Introduction and Features

Oracle Enterprise Single Sign-on Logon Manager (ESSO-LM) provides users with one password to log on to every application on both the company network and the Internet. It works "out-of-the-box" (without programming or additional network infrastructure) with virtually any Windows, Web, proprietary, and host-based application, lowering IT and Help Desk costs without the expense and burden of integration.

ESSO-LM is intelligent agent software that works by responding to logon requests on behalf of the user, directly from the desktop. The Agent responds to each software applications logon request by providing the correct credentials (that is, username/ID, password, and other fields) directly and automatically. A strong authentication mechanism controls access to the Agent, ensuring access by only the designated user.

Feature | Benefits
Single Sign-On | Provides one password to log on to networks, applications, and Web sites.
Authenticator Choice | Authenticate using a Windows logon or LDAP Directory Server logon. Authentication Manageraccepts strong authenticators for its primary authentication – including smart cards.)
Mobility Support | Users can log on from any workstation and use their ESSO-LM credentials via directory servers, database systems, file systems, and Windows Roaming Profiles. (Authentication Manager users can log on using smart cards.)
Workstation Sharing | Multiple users can share the same workstation.
Automated Password Change | Users can choose a new password or the Agent can select one automatically using approved password rules (Password Policies).
Strong Authentication | Soft token-based, two-factor authentication protects against unauthorized access.
Event Logging | Automatically log events such as logons, password changes, and so on.
Auto Prompt | Automatically prompts users to configure logons when they encounter a new password-protected application.
Credential Sharing | Multiple applications can share the same credentials.
Central Administration | All configurations and settings are centrally manageable via the ESSO-LM Administrative Console.
Automatic Backup/Restore | Automatically back up user credentials to a remote location including a directory server, relational database, or file system, and automatically restore user credentials after a system crash.
User Configuration of Logons | In addition to logons predefined by the administrator, users can add individual logons that they may have to other applications and Web sites.
Customization | Many aspects of the user experience, including user setup, are customizable to tailor the product to the security needs of the organization and technical sophistication of the user population.
Secure Architecture | The Agent is designed to be highly secure, including allowing the Administrator to prevent revealing of any passwords, calling modern encryption algorithms, and using tamper-resistant modules.
Copyright ©2011, Oracle and/or its affiliates. All rights reserved.

Version 11.1.1.5.0


What's New in ESSO-LM

● Introduction > What's New in ESSO-LM

What's New in ESSO-LM 11.1.1.5.0

ESSO-LM version 11.1.1.5.0 is the latest edition of Oracle Enterprise Single Sign-on Logon Manager Agent and the ESSO-LM Administrative Console. See the ESSO-LM Release Notes for information on new features in this release.


Console Overview

● Introduction > About the Console

About the ESSO-LM Administrative Console

The ESSO-LM Administrative Console enables both Agent and server configuration of most Agent options, including:

  • Easy creation, management, and deployment of:
    • Application configurations and application configuration lists
    • Credential-Sharing Groups
    • Password Policies
    • Bulk-add lists
    • Agent configuration settings (through registry settings).
  • Easy setup and management of synchronizer extensions:
    • LDAP Directory Servers, including Tivoli Directory Server, Novell eDirectory, Oracle Internet Directory, Oracle Directory Server Enterprise Edition, and OpenLDAP Directory Server
    • Microsoft Active Directory Server systems (including Application Mode)
    • Relational database systems, including Microsoft SQL Server, IBM DB2, and Oracle 9i/10g
    • File systems.

The ESSO-LM Administrative Console obsoletes the need for editing configuration files or the registry by hand, with the associated risks of errors such as "fat-fingering" or providing invalid parameters.

The ESSO-LM Administrative Console functionality is divided into the areas listed below, with their associated topics.

Action | Console Feature | Related Topic
Creating and managing application configurations | Applications | Configuring Application Templates
Creating and managing password generation policies | Password Generation Policies | Setting Password Policies
Creating and managing passphrase sets | Passphrase Questions | Passphrase Sets
Creating and managing credential sharing groups | Credential Sharing Groups | Creating credential sharing groups
Creating and managing bulk-add lists | Applications, Bulk-Add tab | First time use
Agent configuration settings | Global Agent Settings | Configuring Global Agent Settings
Setting up and managing synchronizer extensions | Synchronization | Synchronization
Setting up and managing repositories | Repository | Repository


Audience

These topics are intended for experienced administrators responsible for the planning, implementation and deployment of ESSO-LM. Administrators are expected to understand single sign-on concepts, such as password policies, logon methods, credential sharing groups, and application configuration, as well as have familiarity configuring directory servers, databases and repositories. The person completing the installation and configuration procedure should also be familiar with the company's system standards. Readers should be able to perform routine security administration tasks.


Product Overview

ESSO-LM uses a patented process for detecting requests for credentials, analyzing the response necessary, responding reliably, logging events, and administering settings.

Architecture/Modules

The ESSO-LM component architecture provides maximum flexibility to meet your organization's needs.

The ESSO-LM architecture consists of seven areas: authentication, encryption, intelligent agent response, core (including storage), credential synchronization, event logging, and miscellaneous components. In addition, administration is facilitated by the ESSO-LM Administrative Console.

Authentication

Authentication is how the system validates users so they gain access to ESSO-LM. It consists of three layers: (1) the authenticator itself; (2) the authentication service; and (3) the ESSO-LM Authenticator API. Once the system validates the user, it passes the users validation information to the core shell.

ESSO-LM ships with these authenticators:

  • Windows Domain (same password used to log on to the network)
  • Windows Authentication v2
  • LDAP Directory Server
  • LDAP Directory Server v2
  • Authentication Manager

Authentication Manager ships with these authenticators:

  • Entrust Entelligence
  • Proximity Card
  • Read-Only Smart Card
  • RSA SecurID
  • Smart Card

You determine which authenticators to support, which to install on each computer, and which to enable for each user. (Default: Windows Domain installs)

For details, see Configuring for Windows Authentication.

[ view diagram ]

Encryption

Encryption secures user credentials in the data store. The Shell (core) requests that credentials be encrypted/decrypted based on the appropriate Crypto Library algorithm. The Agent automatically migrates credentials to a new algorithm/strength (for example, from Triple-DES to AES).

ESSO-LM supports a variety of encryption algorithms and algorithm strengths to suit your corporate, legal, security, performance, and other requirements.

ESSO-LM ships with several popular algorithms:

  • Cobra 128-bit
  • Blowfish 448-bit
  • Triple-DES 168-bit
  • AES 256-bit
  • Triple-DES (MS CAPI) (ALL OSs)
  • Triple-DES (MS CAPI) (XP/2003 only)
  • RC-4 (MS CAPI) (ALL OSs)
  • RC-4 (MS CAPI) (XP/2003 only)
  • AES (MS CAPI) (XP/2003 only)

Other algorithms can work as encryption modules.

You determine which encryption algorithms a user can use and which encryption new/modified credentials should use. (Default: Triple-DES)

For details on setting the default algorithm and strength, see Settings Controlling Security.

Top

Intelligent Agent Response

When an application presents a request for credentials, the Agent detects this event, determines the appropriate action, and responds with the correct credentials. The interface that performs these evaluations is the Intelligent Agent Response. It interfaces with Access Manager to supply the proper credentials to each application. Access Manager acquires the credentials from the Shell.

Windows support installs automatically. You determine whether support for Web and/or Host applications installs. (Default: All modules install, but Host support is disabled.)

ESSO-LM ships with the configuration information for popular applications built in.

For more information on built-in applications, see Application Configurations Included. For more information on adding additional application configurations, see Configuring Application Templates.

Top

Application Configuration

ESSO-LM can work with its default install settings. However, ESSO-LM provides the flexibility to tailor its functionality to the specific needs of any organization. Some of the most commonly-customized functions are:

  • Application Templates, which improves usability by letting users select from a predefined logon list. Applications include Windows applications , host applications, and Web applications.
  • Mobility Support, to provide location transparency and automatic backup and restore.
  • Event Logging, which enables ESSO-LM to log various events such as logons, password changes, and so on.
  • First-time use, which customize the user setup process to meet an organizations needs and improve usability.
  • Password policies, which propagate enterprise security policies, improve security, and (when automated) improve usability.
  • ESSO-LM settings, which control the UI, implement security, enable, disable, and configure features, and more.

Each of these decisions impacts multiple stages of planning, deployment, use, and management.

Top

Host Emulators

ESSO-LM supports many host emulators. You determine which, if any, the Agent will recognize. (Default: The Agent works with all supported emulators but requires emulator configuration for some emulators.

It is recommended that you configure host emulators to work with the Agent before deploying ESSO-LM.

For more information on host emulators, see Configuring Host Emulators.

Top

Core (Including Storage)

Using your preferred encryption algorithm, the Agent encrypts and stores user credentials locally in the encrypted Local Credential Storage; it never maintains credentials unencrypted on disk or in memory. The credentials are stored in a user-specific secure database file. Within this file are the encrypted records for each set of user credentials, user settings, and additional configuration information.

Top

Credential Synchronization

While the Agent stores user credentials and settings locally, it can synchronize the credentials and settings with remote file systems, directories, databases, devices, and so on. Synchronization can be of the entire user database file (which contains all user credentials) or of individual records within the database. The synchronization is triggered by a change to the Local Credential Storage or settings. Synchronization can be extended to any storage mechanism via the Synchronization API.

Agent administration is fully supported via the Synchronization component and allows the administrator to dynamically deliver updated settings and configuration data to the Agent through the central storage mechanism.

Top

Synchronization Extensions

The Agent works with a variety of synchronization extensions, providing users access to their credentials from any desktop.

ESSO-LM includes the following synchronizer extensions:

  • LDAP-compliant directory servers, including:
    • IBM Tivoli Directory Server
    • Oracle Internet Directory
    • Novell eDirectory
    • Oracle Directory Server Enterprise Edition
    • OpenLDAP Directory server
    • Microsoft Active Directory Server
    • SQL-compliant relational database system, including
    • Microsoft SQL Server
    • IBM DB2
    • Oracle
For specific version information, refer to the latest ESSO-LM Release Notes.

ESSO-LM also includes a synchronizer extension supporting a file system, such as on a remote network drive share.

You determine which synchronization modules to install on each computer, which modules to enable for each user, and how to configure each extension. (Default: The synchronizer module installs but no synchronization extensions install.)

  • For information on Mobility in general, see Mobility Configuration.
  • For details on synchronization, see Storing User Credentials and Settings.
  • For details on directory servers, see Directory Server Synchronization Support.
  • For details on database systems, see Database Synchronization Support.
  • For details on the File System synchronization extension, see File System Synchronization Support.

Top

Event Logging

When notified by the Shell, the Agent can log all SSO system events, including credential use, credential changes, global credential events, Agent events, and Agent feature use. The Agent can also log specified fields. Events can be logged locally or to any external destination through the Event Logging API. These destinations can include an SNMP service, a Windows server (for viewing via the Windows Event log), or even a local XML log file for simplified parsing and reporting.

The Agent can log all events through its Event Logging API.

ESSO-LM works with a variety of Event Logging extensions and includes two Event Logging extensions writing to both local and remote servers:

  • Local File extension, to an XML file
  • Windows Event Logging extension, to a Windows Event Logging server
  • Oracle may release additional extensions (for example, SNMP and Oracle), and you can easily write your own extensions.

You determine which Event Logging modules to install on each computer, which modules to enable for each user, how to configure the extensions, how frequently the Agent writes to these extensions, how much data the Agent caches, where the Agent writes the log, and more. (Default: No Event Logging modules install, and no logging occurs)

See Event Logging for details.

Top

Miscellaneous Components

ESSO-LM also contains the following miscellaneous modules:

Backup/Restore

For users who do not perform any Credential Synchronization, the Backup/Restore component enables archiving and restoration of user credentials.

Citrix and Windows Terminal Services Tools

For environments that require usage of the Agent within a Citrix Server or Windows Terminal Services environment, additional components are supplied to allow ESSO-LM to interact appropriately within each session.

Installer Package

ESSO-LM ships within a Windows Installer package that supports the flexibility of that technology for easier deployment and customization.

Top

Common Scenarios

First-Time Use

The Agent can prompt the user for current credentials for predefined applications. You determine which, if any, credentials to request. (Default: The Agent does not request credentials for any applications.)

For more information on first-time use issues, see First Time Use (Bulk-Add).

User Work Modes

ESSO-LM supports work modes ranging from "One Workstation, One or Multiple Users" to "Frequent Movement Among Many Workstations" and from always-connected to frequently-disconnected.

For more information on first-time use issues, see User Work Modes.

Usability vs. Security

ESSO-LM lets you choose the balance between usability and security that is appropriate for your organization.

For more information on first-time use issues, see Settings Controlling Usability.

Packaging/Distribution/Installation

ESSO-LM supports most deployment tools and methods. You determine which components deploy to which desktops.

For more information on deployment, see Deploying ESSO-LM.

Top

Resources

ESSO-LM stores all program files, settings, and data in the following places:

  • The %ProgramFiles%\Passlogix\v-GO SSO directory contains ESSO-LM program files. (Default: C:\Program Files\Passlogix\ESSO-LM)
  • The %ProgramFiles%\Passlogix\v-GO SSO\Console directory contains ESSO-LM Administrative Console program files. (Default: C:\Program Files\Passlogix\v-GO SSO\Console)
  • The %ProgramFiles%\Passlogix\SSO File Sync Service directory contains SSO File Sync Service program files. (Default: C:\Program Files\Passlogix\SSO File Sync Service)
  • The %AppData%\Passlogix directory contains user data files. (Default: depends on OS; Windows 2000: C:\Documents and Settings\%UserName%\%AppData%\Passlogix)
  • The HKCU registry tree stores user default settings.
  • The HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix registry tree stores overriding setting (settings that override user settings) and ESSO-LM defaults.
  • The SSOLocator objects on a directory server direct ESSO-LM to where each users' credentials are stored (an SSOConfig object).
  • The SSOConfig objects on directory servers and similar objects on File Systems store overriding settings and user data.

Settings in SSOConfig objects override registry settings.

SSOConfig is the default name, but can be named anything.

Top


Considerations Before Deploying ESSO-LM

The topics in this section discuss important concepts and considerations regarding the deployment and administration of ESSO-LM.

User Work Nodes | Understanding the different ways to set up the Agent side of supporting users working in different configurations, and how to optimize your configuration for each set of scenarios.
Configuration | Understanding the different ways to set up the server side of supporting users working in different configurations, and how to optimize your configuration for each set of scenarios.
Rollout | Understanding the process and issues surrounding rolling out ESSO-LM to an organization.
Administration and Management | Understanding the post-rollout issues for ESSO-LM deployments.


User Work Modes

Users access their computers in a variety of work modes:

  • Some users are always at a given workstation and are the sole user.
  • Some users move frequently among a limited number of workstations (for example, nurses in a department) or move to a different workstation every day or few hours (for example, a call center).
  • Multiple users may share a single workstation, for example, in shifts. Such a workstation may be used as a kiosk, that is, by multiple users who log on on using a smart card or other token.
  • Some users are not always connected to the network.

ESSO-LM supports all these scenarios and can be optimized for each user's most common scenario. (Default: Users are always at a given workstation, but share with others.)

One Workstation, One User

When users are always at a given workstation, their credentials can be backed up to a remote location using an SSO synchronizer extension. See Synchronization for more information.

Alternately, the Backup/Restore facility module can store credentials on the workstation without the use of a remote repository. The Backup/Restore module is not installed by default. Users can perform backups manually, or the backup can be automated. See File-Based Backup/Restore for more information.

Frequent Movement Among Few Workstations

When users move frequently among a few workstations, but are always on those few workstations, you have two basic options for supporting their ESSO-LM credentials.

The recommended option is to utilize a remote SSO repository. Both starting the Agent and any change to credentials force a record-level comparison (synchronization) of all records, ensuring that the user always has the most current credentials possible.

One other option is to configure automatic backup to a network file share. With proper configuration, the Agent will perform a silent backup to a remote store (network drive) with each change of credentials (Refresh Task). When the Agent first starts, it will see if the remote store is newer than the local store; if so, it will perform a silent restore; either way, the user will have the current credentials. Because this is a file-level (as opposed to record-level) comparison, this option is not safe if the user logs onto more than one computer at the same time.

Frequent Movement Among Many Workstations

When users move frequently among many workstations, you have two basic options for supporting their credentials.

The recommended option is to utilize a remote SSO synchronization repository. Both starting the Agent and any change to credentials force a record-level comparison (synchronization) of all records, ensuring that the user always has the most current credentials possible. In addition, to increase security and to reduce disk space use, enable the Delete Local Cache (on Shutdown) option.

Alternately, if your Windows environment is already set up with Windows Roaming Profiles, user data is automatically available to the user since it is included in the %AppData% file directory. However, due to the bandwidth-intensive nature of Windows Roaming Profiles, it is not recommended for use with SSO credentials.

One Workstation, Many Users

A single workstation may be accessed by a number of users, such as a kiosk. A smart card (or other token) and a PIN can be used to log on to a kiosk (Authentication Manager only). To enable these users' access to the remote SSO repository the ssoSCDetect utility can be used to start the ESSO-LM Agent and prompt for primary logon whenever a smart card is inserted in the reader. When the card is removed, the user is automatically logged out of the Agent. See ssoSCDetect (smart card monitor utility) for more information.

Disconnected

When users use laptops or are in remote locations, they often stay disconnected from the network for long periods of time.

The ESSO-LM Agent stores credentials locally, providing full independence for mobile users who cannot rely on a network connection. ESSO-LM modules like Storing User Credentials and Settings and Event Logging support occasional reconnecting, ensuring reliability.

With File-Based Backup/Restore, users can save their own data to a floppy or zip drive. With Authentication Manager, users can save their own data to a smart card.

The ESSO-LM synchronizer extensions are configured for offline users using Synchronization options, including Disconnected Operation (See Settings Controlling Mobility).

Usability and Security

Security: Locked Down vs. User Freedom

You can customize ESSO-LM to provide the balance of security appropriate to your organization's policies and risk/trust level. For example, some organizations need to insure that a user cannot deny having taken a given action, whereas others are not as security-conscious.

Usability: User Flexibility vs. Simplicity

You can customize ESSO-LM to provide the balance of usability appropriate to your organization's policies and user skill level. For example, some organizations largely employ users who are confused by all but the simplest user interface, whereas others are staffed by more experienced users and might wish to offer flexibility in their environment.

Other Settings

You can customize ESSO-LM in many ways, and you can enforce these settings at the user, computer, or group level. (The "group" level can include the entire enterprise.) See Global Agent Settings for details.


Mobility Configuration

Some organizations configure their SSO repository components (directory servers, relational databases, file system share) in a very centralized fashion (for example, all user data store objects under one parent object). Other organizations use a decentralized structure (for example, a parent object for each department, location, level of employee). Each has its advantages and disadvantages, depending on your specific current and future network topology. Below are some general advantages and disadvantages.

Centralized

Advantages

Disadvantages

  • Easy to configure globally
  • Easy to manage
  • Hard to load balance
  • Bandwidth-intensive when user population is dispersed and user data isn't locally replicated (for example, retrieving data on a New York server from Tokyo)
Decentralized

Advantages

Disadvantages

  • Granular control (for example, different security for different users)
  • Can reallocate resources easily (for example, move user data objects as the users move closer to different servers, split data among several servers)
  • Harder to manage
  • Easier to make mistakes with one set of data and not realize the disparity

ESSO-PG

ESSO-PR

Oracle Enterprise Single Sign-on Password Reset

ESSO-LM

Oracle Enterprise Single Sign-on Logon Manager

FTU

First Time Use Wizard

First-Time Use Scenarios

You can control users first-time use scenario from the ESSO-LM repository. Determine your first-time use scenarios and then push the object to the ESSO-LM repository. If using a centralized environment, only one object is needed; if using a decentralized environment, you can customize the first-time use scenario configuration to meet each group's needs. See First Time Use (Bulk-Add) for more information.

System Configuration

You can provide ESSO-LM configuration settings to users from the ESSO-LM repository. Determine your overriding settings and then push them to an object in the ESSO-LM repository. If you are using a centralized environment, only one object is needed, providing ideal top-down security controls; if you are using a decentralized environment, you can customize the settings to meet each group's needs.

Application Configurations

You can provide application configurations to users from the ESSO-LM repository. Determine your application configurations and then push to an object in the ESSO-LM repository. If using a centralized environment, you need only one object; if you are using a decentralized environment, you can customize the list of supported applications to meet each groups needs. See Configuring Application Templates for more information.


Software Rollout

The Basics

You can introduce yourself to ESSO-LM by accessing its basic functions; that is, log on to your computer and the Agent provides the logon to all other applications.

To see examples of this, observe the Agent responding to some predefined applications (for example, Outlook and Lotus Notes 4/5) and some Web sites (for example, Yahoo! and EudoraMail.com). Install ESSO-LM with its typical configuration and then start these applications.

Application Configuration

Once you see the Agent respond to some predefined applications and common web sites, you can easily configure the Agent to detect and respond to almost any password-protected application.


Administration and Management

After the initial deployment, you can continue managing ESSO-LM modules deployment for updates and upgrades, using the ESSO-LM Administrative Console or your own current deployment method.

ESSO-LM Configuration
Directory Servers & Database Systems | Using the ESSO-LM Administrative Console, modify the SSOAdminOverride objects.
File Systems | Using your current File System administration/management tool or the ESSO-LM Administrative Console modify the overriding settings.
Local | Using a domain management tool, a deployment tool, RegEdit, and so on, modify the HKLM hive.
Application Configurations
Directory Servers & Database Systems | Using the ESSO-LM Administrative Console, modify the SSOentlist and (optionally) SSOftulist objects.
File Systems | Using the ESSO-LM Administrative Console modify the entlist and (optionally) ftulist files.
Local | Using the ESSO-LM Administrative Console, modify the entlist.ini and (optionally) ftulist.ini files.
Settings
Change settings post-rollout

Using the ESSO-LM Administrative Console, push overriding settings to the ESSO-LM synchronization repository (for example, the directory server, database, file system).

Using a domain management tool, a deployment tool, RegEdit, and so on, deploy registry changes.

User Data
Directory Servers | Using your current directory administration/management tool, move the user object and (if needed) alter or add an SSOLocator object for the user.
File Systems | Using your current network administration/management tool (or even Windows Explorer), move the user file directory tree and (if needed) change the user files' storage location.
Local | Using a domain management tool, a deployment tool, RegEdit, and so on, change the user files' storage location.
Managing User Credentials
Local Deleting User Credentials
Using a domain management tool, a deployment tool, Windows Explorer, and so on, delete the %AppData%\Passlogix file from the users %AppData%\SSO directory on all computers the user accesses.
Directory Servers

Deleting User Credentials
Using your current directory administration/management tool, delete the user object from the directory and delete user credentials by using Windows administrative access to delete the %AppData%\Passlogix file from the users %AppData%\SSO file directory tree on all computers the user accesses.

Moving a user object
Using your current directory administration/management tool, move the user object using the directory administrative tool and (if needed) alter or add an SSOLocator object for the user.
File Systems Deleting user credentials
Using your current network administration/management tool or Windows Explorer, delete the user files from the file system and delete user credentials by using Windows administrative access to delete the %UserName% AML.mdb file from the user's %AppData%\Passlogix file directory tree on all computers the user accesses.


Configuring ESSO-LM

These topics describe how to configure ESSO-LM to support specific environments.

  • For Windows authentication
  • For directory servers
  • For databases
  • For file systems
  • For Citrix Server


for Windows Authentication

●Administrative Procedures > Configuring the Agent > for Windows Authentication

Configuring for Windows Authentication

ESSO-LM supports Windows Authentication as the Primary Logon Method (Authenticator), creating a true single sign-on user experience. The Agent can use the Windows logon credentials as its authentication. In order for ESSO-LM to support this, the administrator needs to be aware of two issues:

  • The OS must have 128-bit encryption installed.
  • The administrator must enable user-level profiles.

For Microsoft Windows 2000/XP, user-level profile support is part of the base feature set when installed.

Confirming 128-bit Encryption

To check the encryption strength of the OS, launch Microsoft Internet Explorer, and select Help>About. Confirm that Cipher Strength is 128-bit.

If the OS is not 128-bit, download the update from Microsoft:

http://www.microsoft.com/windows/ie/ie6/downloads/recommended/128bit/default.mspx.


Directory Servers: Configuring the Agent

●Administrative Procedures > Configuring the Agent > for Directory Server synchronization

Configuring the Agent for Directory Server Synchronization

This topic describes the settings needed to configure ESSO-LM to use a directory server as a repository. The configuration is similar for all supported directory servers, with explanations of any differences.

  • See Directory Server Synchronization Support for more information about how ESSO-LM makes use of directory server resources.
  • See Overriding Settings for detailed descriptions of the associated registry entries.

Where the LDAP AUI and LDAP Directory Server extension are both installed, values must exist in both AUI\LDAP and Extensions\SyncManager\Syncs\%LDAP%.
  1. Point ESSO-LM to the server or servers.
  2. Do one of the following:
    • From Global Agent Settings in the left pane, select an existing set of registry entries.
    • Import a saved set of settings (File>Registry>Import).
    • Create a new set of registry settings (Insert>Global Agent Settings).
  3. In the left pane of the ESSO-LM Administrative Console, select and open the set of settings, select and open Synchronization (add the appropriate extension if needed), select and open the appropriate extension, then select and open Servers.
  4. In the right pane, select Servers, select the … button, enter the server names, or IP addresses, and click OK.
For Microsoft Active Directory Server (other than Application Mode):
  • If no Servers are entered for the Active Directory extension, and the user account is in an Active Directory domain, then ESSO-LM uses AD domain resources to discover the server. If one or more servers are provided in the Global Agent Settings, then ESSO-LM uses the Servers list to locate the server.
  • Unless otherwise configured, ESSO-LM queries the domain name server (DNS) for the name of the preferred domain controller assigned to the local subnet.
  • In Active Directory networks with multiple servers, be sure to enable replication in order to include the ESSO-LM schema extension and related objects. This assures that ESSO-LM will always find SSO information on every server it connects with.
  • If one or more servers are provided for Microsoft Active Directory Server, use server names, rather than IP addresses.

For Microsoft Active Directory Server Application Mode:

  • At least one server must be specified for ADAM services.
  • Use the port parameter (for example myserver.com:9890 ) to specify particular instances of ADAM running on a single server.
  • Applications templates must reside in a specific OU and not at the root of the ADAM instance.
  5. Point ESSO-LM to the User path.
  6. In the left pane, select the appropriate extension, then do one of the following:
    • For an LDAP extension, select Required.
    • For an Active Directory extension, select Advanced.
  7. In the right pane, select User Paths, then select the … button, enter the user path(s), and click OK.
  8. Enable or disable SSL.
  9. In the left pane, select the appropriate extension.
  10. In the right pane, select SSL options as follows:
  11. If using SSL, select SSL (for LDAP or Active Directory) and select Connect via SSL (defaults to port #636).
  • SSL is not enabled by default; the non-secure default port is #389.
  • To set non-standard ports, use the Servers setting (for LDAP or Active Directory).
  12. If using SSL, select When SSL Fails (for LDAP or Active Directory) appropriately.
For Novell eDirectory

There are two major caveats for Novell eDirectory and some other environments If the domain name for a user is in the form of

cn=%UserName%,ou=people,dc=Oracle,dc=com

instead of the form

namingattribute =%UserName%,ou=people,
dc=Oracle,dc=com

where namingattribute can be any string, do the following:

  1. In the left pane, select the appropriate extension, then select Advanced.
  2. Select Naming Attribute string and set it to CN.

  3. Select Alternate User ID location and set it to uid=%user%,path where path is the rest of the path to the object; for example:

    uid=johnd,ou=people,dc=Company,dc=com.


