cookies on the Edit|Preference|Advanced window.

Netscape 4.04 and 4.05 require AWT 1.1 support provided by the JDK 1.1 patch available from Netscape. All versions of Netscape 4.06 and later include the patch.

If end users look at sensitive or classified documents through Internet Explorer, they must be sure to exit the browser when they have finished. Copies of all files that they have looked at are stored on the computer that they are using until they close all Internet Explorer windows.

Information specific to your i-Planet installation--Provide any special information that the end user will require, if you have added new applications to your i-Planet installation, or if your end users must use specific software in a particular way to gain access to the information they need, or if there are other special settings.

This is the only information your remote end users should require to access and use your i-Planet installation and to be able to work productively.