File Systems: Configuring the Agent

●Administrative Procedures > Configuring the Agent > for File System synchronization

Configuring the Agent for File System Synchronization

This topic describes the settings needed to initially configure the ESSO-LM Agent to synchronize application logons, global agent settings, and user credentials with a network file share.

The configuration settings described below can be distributed to the client workstations either as part of the general deployment of the Agent software (by modifying the MSI installer file), or after Agent deployment, by distributing a registry-entries (.REG) file that can be merged with the client workstation's registry.

  • See Deployment Options for topics about ESSO-LM Agent rollout.
  • See File System Synchronization Support for more information about how ESSO-LM makes use of file system resources.

  • See Overriding Settings for detailed descriptions of the associated registry entries.

    1. Point the ESSO-LM Agent to the server.

    2. Do one of the following:

      • Import a saved set of settings (choose Registry, then Import from the File menu).

        or

      • Create a new set of registry settings (from the Insert menu,l choose Global Agent Settings).

        or

      • Select an existing set of registry entries (by selecting it in the left pane under Global Agent Settings).
    3. In the left pane, select and open the set of registry settings, select and open Synchronization, add the appropriate extension (if needed), select and open the appropriate extension, then select Required.
    4. In the right pane, select Server, enter the server names or IP address and click OK.
    5. Export the settings to the Agent.
    6. Select a method for initial distributing the global agent settings to client workstations:
    7. Customize the MSI package that installs the ESSO-LM Agent to include these settings.
    8. Distribute a .REG file that you export from the ESSO-LM Administrative Console. The REG file can be merged with the client workstation's registry locally by double-clicking the file icon.


Database Synchronization: Configuring the Agent

You can distribute the configuration settings described below to the client workstations either as part of the general deployment of the Agent software (by modifying the MSI installer file) or, after Agent deployment, by distributing a registry entries (.REG) file to merge with the client workstation's registry.

  • See Deployment Options for topics about ESSO-LM Agent rollout.
  • See Database Synchronization Support for more information about how ESSO-LM makes use of database server resources.
  • See Overriding Settings for detailed descriptions of the associated registry entries.
    1. Point ESSO-LM to the database server.
    2. Do one of the following:
      • Select an existing set of registry entries (by selecting it in the left pane under Global Agent Settings).
      • Import a saved set of settings (from the File menu, choose Registry, then Import).
      • Create a new set of registry settings (from the Insert menu, choose Global Agent Settings).
    3. In the left pane, select and open the set of registry settings, select and open Synchronization, add the appropriate extension (if needed), select and open the appropriate extension, then select and open Servers.
    4. In the right pane, select Servers, select the … button, enter the database server name(s) and click OK.
    5. Export the settings to the Agent by selecting a method for initial distribution to client workstations:
      • Customize the MSI package that installs the ESSO-LM Agent to include these settings.
      • Distribute a .REG file that you export from the ESSO-LM Administrative Console. The REG file can be merged with the client workstation's registry locally by double-clicking the file icon.


Using Role/Group Support with Directory-Server Synchronization

In directory-server synchronization installations, ESSO-LM provides support for role/group access control for individual configurations, including application logons, password-change policies, global Agent settings, and passphrase question sets. When this feature is enabled, you can assign access-control lists, similar to those used in Windows security to the individual logons, policies, settings, and question sets.

Role/group support-enabled configurations are exported to a synchronizer container object just like the standard ESSO-LM configuration objects (EntList, FTUlist, and AdminOverride). When role/group support is enabled and these access-controlled objects are present in the container, they override the standard objects. Follow these steps to configure role/group support:

  1. Configure these global Agent settings to enable role/group security support and update the Agent:
Synchronization

Enable role/group security support

Enables role/group support for application logons, password policies, global Agent settings, and passphrase question sets.

Options:

  • Do not use role/group security (default)
  • Use role group security.
Synchronization > selected sync > Advanced

Configuration Objects Base Locations

(LDAP, Active Directory, ADAM)

Specifies where to begin the search for role/group-enabled configuration objects. The search is from the specified locations or locations downward, (away from the root). If there are no entries for this setting, the search is from the root.

  2. Specify the access rights for each configuration:

    Use the Security tab for each configuration (application logons, password policies, global Agent settings, and passphrase question sets) to specify the users and groups that should have access to it.

  3. Export the configurations to a synchronizer container
  4. Connect to the synchronizer directory.
  5. In the right pane, right-click a container object and choose Publish to Repository from the shortcut menu to display this window.
  6. Choose Administrative Console as the Data Source.
  7. Choose Advanced Support and complete the Wizard procedure to export the configuration objects as individual, access-controlled objects.

For best performance and highest security, Oracle recommends the following practices:

  • Unless your organization explicitly requires role/group support, make certain that Enable role/group security support is set to "Do not use..."
  • For best security, make certain that there are no user-writeable areas anywhere down the directory tree from the location specified by Configuration Objects Base Locations (LDAP, Active Directory, ADAM).
  • For best performance, always specify at least one location for Configuration Objects Base Locations. This ensures that the entire server is not searched.
  • To minimize the search load and length, be sure to store as little unnecessary data as possible down the directory tree from the location specified by Configuration Objects Base Locations.


Configuring Application Templates

ESSO-LM recognizes and responds to a wide array of logon scenarios. Users can configure each logon in advance or as they encounter them. When a user configures a logon, the Agent displays a list of predefined applications. Users select an application from this list or create a logon for an unlisted application.

Predefined applications simplify configuration for the user and increase the reliability of both recognizing and responding to logon and password-change requests.

Preconfigured application logons for many popular Windows applications are included with the ESSO-LM Administrative Console in the form of templates that contain all or part of the logon's configuration. The applist.ini file (located in the installation directory in the Plugin\LogonMgrdirectory) includes predefined logons for network and web pop-up logon dialogs boxes and for many online service providers.

Adding Templates

  1. Create the application logons using ESSO-LM Administrative Console configuration features (see "Related Topics," below).
  2. Create and deploy an entlist as an INI file or equivalent synchronization object.
    • Use Export to INI file to create an entlist.ini file.
    • Use Publish to Repository to create an entlist synchronization object.
  3. Do one of the following:
    • If you are using synchronization to deploy application logons, do not use the Location of entlist.ini file setting. The synchronizer automatically locates entlist.ini and ftulist.ini in the user's %AppData%\Passlogix directory.
    • If you are not using synchronization to deploy application logons, use the Location of entlist.ini file setting under End User Experience/Environment.

The administrator must create entlist.ini; the Agent does not create it automatically.


Understanding the Application Configuration Files

ESSO-LM stores its application logon instructions in a file named aelist.ini that typically resides in the each user's %AppData%\Passlogix directory (i.e. C:\Documents and Settings\username\Application Data\Passlogix). The Agent creates aelist.ini by merging two component files:

  • entlist.ini, which you create using the ESSO-LM Administrative Console to provide your organization with customized logons for Windows, Web site, and mainframe/host applications. The Agent's synchronizer extension places entlist.ini in the %AppData%\Passlogix.
  • applist.ini, which is included in the Agent installation package and contains predefined logons for network and web pop-up logon dialogs and for many online service providers. The applist.ini file resides in the Agent's installation directory.

Pre-configured logons for Windows and Web application are provided in ESSO-LM Administrative Console templates.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini) can only be created and edited using the ESSO-LM Administrative Console.

How the Agent Uses entlist.ini

The Agent merges entlist.iniwith applist.ini to create aelist.ini in the %AppData%\Passlogix directory. The Agent overwrites aelist.ini periodically, including at Agent startup. The Agent then uses aelist.ini to detect "known" applications.

If using a synchronizer extension (for example, Directory Server or File System), a remote object overrides any local entlist.ini file, and is then merged with applist.ini.

If there is no remote object or local entlist.ini file, the Agent will utilize applist.ini without creating the aelist.ini file.

While the Agent is running, you can modify entlist.ini or the SSOentlist object. To force the Agent to re-merge to create a new aelist.ini, select Refresh in Logon Manager.

See the following topics for more information about creating and distributing application logons:

  • Creating logons from templates:
  • Adding Windows Applications
  • Adding Web Applications
  • Adding Host/Mainframe Applications
  • Add Application dialog box
  • Distributing Logons
  • Configuring Application Templates
  • Administration and Management

See Pre-Configured Applications and Templates for a list of templates that ship with the program. See the ESSO-LM Global Agent Settings Reference Guide for detailed descriptions of Global Agent Setting options.

How the Agent Uses aetlist.ini

The file that results from the merger of aelist.ini contains all the information necessary to identify and respond to logon and password change events for all configured applications. This information comprises:

  • Application-type settings such as Error Loop settings, for example, how many times the Agent will retry a logon within the specified time period.
  • Application-specific configuration information, for example, application executable name or Web Site URL, password change behavior Password Policies, Error Loop settings, data file extension.
  • Scenario-specific configuration information for the logon and password change scenarios, for example, window dialog title strings, form names, and locations for credentials.
  • Dialog-specific matching settings (for example, that a string or control is or is not present).
  • Other settings (for example, name of a third or fourth field).

The merged file, aelist.ini, has a hierarchical structure, containing all the information necessary for the Agent to uniquely identify and respond to logon and password change events for each application to configure. It organizes logons in sections and subsections as follows:

[*Other Apps] Section1=Application logon 1 Section2=Application logon 2 | This section references two administrator-defined Windows applications defined later in the file. See Adding Windows Applications for details.
[*Mainframe] Section1=Host logon 1 Section2=Host logon 2 & | This section references two host/mainframe applications defined later in the file. See Adding Mainframe applications for details
[*Shared Groups] Section1=Shared Group 1 Section2=Shared Group 2 & SectionN=Shared Group N & | This section references two groups used for credential sharing. See Creating credential sharing groups for details.
[*PasswordPolicies] & | This section enables Password Policies. See Setting Password Policies for details.

The application configurations in entlist.ini allow the Agent to automatically recognize and respond to logon and password-change requests from applications specific to your organization.

When present as a local file or downloaded from a remote object, the Agent downloads an entlist object (if available) to an entlist.ini file, and combines your downloaded or local entlist.ini with those Oracle supplies in applist.ini to create aelist.ini, the complete list of predefined applications available to users. (If entlist.ini is not present, the Agent utilizes applist.ini.)

Because Oracle provides updates to applist.ini, it is strongly recommended that you make no changes to applist.ini: future ESSO-LM releases may overwrite your applist.ini changes, and Oracle provides no guarantees that future releases will support changes you make to applist.ini.


General Guidelines for Setting Up Applications

Setting up and configuring applications is easiest with the following conditions:

  • Have the target applications on the same workstation as the ESSO-LM Administrative Console.
  • Minimize the number of other applications running during configuration.
  • To facilitate creating application configurations and testing:
    • Configure your workstation not to use a synchronizer extension.
    • When the application logon request causes the Agent to respond, tell the Agent to ignore it.
    • In the ESSO-LM Administrative Console, create the application configuration and then use Export Apps to Agent (on the Tools menu) to overwrite the local entlist.ini file.
    • Keep Logon Manager visible, and select Refresh whenever you finish exporting from the ESSO-LM Administrative Console.
    • Bring up the application logon dialog box to see if your new configuration works properly within the Agent.


Adding Windows Applications

The easiest and most precise way to configure Windows applications is by using the Windows Form Wizard.

Before you begin Windows logon configuration, refer to the General Guidelines for configuring applications.

Special Issues and Settings

Some Windows applications interact in unusual ways or have special requirements. For these scenarios, the ESSO-LM Administrative Console offers these additional configuration options.

Special Configuration Settings

On the Fields tab (for a new or selected logon form)
SendKeys

Use the SendKeys option for Windows applications that:

  • Cannot receive credentials from the Windows message queue or by other techniques the Agent normally uses to send credentials
  • Do not use standard Windows controls that have Control IDs
  • Dynamically generate controls or do not use Windows controls at all (for example, Flash applications).
On the Miscellaneous tab (for a new or selected logon form)
Allowable Class | Use the Allowable Class option to identify logon or password-change window classes that must be present in order to execute this logon. This is useful for applications that present logon- or password-change windows with non-standard class names.
Ignore this Window Class

Use the Ignore Window Class option for applications that:

  • Use hidden logon or password-change dialogs, or
  • Present duplicate dialogs.
Attach to window's Message Queue | Use the Attach to... option to keep the focus on the target logon window while sending credentials.
Preset Focus | Use the Preset Focus options to have the Agent set the focus on a field before entering data in it.
On the Miscellaneous tab (for a selected application)
Service Logon | Select the Service Logon option to let the Agent detect an application that runs as a Windows service (that is, in the System space, rather than the User space).
Third/Fourth Field Label | Use these options to specify the text labels the Agent should use to display these additional fields.
File extension for Icon | Use this option to provide a Windows file extension to associate with a logon; this lets the Agent map an icon to it.


Adding Web Applications

ESSO-LM detects and responds to logon and password-change requests for predefined Web applications. Much like Windows and host/mainframe applications, administrators define Web applications by including a section in entlist.ini.

The Agent recognizes specific strings of data at specified locations within the HTML code of a Web page. This data tells the agent how to detect the Web site's logon and password-change screens, where to enter the user credentials, and how to submit those credentials.

The easiest and most precise way to configure Web applications is by using the Web Form Wizard. Before you begin this procedure, refer to the General Guidelines for configuring applications.

Web applications can have the logon and password change forms on the same page, on different pages within the same URL, or at different URLs. Furthermore, logons can be in the same form at different URLs or on different forms at different URLs.

If you add a configuration for a site where the user's local store already includes a logon, your new configuration will override the user's. The user will need to re-enter credentials for this application.

The user can still view the old logon in Logon Manager.


Adding Host/Mainframe Applications

ESSO-LM provides single sign-on functionality to host/mainframe applications through host emulators that:

  • Implement HLLAPI (high-level language application programming interface), or
  • Have a built-in scripting language that can display a dialog.

The host emulator enables an end user to connect the Windows workstation to a mainframe, AS/400, OS/390, Unix, or other host-based session. ESSO-LM recognizes a terminal screen by looking for specific strings of data at specific screen locations.

In order for ESSO-LM to recognize host emulators, enable mainframe support by selecting MFEnable in the Host/Mainframe Apps dialog in the ESSO-LM Administrative Console.

All host/mainframe applications must be predefined. The ESSO-LM end user has no means to define host/mainframe applications. The administrator must also configure the host emulators themselves in order for ESSO-LM to recognize them. Any host emulator can use application logons created by any other host emulator. See Configuring Host Emulators for information on configuring ESSO-LM-supported emulators.

Logon creation is easiest using a host emulator that allows you to select text and that displays the row and column coordinates of your selection.

For information on how to configure an emulator that does not support HLLAPI but does have a scripting language, contact Oracle.

For information on how to configure an emulator that does not support HLLAPI but does have a scripting language, contact Oracle.

For emulators that do not implement HLLAPI or have a scripting language, you can, in some cases, configure the host/mainframe application as a Windows application (to detect the form by its window title) and using SendKeys to supply user credentials. See Adding Windows Applications: Special Issues for more information.

Adding a Host/Mainframe Application

The easiest, and most precise way to configure host/mainframe applications is by using the Host/Mainframe Form Wizard. Before you begin this procedure, refer to the General Guidelines for configuring applications.

Configuring a Host/Mainframe Application Manually

The following procedure describes the steps for manually configuring or modifying a host/mainframe logon. Refer to the specific dialogs and controls for more information. Refer to the General Guidelines for configuring applications before you begin this procedure. Refer to Selecting Windows for a Host or Mainframe Application for the procedure to select an application from a list of open applications.

  1. Start the application and configure the host emulator. See Configuring Host Emulators for more information.
  2. In the ESSO-LM Administrative Console, do one of the following:

    • Create a new host/mainframe application logon.

      or

    • In the left pane, click Applications and select a host/mainframe application. Click the General tab in the right pane.
  3. In the Identification tab of the Host/Mainframe form-configuration dialog box:
    1. Select a logon form from the list and click Edit.
    2. Specify one or more Text Matching captions, so that this page can be identified uniquely from other pages. Specify the identifying Text string of the caption and its starting Row and Column numbers.
    3. Specify the Fields for credentials. Click Edit (under Fields) to display the SendKeys (Host/Mainframe) dialog box. Specify the starting row/column for each field and the keystrokes to send.
  4. If the terminal response time requires a pause between credential field entries, select the Options tab and enter the number of milliseconds to pause in Delay Field.
  5. Repeat the steps above for each additional logon screen.
  6. To add password change information, repeat the process with the Password Change tab and the password change dialog box in the target application.


Adding Java Applications

●Administrative Procedures > Configuring the Agent > Configuring Application Templates > Adding Java Applications

Adding Java Applications and Applets

You can configure Java application logons and Java applet logons (in Web pages) by using the Windows Form Wizard. The procedures for creating and deploying are generally identical for Java and Windows applications.

Before you begin Java logon configuration, refer to the General Guidelines for configuring applications.

In order for the Agent to detect and use Java application logons, the Java Runtime Environment (JRE) must be installed on the workstation prior to installing ESSO-LM. If JRE is not already present when ESSO-LM is installed, the Agent's Java Helper component is not available for installation.


Adding Telnet Applications

ESSO-LM supports Telnet sessions using HLLAPI (high-level language application programming interface) implemented by a mainframe/host emulator. For the most current list of supported emulators, see ESSO-LM Release Notes.

Configuring a logon for a Telnet application is essentially identical to adding host/mainframe applications generally, but with these exceptions:

  • Host applications generally display text captions and data fields in fixed positions, which lets ESSO-LM detect a screen as a logon form using text matching and absolute row/column coordinates. By contrast a Telnet application, including its logon screen, appears in a scrolling text window. The screen position of the text caption for ESSO-LMto match (and begin the logon) should be set as a row number relative to the cursor (negative for above, positive for below) and an absolute column number. See the example below.
  • If one or both of the caption's coordinates are unpredictable, you can use an asterisk (*) for the row setting to match text in any row (and a fixed column), for the column setting to match text in any column (and a row relative to the cursor), or for both settings to match text anywhere on screen.
  • When supplying credentials for a Telnet logon, ESSO-LM ignores the row and column coordinate settings for field-matching. However, the settings must be present in the logon configuration. Use 1 as the value for both row and column coordinates for all credential fields in a Telnet logon.
  • In order to ensure that the Telnet logon credentials are filled in properly, ESSO-LM is enabled with timing logic. The Delay Field setting (on the Options tab for configuring a host/mainframe logon form) indicates the time in milliseconds that the Agent should pause between each action.
See Configuring Host Emulators for additional information on HLLAPI configuration.

Adding a Telnet application logon

The easiest, and most precise way to configure Telnet applications is by using the Host/Mainframe Form Wizard. Before you begin this procedure, refer to the General Guidelines for configuring applications.

Configuring a Telnet application logon manually

The following procedure describes the steps for manually configuring or modifying a Telnet logon. Refer to the specific dialogs and controls for more information. Before you begin this procedure, refer to the General Guidelines for configuring applications.

  1. Start the application and configure the host emulator.
  2. In the ESSO-LM Administrative Console, do one of the following:

    • Create a new host/mainframe application logon.

      or

    • In the left pane, click Applications and select a host/mainframe application.
  3. Click the General tab in the right pane.
  4. Select a logon form from the list and click Edit.
  5. In the General tab of the Host/Mainframe form-configuration dialog box:
    1. Specify one or more Text Matching captions, so that this page can be identified uniquely from other pages. Specify the identifying Text string of the caption and its starting Row and Column numbers.
      • The row numbers should be relative to the current cursor position and can be negative integers. See the example below.
      • The column number is an absolute position.
      • You can also use an asterisk (*) for the row or column as a wildcard.
    2. Specify the Fields for credentials. Under Fields, click Edit. In the SendKeys (Host/Mainframe) dialog box, select each field, and set the Row and Column for each field to 1. If needed, specify any additional keystrokes that should follow each field entry.
  6. If the terminal response-time requires a pause between credential field entries, select the Options tab and type the number of milliseconds to pause in Delay Field.
  7. Repeat the steps above for each additional logon form.
  8. To add Password Change information, repeat the process with the Password Change tab and the password change dialog boxes in the target application.

Text Matching example

Since the text in a Telnet application scrolls, the row positioning must be set relative to the cursor's row, which is always row 1. Therefore, the row coordinate for a caption ("Welcome to VAX/VMS_V6.1") that is two rows above the cursor is -2. The column setting of the start of the caption text is an absolute coordinate; in the example here, 9.

Screen text column
 | 123456789022345678903234567890123
Row# | 123456789012345678901234567890123
-4 |
-3 |
-2 | Welcome_to_VAX/VMS_V6.1_
-1 |
1 | Username: _
2 |
3 |
4 |

For ESSO-LM to identify this sample screen, you could set these text matching criteria (using the Text Matching dialog box):

Match 1
Text | Welcome to VAX/VMS V6.1
Row | -2
Column | 9
Match 2
Text | Username:
Row | 1
Column | 1


First Time Use (Bulk-Add)

●Administrative Procedures > Configuring the Agent > Configuring Application Templates > First Time Use (Bulk Add)

First-Time Use (Bulk-Add)

After the initial product installation, the First-Time Use Wizard requests various items of information to complete the setup process. If multiple authenticators are installed, the user is prompted to choose a Primary Logon Method. In addition, ESSO-LM can also prompt the user for application usernames/IDs and passwords to quickly populate the user's store.

In order to use Bulk-Add, you must enable First-Time Use.

The configuration settings for the First-Time Use Wizard are specified in the ftulist.ini file. End users can be prompted to provide credentials (username/ID, password, third field) for their existing logons. Combining first-time use configuration with predefined logons ensures that users reap the benefits of single sign-on immediately after installation. Alternatively, users can configure their individual logons as they encounter each application.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini can only be created and edited using the ESSO-LM Administrative Console.

Specifying Applications to Bulk-Add

Applications must be individually configured to be used in a bulk-add. See To enable a logon for Bulk-Add .
  1. Select Applications in the left pane, then select the Bulk-Add tab in the right pane.
  2. Click Add.
  3. From the Select Application dialog box, select the applications to add to this group. (Use Ctrl+click or Shift+click to select multiple entries.)
  4. Click OK.
  5. Enter or edit the Date Stamp in yyyymmdd format (for example "20030615" for June 15, 2003). If this date is later than the last date a given Agent completed Setup, then the Agent activates Setup Wizard to add the new logons.
To Enable a Logon for Bulk-Add
  1. Select Applications in the left pane, then select an application.
  2. Click the Bulk add tab in the right pane.
  3. Select Enable Bulk-Add capability for this application.
  4. If the user must re-enter one or more fields for confirmation, then select the appropriate Confirm settings.


Creating and Using Templates

Preconfigured application logons for many popular Windows applications are included with the ESSO-LM Administrative Console in the form of templates.

You can also convert the application logons that you create into templates through the ESSO-LM Administrative Console.

Templates provide two practical benefits for creating and managing pre-configured logons:

  • You can store, share, and reuse a group of specific logon settings as a "starter set" for creating new logons based on the template. Your templates appear as options in the Add Application dialog box.
  • If you make changes to a template's source logon, you can easily apply your changes to any logon based on that template, by using the Update Applications command on the Tools menu.

You create a template by:

  • Selecting an existing application logon in the Manage Templates dialog box from the Tools menu
  • Choosing the logon settings (for the application and for individual forms) that you want to be able to override later; use the Overriding Settings tab in the Edit Template dialog box (click Edit in the Manage Templates dialog box). For Web and Windows applications, you can also choose a setting that the template user must provide in order to complete the logon configuration (on the Supply Info tab).
  • Saving the current file to the Templates folder under the ESSO-LM Administrative Console program directory (typically, this is C:\Program Files\Passlogix\SSO Administrative Console\Templates).

You use a template to create a logon by selecting it from the Applications drop-down list in the Add Application dialog box. You are prompted if additional information is needed to complete the configuration.

You can update application logons with any changes made in their originating templates. Open the ESSO-LM Administrative Console XML file containing the applications and select the Update Applications command from the Tools menu.


Configuring ESSO-LM in a Citrix Environment

Default Installation of ESSO-LM on Citrix Server

The ESSO-LM default installation process automatically detects and installs the components necessary for ESSO-LM in a Citrix environment. The installation process enables ESSO-LM support for every application published on that Citrix server.

Installing ESSO-LM on Citrix Server

  1. Log on to the Terminal server as an administrator and close all applications.
  2. Click Start and then click Run.
  3. In the Run Dialog window, enter cmd and press Enter.
  4. In the Command Promptwindow, enter change user/install and press Enter.
  5. Install ESSO-LM with the appropriate installation options for your environment.
  6. At the command prompt, enter change user/execute when installation is complete.

Controlling ESSO-LM for Specific Applications in Citrix

The following section explains how to change the from the default installation of ESSO-LM and enable it for only specific applications in a Citrix environment. There are two steps in this process. The first step is to remove global ESSO-LM support. The second is to specify which applications are going to be SSO-enabled through their published application configurations.

Removing Global ESSO-LM Support

  1. Click Start and then click Run.
  2. In the Run Dialog window, enter Regedit and press Enter.
  3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
  4. From the right pane, right-click the string value AppSetup and select Modify.
  5. Delete the value data in this entry that refers to SSOLauncher. (C:\Program Files\Passlogix\v-GO SSO\wts\ssolauncher.exe /nossoshutdown)
  6. If you are using Windows Authentication v1 add the “CheckForParentProcess” key to the Passlogix registry hive. This ensures authentication event handoff to ESSO-LM.

HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\AUI\WinAuth\

DWORD:

CheckForParentProcess

Value=0

Removing ssolauncher.exe from AppSetup configures ESSO-LM not to function with any applications on this Citrix server unless specified in your published applications configuration.

Specifying Which Applications Are SSO-Enabled Through the Published Application Configuration (SSOLauncher)

Since ESSO-LM support is now globally disabled, you must specify which applications you wish to be published with ESSO-LM support by including the SSOLauncher.exe command in the published application properties.

  1. Open Citrix Management Console.
  2. Publish/Locate the application you would like to enable for ESSO-LM.
  3. Right-click on the published application and select Properties.
  4. On the Application Location tab, add to the front of the Command Line the following syntax:
    C:\Program Files\Passlogix\v-GO SSO\wts\SSOLauncher.exe/application

The command for SSOLauncher.exe is added to your published application’s command line, it does not replace it.

Following is an example of the Command Line syntax for the application ACT:

C:\Program Files\Passlogix\v-GO SSO\wts\SSOLauncher.exe” /application C:\Program Files\ACT\act.exe

This example is based on the assumption that ESSO-LM and ACT are both installed on the C:\ drive of the Citrix Server.

See SSOLauncher for Citrix Servers for more information.

Enabling Citrix Server Monitoring

To enable ESSO-LM to be monitored by Citrix Server, so that ESSO-LM will not keep otherwise-ended sessions alive, go to the following registry tree:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
  \Control\Citrix\Wfshell\TWI

If an entry named LogoffCheckSysModules exists, append to it: ssoshell.exe. For example, change app1.exe,app2.exe to app1.exe,app2.exe,ssoshell.exe.

If the entry does not exist, create LogoffCheckSysModules as type STRING and set to ssoshell.exe.


SSOLauncher for Citrix Servers

This utility lets you control the delivery of ESSO-LM with published applications in a Citrix Server environment.

To use the ssolauncher utility:

  1. Copy the ssolauncher utility in the WINNT\system32 folder. Otherwise you must include the full path to where ssolauncher resides.
  2. You can now manage the applications you want with which you want ESSO-LM to run by utilizing the ssolauncher utility. By accessing the Citrix Published Application Management console and applying the ssolauncher command through the Application Definition command line you can make ESSO-LM run on an application by application basis.
The ssolauncher command is applied in front of the command line.
Example

ssolauncher.exe /application "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

The following are the commands for ssolauncher:

Command | Use
/application | The full path of the application to execute. This is required.
/command | Used to supply command parameters to an application. This is optional.
/directory | Used to supply working to an application. This is optional.
/wait | The number of milliseconds to wait for an application to shut down. This is optional. If not specified ssolauncher will wait forever for the application to terminate.
/verbose | This supplies dialog boxes for error message if ssolauncher has any failures.
/nossoshutdown | Prevents shutting down sso when application completes.
/SSOCOMMAND LOGON | Used to initiate a command to the "Log On Using ESSO-LM" trigger, located in the ESSO-LM system tray icon.

Sample command line to launch AIM:

ssolauncher.exe /verbose /application "C:\Program Files\AIM95\aim.exe" /directory "C:\Program Files\AIM95"

The command should begin and end with quotation marks if it contains \ characters.


Configuring the Server

●Administrative Procedures > Configuring the Server

Configuring the Server for ESSO-LM

The topics below describe how to configure the server for ESSO-LM deployment and support for synchronization and event logging:

  • Directory server configuration for LDAP services, including:
    • IBM Tivoli Directory Server.
    • Microsoft Active Directory and ADAM.
    • Novell eDirectory.
    • Oracle Internet Directory.
    • Oracle Directory Server Enterprise Edition.
    • Open LDAP Directory Server.
    • Database system configuration: for Microsoft SQL Server, IBM DB2, and Oracle database systems.
    • File system configuration: for any UNC (Universal Naming Convention)-compliant network drive or device.
    • Event logging: to configure a Microsoft Windows 2000 or XP server to receive ESSO-LM Event Log messages.


Directory Servers: Configuring the server

●Administrative Procedures > Configuring the Server > for Directory Server synchronization

Directory Server: Configuring the Server

This topic describes how to extend directory servers to work with ESSO-LM. Although this process simplifies some directory-related tasks, it assumes that the administrator has knowledge of the planning and deployment of directory services. This guide only covers concepts specific to ESSO-LM deployments.

See Directory Server Synchronization Support for more information about how ESSO-LM makes use of directory server resources.

Configuring a directory server for ESSO-LMentails using the ESSO-LM Administrative Console to extend the schema and set up objects in the directory structure.

When you connect to a directory server, you must provide administrator-privileged authentication information. This information includes the directory type, server name or IP address (IP address may not be valid for Microsoft Active Directory Server), port, SSL-use selection, user ID and password.

Your user ID should be in DN format; for example,

uid=yourname,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot

Directory operations must be performed from Microsoft Windows 2000 and XP.

For ADAM (Active Directory/Application Mode) repository:

The ADAM server instance must be installed and running before you begin the following procedure.

The naming context for the Application Directory Partition (step 2, below) must be an organization unit (ou). The example given in the ADAM Setup Wizard panel shows a cn(container name).
  1. Extend the directory schema.

It is considered a good practice to perform a backup of your directory before and after extending the schema. However, it is not necessary to disconnect users to extend the schema, or to reboot the server after the schema is extended.
  2. From the Repository menu, select Extend Schema.
  3. In the Connect to Repository dialog box, enter or select the required connection information, then click OK. The ESSO-LM Administrative Console binds to the repository, adds attributes and object classes, and confirms successful server configuration.
  4. Repeat for each additional server.

  5. Create the container object.

    A container object, typically named vgoconfig (class organizationUnit), holds overriding settings and a container object named People. The People container object (class organizationUnit) holds a container object for each user (class SSOUserData, and each of these user container objects holds user credentials and settings (class SSOSecret.

    Use the ESSO-LM Administrative Console to create container objects with the proper security, to create the People container object with the proper security, and to place overriding settings with the proper security in the People container object.
  6. In the left pane of the ESSO-LM Administrative Console, right-click Repository and select Connect to from the shortcut menu.
  7. Enter or select the required connection information, then click OK.
  8. In the right pane, navigate to the container object where you will create the People object and overriding settings.
  9. If necessary, create a new container object:
    1. Right-click the parent container object, and select New Container from the shortcut menu.
    2. Enter a name for the new container object and select it.
    3. Right-click the container object (where the People container object and overriding settings will exist) and choose Publish to Repository from the shortcut menu.
    4. Choose the Data Source of the overrides and provide the information requested:
      • Administrative Console
      • Data File
  10. When you complete the configuration procedure, the newly-created People object, and entries for any overriding settings appear in the Repository pane. Right-click on any object and choose Refresh if necessary.
  11. Repeat this procedure for each additional container object.
  12. Create locator objects.
    1. In the left pane of the ESSO-LM Administrative Console, right-click Repository and choose Connect to from the shortcut menu.
    2. Enter or select the required connection information, then click OK.
    3. In the right pane, navigate to the container object where you will create the People object and overriding setting.
    4. If necessary, create a new container object:
      1. Right-click the parent container object, and choose New Container from the shortcut menu.
      2. Enter a name for the new container object and select it.
    5. In the right pane, navigate to the container in which you want to add the locator.
    6. Right-click the container and choose Add Locator Object from the shortcut menu.
    7. Specify the Locator Name (enter Default for all users unless there is one for a specific user).
    8. Navigate to the parent container object of the target People container object (or specify its path) and click OK. The newly-created SSOLocator object appears with the name you specified. Right-click any object and choose Refresh if necessary.
    9. Repeat for each additional SSOLocator object.
As described in Directory Structure, ESSO-LM looks for an SSOLocator object when it connects to the Directory Server, which points where the Agent can store user credentials. An object named Default is required somewhere in the tree. You can create specific SSOLocatorClass objects for specific users as needed.


File Systems: Configuring the Server

This topic describes how to extend File Systems to work with ESSO-LM. Although this process simplifies some tasks, it assumes that the administrator has knowledge of the planning and deployment of file system shares. This guide only covers concepts specific to ESSO-LM deployments.

See File System Synchronization Support for more information about how ESSO-LM makes use of file system resources.

Configuring a File System share for ESSO-LM entails using the ESSO-LM Administrative Console to set up objects in the directory structure.

When you connect to a File System, you may need to provide Administrator-privileged authentication information. This information includes the synchronizer extension type, UNC path, user ID, and password.

Your user ID should be in domain name format, for example, yourdomain\yourname

Creating the Container Object

A container object is typically a file system share in UNC format, for example

\\Server\Share

Or it can be a share with a path, for example:

\\Server\Share\Path\subPath

The container object holds overriding settings and a container object named People.

  • The People container object is a file folder that holds a container object for each user (rights: User=Full; Server\Administrators=Full),
  • Each of these user container objects holds a container object named SSOUserData.
  • Each SSOUserData container object holds user settings in an SSOSecretData object (a file) and container objects for each application credential.
  • Each of these container objects contains a user's credentials for one application (a file named SSOSecretData).

Use the ESSO-LM Administrative Console to create container objects with the proper security, to create the People container object with the proper security, and to place overriding settings with the proper security in the People container object.

  1. In the left pane of the ESSO-LM Administrative Console, right-click Repository and choose Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the container object where you will create the People object and overriding settings.
  4. If necessary, create a new container object:
    1. Right-click the parent container object, and choose New Container from the shortcut menu.
    2. Enter a name for the new container object and select it.
  5. Right-click the container object (where the People container object and overriding settings will exist) and choose Publish to Repository from the shortcut menu.
  6. Choose the Data Source of the overrides and provide the information requested:
    • Administrative Console
    • Data File
  7. When you complete the configuration procedure, the newly-created People object and entries for any overriding settings appear in the Repository pane. Right-click on any object and choose Refresh if necessary.
  8. Repeat this procedure for each additional container object.


Database Synchronization: Configuring the Server

This topic describes how to configure a relational database server to work with ESSO-LM. It assumes that you have basic knowledge of relational database administration and operation. This guide only covers concepts specific to ESSO-LM deployments.

See Database Synchronization Support for more information about how ESSO-LM makes use of database resources.

Configuring ESSO-LM for database synchronization requires using the ESSO-LM Administrative Console to extend the database schema and to create the container objects.

  1. Extend the database schema.

Perform a backup of your database before and after extending the schema.
  1. Choose Extend Schema from the Repository menu.
  2. From the Connect to Repository dialog box, enter or select the required connection information, then click OK. You must have administrator-level authentication to connect the ESSO-LM Administrative Console to the database server. The ESSO-LM Administrative Console connects to the database, creates the necessary objects, and confirms successful configuration.

For SQL Server, when extending the schema, if the database does not exist, the extend schema function will create the database for you. For IBM DB2 Setup instructions, click here.
  2. Repeat for each additional server.
  3. Create the container objects.

A container object, typically named SSOConfig, holds a default set of overriding settings and a container object named People. The People container object contains a container object for each user, and each of these user container objects holds user credentials and settings.

Use the ESSO-LM Administrative Console to create container objects, to create the People container object, and to place overriding settings with the proper securityin the People container object.

  1. In the left pane of the ESSO-LM Administrative Console, right-click Repository and select Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the container object where you will create the People object and overriding settings.
  4. If necessary, create a new container object:
  5. Right-click the parent container object, and choose New Container from the shortcut menu.
  6. Enter a name for the new container object and select it.
  7. Right-click the container object (where the People container object and overriding settings will exist) and choose Publish to Repository from the shortcut menu.
  8. Choose the Data Source of the overrides and provide the information requested:

    • Data File

    • Administrative Console
  9. When you complete the configuration procedure, the newly-created People object, and entries for any overriding settings, appear in the Repository pane. Right-click on any object and choose Refresh if necessary.
  10. Repeat this procedure for each additional container object.


Configuration Test Manager

This tool enables you to test your Global Agent Settings to ensure that they are properly configured.

You can only run these tests on an Active Directory repository.

To access this tool, either:

  • Select Test Global Agent Settings from the Tools menu. If you access the test manager from this location, you are required to pick a set of Global Agent Settings to test.

    or

  • Right-click on a set of Global Agent Settings and click Test. If you access the test manager from this location, the tests will run on that set of Global Agent Settings only.

All changes made in the test manager are reflected in the ESSO-LM Administrative Console. Upon launching the test manager, a dialog box appears, informing you that any changes you make in the test manager will be reflected in the ESSO-LM Administrative Console. You can dismiss this message by selecting Do not show this notice again.

Before using this tool, in addition to reading this help information, Oracle strongly recommends that you read the Deploying ESSO-LM with <Repository> and the Configuring the ESSO-LM Agent Best Practice Guides, located at:

http://download.oracle.com/docs/cd/E21040_01/index.htm.

These guides describe best practices and recommended procedures for deploying ESSO-LM on your repository and configuring the ESSO-LM Agent with Global Agent Settings and administrative overrides.

There are three stages in the testing process:

  1. Select Categories . Select the test categories to determine which tests to run.
  2. Enter Parameters . Enter all data needed to run the tests.
  3. Execution and Results . Run tests, view results, and make changes if necessary.

Categories

When you open this tool, the Categories stage is selected in the left pane. The Test Categories pane lists the categories and individual tests.

The Test Categories list is interactive - you can check or uncheck desired categories, and expand or collapse the categories to view the individual tests. You can click on any category or test and a description appears in the right pane.

By default, all categories are selected. Individual tests cannot be selected.

As long as at least one test category is selected, the Next button and the Parameters stage are enabled. The Execution and Results stage is unavailable until all of the data parameters are satisfied.

The Synchronization test category contains the following individual tests, which verify synchronization settings.

Test Name | Test Description
Server Validation | Verifies that the specified server is a valid server name and is accessible. If an IP address is entered as the server name, or the server cannot be accessed, this test will fail.
SSL Configuration | Checks the server to determine if SSL is enabled. If SSL is not enabled on the server, and SSL is enabled in the ESSO-LM Administrative Console, this test will fail.
Schema Extension | Verifies that the schema is extended. If the schema is not extended, this test will fail.
User Object Schema Extension | Verifies that the schema is extended under the Active Directory User Object. If the schema is not extended, this test will fail. This test applies to Active Directory synchronizers only.
Configuration Object Retrieval | Verifies that the Configuration Object Base Location path is valid and that the configuration objects can be retrieved with the test credentials. If the path is not valid or the test credentials supplied do not have permission to retrieve configuration objects, this test will fail.
Credential Location Access Rights | Verifies the proper access rights are assigned to the credential location on the server to upload, retrieve, and delete credentials. If the supplied test credentials do not have permission to perform any of these actions, this test will fail.

Ensure the Synchronization test category is selected and click Next, or click the Parameters stage from the left pane.


Execution & Results

The Execution & Results stage is where you run the tests, view the results, and make changes if necessary.

The Execution & Results stage is unavailable until all of the data is entered during the Parameters stage.

Test Execution and Results

The Test Execution & Results pane lists all the tests to be run, in the order that they will be run. Once you click Execute Tests, the tests will run and once a test is in progress, and icon appears indicating the status of the testing. There are 5 possible statuses:

  • Passed: The test has completed and passed.
  • Need info: The test is paused to allow the user to enter prompted information.
  • Warning: The test has paused, prompting the user with a warning.
  • Failed: The test has failed. Information is provided explaining why the test failed. All testing stops when a single test fails.
  • In Progress: Test is in progress.

Once tests have run, you can click through them and read the results and messages about each test in the Description pane.

Description

The Description pane provides a description of the test. As tests run, the lower portion of the Description pane will provide messages such as warnings, passed and failed situations, and fields to change information and continue testing.

The Execute Tests button begins the testing. When tests are running, the Execute Testsbutton toggles to Stop Tests, allowing you to cancel the testing if desired.

In this pane, you can interact with either Failed or Need Info tests results. You are presented with information and actions or fields you can make changes to and re-run the tests.

Clear All Data

If you want to clear the data for this test and future sessions, click the Clear All Data button at the top of the Descriptionpane. A message will appear asking if you are sure you want to do this and provide two paths:

  • Click OK to clear ALL parameters.
  • Click Cancel to close the dialog box, and all data is retained.

If you click OK , and tests were previously run with results available in the right frame, the test results persist, but the Execute Test button is disabled.

Once the tests have all passed, you can exit by closing the Test Manager from the X in the top right title bar. You may also use the Clear All Data button, navigate to the Categories or Parameters page and set things up to run different tests.


Parameters

The Parameters stage collects all the data necessary to run the tests. The data requested during this stage is dependant upon the test categories selected in the Categories stage.

The Execution & Results stage is unavailable until all of the data parameters are satisfied.

Test Parameters

The parameters are listed in the Test Parameters pane and are dynamic based upon the tests selected. Each parameter has a status icon of Needed or Acquired to visually indicate which parameters need attention. For example, if the User Credentials have not been acquired, and the Global Agent Settings have been acquired, the Test Parameter list will look like this:

Data

The data needed for each parameter is entered in the Data pane on the right.

You must input all needed data before running any tests. Once all parameters are successfully acquired, the Next button and Execution & Results stage become available.

The Next Parameter button, located on the bottom of the Data pane, is available when there are multiple parameters. It enables you to quickly click through all the parameters.

It is important that you ensure that the quality of the data parameters entered is good. Just because data exists and a status is set to acquired, does not mean the data is correct.

As the data is entered, it is captured for the current session. You can either save or clear the data for future sessions:

  • Saving the data: If you want to save the data for future sessions, ensure the Save this value check box located below the Data pane is checked.
  • Clearing the data: If you want to clear the data for this and future sessions, click the Clear All Data button at the top of the Data pane. A message will appear asking if you are sure you want to do this. Confirming this action will clear all entered parameters, turning all of the parameter statuses to Needed. It will also disable the option to proceed to the Execution and Results stage.

Once all data is entered, click Next >, or select the Execution & Results stage in the left pane.

Once all data has been acquired, move onto the next stage.


Setting Password Policies

ESSO-LM allows administrators to set policies that control automatic password generation. Password policies simplify user logons while ensuring the organization's security.

Most applications have constraints for passwords how long they can or must be, whether you can use numbers or symbols, and so on. ESSO-LM password generation feature improves application logon security by automatically creating passwords made up of random characters according to predefined sets of constraints, stored as password policies. Each policy can apply to multiple applications, or subscribers.

Using predefined password policies, you can completely automate password changes and implement sophisticated security schemes, including complex passwords, frequent password changes, and application-specific passwords unknown to users.

If the policy you create makes a password difficult or impossible, ESSO-LM will try to create a password for up to five seconds and then notify the user that it was unable to generate a password. You can preview the passwords a particular policy generates using the Test Password Policy dialog box.


Creating Credential Sharing Groups

Credential sharing groups let users apply a credential change made in one application to other specified applications automatically.

When ESSO-LM handles a credential change for any application that is a member of the sharing group, it automatically applies the credential change to all other group members. Any number or combination of Windows, mainframe/host, and Web applications can share a single credential. when using the Windows (Domain) or Directory Server (LDAP) authenticator, selected applications can share a single credential with the authenticator as well.

Applications will share credentials for only their initial deployment to the Agent unless you enable Credential Sharing Groups. Set this parameter in the Required Password Change settings. You can permit or prohibit users control over which of their applications share credentials in the Advanced Password Change settings.

For example, an enterprise might have a new Web interface to an old mainframe application. One way to share the credential between these two is to use a credential sharing group. Some applications share a common credential (for example, an Intranet application and an e-mail application). These applications should be in the same credential sharing group.

See Credential Sharing Groups for the procedures for creating and managing sharing groups.

The Windows authenticator password is in a predefined group named Domain.

The LDAP Directory Server authenticator is in a predefined group named LDAP.

Supporting Predefined Applications

The ESSO-LM Administrative Console does not currently support adding predefined applications (those included in the default configuration file applist.ini) to credential sharing groups. You must do this manually by creating identically-named sections in entlist.ini (the custom-application configuration file) that identifies the sharing group. The following example adds an Internet Explorer pop-up application to the credential sharing group OurServer.

Example:

[~Internet Explorer Pop-up XP]
Group=OurServer


Storing User Data

ESSO-LMstores user credentials locally in the ...\Application Data\Passlogix folder. Global Agent settings are stored in the Local Machine registry key (HKLM); settings modified the user are stored in the Current User registry key (HKCU).

ESSO-LM can also perform a complete backup of credentials and settings to a file (.bkv). The backup can be performed manually by the user, or automatically by administrative configuration). For details on this feature, see File-Based Backup/Restore .

ESSO-LM can also synchronize individual user credentials with these remote sources, including file-systems, databases, and directory servers. These remote sources can provide the Agent with application logons. first-time-use (setup) information and administrative overrides (global Agent settings). For details on this feature, see Synchronization.

Storing Credentials in the User Object (Active Directory only)

On Active Directory installations, you can configure ESSO-LM to store user data under the user object, rather than in the standard vgoconfig container. To do this, take the following steps:

  1. Use the Enable Storing Credentials under User Object command (on the Repository menu) to update the directory schema to allow user-credential containers as children of user objects. This command also modifies the directory-root security settings to grant users the rights to create the credential containers.
  2. Do one of the following:
    • Select the Store data under the user objects option (in the Add Locator Object dialog box) to create a vgolocator object ("default" for all users that use this locator, or for specific user by distinguished name) that points to the user objects.
    • Use the Location for storing user credentials Agent setting (in the Active Directory settings) to configure the Agent to disregard the vgolocator object and always store credentials under the user object.


File-Based Backup/Restore

If the backup/restore module is installed, the ESSO-LM Administrative Console can perform a complete backup/restore of user credentials and settings to or from another location. The backup/restore can be performed manually (by the user) or automatically (by administrative configuration). Also, a selective backup/restore (writing the newer information over the older information) can be performed automatically (by administrative configuration).

If the Backup/Restore module is installed, the user can perform a manual backup, store to any location (even a floppy drive), and select any password (even a one-character password).

Automatic Backup

You can configure the Agent to perform a full backup of user credentials and settings. This backup can be triggered from the command line (and thus from an "at," or timed, job) or by configuring certain Agent events (for example, the Startup task, the Refresh task, and so on).

Command-Line Automatic Backup

To trigger a Command-Line Automatic Backup, run the Agent from the command line (even when the Agent is currently running) using the following syntax:

ssoshell.exe /mobility /backup [path] /silent &where&
[path] | The actual path to the directory where the backup file is pl`1aced. The default is the last directory where a command line backup file was stored, or to where the Default Backup path (under End-User Experience\ Environment) points.
` | Do not show the Backup/Restore Wizard when performing the backup.

To perform a completely silent backup to a network share at \\FS\Backup\Private:

ssoshell.exe /mobility /backup "\FS1\Backup\Private" /silent

To backup to the last-used location or to where the Default Backup path(under End-User Experience\ Environment) points:

ssoshell.exe /mobility /backup /silent

Event-Driven Automatic Backup

To configure the Agent to perform an automatic backup upon certain Agent events, determine the command line string needed to perform the desired backup. Then, set the appropriate task. For example, to perform a backup with every change in credentials, set a task to run When logons change (under End-User Experience\Advanced\Special Tasks) to the command line string.

Forced Restore

The Agent can be configured to perform a full restore of user credentials and settings, replacing any existing data. This restore can be triggered from the command line (and thus via a remote "run" command) or by configuring certain Agent events (for example, the startup task).

Command-Line Forced Restore

To trigger a Command-Line Automatic Backup, run the Agent from the command line (even when the Agent is running) using the following syntax:

ssoshell.exe /mobility /restore [path] /silent &where&
[path] | The path to the directory where the backup file exists. The default is the last directory where a command line backup file was stored, or where the Default Backup path (under End-User Experience\Environment) points.
/silent | Do not show the Backup/Restore Wizard when performing the backup.

To perform a completely silent restore from a network share at \\FS\Backup\Private:
ssoshell.exe /mobility /restore "\FS1\Backup\Private" /silent

To restore from the last-used location or to where the Default Backup path (under End-User Experience\ Environment) points:

ssoshell.exe /mobility /restore /silent

Event-Driven Forced Restore

To perform a Forced Restore upon certain Agent events, determine the command line string needed to perform the desired restore. Then, set the appropriate task. For example, to perform a restore at startup, set a task to run After Agent starts up (under End-User Experience\Advanced\Special Tasks) to the command line string.


Synchronization

Synchronizer extensions allow you to synchronize credentials between an end user's local store (on a workstation) and a store in a remote SSO repository (file system share, relational database or directory server). You can also use these extensions to deploy Administrative Overrides of local Agent settings, application logon configurations (overriding entlist.ini and to be merged with applist.ini), and bulk-add lists (overriding ftulist.ini). See Overriding Settings for more information.

Synchronizer extensions communicate with directory servers, database servers, file systems, and other storage devices. Each type of extension has its own configuration requirements. ESSO-LM supports the following extensions:

  • Microsoft Active Directory Server, including Application Mode.
  • An LDAP-compliant directory server, including IBM Tivoli Directory Server, Novell eDirectory, Oracle Internet Directory, Oracle Directory Server Enterprise Edition, and OpenLDAP Directory Server.
  • Relational databases, including Microsoft SQL Server. IBM DB2 and Oracle 9i/10g.
  • Network file systems.

The synchronizer extensions are capable of performing the following tasks:

  • Connecting to (or binding with) a destination device/resource/store.
  • Retrieving any overriding settings (Administrative Overrides, application configuration information, and first-time use configuration information).
  • Synchronizing the local user store (credentials) with the remote store.

ESSO-LM supports using each extension multiple times, which allows you to support multiple configurations. For example, if the LDAP Directory Server and File System synchronizer extensions are installed, the Agent will synchronize credentials with, and download overriding settings from, both an LDAP Directory Server and a File System.) See Multiple Synchronizer Extensions for more information about the procedures.


Directory Server Synchronization Support

The ESSO-LM Administrative Console supports any LDAP directory server, including:

  • IBM Tivoli Directory Server
  • Microsoft Active Directory (including Application Mode)
  • Novell eDirectory
  • Oracle Internet Directory
  • Oracle Directory Server Enterprise Edition
  • Open LDAP Directory Server

ESSO-LM uses directory server resources for administrative configuration, mobility, and backup. Administrators can deploy configuration overrides to provide new registry, entlist.ini, and ftulist.ini (bulk-add) settings or to update existing settings. Users can store credentials (for backup) and move among multiple computers (for mobility). When ESSO-LM connects to a directory server, it utilizes a specific directory structure to determine where the user's credentials and overriding settings reside.

Each Directory Server presents platform-specific configuration issues. These are addressed in the individual configuration topics.

Directory Structure

Within each directory, ESSO-LM utilizes the following object structure:

[ view diagram ]

When a user first connects to a directory server, the system is configured to locate a specific path on the directory tree. Using the process described below, the Agent is able to find the SSOConfig object, which contains overriding settings, and a People object, which contains the user's settings, preferences, and credentials.

Finding and Creating User Objects

This topic explains the methods that ESSO-LM uses to locate user objects and configuration information, and how to create these objects.

The Agent must locate the specific object in which to store and retrieve the user's credentials. After the first successful connection, the Agent records the objects DN in the user's registry at:

HKCU\…\Extensions\SyncManager\%Extension%:Root

where %Extension% can be any name as specified in Sync Order (see Synchronization). However, for the first connection from a given workstation, if the user's object is moved, or if the user registry does not contain this information, the Agent must search for the user's object.

ESSO-LM uses three methods to search for the proper location to store user credentials on a directory server. Each method looks at the specified distinguished name; the latter two then each "walk the directory tree," toward the root, to look for a parent object with relevant information.

  • The first method is to look for the user object CN=%UserName%,OU=People) in a specified place.
  • The second method is to look for a user-specific pointer object (CN=%UserName%,OU=SSOLocator) to the right place; and if the object is not present, "walk the tree" until the Agent finds the object or checks the root.
  • The third method is to look for a default pointer (CN=default,OU=SSOLocator) to the right place; and if the object is not present, "walk the tree" until the Agent finds the pointer to the object or checks the root.

If none of these methods succeeds, the user cannot store credentials on the Directory Server (any existing local credentials will be useable).

The %UserName% variable is set automatically in Microsoft Active Directory from the users system username/ID. For LDAP Directory Servers, the %UserName% variable is set from the username/ID with which the user performs a bind to the Directory Server.

Method 1: ESSO-LM Looks for the User Object

ESSO-LM first looks for the user object, CN=%UserName%, inside an OU=People object, specified by the Root registry key (see above).

If that registry key is set to

OU=SSOConfig,OU=QA,OU=Eng,OU=Company,DC=com,

then the Agent looks for

CN=%UserName%,OU=People,OU=SSOConfig,OU=QA,OU=Eng,OU=Company,DC=com.

If the Root registry key is not set, the Agent looks in

HKLM\…\Extensions\SyncManager\%Extension%

for User Paths (see Synchronization\LDAP\Required) or Naming Attribute string (see Synchronization\LDAP\Advanced), which points to where the Agent should look.

For example, if UserPath1 is set to

CN=users,DC=Company,DC=com

then the Agent looks for

CN=%UserName%,OU=People,OU=SSOConfig,OU=QA,OU=Eng,OU=Company,DC=com

Method 2: ESSO-LM Looks for a User Pointer

If the user object is not present, ESSO-LM next looks for an SSOLocator object in the same object as the SSOConfig object. Therefore, continuing the example above, the Agent looks for

CN=%UserName%,OU=SSOLocator,OU=QA,OU=Eng,DC=Company,DC=com

If the user pointer is not present, then the Agent "walks the tree," toward the root, looking first in

CN=%UserName%,OU=SSOLocator,OU=Eng,DC=Company,DC=com

and then

CN=%UserName%,OU=SSOLocator,DC=Company,DC=com

If an SSOLocator object exists with the users CN, it points to where the users credentials will be stored; the Agent records this information in the users Root registry key, and future logons look in that location.

Note that the pointer can indicate any location in the Directory Tree; for example, a pointer at

CN=%UserName%,OU=SSOLocator,OU=Eng,DC=Company,DC=com

can point to a user object at

CN=%UserName%,OU=People,OU=SSOConfig,OU=Sales,DC=Company,DC=com.

Method 3: ESSO-LM looks for a Default Pointer

If a user pointer object is not present, ESSO-LM next looks for a default object inside each SSOLocator object. Continuing the example above, the Agent looks for

CN=default,OU=SSOLocator,OU=QA,OU=Eng,DC=Company,DC=com

If an SSOLocator object exists with the CN=default object, it points to where the users credentials will be stored by default; the Agent records this information in the users Root registry key, and future logons look in that location. An example of a default object is OU=People,OU=SSOConfig,OU=Sales,DC=Company,DC=com.


File System Synchronization Support

The ESSO-LM Administrative Console supports file system synchronization with any network drive/device that can be addressed by UNC (Universal Naming Convention). File system synchronization can also be used to support a kiosk user scenario, where multiple users share a single workstation.

File System Structure

When a user first connects to the file system, the computer is configured to locate a specific path. The Agent is then directed to find the SSOConfig object, which contains overriding settings and a People object, which contains the user's settings, preferences, and credentials.


Database Synchronization Support

ESSO-LM Administrative Console supports synchronization of user credentials, application logons, and global Agent settings between client workstations and a relational database server. Supported servers include Microsoft SQLServer 2000, IBM DB2, and Oracle 9i/10g.

In this type of synchronization, ESSO-LM configuration objects and user data containers are stored on the server as database records in ESSO-LM-specific tables:

  • SSO_ADMIN stores, as records, the configuration objects you create in the ESSO-LM Administrative Console:
  • EntList (application logons), FTUList (Setup Wizard configurations)
  • AdminOverride (Global Agent Settings)

During synchronization, all workstation users read their logons and overrides from this table; only the administrator, using the ESSO-LM Administrative Console) can write to it. These configuration object are depicted in the ESSO-LM Administrative Console in the same hierarchal layout as for file system and directory server synchronizers.

  • SSO_USERS stores user credentials, preferences, and synchronization states as records. During synchronization, users read and write to their own record. Only the record for the user currently logged on can be accessed. In the ESSO-LM Administrative Console, the records for each user are depicted within the user container.

When ESSO-LM connects to the database server, it reads the configuration objects and overriding settings (from SSO_ADMIN) and synchronizes the user data (in SSO_USERS).

The procedure for configuring database synchronization is similar to that for other synchronization methods.

  1. Extend the database schema to create the two tables described above.
  2. Create the container objects: an SSOConfig object. This object contains overriding settings and a People object, which holds the user containers for each user's settings, preferences, and credentials.


Multiple Synchronizer Support

ESSO-LM supports synchronizing to multiple synchronizer extensions and multiple configurations of the same extension. In either scenario, the Agent attempts to complete synchronization with the first extension and then with each subsequent extension.

Overriding settings can exist on each extension. See Handling Multiple Sets of Overriding Settings for an explanation of how the Agent handles multiple extensions with overriding settings.

References to %AD%, %LDAP%, and %File% refer to the respective extensions, and %Extension% refers to any of those extensions.

Multiple Synchronizer Extensions

ESSO-LM supports using multiple synchronizer extensions simultaneously. For example, the Agent could first synchronize with a Microsoft Active Directory Server, then with an Oracle Directory Server Enterprise Edition, and then with the File System synchronizer. With Authentication Manager, the Agent could then synchronize with a smart card.

To enable this:

  1. Install ESSO-LM with the desired synchronizer extensions.
  2. In the ESSO-LM Administrative Console, select an existing set of Global Agent Settings or create a new set.
  3. In the left pane, open the Global Agent Settings, right-click Synchronization and select Manage Synchronizers.
  4. In the Synchronizers dialog box, select Add, name this extension, select the extension type (for example, Active Directory, File System, or LDAP), then click OK.
  5. Repeat the previous step for additional synchronizer extensions, and reorder as desired.
  6. For each synchronizer: select it in the left pane and confirm in the right pane that Path is selected and the location specified is correct.

Oracle recommends that you set the DisplayName registry entry to help the user distinguish between the multiple extensions.

Multiple Configurations of the Same Synchronizer Extension

ESSO-LM supports using a given extension with multiple configurations. For example, one LDAP Directory Server configuration could be for an Oracle Directory Server Enterprise Edition, and another LDAP Directory Server configuration could be for Novell eDirectory.

To enable this:

  1. Install ESSO-LM with the desired synchronizer extensions.

In the ESSO-LM Administrative Console, select an existing set of Global Agent Settings or create a new set.

  1. In the left pane, open the Global Agent Settings, right-click Synchronization and select Manage Synchronizers.
  2. In the Synchronizers dialog box, select Add, name this extension, select the extension type LDAP, then click OK.
  3. Repeat the previous step for additional synchronizer extensions, and reorder as desired.
  4. For each synchronizer: select it in the left pane and confirm in the right pane that Path is selected and the location specified is correct.

Oracle recommends that you set the DisplayName registry entry to help the user distinguish between the multiple extensions.


Roaming Profile Synchronization Extension

The ESSO-LM Administrative Console supports file system synchronization. The Roaming Profile Synchronizer extension supports roaming profiles. Use it in the deployments that meet the following conditions:

  • Users are set up to use roaming profiles on the server.
  • The “Delete Local Cache” setting has not been enabled for synchronization.
  • You are using V1 Authentication.

If the above conditions exist, set up the roaming profile environment as follows:

  1. Set ESSO-LM to operate in a multi-sync environment, where one of the sync extensions installed is the roaming sync extension. A multi-sync environment is one in which at least two sync extensions are installed. For example, if you are using AD sync extension, you must install AD sync extension and Roaming profile extension.
  2. The Roaming Profile Synchronizer extension must be the first synchronizer in the sync configuration order. To set this order, expand Global Agent Settings > Live and click on Synchronization. Locate the Sync Order field and click the "…" button. On the Synchronizers panel make sure ROAMSyncExt is first and the other Sync type being used is second, for example, ActiveDirectory.
  3. No changes need to be made in the AD sync settings, or any other sync being used with Roaming Profiles.


Overriding Settings Objects

Configuration Objects

Synchronizer extensions can download overriding configurations for global Agent settings (administrative overrides), application configuration information (EntList), and first-time use scenarios (FTUlist). Each of these objects has a local equivalent:

Settings Type | Local Equivalent | Directory Server/ Database Object Name | File System Object Name
Administrative Overrides | Registry entries under HKLM | SSOAdminOverride | AdminOverride
Application logon configuration information | The entlist.ini file | SSOentlist | entlist
First-time-use configuration information (including bulk-add information) | The ftulist.ini file | SSOftulist | ftulist

The latter two types of objects are similar in format and layout to their local equivalents, entlist.ini and ftulist.ini. The first type of object has the following syntax:

[HKLM\Software\Passlogix]

REQUIRED: RegistryPath\RegistryPath:KeyName=TYPE:Value

This format is exported by the ESSO-LM Administrative Console.

Example:

[HKLM\Software\Passlogix]

Shell:AutoBackupPath=STRING:\\FS\Home

Shell:ShowAccessBtn=DWORD:1

Extensions\AccessManager:ReauthOnReveal=DWORD:0

In directory server installations, this configuration information can be enabled with support for role group-based access.

Certain settings, such as server URLs, must not be overridden and are thus permanently excluded from administrative override objects. The table in Overriding Setings: Registry Entries denotes whether a setting is excluded from being overriden.

Working with Multiple Sets of Overriding Settings

The Agent attempts to retrieve each type of overriding settings from each extension until it finds an extension that has at least one of each; once an overriding setting is downloaded, the Agent does not query other extensions for that overriding setting.

Sample Scenarios

Example:
  • Order: Ext1,Ext2,Ext3,Ext4.
  • Ext1 has Admin Overrides.
  • Ext2 has Admin Overrides, an entlist.ini file, and an first-time use information file.
  • Ext3 has no Admin Overrides.
  • Ext4 has Admin Overrides, and an first-time use information file.
Scenario A
  • Ext1 connects; downloads Admin Overrides; and synchronizes.
  • Ext2 connects; downloads application configuration information and first-time use configuration information; and synchronizes.
  • Ext3 connects and synchronizes.
  • Ext4 connects and synchronizes.
Scenario B
  • Ext1 fails.
  • Ext2 connects; downloads Admin Overrides, application configuration information, and first-time use configuration information; and synchronizes.
  • Ext3 connects and synchronizes.
  • Ext4 connects and synchronizes.
Scenario C
  • Ext1 fails.
  • Ext2 fails.
  • Ext3 connects and synchronizes.
  • Ext4 connects; downloads Admin Overrides and first-time use configuration information; and synchronizes.


Selective Backup Command Line Synchronization

●Using the Console > Repository > Selective Backup Command Line Synchronization

Selective Backup/Restore

The Agent can be configured to compare the local store of user credentials with a remote backup file and write the newer set over the older set. This selective backup/restore, or "synchronize", can be triggered from the command line (and thus from an "at", or timed, job) or by configuring certain Agent events (for example, the Startup task, the Refresh task, and so on).

Individual sets of credentials are not compared; for this more-granular level of synchronization, see Synchronization.

Command-Line Synchronization

To trigger a Command-Line Synchronization, run the Agent from the command line (even when the Agent is currently running) using the following syntax:

ssoshell.exe /mobility /sync [path] /silent

Where:

[path] | The actual path to the directory where the backup file may exist. (Default: the last directory a command line backup file was stored, or where Shell:AutoBackupPath points.)
/silent | Do not show the Backup/Restore Wizard when performing the backup/restore.

To perform a completely-silent synchronize with a network share at \\FS\Backup\Private:

ssoshell.exe /mobility /sync "\FS1\Backup\Private" /silent

To synchronize to the last-used location or to where Shell:AutoBackupPath points:

ssoshell.exe /mobility /sync /silent


Event Logging

The topics in this section describe the ESSO-LM Administrative Consoleevent logging feature and setup process. Event logging monitors a variety of user events including:

  • Agent startup/shutdown
  • Logon
  • Password changes
  • Credential addition, change, and deletion
  • Authenticator changes
  • Backup and restore
  • Credential synchronization
  • Settings changes
  • Help-system use

Through the ESSO-LM Administrative Console, you control what events are logged, where and when they are logged, and whether to maintain a local copy of the log. The addition of extensions allows for various log destinations and formats.


Event Logging: Configuring the Agent

●Administrative Procedures > Event Logging > Agent Configuration

Event Logging: Agent Configuration

Event Logging is an optional feature of ESSO-LM. It does not install by default.

To install event logging, select Custom Install and enable the Event Manager and the event logging extensions you want to use from the Extensions selection. After installation, you must set up certain parameters for event logging and any installed extensions.

Global settings are set in HKLM\…\Extensions\EventManager.

Extension-specific settings are set in HKLM\…\Extensions\EventManager\%Extension%.

ESSO-LM ships with the Local (XML) File extension (Local Storage) and the Windows Event Logging extension (WindowsEvent).

Global Settings

As events occur, they are cached until a predefined amount of time passes. At this point, the events are filtered and sent to the appropriate extension. Upon successful transmission to each extension, the events are cleared from the cache.

Under Global Agent Settings > [selected set] > Event Manager
Filter | Specifies which event types and which specific events will be logged. Specify one global filter value for all extensions, or a different global filter value for each extension.
Retry | Specifies the interval (in minutes) the Agent should wait between successive attempts to log cached events to the event extensions. Default value for all extensions is 30 minutes.

Local File Extension

The local-access Event Manager extension is the Local File Extension. This extension creates an XML file %UserName%.eventlog.xml containing the filtered event data. The file is in the same directory (%AppData%\Passlogix) as the users AML file and is readable by any recent-release browser.

Under Global Agent Settings > [selected set] > Event Manager >LocalStorage
Filter | Specifies which events to log to the Local (XML) File Logging extension.
Retry | Specifies the interval (in minutes) between retries for the Local (XML) File Logging extension. Default is 30 minutes.

The following example shows the raw XML for an event log containing a single logon event:

Example:

<EVENTLOG>

<event>

<type>Info</type>

<category>Logon</category>

<timestamp>4/25/2002 5:46:06 PM</timestamp>

<appname>ACT</appname>

<username>SSOUser</username>

</event>

</EVENTLOG>

Windows Event Logging Extension

The Windows Event Logging extension relies on the Windows Event Logging built into Microsoft Windows 2000 and XP. To view the log, start Event Viewer (for example, run eventvwr.exe). ESSO-LM entries are in the Application Log. The server must be properly configured.

Under Global Agent Settings > [selected set] > Event Manager >WindowsEvent
Event Server

Server name for the Windows Event Logging extension (omit the "\\", for example, specify fileserver, not \\fileserver). If not provided, logging is performed on the local computer.

The server should have a trusted relationship with the user's account and the user's computer, depending on access rights and restrictions.
Filter | Specifies which events to log to the Windows Event Logging extension.
Retry | Interval (in minutes) between retries for the Windows Event Logging extension


Event Logging: Configuring the Server

●Administrative Procedures > Event Logging > Server Configuration

Event Logging: Server Configuration

Configuring a Windows Event Server to Receive ESSO-LM Logging

To configure a Microsoft Windows 2000 or XP server to receive Event Log messages, either install the Agent to that server or copy SSOeventmessage.dll from an Agent installation to the server, preferably in the System32 directory. Create the four following registry keys under

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\v-GO Single Sign-On

EventMessageFile | STRING | Full path to the file SSOeventmessage.dll, including filename (recommended %WinDir%\System32\SSOeventmessage.dll)
TypesSupported | DWORD | 7
CategoryMessageFile | STRING | Full path to the file SSOeventmessage.dll, including filename (recommended %WinDir%\System32\SSOeventmessage.dll)
CategoryCount | DWORD | 4


Windows Event Log-Based Reporting

Large deployments of ESSO-LM will often see the need for frequent auditing of user actions and information describing each action (such as date, time, and the name of the user). ESSO-LM records this information through the Windows Event Log mechanism, enabling you to easily leverage your existing infrastructure to collect source data for system-wide audits.

Using the event log data recorded by ESSO-LM, you can:

  • Track the actions of ESSO-LM users, such as logons and password changes. This includes associated information such as the action type, AD account name, date, time, and the credentials used to perform the action, if applicable.
  • Track the credentials that were used to log on to an application over time by each user. This can help detect attempts of unauthorized access by users who share their credentials without permission.
  • Track the actions of ESSO-LM administrators. For example, if someone pushes a misconfigured template to the repository, you can find out when the update was performed on that particular ESSO-LM object and by whom.
  • Track application usage. You can use the event log data to analyze application usage by user, time, and date. Such information can aid you in gauging system loads, for example when setting up load balancing in large deployments.

Technical Prerequisites

The required event data is recorded on the machine hosting your Active Directory repository. In order to generate reports based on this data, you must:

  1. Enable the required level of log verbosity for your Active Directory instance by setting the following registry value:
    • Path: HKLM\SYSTEM\CurrentControlSet\Services\<AD_instance>\Diagnostics
    • Key: 8 Directory Access (DWORD)
    • Value: 0x00000005 (hex)
  2. Query the Win32_NTLogEvent handler and filter your queries by event type SSO EventMgr. This is the event type used by ESSO-LM when recording data in the Windows Event Log.


Deploying the Agent

●Administrative Procedures > Deploying the Agent

Deploying ESSO-LM

The topics in this section describe the options for packaging, deploying, and managing ESSO-LM in a networked environment:

  • Microsoft Windows Installer (MSI) Package
  • Deployment Options
  • Administration and Management
  • Storing User Credentials and Settings
  • File-Based Backup/Restore


Microsoft Windows Installer (MSI) Package

ESSO-LM ships as an MSI package, a standard format used by installers from Microsoft and other vendors. Many other installers can read MSI files. For information on the contents of the ESSO-LM Setup MSI, see MSI Package Contents.

You might want to create an MSI package to meet special requirements, such as:

  • Providing custom applications and ESSO-LM Agent configurations
  • Deactivating some options or components (for example, different authenticators) before end users install the Agent
  • Adding options or components to accommodate a complex environment, for example, one using biometric security devices or having an unusual network topology.

To meet these needs, there are these options:

  • Use a command-line installation.
  • Customize the installer package using the ESSO-LM Administrative Console Custom MSI Generator.

  • Include logons and Global Agent Setting configurations that you created in ESSO-LM Administrative Console in the installer.

    Use the Configuration Test Manager to verify that you have configured your Global Agent Settings correctly.
  • Deploy using a third-party deployment tool.


Deployment Options

This section describes using the default MSI package from the following perspectives:

  • Performing an installation with the shipped MSI package
  • Launching the MSI package from the command line
  • Remote installation
  • Editing the MSI package
  • Adding logons and settings that you create with the ESSO-LM Administrative Console to the MSI package
  • Alternate tools and methods

Performing an Installation with the Shipped MSI Package

To perform an installation using the shipped MSI package, insert the ESSO-LM CD-ROM, or run the program setup from the CD-ROM or network share and follow the prompts. Because each environment is different and each organization has different needs, Oracle recommends you perform a custom install and select the desired components.

Installing from the Command Line

The MSI package can be installed from the command line. To do this, run the setup program with the appropriate parameters. The components of the command line are the executable name, InstallShield parameters (for example, /s for a silent install), and the ESSO-LM feature names:

ProductName.exe(where ProductName is the software being installed) [/s] /v"[/qn ] ADDLOCAL="FeatureName""

/s | InstallShield should be silent (optional)
/v"&hellip;" | InstallShield should pass the following parameters to the MSI package
/qn | The MSI package should install quietly (optional)
RUNVGO | Whether the Agent should be launched after the install: YES or NO
MDAC | Whether to install MDAC: YES or NO
ADDLOCAL "FeatureNames" | FeatureNames is a comma-delimited list of the ESSO-LMfeatures to install, see MSI Package Contents for a list of the acceptable list values.
Quoting is critical. There must be quotes around the MSI features (the quote after /v and the second quote at the end of the line) and around each value within the MSI features (for example, "NO" or "Core").

Example:

Install (without seeing any visual signs) the core, the Windows authenticator, NO support for Microsoft Internet Explorer or hosts, and the Microsoft Active Directory synchronizer, and then start the Agent, as follows:

ProductName.exe /s /v"/qn RUNVGO="YES"
ADDLOCAL="Core,Authenticators,SLA,LogonMgr,SetupMgr,SyncMgr,AD_Sync,English_Pack""

Installing the MSI Package Remotely

To install ESSO-LM to a computer remotely, verify that your system meets the following conditions:

  • Windows Installer must be present on the remote computer
  • The MSI package must be accessible to the remote computer
  • The person performing the remote installation must have administrator access rights to the remote computer.

Editing the MSI Package

Some organizations want to distribute MSI packages without Oracle-supplied optional components or with additional components (for example, alternative authenticators). The ESSO-LM Administrative Console includes a Custom MSI Generator that you can use to create custom MSIs to suit the needs of your enterprise.

Adding Console-Created Application Logons and Global Agent Settings

You can also use the Custom MSI Generator to create a modified ESSO-LM installation package. The modified MSI package you create with this feature can include:

  • Selected application logons from an entlist.ini file or from the current ESSO-LM Administrative Console configuration.
  • Agent settings from an administrative overrides (.ini) file or from the current ESSO-LM Administrative Console configuration.

To do this use the Generate Customized MSI command on the Tools menu.

Use the Configuration Test Manager to verify that you have configured your Global Agent Settings correctly.

Using Other Deployment Tools

ESSO-LM works with numerous deployment methods and tools, including (but not limited to):

  • Manual installation (for example, from a CD-ROM or network share)
  • Microsoft Windows Installer (MSI) service (local or remote installation)
  • Network remote installation (for example, copy files and install registry entries remotely to a desktop)
  • Microsoft SMS
  • IBM Tivoli
  • Attachmate NetWizard
  • Intel LANDesk
  • Novadigm Radia/EDM
  • Novell ZENworks
  • HP OpenView
  • Seagate Desktop Management Suite
  • McAfee ZAC Suite
  • Veritas WinINSTALL


Deploying the Agent with v-GO ODE

●Administrative Procedures > Distributing the Agent > Deploying the Agent with v-GO ODE

Deploying the Agent with ESSO-Anywhere

Oracle Enterprise Single Sign-on Anywhere (ESSO-Anywhere) provides a simple and flexible method for deploying configurations of ESSO-LM, Authentication Manager, ESSO-PG, and ESSO-PG in any combination, all with little or no administrator involvement.

You can create as many configurations as necessary for members of your enterprise, and use ESSO-Anywhere to take snapshots and compile complete deployment packages, which you then distribute to the appropriate users. ESSO-Anywhere also simplifies the upgrade and rollback process, all with virtually no hands-on involvement on your part.

ESSO-Anywhere is a separate module of the Oracle suite available from Oracle. For more information, see the Oracle Web site at www.oracle.com.


The MSI Generator

This tool enables you to create a custom .MSI file that to use for mass deployment to ESSO-LM end-users.

To access this tool, select Generate Customized MSI from the Tools menu.

Before using this tool, in addition to reading this help information, Oracle strongly recommends that you read the Packaging ESSO-LM for Mass Deployment Best Practice Guide, located at: http://download.oracle.com/docs/cd/E21040_01/index.htm. This guide describes best practices and recommended procedures for creating a custom MSI file for deploying ESSO-LM to end-users.

There are three stages in the .MSI generation process:

  1. Base MSI Selection . Select a Base MSI file.
  2. Feature Selection. Select the features to include in your custom MSI file.
  3. New MSI Generation. Select the Global Agent Settings file to include, and an output file location.

Base MSI Selection

Upon opening this tool, the Base MSI Selection stage is selected in the left pane. All other stages are unavailable until the base MSI file is selected.

  1. In Path field, click Browse …, navigate to the MSI file, and click Open. If an invalid MSI file is selected, a message appears indicating that the MSI file failed to open.
  2. Click Next >, or select the Feature Selection stage in the left pane.


Selecting MSI Features

The Feature Selection stage becomes available after you select a valid MSI file. The features display in a tree structure.

Make your selections and click Next >, or select the New MSI Generation stage in the left pane.

There are three possible states for the check boxes:

  • Unchecked: A state of no check in the parent node indicates that no child nodes are checked. The reverse is also true – if no child nodes are checked, the parent node is unchecked.

  • Partial Check: If any (but not all) of the child nodes are checked, the parent reflects this with a partial check state. A partial check in a parent node indicates that at least one of the non-default child nodes is checked.

  • Checked: If a parent is checked, all of its children are checked as well. The reverse is also true – if all of the children are checked, the parent is checked as well.

There might be some default items in the list that are required in the installer, and cannot be changed. An example of this is the English item in the Languages node in the ESSO-LM MSI file. English is installed as the default language. Default items have no influence on the state of the checkboxes and are unavailable for selection.


Generating a New MSI

The New MSI Generation stage becomes available after you select a valid MSI file. In this stage you choose the Global Agent Settings and Output location for the MSI file.

  1. If you want to include a Global Agent Settings file in the MSI file, select it from the Global Agent Settings drop-down box. You can leave the default selection of <None> if you do not want to include a Global Agent Settings file.
  2. In the Output MSI field, click the Browse (…) button. Select a valid path and enter a File Name for the output MSI file. Click Save. If you enter an invalid path or name, a message appears indicating that the output MSI file name is invalid.
  3. Click Generate. A message appears indicating that the file has been saved. Click OK.

If an error occurs, ensure that you have entered a valid path and file name.

Testing and Deploying to End Users

After you have tested and verified the MSI file fully, use a deployment tool (such as Microsoft Systems Management Server) to deploy ESSO-LM enterprise-wide.

For in-depth discussion and best practices on testing the MSI file, refer to the Packaging ESSO-LM for Mass Deployment Best Practice Guide, located at: http://download.oracle.com/docs/cd/E21040_01/index.htm.


Console Main Menu Commands

●Using the Console > Console Main Menu Commands

ESSO-LM Administrative Console Main Menu Commands

The table below describes the commands available on the ESSO-LM Administrative Console main menu and the corresponding keyboard and mouse shortcuts.

Menu | Command | Description | Shortcut
File | New | Start a new configuration | Ctrl+N
Open | Open | Ctrl+O
Merge

Merge current configuration (applications, password generation policies, credential sharing groups) with a configuration file.

If the merged file contains items with the same names as those in the current configuration, the Import/Merge Conflict dialog box opens. Select the items to import and click OK.
If the imported file contains a set of global Agent settings with the same name as an existing set in the current configuration, the imported set is named Copy of existing settings.
Save | Save the current configuration to a file (XML). | Ctrl+S
Save As | Save a copy of the current configuration to a different file.
Import

Import configuration from an administrative override object (INI) file or a registration entries (REG) file as a new set of global Agent settings

If the imported file contains items (applications, policies, groups) with the same names as those in the current configuration, the Import/Merge Conflict dialog box appears.

Right-click Applications and choose Import

or Ctrl+I

Choose Import from HKLM to import global Agent settings from the local-machine registry to the ESSO-LM Administrative Console as a set named "Live."
Export Export selected applications and all password policies and groups to an entlist.ini file, which is a store of application logons.

Right-click Applications and select Export or Ctrl+E.
Exit | Quit the program.
Menu | Command | Description | Shortcut
Edit | Delete | Delete the item selected in the left pane. Click Yes to confirm or No to cancel. | Del
Menu | Command | Description | Shortcut
Insert | Application | Add a new application configuration; displays the Add Application dialog box. | Right-click Applications and select New Windows App, New Web App, or New Host App.
UAM Policy | Add a new UAM policy; displays the New UAM Policy dialog box. | Right-click Policies and select New Policy.
Password Generation Policy

Add a new password generation policy; displays the Add Password Policy dialog box.

  • Enter Policy Name and click OK.
 Right-click Password Generation Policy and select New Policy.
Passphrase Questions

Add a new passphrase set; displays the Add Passphrase Set dailog box.

Enter a Passphrase Set Name and click OK.

 Right-click Passphrase Questions and select New Passphrase Set.
Credential Sharing Group

Add a new credential sharing group; displays the Add Sharing Group dialog box.

  • EnterGroup Name and click OK.
  • Enter Policy Name and click OK.
 Right-click Credential Sharing Group and select New Group.

Exclusion List

Add a new exclusion list; displays the Add Exclusion List dialog box.

Enter a name for the list and click OK.
  • Select the Exclusions node in the left pane, and click Add at the bottom of the right pane.
  • Right-click on the Exclusions node, and select New List from the contextual menu.
  • Select the Exclusions node and right-click in the empty space in the right pane.
Global Agent Settings | Save the current configuration to a file (XML). | Right-click Global Agent Settings and select New Settings.
Sync Extension | Save a copy of the current configuration to a different file. | Right-click Synchronization and select Manage Synchronizers.
Menu | Command | Description
Repository | Extend Schema | Connect to synchronization repository and create a new synchronization schema (for LDAP and database sync support). Displays Connect to Repository dialog box.
 | Initialize UAM Storage | Create static repository containers in which to store ESSO-UAM data.
 | Use Short Names | Check or uncheck to toggle between displaying and hiding user credential containers in the Repository window tree view.
 | Show User Credential Containers | Check or uncheck to toggle between displaying and hiding ESSO-LM user credential containers in the Repository window tree view.
Menu | Command | Description
Tools | Publish to Repository | Opens the "Publish to Repository" dialog box, from which you can select multiple objects to publish simultaneously.
 | Export Apps to Agent | Add the application logons in the current ESSO-LM Administrative Console session to the list of pre-configured logons for the locally-installed Agent. This option updates the local entlist.inifile, and optionally, the ftulist.ini (first time use) file.
 | Write Global Agent Settings to HKLM | Export global Agent Settings to local-machine registry; displays a confiroirmation message.
 | Test Global Agent Settings | Launch the Oracle Test Manager to validate that you have configured Global Agent Settings correctly. See Configuration Test Manager for complete procedures for using this tool.
 | Manage Templates | Create, modify, and remove templates for application logons; displays the Manage Templates dialog box.
 | Update Applications | Update applications based on templates that have been modified since the application's creation; displays the Update Applications dialog box.
 | Modify Configuration | View or edit the configuration (INI) files for the locally-installed ESSO-LM Agent. Choose Applist, or open any FTUlist, EntList, MfrmList, or other INI file by name.
 | Generate Customized MSI | Launch the Oracle MSI Generator, a wizard-style utility with which you create a custom .MSI file to use for mass deployment to ESSO-LM end-users.


Applications

Displays application configuration information and provides access to logon settings.

Click Applications in the left pane to display these tabs in the right pane:

  • The Application List displaying currently configured logons.

  • The Bulk Add (multiple logon deployment) controls.
  • Right-click Applications in the left pane to display a shortcut menu with these options:
New Windows App | Configure a new Windows application. Displays the Add Application dialog box.
New Web App | Configure a new Website application. Displays the Add Application dialog box.
New Host App | Configure a new mainframe application. Displays the Add Application dialog box.
Import | Open stored application configurations in a .REG or .INI file.
Export | Save one or more application configurations in an INI file.


Applications List tab

●Using the Console > Applications > Applications List

Applications List

Displays a list of applications with logons configured for use with ESSO-LM.

  • To add new applications click Add .
  • To modify a listed application's logon configuration, click an application, then click Edit .
  • To delete one or more logon configurations, click an application (use Ctrl+click or Shift+click to select multiple entries), then click Delete.


Add Application Dialog Box

Use the Add Application dialog to begin configuring a new application logon. You can define an application logon from scratch or you can use a stored template that provides pre-configured values for some or all logon settings.

To add an application:

  1. Type a Name for the new logon.
  2. Select an Application Type:
    • Windows
    • Web
    • Host/Mainframe
  3. Do one of the following:
    • Select a template from the Application drop down list and click Next to provide any additional information needed to complete the logon.
    • Leave the Application selection as New [type] Application and click Finish to create the logon from scratch.
  4. If this application requires authentication by RSA (SecurID/SoftID) token, select the RSA securID check box.
  5. Click Finish.

The Form Wizard for the selected Application Type launches. See Windows Form Wizard, Web Form Wizard or Host/Mainframe Form Wizard for more information.


Adding an Application from a Template

●Using the Console > Applications > Add Application dialog box > Adding an Application from a Template

Add Application from Template

Use this wizard page to supply application logon configuration settings that are not provided by the application logon template. Settings that must be supplied to complete the logon are marked in the left pane with a red X.

  1. In the left pane of the dialog box, click a logon setting item that is marked by a red X. The corresponding dialog box for supplying the setting appears in the right pane.
  2. Enter or choose the requested setting. A green checkmark replaces the red X when the setting is completed.
  3. Click Finish to close the wizard and add the new application.


New Windows or Java application

●Using the Console > Applications > New Windows or Java application

Creating a New Windows or Java Application Template

You can create a new Windows application template using the "Applications" menu or the "Add Application" icon in the ESSO-LM Administrative Console, or directly from the window of an open application.

Creating a Template Using the ESSO-LM Administrative Console

  1. In the left pane, right-click Applications then select New Windows App from the shortcut menu. The Add Application dialog box appears with the Windows option selected.

  2. Type a Name for the new logon and click OK. The Windows Form Wizard (for configuring new logon forms) appears.

    or

  3. Click the Add Application* icon [image] on the ESSO-LM Administrative Console toolbar.
  4. Select an application from the "Select Window" screen. The Windows Form Wizard (for configuring new logon forms) appears.

See Windows Form Wizard for more information.

Creating a Template Using an Open Application

You can create a new template on-the-fly for a Windows application while the application is running.

In order to perform this procedure, both the ESSO-LM Administrative Consoleand the ESSO-LM Agent must be running, and you must configure the Agent settings to display the Title Bar Button [image] .

  1. Launch the application for which you want to create a template.

  2. Select Create Template* from the application's Title Bar Button menu.

    Two things happen:

    • In the application's window, ESSO-LM detects the credential fields and highlights them.
    • A condensed version of the Form Wizard appears. Enter information for the following fields:
      • Form Name. This field is pre-filled with the name of the selected application. You can leave this as it is or change it if you want to.

      • Form Type. Select the form type from the drop-down menu:

        Logon

        Logon Success

        Logon failure

        Password change

        Password change success

        Password change failure

    • Add to Template.

      This field defaults to the New Template selection. Alternatively, the drop-down menu contains the list of all configured Windows application templates to which you might want to add this form.

    • Edit Fields/Hide Details.

      Toggle this button to expand the window to display the entire Form Wizard, or collapse the window to the simpler Form Wizard.

See Windows Form Wizard for more information.

*This menu item is new as of version 11.1.1.5.0.


Windows Form Wizard

Use the Windows Form Wizard to perform any of these tasks:

  • Configure new logons for Windows applications or for Java applets and applications.
  • Add new forms to existing logons
  • Create forms for automatic password changes.
  • Create forms for supporting a password confirmation field displayed in a separate window.
  • Create forms for automatic detection of password change success and failure.

The Windows Form Wizard lets you use the application itself to identify its forms, the individual fields, and the submit OK button.

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Windows Applications for specific information about configuring Windows application logons.

To configure a form:

  1. Start the target application and navigate to the target form. Arrange the ESSO-LM Administrative Console and target application windows so that you can see both at once.
  2. In the Form Wizard, select the type of form you want to configure. The available options are:
    • Logon. Configures a logon form.
    • Logon success. Configures a form that detects a match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's entries and displays the Logon Success dialog box. If this form is not present, the Agent captures credentials immediately after the user enters them and clicks OK. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • Logon failure. Configures a form that detects a non-match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's incorrect entries and displays the Logon Failure dialog box. If this form is not present, the Agent immediately informs the user that the credentials are incorrect, displaying either the New Logon dialog box or the Retry Logon dialog box to allow the user to re-enter credentials. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • Password change. Configures a password change form.
    • Password confirmation. Configures a new password confirmation form for applications that display their "Confirm password" field in a separate window.
    • Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Windows Form Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
    • Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Windows Form Wizard in which you will configure the necessary fields.
  3. In the Application Window list, select the window to configure. Note that a blinking outline indicates the application window you select.
  4. Confirm that you have selected the correct window, then click Next.
  5. In the Credential Fields page list, click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • Username/ID
    • Password (Logon forms only)
    • Old Password (password change forms only)
    • New password (password change forms only)
    • Confirm new password (password change and password confirmation forms only)
    • Submit button.
  6. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. Select a field to configure; for example, the logon window's user ID field. In the application's window, a blinking outline indicates the field corresponding to your current selection.

    2. Confirm that you have selected the correct field, then right-click the selected item and choose the field type (for example, UserID) from the shortcut menu. The corresponding icon appears to the left of the item. To deselect an item, right-click the item and choose None from the shortcut menu.

      Password change success forms do not inject credentials and thus do not require you to configure any fields. In such cases, proceed to step 8, as the Credential Fields page will not be displayed.

      The Class and Text columns provide cues to the fields. For example, text boxes appear as "Edit" Class; password fields usually have the Text value *** HIDDEN ***.
  7. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  8. Confirm that you have configured the necessary fields and button, then click Next. A summary page appears, listing your configuration.
  9. Do one of the following:
    • Click Back to return to a previous page and make corrections.
    • Click Finish to complete the logon configuration and close the Form Wizard.


Application window

●Using the Console > Applications > New Windows/Java application > Windows Form Wizard > Application window

Application Window (Windows Form Wizard)

Use this Form Wizard page to select the application's logon or password/PIN change window.

See Windows Form Wizard for a detailed procedure for configuring Windows applications.

Controls

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Credential field

●Using the Console > Applications > New Windows/Java application > Windows Form Wizard > Credential field

Credential Field (Windows Form Wizard)

Use this Form Wizard page to select the fields of the application's logon or password change window.

See Windows Form Wizard for details of the procedure for configuring Windows applications.

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID or Text, to sort the list. Right-click a field in the list to display a shortcut menu of field types and the submit control:

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • Confirm New Password
  • OK (submit control)

Refresh

Updates the field list.

Use "Send Keys" for this form, do not use Control IDs

Indicates that the Agent should transmit logon data to this form as a series of keystrokes, rather than by addressing individual fields by Control ID. See SendKeys for more information.

Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Detect Fields | Scans the field list and attempts to match them with field types. Note that although Detect Fields is usually accurate with typical applications, the fields should be checked for proper field types.
Refresh | Updates the field list.
Back | Go back to the previous Wizard page
Next | Go forward to the next Wizard page.


Summary

Displays the results of the Wizard. Do one of the following:

  • Click Finish to save your settings and close the Wizard.

    or

  • Click Back to return to a previous page and modify your settings.


Windows Form Wizard for RSA SecurID

●Using the Console > Applications > New Windows/Java application > Windows Form Wizard for RSA SecurID

Windows Form Wizard (for RSA SecurID Applications)

Use the Windows Form Wizard to perform any of these tasks:

  • Configure new logons for RSA SecurID Windows applications.
  • Add new forms to existing RSA SecurID logons
  • Create forms for automatic PIN changes.
  • Create forms for supporting a PIN confirmation field displayed in a separate window.
  • Create forms for automatic detection of PIN change success and failure.

The Windows Form Wizard lets you use the application itself to identify its forms, the individual fields, and the submit OK button.

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Windows Applications for specific information about configuring Windows application logons.

To configure a form:

  1. Start the target application and navigate to the target form. Arrange the ESSO-LM Administrative Console and target application windows so that you can see both at once.
  2. In the Form Wizard, select the type of form you want to configure. The available options are:
    • SecurID Logon. Configures a SecurIDlogon form.
    • PIN Change. Configures a PIN change form.
    • Confirm PIN. Configures a new PIN confirmation form for applications that display their "Confirm PIN" field in a separate window.
    • Logon Success. Configures a form that serves as a match for the target application's Logon Success message. Since this form does not inject credentials, the Credentials page of the Windows Form Wizard is skipped. When the logon success message is detected, ESSO-LM will automatically save the new credentials.
    • Logon Failure. Configures a form that serves as a match for the target application's logon failure message and reinjects credentials when the logon failure message is detected. If you select this option, you will be presented with the Credentials page of the Windows Form Wizard in which you will configure the necessary fields.
    • PIN Change Success. Configures a form that serves as a match for the target application's PIN change success message. Since this form does not inject credentials, the Credentials page of the Windows Form Wizard is skipped. When the PIN change success message is detected, ESSO-LM will automatically save the new credentials.
    • PIN Change Failure. Configures a form that serves as a match for the target application's PIN change failure message and reinjects credentials when the PIN change failure message is detected. If you select this option, you will be presented with the Credentials page of the Windows Form Wizard in which you will configure the necessary fields.
  3. In the Application Window list, select the window to configure. Note that a blinking outline indicates the application window you select.
  4. Confirm that you have selected the correct window, then click Next.
  5. In the Credential fields page, for each credential field:
    1. Select a field to configure; for example, the logon window's user ID field. In the application's window, a blinking outline indicates the field corresponding to your current selection.

    2. Confirm that you have selected the correct field, then right-click the selected item and choose the logon field type (for example, UserID) from the shortcut menu. The corresponding icon appears to the left of the item. To deselect an item, right-click the item and choose None from the shortcut menu.

      New PIN Acceptance forms do not inject credentials and thus do not require you to configure any fields. In such cases, proceed to step 7, as the Credential Fields page will not be displayed.

      The Class and Text columns provide cues to the fields. For example, text boxes appear as "Edit" Class; PIN fields usually have the Text value *** HIDDEN ***

  6. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  7. Confirm that you have configured the necessary fields and button, then click Next. A summary page appears, listing your configuration.
  8. Do one of the following:
    • Click Back to return to a previous page and make corrections.
    • Click Finish to complete the logon configuration and close the Form Wizard.


Identification Tab for Configuring a Windows Application

Use the Identification (Windows) tab to modify program and window information about a Windows application logon configuration.

  • Configure a logon manually by adding, editing or deleting entries in the AppPathKeys and Window Titles list, or
  • Use the Windows Form Wizard to define windows, titles and fields by pointing and clicking.

Controls

Form name | Name of the application logon form.
AppPathKeys | The Windows registry key identifying an application associated with this logon to match against running processes. (Usually the application executable's name, such as Eudora.exe.)
Window Titles | Text matched against logon window titles to identify logon requests. Click Choose to select a title from a currently-running application window.
Disabled

Select to disable this Windows template. This can be used with the sort order feature to disable certain Web popups.

This feature is useful in a situation where an application has hundreds of windows titles defined using Regular Expressions or wild cards, but a few of those window titles should not be responded to. Rather than creating hundreds of templates to respond to, an administrator can define the window title to match (with regular expressions or wild cards), and exclude those that should not be matched by creating a disabled template for them.
Wizard | Start the Windows Form Wizard for configuring an application visually.

Configuring an Application Using the Windows Form Wizard

  • Click Wizard.

Configuring an Application Manually

  1. Enter the Name of the application.
  2. In the AppPathkey group, click Add.
  3. In the Add AppPath Key dialog box, enter a valid application key (usually the application executable's name, such as Eudora.exe). Click OK.
  4. In the Window Titles group click Add, then enter the Window title or click Choose to open the Select Window dialog box, where you can select a title from a currently-running application window.
  5. Click OK.


Select Window Title

Use the Select Window dialog to choose the title of an application's logon or password change window.

  • Select the logon or password change window and click OK.

Controls

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.


Fields Tab for Configuring a Windows Application

Use the Fields (Windows) tab to define how the Agent interacts with the fields of the logon form. You can identify one of the following for the currently-selected application form:

  • Up to four logon fields (user ID, password, etc.), using Control IDs
  • A series of keystrokes (with optional timings) that fill-in and submit the logon form, using SendKeys.

Controls

Transfer Method
(choose one)

Control ID: Use standard Windows control IDs to identify and transmit credentials to a field. Click Add to add a field and enter its Control ID or Edit to modify existing field settings.

SendKeys: Configure fields by transmitting a keystroke series to the form. Click Edit to enter or change the series.

SendKeys using Journal Hook: Configure fields by transmitting a keystroke series to the form using Journal Hook. Click Edit to enter or change the series.
Fields

Fields with transfer methods configured for this logon form. You can:

  • Select a field and click Edit to modify Control ID, SendKeys, or SendKeys using Journal Hook settings.
  • Click Add to add a field (for Control ID only).


Fields Tab

●Using the Console > Applications > New Windows/Java application > Fields Tab for Configuring a Windows Application > ControlID

ControlID

Use the Control ID dialog box to identify the fields and the submit button of a logon form in order to configure the ESSO-LM response.

Controls
Controls
Field

Select the credential data that the control represents, or identify the control as the Submit (OK) button.

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • OK (submit control)
Control ID | Enter the control ID of the selected field or button.
Skip field if control is disabled | Select this option to prevent the Agent from entering data if the selected field is set not to accept user entry.


SendKeys (for a Windows application logon)

●Using the Console > Applications > New Windows/Java application > Fields Tab for Configuring a Windows Application > SendKeys (for a Windows application logon)

SendKeys for a Windows Application Logon

Use the SendKeys dialog box to specify a series of keystrokes that ESSO-LM should transfer to the logon form.

Use the SendKeys option for Windows applications that:

  • Cannot receive credentials from the Windows message queue or by other techniques the Agent normally uses to send credentials.
  • Do not use standard Windows controls that have Control IDs.
  • Dynamically generate controls or do not use Windows controls at all (for example, Flash applications).

The New Actions list box in the right pane of the SendKeys dialog box provides the keystroke options for each action. Highlight the action to configure SendKeys for, and select or type the options you need on for each action. Click the Insert button to add the key or action to the series.

For East-Asian Language Applications: When adding information using SendKeys in an East Asian-language (Chinese, Japanese, Korean) application template, you must insert an Enter key press preceding the Tab key that advances to the next field. The Enter key signals the Input Method Editor that you have completed the field and allows the IME to differentiate the credentials fields.

Journal Hook SendKeys for East-Asian languages is not compatible with ESSO-LM.

Your selections appear in the Current Actions list in the left pane:

  • To change the order of the series, select an item and click the up or downarrows to move it.
  • To delete an item, select it, and click Delete.
  • To edit an item, select it, and click Edit. The Edit Action dialog opens. Edit the fields as necessary and click OK.

Controls

New Action Controls Description
Fields

Field Type

Select a credential item from the list to add to the series.

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • Old Password
  • New Password
  • Confirm New Password

Character to insert after field

Select a keystroke to insert automatically after the field is filled:

  • None (no keystroke)
  • Enter (to submit the form)
  • Tab (to advance the cursor)

Also see Special Keys, below.

Inject directly into control

Injects the credential directly into the control. Click the ... button to open the Choose Control ID dialog box.

When using SendKeys, the application is treated as a Windows application. The controls that appear in the Choose Control ID dialog box indicate whatever Windows controls ESSO-LM can find.

Insert

Add the current selection to the series.
New Action Controls Description
Click

Click at a coordinate

Simulates a mouse click at the X, Y coordinate specified.

X: Choose the X coordinate for the mouse click.

Y: Choose the Y coordinate for the mouse click.

Relative to the: Select where the mouse click will be relative to:

  • Screen
  • Active Window

Mouse button: Select which mouse button will be clicked:

  • Left
  • Middle
  • Right

Click on a control

This option is similar to clicking at a specified coordinate, except that ESSO-LM determines where the control is and simulates a click in the center of the control. Click the ... button to open the Choose Control ID dialog box.

When using SendKeys, the application is treated as a Windows application. The controls that appear in the Choose Control ID dialog box indicate whatever Windows controls ESSO-LM can find.

Insert

Add the click selection to the series..
New Action Controls Description
Run Task

Command line to run

Enter a Command line to be executed. This feature allows you to run a program in the middle of entering keystrokes.

  • Window Handles can be appended to the command line to inform the script of the window handle currently being worked on:
    $(HWND)
  • Environment Variables can also be appended to the command line:
    $(USERDOMAIN)\$(USERNAME)

Click the ... button to open the Choose Control ID dialog box.

Virtual key codes cannot be used within the command line (the initial backquote character will terminate the command line).

Expected return code

Enter the expected return code. The rest of the Sendkeys script is discarded if this value is not returned.

Time out (sec.)

Enter the number of milliseconds to wait for the task to complete. The rest of the Sendkeys script is discarded if this timeout is reached. The maximum timeout period is 5 seconds.

Insert

Add the task to the series.

New Action | Controls | Description
Delay | Length of delay (in seconds) | Type or select a delay between keystrokes.
 | Insert | Add the delay to the series.
New Action Controls Description
Set Focus

Set focus to control

Sets the focus to the control. Click the ...button to open the Choose Control ID dialog box.

When using SendKeys, the application is treated as a Windows application. The controls that appear in the Choose Control ID dialog box indicate whatever Windows controls ESSO-LM can find.

Insert

Add the focus to the series.

New Action | Controls | Description
Text | Enter text to insert | Type any literal text to add to the series.
 | Insert | Add the text to the series.
New Action Controls Description
Special Keys

Category/Keys

Choose a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Page Down) from the right list.

Key Press

Insert the key as a single keystroke (default).

Key Down/Up

Insert the key as a pair of actions: key-press and key-release. This option lets you insert other keystrokes between these actions to indicate one or more keys held down as another is typed, as for a "hot key" combination that moves the focus to a specific text box.

For example, to insert the keystroke "Alt+P," select the Key Down/Up option, then select Modifier for the Category and Alt for the Key. and click Insert. This inserts two actions: [Down:Alt] and [Up:Alt].

Select the Text tab and enter P in the text box. In the left pane, select [Up:Alt] and click Insert. The "P" is inserted between the two Alt-key actions, producing "Alt-P."

Insert

Add the keystroke to the series.


Matching Dialog

●Using the Console > Applications > New Windows/Java application > Matching Tab for Configuring a Windows Application > Matching Dialog

Matching Dialog Box

Use this dialog box to create match criteria that the Agent uses to distinguish among similar target forms that use the same credential data. This lets the Agent apply a single set of user credentials appropriately to these multiple forms. To display this dialog box, from the Matching tab (for configuring a Windows logon form) click Add.

The easiest and most efficient way to create match criteria is through the Control Match Wizard. The Wizard lets you specify match criteria by selecting elements from the target form itself. You can also create and modify match criteria manually.

Creating Match Criteria Using the Wizard

  • Click Wizard and follow the onscreen instructions.

Creating or Modifying Match Criteria Manually

  1. Enter a Match name and select the Type of the target form.
  2. Add or edit the Window Titles that the target form displays, or select Use Titles from Main.
  3. Add or edit the Control Matching items: these are criteria based on the properties of form objects (such as a text caption, or a control class). Together these items uniquely identify the target form.
  4. Add or edit the Control IDs of the target form's credential fields.
  5. Click OK.
Controls
Match Name | Enter or edit the name for the Match
Type

Select the type of form to match:

  • Logon
  • Change Password
  • Confirm (Password)
  • Ignore
  • Logon Success
  • Logon Failure
  • Password Change Success
  • Password Change Failure
Unlike the “Logon,” “Change Password,” “Confirm,” and “Ignore” match types, these matches cannot be explicitly selected by the user. They are determined by form type.
Windows Titles | Click Use Titles from Main to copy the Windows Titles in the General tab for this logon or click Add to enter titles manually.
Control Matching | Click Add (or select a matching item and click Edit) to display the Control Matching dialog box.
Control ID | Click Add ( or select a control ID item and click Edit) to display the Control ID dialog box.
Wizard | Start the Control Match Wizard.


Add Edit Window Title

●Using the Console > Applications > New Windows/Java application > Matching Tab for Configuring a Windows Application > Add Edit Window Title

Add/Edit Window Title

Use this dialog box to add or modify the text string that the Agent uses to detect specific application windows (for example, for logon entry or password change) by their window title.

Specifying a Window Title for Matching

  1. Select one of the following (see Matching Expressions, below).
    • Exact match
    • Use wildcards (does not apply to Kiosk Manager)
    • Use regular expression (does not apply to Kiosk Manager)
  2. Type (or edit) the Window Title or a matching expression.
  3. Click OK.

Matching Expressions

For applications that have varying text in their URLs, you can use substrings or regular expressions to specify how to match the variable text.

Wildcards
  • ? (question mark) matches any single character.
  • * (asterisk) matches zero or more occurrences of any character.
This does not apply to Kiosk Manager.
Regular Expressions

You can also use the set of regular expressions to specify a string pattern that the Agent should recognize as a match.

This does not apply to Kiosk Manager.

Matching Environment Variables

For applications that include the user's name in the URL (as derived from the DOMAINUSER environment variable in the workstation operating system), select Exact as the matching criterion, and use one of the following substitution tokens in the match string:

%DOMAINUSER% | User name exactly as derived from the environment variable
%UC%%DOMAINUSER% | User name converted to all upper case
%LC%%DOMAINUSER% | User name converted to all lower case
Example

This Window Titleentry matches a password-change window title that includes the username.

Password Expired - %UC%%DOMAINUSER%


Add Edit Control Matching

●Using the Console > Applications > New Windows/Java application > Matching Tab for Configuring a Windows Application > Add Edit Control Matching

Control Matching

Use the Control Matching dialog box to specify a match criterion based on the properties of a target-form control (such as a text caption, or a control style).

Controls
Control ID | Type the numeric identifier of the control.
Match Condition | Select one property of the control, select a relation (Equals or Not Equal, Equals regular expression, Not equals regular expression), and type or select the condition that should (or should not) be met. The valid conditions for each property are:
 | Class | Edit or Static control
 | Style | A decimal numeric identifier for the aggregate of styles applied to the control.
 | Text | A literal string.

Click OK to save and exit the dialog box or Cancel to exit without changes.


Add Edit Control ID

●Using the Console > Applications > New Windows/Java application > Matching Tab for Configuring a Windows Application > Add Edit Contol ID

Control ID dialog box (Windows Fields tab)

Use the Control ID dialog box to identify the fields and the Submit button of a logon form in order to configure the Agent's response.

Controls

Field

Select the credential data that the control represents, or identify the control as the Submit (OK) button.

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • OK (submit control)
Control ID Enter the control ID of the field or button.
Control Type

Select the control type:

  • Edit (text box)
  • Combo (drop-down list box)
  • List
In most cases, you can use the Windows Form Wizard to identify fields and control IDs.


Control Match Wizard

Use the Control Match Wizard to define match criteria by choosing from the windows and controls of the target application. The Agent uses match criteria to identify a target form, such as a password-change dialog, that is similar to the currently selected logon. The Agent then supplies data to the matched target form using the same credentials as the original logon. You can also use match criteria to specify target forms similar to the current logon that the Agent should ignore.

Using the Wizard to Create Match Criteria

  1. Start the target application and navigate to the target form. Arrange the ESSO-LM Administrative Console and target application windows so that you can see both at once.
  2. Select a form Match Type, then follow the onscreen instructions or help topics.
    • Ignore
    • Logon
    • Password Change
    • Password Confirm

See the Matching tab for more information

To display the Control Match Wizard:

  1. From the Matching tab, select Add (for configuring a Windows logon form). The Matching dialog box appears.
  2. Click Wizard.


Ignore App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should ignore from the Window List.
  2. Click Next to display the Match Fields page.

Controls

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Ignore Match Fields

Use this Wizard page to choose a set of match fields, one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria.
  2. Click Next to display the Summary page.

Controls

Match Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of match criteria:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Goes back to the previous Wizard page.
Next | Goes forward to the next Wizard page.


Logon App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should recognize as a logon form from the Window List.
  2. Click Next to display the Match Fields page.
Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Logon Match Fields

Use this Wizard page to choose a set of match fields: one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria
  2. Click Next to display the Credentials page.

Controls

Match Fields

D isplays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Logon Credential

Use this Wizard page to identify the field in which the Agent should supply credential data.

  1. In the field list, right-click a field and select the credentials.
  2. Click Next to display the Summary page.

Controls

Credential Fields

D isplays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • UserID
  • Password
  • Third Field
  • Fourth Field
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Change App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should recognize as a password-change form from the Window List.
  2. Click Next to display the Match Fields page.
Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Change Match Fields

Use this Wizard page to choose a set of match fields: one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria
  2. Click Next to display the Credentials page.

Controls

Match Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Change Credential

Use this Wizard page to identify the field in which the Agent should supply credential data.

  1. In the field list, right-click a field and select the credentials.
  2. Click Next to display the Summary page.

Controls

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • UserID
  • Old Password/PIN
  • New Password/PIN
  • Confirm PasswordPIN
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Confirm App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should recognize as a password-confirmation form from the Window List.
  2. Click Next to display the Match Fields page.

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.

Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Confirm Match Fields

Use this Wizard page to choose a set of match fields: one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria
  2. Click Next to display the Credentials page.

Controls

Match Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Confirm Credential

Use this Wizard page to identify the field in which the Agent should supply credential data.

  1. In the field list, right-click a field and select the credentials.
  2. Click Next to display the Summary page.

Controls

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • UserID
  • Old Password/PIN
  • New Password/PIN
  • Confirm PasswordPIN
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Options Tab for Configuring a Windows Application

Use the Miscellaneous (Windows) tab to refine properties of the currently-selected application logon form for special configurations.

Controls

Attach to window's Message Queue | Select to hold on to the target window while sending credentials.
Preset Focus | Select to set the focus on a logon field before the Agent places data in the field.
System Logon | (Reserved)
Use WM_CHAR messages to fill controls | Some applications require that you enter passwords via a keyboard and not set text commands. Enabling this setting simulates keyboard entry in an alternate way by setting text within controls.
Adhere to Logon Loop Grace Period | Select to have the Agent ignore this application's logon form when the logon loop grace period (set on the application's Miscellaneous tab) is in effect..
Fall back to SendKeys if direct injection fails | Indicates whether to use SendKeys to enter credentials if direct injection using ControlIDs fails. Default is Yes.
Auto-Recognize | Select to have the Agent recognize the application automatically. If this setting is checked or unchecked, it overrides the global Agent setting. If this setting is checked, the user can configure this setting from the Logon Manager. If this setting is unchecked, the user will not have access to this setting from the Logon Manager.
Auto Submit | Select to have the Agent automatically select OK for this application logon after providing credentials.
Sort Order | Specify the order in which ESSO-LM searches templates for window class titles containing regular expressions. By setting sort order, you increase the efficiency of your search without eliminating less precise matches. If you do not assign a sort order to a template, ESSO-LM checks templates in ascending order (lower values are checked first). Default is 1000.
Detection Delay | The time interval that the Agent should wait before detecting the application fields.


New Web application

●Using the Console > Applications > New Web application

Creating a New Web Application Template

The Web Form Wizard simplifies the process of creating a new Web application template. You can launch the Web Form Wizard using the "Applications" menu or the "Add Application" icon in the ESSO-LM Administrative Console, or directly from the window of an open application.

Creating a Template Using the ESSO-LM Administrative Console

  1. In the left pane, right-click Applications then select New Web App from the shortcut menu. The Add Application dialog box appears with the Web option selected.

  2. Type a Name for the new logon and click OK. The Web Form Wizard (for configuring new logon forms) launches.

    or

  3. Click the Add Application* icon [image] on the ESSO-LM Administrative Console toolbar.
  4. Select a Web application from the "Select Window" screen. The Web Form Wizard (for configuring new logon forms) launches.
Creating a Template Using an Open Application

You can create a new template on-the-fly for a Web application while the application is running.

In order to perform this procedure, both the ESSO-LM Administrative Consoleand the ESSO-LM Agent must be running, and you must configure the Agent settings to display the Title Bar Button [image] .

  1. Open a browser and navigate to the URL for which you want to create a template.

  2. Select Create Template* from the browser's Title Bar Button menu.

    The Web Form Wizard (for configuring new logon forms) launches.

See Adding Web Applications for more information.

*This menu item is new as of version 11.1.1.5.0.


Web Form Wizard

The Web Form Wizard lets you browse the Web application itself to capture the identifiers for its logon or password-change windows, the individual fields, and the submit OK button. To display the Web Form Wizard:

  1. Create a New Web application.
  2. In the New Web Application configuration dialog, click Wizard. The Web Form Wizard appears.
When using a workstation running at 800x600 resolution, buttons are missing from the bottom of the Web Form Wizard. The wizard is also extremely slow to start at this resolution. Oracle recommends that you set the resolution on your workstation to a higher resolution.

Configuring a Web Application

  1. In the dialog box that appears, select the type of application form you want to configure. The available options are:
    • Logon. Configures a logon form.
    • Logon success. Configures a form that detects a match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's entries and displays the Logon Success dialog box. If this form is not present, the Agent captures credentials immediately after the user enters them and clicks OK. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • Logon failure. Configures a form that detects a non-match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's incorrect entries and displays the Logon Failure dialog box. If this form is not present, the Agent immediately informs the user that the credentials are incorrect, displaying either the New Logon dialog box or the Retry Logon dialog box to allow the user to re-enter credentials. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • Password change. Configures a password change form.
    • Password confirmation. Configures a form that verifies that the user's second password entry in a password change form is identical to the first password entry.
    • Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Web Form Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
    • Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Web Form Wizard in which you will configure the necessary fields.
If you are editing an existing form, this dialog box will not appear.
  2. In the Web Form Wizard, enter the Web Address (URL) of the website and click Go. The top pane of the Wizard acts as a web browser window. You can resize the Wizard's window as needed.
  3. In the top pane, navigate to the Web site's logon form. When the Wizard detects one or more forms in a web page, it lists the forms and their elements (fields and buttons) in the bottom pane.
  4. Click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • Username/ID
    • Password
    • Old Password (password change forms only)
    • New Password (password change forms only)
    • Submit button.
  5. (Optional) Select Use ordinals instead of names. The Credential Fields Screen displays the fields, assigning control IDs by location order instead of using native (dynamic) control IDs.
  6. (Optional) Select Show non-input fields. The ESSO-LM Administrative Console detects fields that have input functionality but into which you cannot enter information, such as IMG tags that function as Submit buttons, and includes these fields in the Web Form Wizard fields list.
  7. (Optional) Select Allow multiple field designation. The ESSO-LM Administrative Console recognizes multiple fields that require the same credential, such as enter and confirm password fields, or a page with the same field on two forms.
  8. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. If you are editing an existing template, you may change the form type using the Form Type drop-down at the lower right. Keep in mind that if you do so, you will need to reconfigure the template (reassign fields, and so on). Only fields relevant to a given form type are displayed when that form type is selected.
    2. Identify and select a field from the list in the bottom pane. (The Element and Type descriptions provide cues.) In the top pane, a blinking outline indicates the corresponding field or button you have selected.
    3. Confirm that you have selected the correct field, then right-click the selected item and choose from the shortcut menu (for example, UserID). An icon appears to the left of the item. To deselect an item, right-click the item and select None from the shortcut menu.
  9. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. If you are editing an existing template, you may change the form type using the Form Type drop-down at the lower right. Keep in mind that if you do so, you will need to reconfigure the template (reassign fields, and so on). Only fields relevant to a given form type are displayed when that form type is selected.
    2. Identify and select a field from the list in the bottom pane. (The Element and Type descriptions provide cues.) In the top pane, a blinking outline indicates the corresponding field or button you have selected.
    3. Confirm that you have selected the correct field, then right-click the selected item and choose from the shortcut menu (for example, UserID). An icon appears to the left of the item. To deselect an item, right-click the item and select None from the shortcut menu.
  10. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. If you are editing an existing template, you may change the form type using the Form Type drop-down at the lower right. Keep in mind that if you do so, you will need to reconfigure the template (reassign fields, and so on). Only fields relevant to a given form type are displayed when that form type is selected.
    2. Identify and select a field from the list in the bottom pane. (The Element and Type descriptions provide cues.) In the top pane, a blinking outline indicates the corresponding field or button you have selected.
    3. Confirm that you have selected the correct field, then right-click the selected item and choose from the shortcut menu (for example, UserID). An icon appears to the left of the item. To deselect an item, right-click the item and select None from the shortcut menu.
  11. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  12. Repeat the two previous steps for each field required to logon. You can configure up to four fields in all.
  13. When you have completed your configuration click OK to save it and close the Web Form Wizard.


Web Form Wizard for RSA SecurID

●Using the Console > Applications > New Web application > Web Form Wizard for RSA SecurID

Web Form Wizard (for RSA SecurID Applications)

Use the Web Form Wizard to perform any of these tasks:

  • Configure new logons for RSA SecurID Windows applications.
  • Add new forms to existing RSA SecurID logons.
  • Create forms for automatic PIN changes.
  • Create forms for automatic detection of PIN change success and failure.

The Web Form Wizard lets you browse the Web application itself to capture the identifiers for its forms and windows, the individual fields, and the submit (OK) button. To display the Web Form Wizard:

  1. Create a New Web application. Be sure to select the RSA SecurID check box in the Add Application dialog.
  2. In the New Web Application configuration dialog, click Wizard. The Web Form Wizard appears.
When using a workstation running at 800x600 resolution, buttons are missing from the bottom of the Web Form Wizard. The wizard is also extremely slow to start at this resolution. Oracle recommends that you set the resolution on your workstation to a higher resolution.

Configuring a Web Application

  1. In the dialog box that appears, select the type of application form you want to configure. The available options are:
    • SecurID Logon. Configures a SecurID logon form.
    • SecurID Logon success. Configures a form that detects a match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's entries and displays the Logon Success dialog box. If this form is not present, the Agent captures credentials immediately after the user enters them and clicks OK. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • SecurID Logon failure. Configures a form that detects a non-match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's incorrect entries and displays the Logon Failure dialog box. If this form is not present, the Agent immediately informs the user that the credentials are incorrect, displaying either the New Logon dialog box or the Retry Logon dialog box to allow the user to re-enter credentials. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • PIN change. Configures a PIN change form.
    • PIN confirmation. Configures a form that verifies that the user's second password entry in a password change form is identical to the first password entry.
    • PIN change success. Configures a form that serves as a match for the target application's PIN change success message. Since this form does not inject credentials, the Credentials page of the Web Form Wizard is skipped. When the PIN change success message is detected, ESSO-LM will automatically save the new credentials.
    • PIN change failure. Configures a form that serves as a match for the target application's PIN change failure message and reinjects credentials when the PIN change failure message is detected. If you select this option, you will be presented with the Credentials page of the Web Form Wizard in which you will configure the necessary fields.
If you are editing an existing form, this dialog box will not appear.
  2. In the Web Form Wizard, enter the Web Address (URL) of the Web site and click Go. The top pane of the Wizard acts as a web browser window. You can resize the Wizard's window as needed.
  3. In the top pane, navigate to the Web site's logon form. When the Wizard detects one or more forms in a Web page, it lists the forms and their elements (fields and buttons) in the bottom pane.
  4. Click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • SecurID Username
    • Passcode
    • Tokencode
    • Old PIN (PIN change and PIN change failure forms only)
    • New PIN (PIN change and PIN change failure forms only)
    • Submit button.
  5. (Optional) Select Use ordinals instead of names. The Credential Fields Screen displays the fields, assigning control IDs by location order instead of using native (dynamic) control IDs.
  6. (Optional) Select Show non-input fields. The ESSO-LM Administrative Console detects fields that have input functionality but into which you cannot enter information, such as IMG tags that function as Submit buttons, and includes these fields in the Web Form Wizard fields list.
  7. (Optional) Select Allow multiple field designation. The ESSO-LM Administrative Console recognizes multiple fields that require the same credential, such as enter and confirm password fields, or a page with the same field on two forms.
  8. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. If you are editing an existing template, you may change the form type using the Form Type drop-down at the lower right. Keep in mind that if you do so, you will need to reconfigure the template (reassign fields, and so on). Only fields relevant to a given form type are displayed when that form type is selected.
    2. Identify and select a field from the list in the bottom pane. (The Element and Type descriptions provide cues.) In the top pane, a blinking outline indicates the corresponding field or button you have selected.
    3. Confirm that you have selected the correct field, then right-click the selected item and choose from the shortcut menu (for example, SecurID Username). An icon appears to the left of the item. To deselect an item, right-click the item and select None from the shortcut menu.
  9. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  10. Repeat the two previous steps for each field required to logon. You can configure up to four fields in all.
  11. When you have completed your configuration click OK to save it and close the Web Form Wizard.


Identification Tab for Configuring a Web Application

Use the Identification (Web) tab to modify program and window information for a Web application logon configuration.

  • You can configure a logon manually by adding, editing, or deleting entries in the Form name and URL fields,

or

  • You can use the Web Form Wizard to define URLs, forms, and fields by pointing and clicking.

Controls

Form name | Enter an application name.
URL | One or more URLs (or Uniform Resource Locator, commonly called a Web address) of the logon or password-change form to configure. Click Add (or select a matching item and click Edit) to display the URL dialog box. Click Delete to remove a URL.


Identification Tab for Configuring a Web Application

●Using the Console > Applications > New Web application > Fields Tab for Configuring a Web Application

Fields Tab for Configuring a Web Application

Use the Fields (Web) tab to define how the Agent interacts with the fields of the logon form. Select one of the following transfer methods for the currently-selected application form:

  • Up to four logon fields (user ID, password, etc.), using Control IDs

  • A series of keystrokes (with optional timings) that fill-in and submit the logon form, using SendKeys or SendKeys using Journal Hook.

    If you want to switch from one transfer method to the other after creating a Web form, select the desired transfer method on this screen. The ESSO-LM Administrative Console converts the fields for the transfer method you selected.

    When you switch from Control IDs to SendKeys, all fields convert with a direct injection setting. You can change the injection method during the editing process. When you switch from SendKeys to Control IDs, any field that is not set to inject directly does not convert.

Controls

Transfer method
(choose one)

Options:

  • Control IDs: Use standard Windows control IDs to identify and transmit credentials to a field. Click Add to add a field and enter its Control ID or Edit to modify existing field settings.
  • SendKeys: Configure fields by transmitting a keystroke series to the form. Click Edit to enter or change the series.
  • SendKeys using Journal Hook: Configure fields by transmitting a keystroke series to the form using Journal Hook. Click Edit to enter or change the series.
Fields

One or more credential fields (including the Submit button) with transfer methods and their identifying information. You can:

  • Select a field and click Edit to modify Control ID or SendKeys settings.
  • Click Add to add a field (for Control ID only).
  • Click Delete to remove a field (for Control ID only).
  • Use the Up [image] and Down [image] arrows to re-order the fields.


Field Identification Dialog Box

Use this screen to specify the type of field you want the Agent to recognize. Check the appropriate radio button from among the following:

  • Use field name: Select for a Web site whose fields have consistent, named labels, such as "User" or "e-mail."
  • User ordinal number: Select if you want to replace varying field numbers with ordinals for dynamic Web pages. See Dynamic and Ordinal Control IDs for more information.
  • Use matching: Select for a Web site where the field index varies depending on the user. Choose from among the matching choices as explained in the following table.
Tag | Enter an HTML tag type; for example, <TD>for a table cell.
Match Tag Instance | Select to match a specific instance of the Tag and select the instance number; for example, 3 for the third table cell on the page.
Criteria

Select one criteria type:

  • Text. The plain-text (InnerText) content of the tag element (for example, Enter your password)

  • HTML. The rich-text (InnerHTML) content of the tag element (for example, <b>Enter your password</b>).

    Certain browsers' innerHTML properties tags can differ from the normal HTML. For instance, the tags might appear in a different letter case, or they might add or remove spacing between the tag and the enclosed text. In order to avoid matching problems, use alternate tags and wildcard characters to account for these differences.

    Example: Although you would expect the tag for a bold "OK" button to be: <b>OK</b>, the innerHTML tag might be: <B> OK </B>. To ensure that this match works, specify this regular expression as: <(b|B)>.*OK.*</(b|B)>.
  • Attribute. In the box, enter an HTML attribute of the tag element (for example, id =password).
Value | Enter the text of the Criteria to match.
Match Whole Value | Select to enforce strict matching of the Value you entered in the previous field(that is, any additional text in the tag element will cause the match to fail).
Use regular expression

Select any legal expression to match the Value you entered in the previous field (you can use wildcards to create a broader matching range).

Do not use the colon (":") as part of your matching expression. Oracle Enterprise Single Sign-on Logon Manager uses this character as a delimiter when parsing the contents of the expression.


SendKeys Settings for a Web Application

Use the controls on this screen to define SendKeys actions. If you convert the transfer method from Control IDs to SendKeys or SendKeys using Journal Hook, ESSO-LM Administrative Console automatically converts the ControlID settings to SendKeys actions, and specifies the "Direct injection" option. If you convert from either SendKeys transfer method to Control IDs, you must configure the settings to use direct injection or they will be lost.

Using the SendKeys Editor
  1. On the "Fields" tab, select SendKeys as the transfer method. The "Fields" window changes to reflect conversion of the existing fields, whose names now include "-> direct injection."

  2. Click the Edit button to open the SendKeys editor. The "Current Actions" list contains the items that the editor has detected.

    The "New Actions" box contains a list of additional controls to add to the form. Depending on what you select in this list, the options to its right vary.

    For example, if you select Fields from the "New Actions" list, the "Field Type" box appears, offering choices of a third and fourth field. If you select Delay, a menu in which you can specify a delay interval appears.

  3. Select an item in the Current Actions list and click the Edit button below the list to change the settings for that field or action. Click the Up [image] or Down [image] arrows to re-order the list.

  4. Use the "New Actions" section of the SendKeys editor to add fields and actions to the list. Refer to the tables below for information on configuring the various action choices.

    After you configure a New Action and insert it, it appears as part of the "Current Actions" list.

SendKeys Controls

Current Actions
Keys/Actions

Lists the keys and actions that the editor detected. If you converted this list from Control IDs to SendKeys, every action is configured for direct injection by default.

Use the Up [image] and Down [image] arrows to re-order the items in this list.
New Action | Controls | Description
Fields

Field Type

Select a credential item from the list to add to the series.

  • Username/ID
  • Password
  • Third Field
  • Fourth Field

Character to insert after field

Select a keystroke to insert automatically after the field is filled:

  • None (no keystroke)
  • Enter (to submit the form)
  • Tab (to advance the cursor)

Also see Special Keys, below.

Inject directly into control

Injects the credential directly into the control. Click the "…" button to open the Web Field dialog box.

Web Field

Function

This box is pre-filled with the name of the field that you are editing and cannot be changed.

  1. Click Wizard to launch the Web Form Wizard, which is pre-filled with the URL that you specified previously.
  2. Select a field from the Web page in the wizard and click OK to close the wizard. You return to the "Web Field" dialog box, which is populated with the parameters of the field that you selected.
  3. Click OK to exit the "Web Field" dialog box. The "Current Actions" list now includes the field or action that you just configured.
Frame | Identifies the frame number in the Web page that contains the function you are configuring.
Form | Identifies the type of form you are creating based on the function.
Field identification | Identifies the field as specified in the Web page.
Field type

Identifies the type of field:

  • Text
  • Password
  • Select-One
  • Select-Multiple

Insert

Add the current selection to the series.
New Action | Controls | Description
Click

Click on a control

Select "…" to open the "Web Element" dialog box, and click Wizard to launch the Web Form Wizard. This time, the wizard identifies only clickable fields.

Select the field that you want to associate with a click, and select OK. The wizard closes and returns you to the "Web Element" dialog box. Its fields are populated with the information that the wizard identified.
Frame | Identifies the frame number in the Web page that contains the function you are configuring.
Form | Identifies the type of form you are creating based on the function.
Field identification | Identifies the field as specified in the Web page.
Field type

Identifies the type of field:

  • Submit
  • Image
  • Button
  • Anchor
  • IMG

ESSO-LM Administrative Console detects where the control is and simulates a click in the center of the control.

Insert

Add the click selection to the series..
New Action Controls Description
Run Task

Command line to run

Enter a Command line to be executed. This feature allows you to run a program in the middle of entering keystrokes.

  • Window Handles can be appended to the command line to inform the script of the window handle currently being worked on:
    $(HWND)
  • Environment Variables can also be appended to the command line:
    $(USERDOMAIN)\$(USERNAME)

Click the ... button to open the Choose File dialog box.

Virtual key codes cannot be used within the command line (the initial backquote character will terminate the command line).

Expected return code

Enter the expected return code. The rest of the SendKeys script is discarded if this value is not returned.

Time out (sec.)

Enter the number of milliseconds to wait for the task to complete. The rest of the SendKeys script is discarded if this timeout is reached. The maximum timeout period is 5 seconds.

Insert

Add the task to the series.

New Action | Controls | Description
Delay | Length of delay (in seconds) | Type or select a delay between keystrokes.
 | Insert | Add the delay to the series.
New Action | Controls | Description
Set Focus | Set focus to control | Sets the focus to control. Click the ...button to open the Web Element dialog box and launch the Web Form Wizard. Select which of the available fields will receive focus. Click OK.
 | Insert | Add the focus to the series.
New Action | Controls | Description
Text | Enter text to insert | Type any literal text to add to the series.
 | Insert | Add the text to the series.
New Action Controls Description
Special Keys

Category

Choose a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Backspace) from the right list.

Key List

Select the functionality of the key.

  • Key Press. Insert the key as a single keystroke (default).

  • Key Down/Up. Insert the key as a pair of actions: key-press and key-release. This option lets you insert other keystrokes between these actions to indicate one or more keys held down as another is typed, as for a "hot key" combination that moves the focus to a specific text box.

    For example, to insert the keystroke "Alt+P," select the Key Down/Up option, then select Modifier for the Category and Alt for the Key. and click Insert. This inserts two actions: [Down:Alt] and [Up:Alt].

    Select the Text tab and enter P in the text box. In the left pane, select [Up:Alt] and click Insert. The "P" is inserted between the two Alt-key actions, producing "Alt-P."

  • Key Down. Insert the key as a downward press only.
  • Key Up. Insert the key as a release only.

Insert

Add the keystroke to the series.


Matching tab (for configuring a Web application)

●Using the Console > Applications > New Web application > Matching tab (for configuring a Web application)

Matching Tab for Configuring a Web Application

Use the Web Matching tab to distinguish among logon, password-change, or password-confirmation forms (referred to here as target forms) within the same Web application, typically a multi-form portal page. The Agent uses the matching criteria you supply here to distinguish among similar forms.

This tab is typically used to refine the detection match criteria, that is, the set of HTML tags and values you use to identify a specific page. You can then create an offset match that uses a subset of the detection match to identify the desired logon or password-change form on the page.

Creating or Modifying Detection-Matching Criteria

  1. In the Detection Match list, do one of the following:
    • Click Add to create a new matching criterion.
    • Select a match and click Edit to modify an existing match.
  2. From the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  3. If necessary, adjust the match criteria order.
    1. Select a match to move.
    2. Click the Up [image] or Down [image] arrow.
  4. Click OK.

Offset Matching

Offset matching should only be used with portal Web pages.

This type of matching is used with portal pages that have multiple windows that the user can rearrange, add, and remove. If the site you are matching on is not a portal, leave the offset matching section on this panel blank.

With regular match detection, the forms must always appear in the same order. With offset matching, you can rearrange the forms (which look like a window) and isolate a specific window from all the others. This only applies to portal pages because these pages are dynamic, and ordinal values are used to match instead of field names.

Use the Offset Start field to tell ESSO-LM which match result's forms to use for the form offsets. The offset start value should be the number of the offset matches. For example, if there are 3 offset matches, the offset start value should be 3.

Creating or Modifying Offset Matching Criteria

  1. In the Offset Match list, do one of the following as needed:
    • Click Copy from Detection to copy defined Detection Match criteria.
    • Click Add to create a new matching criterion.
    • Select a match and click Edit to modify an existing match.
  2. In the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  3. If necessary, adjust the match criteria order.
    1. Select a match to move.
    2. Click the Up [image] or Down [image] arrow.
    3. Select an Offset Start.
  4. Click OK.


Edit Match Criteria for a Web Application

Use this dialog box to create or modify matching criteria for the selected Web form.

Tag | Enter an HTML tag type; for example, <TD> for a table cell.
Match Tag Instance | Select to match a specific instance of the Tag and select the instance number; for example, 3 for the third table cell on the page.
Criteria

Select one criteria type:

  • Text. The plain-text (InnerText) content of the tag element (for example, Enter your password)

  • HTML. The rich-text (InnerHTML) content of the tag element (for example, <b>Enter your password</b>).

    Certain browsers' innerHTML properties tags can differ from the normal HTML. For instance, the tags might appear in a different letter case, or they might add or remove spacing between the tag and the enclosed text. In order to avoid matching problems, use alternate tags and wildcard characters to account for these differences.

    Example: Although you would expect the tag for a bold "OK" button to be: <b>OK</b>, the innerHTML tag might be: <B> OK </B>. To ensure that this match works, specify this regular expression as: <(b|B)>.*OK.*</(b|B)>.
  • Attribute. In the box, enter an HTML attribute of the tag element (for example, id =password).
Value

Enter the actual text to match.

  • Match whole value: Select to enforce strict matching of "Value" (that is, any additional text in the tag element will cause the match to fail).
  • User regular expression: Select to allow more flexible matching based on regular expressions.
Operation

Select the relationship of this match to any others:

  • And: This match is one of multiple matches required to identify the form.
  • Or: This match alone identifies the form.
  • Not: This match excludes the form

The AND, OR, and NOT operators specify the conditions under which the Agent should respond to Web match combinations.

If you assign a match value of AND to a match criterion, that criterion must be present for the Agent to respond to a page. So, when several fields are assigned an AND operator, all those criteria must be present.

If you assign a match value of OR to several match criteria, the Agent responds if any one of the criteria is present.

The NOT operator is used as an excluder when performing a match. The Agent responds to any criteria that are assigned the AND and OR operators, unless the conditions of the NOT criteria are present. The Agent excludes the instances specified by the NOT operator.


Add Edit URL

●Using the Console > Applications > New Web application > Matching Tab for Configuring a Web Application > Add Edit URL

Add/Edit URL

Use this prompt to specify the URL (or Uniform Resource Locator, commonly called a Web address) of the logon or password-change form to configure.

To specify a URL for matching

  1. Select one of the following (see Matching Expressions, below).
  2. Exact
  3. Wildcard (does not apply to Kiosk Manager)
    • Regular Expression (does not apply to Kiosk Manager)
  4. Type (or edit) the URL or a matching expression.
  5. Click OK.

Matching Expressions

For applications that have varying text in their URLs, you can use substrings or regular expressions to specify how to match the variable text.

Wildcards
  • ? (question mark) matches any single character.
  • * (asterisk) matches zero or more occurrences of any character.
This does not apply to Kiosk Manager.
Regular Expressions

You can also use the set of regular expressions to specify a string pattern that the Agent should recognize as a match.

This does not apply to Kiosk Manager.

Matching Environment Variables

For applications that include the user's name in the URL (as derived from the DOMAINUSER environment variable in the workstation operating system), select Exact as the matching criterion, and use one of the following substitution tokens in the match string:

%DOMAINUSER% | User name exactly as derived from the environment variable
%UC%%DOMAINUSER% | User name converted to all upper case
%LC%%DOMAINUSER% | User name converted to all lower case
Example

This URLentry matches a password-change window title that includes the username:

Password Expired - %UC%%DOMAINUSER%


Adding and Editing Web Fields

Use this dialog box to specify a credential field or Submit button on a Web form.

Function

Select a credential type:

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • New Password
  • Confirm New Password
  • Submit
Frame | Type the target name of the browser frame in which the field appears (specified by the NAME attribute in a <frame> element in the target page's parent frameset).
Form | Type the name of the form in which the field appears (specified by the NAME attribute in the <form> element in the target page).
Field identification | Select the "…" button to launch the Field Identification dialog box, where you can select which type of field you want to match.
Field type | Select the field type (corresponding to the type attribute of the field's <input> element) or a hyperlink anchor or IMG tag (<A HREF=...>) used as a Submit button.
Credential Type | <INPUT TYPE=...> Options
UserID | Text
Password | Password
Third Field | Select-One
Fourth Field | Select-Multiple
New Password
Confirm New Password
Submit | Submit
Image
Button
Anchor (<A HREF...> tag
IMG (<A HREF...> tag


Options Tab Configuring for a Web Application

●Using the Console > Applications > New Web application > Options Tab Configuring for a Web Application

Options Tab for Configuring for a Web Application

Web pages occasionally include forms that require a short time to become enabled as the page loads. In such a case, ESSO-LM might submit credentials too soon. To avoid this occurrence, use the Submit Delay setting on the Options tab to allow time for all forms to become enabled.

Dynamic Page | Check to indicate that the Web page for the template includes dynamic content.
Adheres to Logon Loop Grace Period | Select to have the Agent ignore this application's logon form when the logon loop grace period (set on the application's Miscellaneous tab) is in effect.
Auto-Recognize | Select to have the Agent recognize the application automatically. Specifying a status for this setting on the Options tab overrides the global Agent setting. If this setting is checked, the user can configure this setting from the Logon Manager. If this setting is unchecked, the user will not have access to this setting from the Logon Manager.
Auto Submit | Select to have the Agent automatically select OK for this application logon after providing credentials.
Preset Focus | Select to set the focus on a logon field before the Agent places data in the field.
Submit via Keyboard | Select to instruct the Agent to enter a programmatic "Submit" command for Web pages that have no "Submit" button.
Submit Delay (milliseconds) | Enter a time in milliseconds for the Agent to wait to submit credentials.


New Host/Mainframe Application

Use this dialog box to configure a new logon for a host/mainframe application.

See Adding Mainframe Applications for the full procedure.

Configuring a New Host/Mainframe Application

  1. Start the target application.
  2. In the left pane, right-click Applications then select New Host App from the shortcut menu.
  3. The "Add Application" dialog box appears with the Host/Mainframe option selected.
  4. In the Add Application dialog box, enter a Name for the new logon and click OK. The Host/Mainframe Form Wizard (for configuring new logon forms) appears.

See Adding Mainframe Applications for more information.


Host/Mainframe Form Wizard

Use the Host/Mainframe Form Wizard to perform any of these tasks:

  • Configure new logons for a host/mainframe emulator or Telnet (scrolling-screen) applications.
  • Add new forms to existing logons.
  • Create forms for automatic password changes.
  • Create forms for detecting password change success and failure.

The Host/Mainframe Form Wizard lets you use the application itself to identify its logon/password-change windows and the individual username/ID, password, and other fields. The general steps for creating a logon are as follows:

  1. Start the target emulator or Telnet application.
  2. Select the Form Type and Screen Type.
  3. Copy the text of the application's logon/password-change screen and paste it to the ESSO-LM Administrative Console.
  4. Indicate the text and position of onscreen captions that identifies the screen as a logon/password-change form.
  5. Indicate the position (or, for Telnet applications, the sequence) of the individual username/ID, password, and other fields.
  6. Review the configuration and make changes as needed, using the Back and Next buttons.
  7. To modify a host/mainframe logon's settings manually, use the Identification tab (for configuring a host/mainframe logon form).
  8. Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Host/Mainframe Applications for specific information about creating and configuring host/mainframe logons.

Configuring a Host/Mainframe Application

Start the target application in the host/mainframe emulator or Telnet.

  1. In the ESSO-LM Administrative Console, do one of the following:
    • Create a new host/mainframe application logon.
    • Select an existing host mainframe application, then in the General tab, click Add.
  2. In the Host/Mainframe Wizard, select the form type. The available options are:
    • Logon. Configures a logon form.
    • Logon success. Configures a form that detects a match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's entries and displays the Logon Success dialog box. If this form is not present, the Agent captures credentials immediately after the user enters them and clicks OK. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • Logon failure. Configures a form that detects a non-match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's incorrect entries and displays the Logon Failure dialog box. If this form is not present, the Agent immediately informs the user that the credentials are incorrect, displaying either the New Logon dialog box or the Retry Logon dialog box to allow the user to re-enter credentials. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • Password change. Configures a password change form.
    • Password confirmation. Configures a form that verifies that the user's second password entry in a password change form is identical to the first password entry.
    • Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Host/Mainframe Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
    • Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Host/Mainframe in which you will configure the necessary fields.
  3. In the Screen Type wizard page, do one of the following:
    • Choose Fixed Screen for applications running on a host/mainframe emulator that presents logon forms as static text pages.
    • Choose Scrolling Screen for applications running on Telnet or other scrolling-screen consoles that request logon information as a series of prompts.
  4. In the Paste Screen Text page that opens, in the target application, copy all of the onscreen text to the Windows Clipboard.
Some emulators provide a Copy command or button; others let you select Ctrl+C to copy. In Windows Telnet, select the text and select Enter.
  5. In the Console's Paste Screen Text page, click Paste Text topaste the text into the wizard page, and click Next.

If the emulator screen does not use return or line-feed characters, adjust the Characters per Line to set proper text wrapping.
  6. In the Cursor Position page, click or use the arrow keys to place the text cursor in the exact position that it appears in the Telnet application's window.
  7. Click Next to display the next wizard page.
  8. In the Text to Match wizard page, select a block of text that identifies the screen as a logon or password-change form. Right-click the selection, and click Add as Text Match. Repeat this step for additional text blocks.
  9. When your selections are complete, click Next to display the next wizard page.
  10. In the Fields wizard page, do one of the following:
    • For a fixed-screen logon, place the text cursor at the starting position of a field. Right-click and select the field type (Username/ID, Password, Third Field, Fourth Field) from the shortcut menu. Repeat this step for each required field.
    • For a scrolling screen, place the text cursor at the prompt-entry position. Click Add, then select the first field type requested. Repeat this step for each required prompt.
  11. When your selections are complete, click Next to display the summary page.
  12. Review the configuration. To make changes, use the Back and Next buttons to display a page.
  13. When your configuration is complete, click Finish.


Host/Mainframe Form Wizard for RSA SecurID

●Using the Console > Applications > Selected Application > Host/Mainframe Form Wizard for RSA SecurID

Host/Mainframe Form Wizard

Use the Host/Mainframe Form Wizard to perform any of these tasks:

  • Configure new logons for a host/mainframe emulator or Telnet (scrolling-screen) applications.
  • Add new forms to existing logons
  • Create forms for automatic PIN changes
  • Create forms for detecting PIN change success and failure

The Host/Mainframe Form Wizard lets you use the application itself to identify its windows and fields. The general steps for creating a logon are as follows:

  1. Start the target emulator or Telnet application.
  2. Select the Form Type and Screen Type.
  3. Copy the text from the form displayed by the application and paste it to the ESSO-LM Administrative Console.
  4. Indicate the text and position of onscreen captions that identifies the screen as a form of the selected type.
  5. Indicate the position (or, for Telnet applications, the sequence) of the individual username/ID, PIN, and other fields.
  6. Review the configuration and make changes as needed, using the Back and Next buttons.

To modify a host/mainframe logon's settings manually, use the General tab (for configuring a host/mainframe logon form).

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Host/Mainframe Applications for specific information about creating and configuring host/mainframe logons.

Configuring a Host/Mainframe Application

Start the target application in the host/mainframe emulator or Telnet.

  1. In the ESSO-LM Administrative Console, do one of the following:
    • Create a new host/mainframe application logon. Be sure to select the RSA SecurID check box in the Add Application dialog.
    • Select an existing host mainframe application, then in the General tab, click Add.
  2. In the Host/Mainframe Wizard, select the form type. The available options are:
    • SecurID Logon. Configures a logon form.
    • SecurID Logon success. Configures a form that detects a match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's entries and displays the Logon Success dialog box. If this form is not present, the Agent captures credentials immediately after the user enters them and clicks OK. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • SecurID Logon failure. Configures a form that detects a non-match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's incorrect entries and displays the Logon Failure dialog box. If this form is not present, the Agent immediately informs the user that the credentials are incorrect, displaying either the New Logon dialog box or the Retry Logon dialog box to allow the user to re-enter credentials. Refer to the Oracle Knowledgebase for a full discussion on using this form.
    • PIN change. Configures a PIN change form.
    • PIN confirmation. Configures a form that verifies that the user's second password entry in a password change form is identical to the first password entry.
    • PIN change success. Configures a form that serves as a match for the target application's PIN change success message. Since this form does not inject credentials, the Credentials page of the Host/Mainframe Wizard is skipped. When the PIN change success message is detected, ESSO-LM will automatically save the new credentials.
    • PIN change failure. Configures a form that serves as a match for the target application's PIN change failure message and reinjects credentials when the PIN change failure message is detected. If you select this option, you will be presented with the Credentials page of the Host/Mainframe Wizard in which you will configure the necessary fields.
  3. In the Screen Type wizard page, do one of the following:
    • Choose Fixed Screen for applications running on a host/mainframe emulator that presents logon forms as static text pages.
    • Choose Scrolling Screen for applications running on Telnet or other scrolling-screen consoles that request logon information as a series of prompts.
  4. In the Paste Screen Text page that opens, in the target application, copy all of the onscreen text to the Windows Clipboard.
Some emulators provide a Copy command or button; others let you select Ctrl+C to copy. In Windows Telnet, select the text and select Enter.
  5. In the Console's Paste Screen Text page, click Paste Text topaste the text into the wizard page, and click Next.

If the emulator screen does not use return or line-feed characters, adjust the Characters per Line to set proper text wrapping.
  6. In the Cursor Position page, click or use the arrow keys to place the text cursor in the exact position that it appears in the Telnet application's window.
  7. Click Next to display the next wizard page.
  8. In the Text to Match wizard page, select a block of text that identifies the screen as a logon or password-change form. Right-click the selection, and click Add as Text Match. Repeat this step for additional text blocks.
  9. When your selections are complete, click Next to display the next wizard page.
  10. In the Fields wizard page, do one of the following:
    • For a fixed-screen logon, place the text cursor at the starting position of a field. Right-click and select the field type (Username/ID, Password, Third Field, Fourth Field) from the shortcut menu. Repeat this step for each required field.
    • For a scrolling screen, place the text cursor at the prompt-entry position. Click Add, then select the first field type requested. Repeat this step for each required prompt.
  11. When your selections are complete, click Next to display the summary page.
  12. Review the configuration. To make changes, use the Back and Next buttons to display a page.
  13. When your configuration is complete, click Finish.


Identification Tab for Configuring a Host/Mainframe Application

●Using the Console > Applications > New Mainframe/Host application > Identification Tab for Configuring a Host/Mainframe Application

Identification Tab for Configuring a Host or Mainframe Application

Use this dialog box to modify information about a Host/Mainframe application logon form.

See Adding Telnet Applications for information about configuring logons for Telnet applications.
Controls
Form Name | The name of the application logon form. You can edit the name.
Window Titles

Since some emulators do not have unique characteristics within their screens to differentiate one from another, you have the option of selecting the window title from a list of open emulator applications.

  • Click Add to open the "Window Title" screen and enter a window title name manually.

    or

  • Click Choose to open the "Select Window" screen and pick an application from the open emulator list.
Text Matching | Displays the literal Text string that the Agent uses to identify this form, the screen coordinates (Row and Column numbers) of the first character of the string. Click Add to specify a new text identifier or Edit to modify an existing one.
Fields | Displays the series of keystrokes that ESSO-LM transfers to the host application's logon form. To add or modify a keystroke series, click Edit to display the SendKeys(Host/Mainframe) dialog box.
Wizard | Start the Host/Mainframe Form Wizardfor configuring an application visually.


Text Matching (on a Host/Mainframe Logon Form)

Use the Text Matching dialog box to specify the text and position of an onscreen caption that identifies the screen as a logon or password-change form.

You must also specify the location (row and column number) of the first character of the text. Use the cursor-position indicator in the status bar at the bottom of the session window to find the row and column numbers of the text.

For Telnet applications, use row coordinates relative to the cursor position. See Adding Telnet Applications for an example. You can also use an asterisk for wildcard matching of a row, column or both.

When you have completed your entries for a match, click OK.

Controls

Row | Type the row number (vertical screen coordinate) of the first character of the Text. For Telnet applications (with supported host emulators), this value is relative to the cursor position and can be negative (to indicate a row above the cursor) or an asterisk (*) to indicate any row onscreen).
Column | Type the column number (horizontal screen coordinate) of the first character of the Text. For Telnet applications (with supported host emulators), this setting can be an asterisk (*) to indicate any row onscreen.
Text | Type the string of text to match.


Edit Fields/Actions (Host Mainframe)

●Using the Console > Applications > New Mainframe/Host application > Identification Tab for Configuring a Host or Mainframe Application > SendKeys

Edit Fields and Actions for a Host/Mainframe Application

Use theEdit Fields/Actions dialog box to specify a series of keystrokes for ESSO-LM to transfer to the host application's logon form.

The tabs in the right pane of the Edit Fields/Actionsdialog box provide the keystroke options. Select or enter the options you need on each tab. Click the Insert button to add the key or action to the series.

Your selections appear in the list in the left pane. To change the order of the series, select an item and click the up or down arrows to move it. To modify an item, select it, and click Edit to display the Fields dialog box. To delete an item, select it, and click Delete.

Controls

Current fields/actions
Fields tab Select fields to insert

Select a credential item from the list to add to the series:

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • New Password
  • Confirm New Password

Use the Up [image] and Down [image] arrows for correct navigation through the form.

Insert this character after field

Select a keystroke to insert automatically after the field is filled:

  • None (no keystroke)
  • Tab (to advance the cursor)
  • Enter (to submit the form)

Also see Special Keys, below.

Position

Enter the row and column coordinates of the first character of the text-entry field.
If the column number is variable, (for example, most Unix systems include the affected username as part of the "New Password" and "Confirm Password" field labels when changing passwords), you can use a regular expression to wildcard the variable portion of the field label so that ESSO-LM always injects credentials in the correct spot.

Insert

Add the current selection to the series.
Delay tab

Length of delay (in seconds)

Enter or select a delay between keystrokes.
Text tab

Enter text to insert

Enter any literal text to add to the series.

Insert

Add the text to the series.
Special Keys tab

Category/Key

Select a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Page Down) from the right list.

Insert

Add the keystroke to the series.


Fields Tab for Configuring a Host/Mainframe Application

●Using the Console > Applications > New Mainframe/Host application > Fields Tab for Configuring a Host/Mainframe Application

Fields Tab for Configuring a Host or Mainframe Application

Use the Fields tab to define how the Agent interacts with the fields of a form.

You must also specify the location (row and column number) of the first character of the field. Use the cursor-position indicator in the status bar at the bottom of the session window to find the starting row and column numbers of the text. When you have completed your entries, click OK.

See Adding Host/Mainframe Applications for more information.

Controls

Fields/Actions

Select the field type:

  • UserID
  • Password/OldPassword
  • Third Field
  • Fourth Field
  • New Password
  • Confirm New Password

Use the Up [image] and Down [image] arrows to re-order the fields for correct navigation through the form.

Click Edit to specify the way the Agent navigates the form.


Matching Tab for Configuring a Host or Mainframe Application

Use the “Matching” tab to specify the text that identifies the screen as a logon or password-change form.

Controls

Row | Enter the row number (vertical screen coordinate) of the first character of the text. For Telnet applications (with supported host emulators), this value is relative to the cursor position and can be negative (to indicate a row above the cursor) or an asterisk (*) to indicate any row onscreen).
Column | Enter the column number (horizontal screen coordinate) of the first character of the text. For Telnet applications (with supported host emulators), this setting can be an asterisk (*) to indicate any row onscreen
Text to Match | Displays the literal Text string that the Agent uses to identify this form, the screen coordinates (Row and Column numbers) of the first character of the string. Click Add to specify a new text identifier or Edit to modify an existing one.


Options Tab for Configuring a Host or Mainframe Application

Use this screen to configure behaviors for a host or mainframe application.

To display this tab, do one of the following:

  1. Create a new host/mainframe application logon.

or

  1. In the left pane, click Applications and select a host/mainframe application.
  2. Click the General tab in the right pane.
  3. Select a logon form from the list and click Edit.
  4. In the Host/Mainframe form-configuration dialog box, select the Options tab.

Controls

Field Delay | Enter a time in milliseconds for the Agent to wait to submit credentials.
Screen type | Specify whether the application has a fixed or scrolling screen.
Column position of cursor | Specify the column where the cursor should be placed before starting to enter credentials..
Adhere to logon loop grace period | Select to have the Agent ignore this application's logon form when the logon loop grace period (set on the application's Miscellaneous tab) is in effect.
Auto-Recognize | Select to have the Agent recognize the application automatically. If this setting is checked or unchecked, it overrides the global Agent setting. If this setting is checked, the user can configure this setting from the Logon Manager. If this setting is unchecked, the user will not have access to this setting from the Logon Manager.
Auto-Submit | Select to have the Agent automatically select OK for this application logon after providing credentials.


Bulk-Add tab

●Using the Console > Applications > Bulk Add

Bulk Add tab

See First Time Use (Bulk-Add) for more information.

Specifying Applications to Bulk-Add

You must configure applications individually to use in a bulk-add. See To enable a logon for Bulk-Add.
  1. Click Applications in the left pane, then click the Bulk-Add tab in the right pane.
  2. Click Add. The Select Application dialog box appears.
  3. Select the applications to add to this group. (Use Ctrl+click or Shift+click to select multiple entries.)
  4. Click OK.
  5. Type or edit the Version Stamp in yyyymmdd format (for example "20030615" for June 15, 2003). If this date is later than the last date a given Agent completed setup, then the Agent activates the Setup Wizard to add the new logon(s).


Application (selected)

●Using the Console > Applications > Application (selected)

Selected Application

Represents a configured application. Use the tabs in the right pane to view or modify this logon's properties.

To select a logon for viewing or editing:

  1. Click Applications in the left pane, then click the Applications List tab in the right pane.
  2. Select an application from the list, then click Edit.

or

  1. In the left pane, click the plus sign (+) next to the Applications icon (or double-click Applications) to display the configured logons.
  2. Do one of the following:

    • Click a logon icon to select it. The General tab appears in the right pane.

      or

    • Right-click a logon icon to display a shortcut menu with these options:

New Form | Add a new form for the selected application logon. Displays the corresponding configuration dialog for the selected application type.
Delete | Delete the selected logon.
Make copy | Duplicate the selected logon.
Rename | Rename the selected logon.


General tab for (selected application)

●Using the Console > Applications > Selected Application > General tab

General Tab (for a Selected Application)

Use the General tab to add or modify form or field configurations for the selected application.

Description | Enter an optional text comment to appear in the Description field of the Agent Logon Manager. For example, "Email."=
Reference

Enter an optional text comment to appear in the Reference field of the Agent Logon Manager. For example, the "Version 1.0."

This field is read-only on the client side.
Add | Add a new form for the selected application. The corresponding configuration dialog box for the selected application type appears.
Edit | Modify an existing logon form. Select a form from the Forms window, then click Edit. The corresponding configuration dialog for the selected application type appears.
Delete | Remove a form. Select a form from the Forms window, then click Delete. If only one form is listed, deleting it will remove the application entirely.
Add [Edit] Notes | Type or modify optional comments or documentation.
Deny response

Check this button to prevent the Agent from responding to this form.

Disabling any form in a template disables the entire template.


Bulk add tab (for selected application)

●Using the Console > Applications > Selected Application > Bulk Add Tab

Bulk Add Tab (for a Selected Application)

Use this tab for special configurations of the currently-selected application. Also see Bulk-Add tab (general) for more information.

Enable Bulk-Add capability for this application | Select to enable this application to be included in a bulk-add.
Confirm UserID during Bulk-Add | Select to require the user to confirm username in order to perform a bulk-add.
Confirm Password during Bulk-Add | Select to require the user to confirm password in order to perform a bulk-add.
Confirm Third Field during Bulk-Add | Select to require the user to confirm a third field's information in order to perform a bulk-add.
Confirm Fourth Field during Bulk-Add | Select to require the user to confirm a fourth field's information in order to perform a bulk-add.


Authentication tab (for selected application)

●Using the Console > Applications > Selected Application > Authentication

Authentication Tab (for a Selected Application)

Use this tab to set the minimum authentication grade for the selected application.

The Primary Logon Method used must have an Authentication Grade equal to or higher than this value in order for ESSO-LM to log on to the selected application.

If the end-user's Primary Logon Method has an authentication grade lower than the minimum set for this application, when the user requests access to the application, ESSO-LM prompts the user to authenticate at a higher grade. The user will only gain access after successfully logging on at the required grade.

To set the authenticator grade for primary logon methods using the Authenticator Grade setting.

Minimum Authentication Grade Select or type the numeric value of the lowest Authentication Grade the end user's Primary Logon Method must have. The default is 1.


Error Loop tab (for selected application)

●Using the Console > Applications > Selected Application > Error Loop tab

Error Loop Tab (for a Selected Logon)

Use the Error Loop tab (under a selected application) to control the appearance and behavior of the Logon Error (Error Loop) dialog box for individual applications.

  • To set Error Loop globally, for all applications, use the Error Loop global Agent settings (see Error Loop (End-User Experience - Response)).
  • To set Error Loop by application type, use the Error Loopglobal Agent settings for each type (Windows, Web, Host/Mainframe).

Controls

Logon Timeout (sec.)

[TimeOut]

Maximum time in seconds between successive logon attempts before Logon Error dialog appears. Default is 30.

If Logon Timeout is set to 0, a logon error (for example, entering the wrong credentials) will not display the Logon Error dialog box.

Max. Retries

[MaxRetry]

Maximum number of retries (after first try) allowed before the Logon Error dialog box appears. Default is 1.

Hide "Confirm Password"

[HideConfirmPW]

Whether to hide the password confirmation field in the Logon Error dialog box. Default is No.
(Global registry equivalents shown in brackets.)


Password Change Tab (for a Selected Application)

Use the Password Change tab to set or modify options that control how the Agent manages password changes.

The Agent distinguishes between logon and password change fields that appear on the same screen or on different tabs of a dialog box. In the instance of this type of screen, the Agent prompts the user, through the Action Chooser dialog box, to select a password change or logon. You can configure a period of time for which the user will not need to change passwords, and hence will not receive the Action Chooser.

Controls

Password Change Options
Password Change Dialog Behavior

Controls how the Agent responds when an application prompts the end user to change passwords. The options are:

  • Prompt User: Prompts the user with the Password Change Wizard.
  • Manual: Prompts the user to select a new password; does not let the Password Change Wizard automatically generate a password.
  • Manual w/Auto Option: Prompts user to select a new password, but lets the Password Change Wizard offer to generate a password automatically.
  • Auto w/Manual Option: Generates a new password automatically, but first allows the user to select a new password.
  • Quietly Generate and Submit Password: Generates and submits password without prompting the user.
Prevent Ability to Cancel

When enabled, disables the “Cancel” button in the password change dialog, prohibiting the user from canceling the password change process.

This setting is new as of ESSO-LM version 11.1.1.1.0.
Enable Password verify pop-up dialog | Check this box if you want to display the password change verification pop-up dialog box, which provides an additional confirmation that the password has been changed.
Lock focus to password change dialog

When enabled, locks desktop focus to the password change dialog, preventing interaction with the target application until the user completes or dismisses the dialog.

This setting is new as of ESSO-LM version 11.1.1.1.0.
Password Generation Policy | Select a password generation policy. To subscribe multiple applications to a policy, see Policy Subscribers.
Credential Sharing Group | Select a credential sharing group. To assign multiple applications to a password group, see Credential Sharing Groups.
Password Expiration Options
Enable Password Expiration | Select this check box to require users to change passwords after a specified period.
Number of days until password expires | Enter or select the number of days for which a user's password is valid.
Run this command when the password expires | Type the full path and command (or click Browse to locate the executable file) that should be invoked when the user attempts to log on after the Number of days setting has elapsed. (Example C:\Program Files\PassChange\passchange.exe. )
Logon Chooser Options

Bypass Logon Chooser

Controls whether the Logon Chooser appears when a password change is initiated. When enabled, the password change dialog will be displayed immediately if the selected condition is met. The available conditions are listed below.

Options:

  • When the most recent logon was to the same application instance.
  • When the most recent logon for the same application occurred within:
    • If you select the second condition, specify the length of the timeout in seconds. Valid range is 1-999999 seconds.
Bypass Logon Chooser for*

If you select to bypass the Logon Chooser by either means above, specify the forms that you want the Agent to bypass.

Options:

  • Password Change and Logon forms.
  • Password Change form only.

This setting is new as of ESSO-LM version 11.1.1.5.0.
Action Chooser Grace Period
Days Enter the length of the grace period (in days) for which the Agent will not display the Action Chooser dialog box.
Automatically proceed with password change

When enabled, the Action Chooser is bypassed when the grace period expires and password change initiates automatically.

This option is only available after the grace period has been specified.

This setting is new as of ESSO-LM version 11.1.1.1.0.


Events Tab (for a Selected Application)

Use this tab to add a logon event and configure the environment surrounding it.

Add Logon Event

Run this command when a logon for this application is added

This setting allows you to define a process (such as exe, web, script, etc.) to be run immediately after the Add Logon Wizard is completed for an application.

For example, this setting could be used to launch a password change application right after credentials are entered into the Agent, thus allowing the Agent to change the application password immediately.

Click the Browse button to locate a command to be entered.
Pre Logon Event
Run this command before a logon for this application is used

This setting allows you to define a pre-logon task that occurs prior to each logon instance, transmitting information from this process about the current logon attempt. The information in the resulting exit code cues Logon Manager whether to continue credential submission or abort the logon process.

For example, you might want to run a script to call an API, perform a task to ensure that an application is in the state required for logon, or check usernames against a list of permitted or prohibited applications.

Click the Browse button to locate a command to be entered.
Failure Return Code

The Agent will ignore a logon returning a number of errors equal to or higher than the number set in this field. A higher setting allows the application to return multiple error codes. The default for this setting is 1.
Time out

Specifies the time, in milliseconds, for the Agent to wait for the task to complete. This setting is incremental from 1.000 to 5.000 milliseconds (default). If the task has not completed within the specified time, the task terminates and logon does not occur.
It is recommended that you specify a full path to the application to run, and surround it with double quotes. For example, "C:\Program Files\My Tools\checktool.exe"


Miscellaneous Tab (for Selected Application)

●Using the Console > Applications > Selected Application > Miscellaneous Tab (for Selected Application)

Miscellaneous Tab (for a Selected Application)

Use this tab for special configurations of the currently-selected application.

Miscellaneous Settings

Allow Masked Fields to Be Revealed

Select to enable the Reveal button for for masked fileds in Wizards and property pages.

Force Reauthentication

Select to require the user to reauthenticate before providing credentials to this application.

Auto Submit

Select to have the Agent automatically select OK for this application logon after providing credentials.

Service Logon

Select to let the Agent detect an application that runs as a Windows service (that is, in the System space, rather than the User space).

Auto-Recognize

Select to have the Agent recognize applications and Web sites and log users on automatically. If this setting is checked or unchecked, it overrides the global Agent setting. If this setting is checked, the user can configure this setting from the Logon Manager. If this setting is unchecked, the user will not have access to this setting from the Logon Manager.

If this setting has a green box instead of a check, this means that the user can configure this setting from the Logon Manager.

Mask Third Field

 Select to mask the third field of an application logon. This affects the third field appearance on the following pages: New Logon property, Error Loop Dialog, Logon Properties, and FTU Entry. By default, this box is checked (third field is masked).

Mask Fourth Field

 Select to mask the fourth field of an application logon. This affects the fourth field appearance on the following pages: New Logon property, Error Loop Dialog, Logon Properties, and FTU Entry. By default, this box is checked (fourth field is masked).
Prohibit disabling the addition of new logons

Specifies whether the “Disable” button in the “New Logon” dialog is active for this application. When enabled, the “Disable” button is deactivated and the user is prohibited from adding new logons for this application when auto-prompted by the Agent. When disabled, clicking the “Disable” button adds this application is to the “Exclusions” list in the Agent settings dialog.

Options:

  • Yes
  • No (default)

This setting changed in version 11.1.1.1.0.

Prohibit canceling the addition of new logons

Specifies whether the “Cancel” button in the “New Logon” dialog is active for this application. When enabled, the “Cancel” button is deactivated and the user is prohibited from canceling a logon addition in progress for this application after being auto-prompted by the Agent. When disabled, clicking the “Cancel” button defers the logon addition until the next time this application is detected.

Options:

  • Yes
  • No (default)
Allow creation of multiple accounts during credential capture

Specifies whether to enable the checkbox that allows the user to add another set of credentials in the "New Logon" dialog box.

For any template, this setting overrides the Global Agent Setting of the same name.

File extension (for Icon)

Enter a Windows file extension associated with a logon. Instructs the Agent to map an icon to the configuration.

ConfigName

Click Choose to select the windows and control that contains the text to use to create the new logon's initial configuration name (Windows applications only).

UserID Field Label

Type a text label to be used by the Agent for the username/ID field.

Password Field Label

Type a text label to be used by the Agent for the password field.

3rd Field Label

Type a text label to be used by the Agent when displaying a third logon field.

4th Field Label

Type a text label to be used by the Agent when displaying a fourth logon field.
SendKeys Settings
Delay Char Use this setting to add a delay, in milliseconds, between every press in SendKeys, slowing credential submission. This setting is useful for applications that require additional time to recognize credential input.
Logon Loop Grace Period

None

There is no grace period between logon prompts. The user is logged on automatically after initial logon. (Default)
Prompt If the logon grace period has not expired, the user receives a prompt asking if he wants to log back on to an application.
Silent

The Agent ignores the applcation for the duration of the grace period and does not inject credentials until the grace period expires.

Minutes

Set the length of the grace period in minutes.

Reset for each process

When enabled, the grace period is reset for each new process that is launched. This will cause ESSO-LM to log the user on to an application when the application is closed and restarted, even if the grace period has not expired.

When disabled, the grace period is not reset for each new process. ESSO-LM will not attempt to log the user on to an application that has been restarted until the grace period has expired. (When this is disabled and the grace period has not expired, the user will be prompted to log on again if the Prompt/Silent option is set to Prompt.)
Credential Capture Mode

Configures credential capture behavior by using one of the modes below.

  • Silent credential capture mode is not compatible with applications that require SendKeys. For this reason, you cannot use this mode for host/mainframe applications, nor for any Web or Windows application for which you use SendKeys.
  • You should not use silent credential capture for applications where the username and password are obfuscated.

*This setting is new as of version 11.1.1.5.0.
Default to global agent setting

Specifies that this application should use the same value as that in the Initial Credential Capture global agent setting.

Selecting any of the following settings overrides the global agent setting.
Do not capture silently Presents the New Logon dialog box in which the user enters credentials manually.
Capture, but do not inform user

The Agent captures the credentials as the user enters them, and does not inform the user of the process.

Capture, and inform user with balloon tip

The Agent captures the credentials as the user enters them, and displays a balloon tip near the system tray to inform the user during the process.

Capture, and present New Logon dialog box

The Agent captures the credentials as the user enters them, and displays a balloon tip near the system tray to inform the user during the process. After capturing the credentials, the Agent displays the New Logon dialog box with the user's entries pre-filled. The user can accept, change, cancel, or disable.
Silent capture timeout

The time (in milliseconds) that the Agent should wait to create an account after the user submits credentials.

If this timeout expires before the Agent can determine if the logon succeeded or failed, it dismisses the credentials it captured.


Choose Control ID

Use the ConfigName wizard to select a logon window's text control to use as the initial name of the application logon. Use this feature to name a logon (when it is added to the Agent) with a variable text item (such as an account name) that appears in the logon window.

  1. Select the window that contains the text control you want to use, then click Next.
  2. Select the control that contains the text item to use as the logon's initial configuration name. Click Finish.

Controls (Application Window)

Window List | Displays the windows of current applications. Click on the column heads to sort the list.
Show hidden window | Specifies to include hidden windows in the Window list.
Next | Advances to the next Wizard page.

Controls (ConfigName Control)

Control List | Displays the controls of the currently-selected application window. Click on the headers (Class, ID,or Text) to sort the list.
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the field list.
Back | Returns to the previous Wizard page.


Security Tab

●Using the Console > Exclusions > Security tab

Security Tab (for Role/Group Support)

Use this tab to set the access rights for the currently-selected configuration item. You can assign access rights to these items:

  • Application logons (including associated credential sharing groups).
  • Password generation policies.
  • Global Agent settings.
  • Passphrase question sets.
  • Exclusion lists.
For increased security on Active Directory domains, right-click the domain administrator's name and select DENY. This action will ensure that application templates are not automatically sent to domain administrators.

Controls

Directory | Select the target directory server.
Access information:
Name | Lists the groups or users who currently have access to this item.
ID | The user account name.
Access | Indicates whether the user or group has read/write or read-only access rights to the currently selected item. To change a user or group's access rights, right-click the user or group and select Read or Read/Write from the shortcut menu.
Actions:
Copy Permissions To… | Displays the Select Application screen. Select an application to add; use Ctrl+click or Shift+click to select multiple entries. Click OK to confirm your selection.
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected item. Click OK to confirm your selection.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries. Click OK to confirm your selection.


Provisioning Tab for a Selected Application

●Using the Console > Provisioning Gateway > Provisioning Tab

Provisioning Tab (for Role/Group Support)

From this tab, permissions can be added and removed. You can also select the level of access rights (for example, add/modify/delete applications) for those permissions.

Controls

Directory | Select the target directory server.
Access information:
Name | Lists the groups or users who currently have access to this item.
ID | Lists the user account name.
Access | Indicates the permissions that have been granted to the user or group (Add, Modify or Delete Logon). To change a user or group's access rights, right-click the user or group and select Add Logon, Modify Logon or Delete Logon from the shortcut menu.
Actions
Copy permissions to | Use this button to easily apply the provisioning rights for the current application to multiple applications. Clicking this button displays a dialog listing all the applications. Selects the applications that you want these provisioning rights to be copied to. Use Ctrl+click or Shift+click to select multiple entries. Click OK.
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected item.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.

Add User or Group Dialog Box

The Select User or Group dialog box varies based on the directory server being used:

  • LDAP
  • Active Directory/ADAM

LDAP

Use this dialog to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls

Search Base | The base (highest-level) directory to begin searching for user/group accounts. All subdirectories of the base directory are searched. Type a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search. Use this dialog to browse to and select the base (highest-level) directory to search for user/group names. Click OK when finished.
Search | Begin searching the base directory for users and groups.
Users or Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.

Active Directory/ADAM

Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls

List Names From | Select an Active Directory domain or server.
Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add | Copies user(s) and group(s) selected in the Names list to the Add Names list. Use Ctrl+click or Shift+click to select multiple entries.
Members | When a group is selected the Names list, displays the Global Group Membership dialog box, which lists the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names | Display the names of the user(s) or group(s) for whom you have you have added so far. Click OK to add these names to the access list for the current configuration item. Note: You can type or edit user names in this list. However, entries are checked for invalid account names, and duplicate account selections are automatically removed when you click OK.


Shared Accounts Template

Use this tab to create a shared account template.

Shared Accounts Tab

Use this tab to define the shared account rights for each new application. After each application is created and the shared account rights are defined, you can change the rights as needed.

Controls
This is a shared account template | Mark this checkbox to set the template key and define the template as shared. The default is None.
Directory | Select the target directory server.
Access Information
Name | Lists the groups or users who currently have access to this item.
ID | Lists the user’s account name.
Access | Indicates the permissions that have been granted to the user or group (Add Logon, Modify Logon, or Delete Logon). To change a user’s or group’s access rights, right-click the user or group and select Add Logon, Modify Logon, or Delete Logon from the shortcut menu.
Actions

Copy Permissions to

Use this button to easily apply the shared account rights for the current application to multiple applications. Clicking this button displays a dialog listing all the applications. Select the applications that you want these shared account rights to be copied to. Use Ctrl+click to select multiple entries. Click OK.

Add

Displays the Add User or Group dialog box (for Active Directory or ADAM) to select the users or groups who should have access to the currently selected item.

Remove

Removes selected users or groups from the list. Select a user or group to remove; use Ctrl+click to select multiple entries.

Add User or Group Dialog Box

The Select User or Group dialog box varies based on the directory server being used:

  • For AD/ADAM, use this control to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, Delete Logon).


Export to INI File

  1. Export selected applications and all password policies and groups to an entlist.ini file- a store of application logons.
  2. Do one of the following:

    • Select applications to export (use Ctrl+click or Shift+click to select multiple entries), then click OK.

      or

    • Click Export All to export all listed applications.
  3. If any applications you have selected are enabled for Bulk-Add, you can select Create First-Time-Use file to generate a bulk-add (ftulist.ini) file.
  4. Click OK. The Export EntList file dialog box appears.
  5. Locate and open the folder for the file, name the file, and click Save.
  6. If you chose to create a First-Time Use file, the Export First-Time Use dialog box appears. Locate and open the folder for the file (rename the file if desired), and click Save.


Export EntList File

Save an exported application configuration file (enlist.ini) to disk. The Export EntList file dialog displays when you export application logon information using the Export to INI file dialog box.

  1. Locate and open the folder for the file, name the file, and click Save.
  2. If you chose to create a First-Time Use file, the Export First-Time Use dialog box opens. Locate and open the folder for the file (rename the file if desired), and click Save.


Export First-Time Use

Save a first-time-use file (ftulist.ini) to disk. The Export First-Time Use dialog box opens when you create a First-Time Use file while exporting application logon information to an enlist.ini file.

  1. Locate and open the folder for the file (rename the file if desired).
  2. Click Save.


Import Merge Conflict

The Import/Merge Conflict dialog box appears if the merged file contains items with same names as those in current configuration.

  • Select the items to import and click OK.

    The items you select overwrite the current like-named items.


Manage Templates

Use this dialog box to create, modify, and remove templates for application logons. To display this dialog box, on the Tools menu, click Manage Templates.

When creating templates, take precautions to ensure that no complete template name exactly matches the first part of another template name. If the Agent finds two templates, one of whose names is a subset of the other, the Agent recognizes the template with the shorter name.

For example, if two templates are named ABC and ABD, this issue does not occur. But if one template is named ABC, and one is named ABC_D, the Agent recognizes only the ABC template, and ignores the ABC_D template, regardless of which application is opened.

Creating a New Template from an Application

  1. Click Add to create a new template from an application logon.
  2. From the Select Applications dialog box, select the application on which to base the template.
  3. Click OK. From the Edit Template dialog box, specify the settings that must be supplied by an administrator, and the template's overriding settings.

Modifying an Existing Template

  • Select an application from the list and click Edit. From the Edit Template dialog box, modify the settings that must be supplied by an administrator, and the template's overriding settings.

Deleting a Template

  • Select an application from the list and click Remove.


Override Settings Tab (Edit Template Dialog Box)

Use this tab to select the settings that the template updates in all logons that are based on it. You can choose global overrides that apply to all of the forms in the application logon configuration, and you can also select specific overrides for individual forms.

The left pane displays the hierarchy of the application and its component forms:

  • The global override settings for applications correspond to the general configuration settings for each application-type.
  • The form-specific settings correspond to the configuration controls for individual logons.

Both Setting types are listed in the right pane with a Category that corresponds to the application-configuration dialog box in which you make the setting. Refer to the dialog box or tab for information on each setting.

Applications | General Error Loop Password Change Miscellaneous
Windows forms | General Fields Matching Miscellaneous
Web forms | General Matching
Mainframe/Host forms | General Options

To display this tab:

  1. Choose Manage Templates from the Tools menu.
  2. Do one of the following:

  • Add a new template.

    or

  • Select an existing template and click Edit.

  3. In the Edit Templates dialog box, select the Overriding Settings tab.


Supply Info Tab (Edit Template Dialog Box)

Use this tab to specify what information an administrator must provide in order to complete an application logon based on this template. You can choose all items or choose individual items by selecting checkboxes.


Update Applications (from Template)

Use this dialog box to update application logons based on a template that has been modified since the logons were created. Only logons whose templates have been modified appear in the list. Select the applications to update (use SHIFT+CLICK or CTRL+CLICK for multiple applications), then click Update.


Dynamic and Ordinal Control IDs

Certain applications change the control ID for each field with every application launch. ESSO-LM provides you with the option to assign ordinal ID numbers to replace these dynamic control IDs, thereby eliminating variations in control IDs with each application launch.

ESSO-LM assigns mandatory ordinal field IDs by default to .NET applications, which have no native support for control IDs.

Configuring ESSO-LM to assign ordinal control IDs

  1. Launch the ESSO-LM Administrative Console.
  2. Pause the ESSO-LM Agent.
  3. Launch an application to create a template.
  4. Launch the template wizard.

  5. Select Logon.

    The control ID for each field appears in the Credential Fields screen. For applications with dynamic control IDs, these ID numbers will vary with each launch. (This does not apply to .NET applications, which have no native control IDs.)

  6. Select Use ordinals instead of control IDs.
    • The Credential Fields Screen displays the fields, assigning control IDs by location order instead of using native (dynamic) control IDs.
    • For applications with native Control ID Support, if Use ordinals instead of control IDs is checked, the control ID detection is done by enumerating controls on the application window. The ID column will be filled with field ordinals and the display refreshes.
    • If you select not to use ordinal IDs, dynamic control IDs will display as the default (except for .NET applications, for which the ordinals are already displayed).
    • If you select Use ‘Send Keys’ for this form. Do not use Control ID, the Use ordinals instead of control IDs option is unavailable.
  7. Select a numeric field value to determine which field is assigned to the ID. The field will be surrounded by a flashing border. Right click the dropdown menu to select the field name (for instance, Username or Password).


Testing Templates

The ESSO-LM Administrative Console Template Test Manager* provides a simple way to validate templates that you have created, before publishing them. It engages the Agent directly, bypassing the repository and synchronization. The manager guides you through the test, prompting you to take action at various points, and asking questions about the results. Your answers to these questions are the cue to the manager's next steps.

Using the Template Test Manager requires the following:

  • The ESSO-LM Administrative Console
  • The ESSO-LM Agent
  • Application templates that you want to test added to the ESSO-LM Administrative Console
  • Applications whose templates you have added to the ESSO-LM Administrative Console.
The Template Test Manager supports Windows applications only.

Using the Template Test Manager

  1. Launch the ESSO-LM Administrative Console.
  2. Right-click on a template under the "Applications" menu, and select Test to launch the Template Test Manager. During testing, the ESSO-LM Administrative Console application window minimizes and the Template Test Manager receives focus.
  3. Observe the three sections of the manager window:
    • The "Forms to be validated" section contains the name of the template (and all its forms) that you have selected to test. A status icon appears next to each name to indicate its status:
      • Processing
      • Success
      • Failure
    • The "Status Messages" section apprises you of the test status.
    • The "Interactions" section prompts you to take the actions required to proceed with the test. Watch the status messages and follow the interactions prompts and proceed accordingly.
  4. The manager asks if the Agent detected the template. If the test was successful, click Yes, and then click Finish. If the test is not successful, click the button that best describes why detection was unsuccessful:
    • Yes, but also responds to other windows that should be ignored
    • No (any other reason)
  5. Click Next to receive suggestions to correct the errors in the template.
  6. Continue the process until the Agent responds correctly to the template.
  7. Select Close to shut down the Template Test Manager and return to the ESSO-LM Administrative Console.
Example
  1. In the ESSO-LM Administrative Console, you have selected an application template, right-clicked it, and selected Test. The Template Test Manager launches, and the template's forms appear in the "Forms to be validated" section, but the Agent is not running. The "Status Messages" section reads,
    "Waiting for the ESSO-LM Agent…." This indicates that the Agent is not active and that you must launch it to begin the test. So, the "Interactions" section displays the action request, "Launch the ESSO-LM Agent."
  2. You launch the Agent, and the status message indicates that the Template Test Manager is publishing the template to the Agent. The "Actions" message prompts you to launch the application for the template you are testing.
  3. After you launch the application, the Agent should detect it and respond (in accordance with your configuration for initial credential capture).
  4. The "Interactions" section informs you that you are at the "Detection" stage and presents the question, "Does the Agent detect the window?" Select the appropriate response:
    • Yes
    • Yes, but also responds to other windows that should be ignored
    • No
  5. Click Next.
  6. If you responded Yes, the Interactions section in the next screen informs you that the test was completed successfully. A check icon [image] appears next to the template name.
  7. If you responded with either of the other answers, click Next and the manager prompts you through a series of troubleshooting tests, offering suggestions based on your input.
  8. Continue the process until you have modified the template to achieve successful results.
  9. Click Close when done.

*This utility is new as of version 11.1.1.5.0.


Managing Sessions

●Using the Console > Managing Sessions

Kiosk Manager

Kiosk Manager manages user sessions in a kiosk environment. The following Kiosk Manager settings are configured through the ESSO-LM Administrative Console:

  • Actions
  • Session States
  • General operation settings
  • Confirmation messages
  • Kiosk Manager Desktop Manager UI customization
  • Kiosk Manager Desktop Manager Text Message

To create Actions and Session States:

  1. Click Create Action to create a new action.

    An action tells Kiosk Manager to do something, such as run a program, call a .NET method, terminate a specific application, or terminate all but a specified list of applications.

  2. Click Create Session State to create a new session state.

    "Session States" are a list of events to associate with the actions, for example, a defined session state tells Kiosk Manager that when a session ends, perform this list of actions. A session state defines what should occur within a logon session: When a logon session starts, what actions should be performed? When a logon session ends, what actions need to be performed?


Create Session Action List

●Using the Console > Kiosk Manager > Actions > Create Action

Kiosk Manager > Add List Dialog Box

Use this dialog to create action lists. Select the List Type and enter a Name. Click OK when complete.

The three types of actions that can be created are lists are:

  • Terminate lists
    Terminate lists are a list of applications to be closed by Kiosk Manager on session end.
  • Run lists
    Run lists are either a .NET API to call or a script of command lines to be executed by Kiosk Manager.
  • Special Actions lists
    Special Action lists specify how to handle application windows, such as the positioning of the application and the order that this application has actions performed on it.


Special Actions

●Using the Console > Kiosk Manager > Actions > Special Actions

Kiosk Manager > Special Actions

Use this panel to specify how to handle application windows, such as the positioning of the application and the order that this application has these actions performed on it.

If an application window does not appear in a special actions list, it will be hidden.

Controls

AppPathKeys

The Windows registry key identifying an application associated with this logon to match against running processes. (Usually the application executable's name, such as Notepad.exe.)

Window Titles | Text matched against logon window titles to identify logon requests.
Reposition Application

This setting and those below it allow you to specify the position of the application.The state of this checkbox determines if the actions listed below it will be applied to the application window.

Options:

  • Maximize
  • Minimize
  • Restore
  • Move to. Enter the coordinates for the applications position.
  • Resize. Enter the width and height for the applications position.
Sort Order | This setting determines the order in which special actions are executed. This ensures that windows which are brought to the foreground can be in a specific order with a preferred window displayed on top when multiple windows are repositioned.
Bring to foreground | This setting ensures that the application window is always first in the application windows order.
Shared Application | Check this box to enable an application to be shared among user sessions. For example, if “Notepad.exe” is designated as a shared application, if user1 opens a document in notepad and then locks the session, notepad will be running when user2 starts a session. If user2 then closes notepad and locks their session, notepad will no longer be running when user1 logs back on.
Disabled | Select this checkbox to disable this list. Disabling a list allows you to retain the settings in a list without deleting the original list. This way you can still refer to the settings and use them with other lists.

Configuring an Application

  1. Under the AppPath Keys box, click Add. The Process Path Key dialog box displays.
  2. Enter a valid application key (usually the application executable's name, such as Notepad.exe). Click OK.
  3. The application has been added to the list of applications to close on session end. Kiosk Manager will terminate these applications when a session ends.
  4. Use the Edit and Delete buttons to modify or remove applications from this list.
  5. In the Window Titles box, click Add. The Windows Title dialog box appears.
  6. Enter a valid windows title. Click OK.

Specifying a Window Title for Matching

  1. Enter (or edit) the exact Window Title.
  2. Click OK.


List of Sessions to Terminate

●Using the Console > Kiosk Manager > Actions > List of Sessions to Terminate

Kiosk Manager > Terminate List

Use this panel to create a list of applications to be closed by Kiosk Manager on session end.

Controls

AppPathKeys

The Windows registry key identifying an application associated with this logon to match against running processes. (Usually the application executable's name, such as Notepad.exe)

Window Titles | Text matched against logon window titles to identify logon requests.
Process Termination Type

Select the methods of termination for applications to be closed on session end:

  • Keystroke Sequence
  • .NET SendKeys
  • SendKeys: Configure fields by transmitting a keystroke series to the form. Click Edit to enter or change the series.
  • SendKeys using Journal Hook: Configure fields by transmitting a keystroke series to the form using Journal Hook. Click Edit to enter or change the series.
    • Process closure requests
    • Process termination
When using keystroke sequences to terminate an application, a visual flicker occurs on the end users screen. This flicker is a function of using sendkeys to terminate an application.
Disabled | Select this checkbox to disable this list. Disabling a list allows you to retain the settings in a list without deleting the original list. This way you can still refer to the settings and use them with other lists.

Configuring an Application

  1. Under the AppPath Keys box, click Add. The Process Path Key dialog box displays.
  2. Enter a valid application key (usually the application executable's name, such as Notepad.exe). Click OK.
  3. The application has been added to the list of applications to close on session end. Kiosk Manager will terminate these applications when a session ends.
  4. Use the Edit and Delete buttons to modify or remove applications from this list.
  5. In the Window Titles box, click Add. The Windows Title dialog box appears.
  6. Enter a valid windows title. Click OK.

Specifying a Window Title for Matching

  1. Enter (or edit) the exact Window Title.
  2. Click OK.


Session Manager State Actions tab

●Using the Console > Kiosk Manager > Session States > Actions Tab

Kiosk Manager > Session States > Actions Tab

The Actions tab contains a list of all the actions associated with this session state. This panel is empty for newly created session states. Once you associate actions with the session state, the actions appear in this panel.

Use this panel to create, associate, edit and delete actions.

To use the Actions tab:

  • To define a new action list, click Create. There are two types of action lists: Terminate lists and Run lists. A new action that you create from this panel is automatically added to this session state.
  • To associate a defined action with this session state, click Associate and select an action from the list.
  • To make changes to an action, highlight it and click Edit.
  • To delete an action from a session state, click Delete. This deletes the action only from the current session state, not the actions list.


Session Run List

●Using the Console > Kiosk Manager > Actions > Run List

Kiosk Manager > Run List

Use this panel to define either a .NET API to call or a script of command lines to be executed by Kiosk Manager.

Commands

Select a .NET API or Script command to run:

.NET API | Assembly | Click the "…" to locate the .NET assembly to use. The assembly loads.
Class | Select a .NET class using the drop-down box. The .NET classes listed will be those that are available in the selected assembly.
Method

Select a method to call using the drop-down box. The .NET methods listed will be those that are available in the selected class. The method will be limited to the following signature and will not take any parameters or return any values:

void MethodName();

Unlike the script, processing will not continue until the method returns.

Click here to see a sample .NET API .

.NET API calls are synchronous (Kiosk Manager will wait for the call to complete).
Script

Enter a command line script for Kiosk Manager to execute. If this list contains multiple commands, each line starts without waiting for the previous task to terminate or checking the previous task’s return code.

Command line calls are asynchronous (run in parallel to other tasks including Kiosk Manager).
Disabled | Select this checkbox to disable this list. Disabling a list allows you to retain the settings in a list without deleting the original list. This way you can still refer to the settings, and copy them to other lists, etc.


Kiosk Manager - SendKeys Format

When using keystroke sequences to terminate an application, a visual flicker occurs on the end users screen. This flicker is a function of using SendKeys to terminate an application.

Each key is represented by one or more characters. To specify a single keyboard character, use the character itself. For example, to represent the letter A, pass in the string "A" to the method. To represent more than one character, append each additional character to the one preceding it. To represent the letters A, B, and C, specify the parameter as "ABC."

The plus sign (+), caret (^), percent sign (%), tilde (~), and parentheses () have special meanings to SendKeys. To specify one of these characters, enclose it within braces ({}). For example, to specify the plus sign, use "{+}". To specify brace characters, use "{{}" and "{}}". Brackets ([ ]) have no special meaning to SendKeys, but you must enclose them in braces. In other applications, brackets do have a special meaning that might be significant when dynamic data exchange (DDE) occurs.

To specify characters that aren't displayed when you press a key, such as ENTER or TAB, and keys that represent actions rather than characters, use the codes in the following table.

Key | Code
BACKSPACE | {BACKSPACE}, {BS}, or {BKSP}
BREAK | {BREAK}
CAPS LOCK | {CAPSLOCK}
DEL or DELETE | {DELETE} or {DEL}
DOWN ARROW | {DOWN}
END | {END}
ENTER | {ENTER}or ~
ESC | {ESC}
HELP | {HELP}
HOME | {HOME}
INS or INSERT | {INSERT} or {INS}
LEFT ARROW | {LEFT}
NUM LOCK | {NUMLOCK}
PAGE DOWN | {PGDN}
PAGE UP | {PGUP}
PRINT SCREEN | {PRTSC} (reserved for future use)
RIGHT ARROW | {RIGHT}
SCROLL LOCK | {SCROLLLOCK}
TAB | {TAB}
UP ARROW | {UP}
F1 | {F1}
F2 | {F2}
F3 | {F3}
F4 | {F4}
F5 | {F5}
F6 | {F6}
F7 | {F7}
F8 | {F8}
F9 | {F9}
F10 | {F10}
F11 | {F11}
F12 | {F12}
F13 | {F13}
F14 | {F14}
F15 | {F15}
F16 | {F16}
Keypad add | {ADD}
Keypad subtract | {SUBTRACT}
Keypad multiply | {MULTIPLY}
Keypad divide | {DIVIDE}

To specify keys combined with any combination of the SHIFT, CTRL, and ALT keys, precede the key code with one or more of the following codes.

Key Code

SHIFT +

CTRL ^

ALT %

To specify that any combination of SHIFT, CTRL, and ALT should be held down while several other keys are pressed, enclose the code for those keys in parentheses. For example, to specify to hold down SHIFT while E and C are pressed, use "+(EC)." To specify to hold down SHIFT while E is pressed, followed by C without SHIFT, use "+EC."

To specify repeating keys, use the form {key number}. You must put a space between key and number. For example, {LEFT 42} means press the LEFT ARROW key 42 times; {h 10} means press H 10 times.

In addition to the above SendKeys, there is also a wait command. The wait command is in the format {WAIT number} where "number" is the number of milliseconds delay. The wait can be anywhere in the string (that is, beginning, middle, end} and can be used as many times as needed.

For example, if you want to send Ctrl+Shift+F7, then wait for 5 seconds, and then send Alt+F4, the format should be as follows:

^+{F7}{WAIT 5000}%{F4}

© 2001-2002 Microsoft Corporation. All rights reserved.


Session States Overview

●Using the Console > Kiosk Manager > Session States Overview

Kiosk Manager > Session States

This panel contains the list of session states that have been created. Session states are a list of events to associate with the actions, for example, a defined session state tells Kiosk Manager that when a session ends, perform this list of actions. A session state defines what should occur within a logon session; for instance, when a logon session begins or ends, what actions should be taken.

Use this panel to create, edit, copy and delete session states.

To add a session state:

  • Click Create to add a new session state.

    or

  • Highlight a session state.
  • Click Edit to select the events and authenticators that this session state should respond to. The Edit command also allows you to select which actions are to be associated with the events and authenticators selected for this state.

To copy a session state:

  • Click Copy to quickly make a copy of this session state. To change the name, right-click the session state in the left pane and click Rename. You can also perform a copy by right-clicking the session state in the left pane and clicking Copy.

To delete a session state:

  1. Click Delete to delete a session state. A confirmation message appears before the state is deleted.


Add Session State

●Using the Console > Kiosk Manager > Session States > Create Session State

Kiosk Manager > Add Session State

Use this dialog box to add and name a new session state. Type a Session State Name and click OK.


Events Tab

●Using the Console > Kiosk Manager > Session States > Events Tab

Kiosk Manager > Session States > Events Tab

The Events tab contains a list of all the possible events that Kiosk Manager can respond to and the option to add custom events. Each listed event has a checkbox next to it that when checked indicates that the associated action lists should be executed when this event occurs. When a new session state is created, Session End is checked by default.

There are two ways to create events:

  • Create your own custom events by clicking the Add button. Use the Edit button to edit the custom event name and the Delete button to delete a custom event.

or

  • Select the pre-defined events for this session state. Available events are:
    • After Session Unlocked
      This event runs when the user unlocks their session after authentication has taken place. If an authentication is canceled, this event will not be triggered.
    • AM Device In
      This event is triggered when the SSO device monitor is enabled and a monitored authenticator is detected (e.g., a smart card is inserted or a biometrics device is in range).
    • AM Device Out
      This event is triggered when the SSO device monitor is enabled and a monitored authenticator is detected (e.g., a smart card is removed or a biometric goes out of range). This event will only be triggered when:
      • A session is open or locked
      • A "Device-In" event started the session
    • AM Grace Period
      This event is triggered if an authenticator which uses a grace period function is being used and a user returns to an open session within the grace period.
    • Authenticator Logon
      This event is triggered when an authenticator has accepted a logon. For example, the correct password for WinAuth or the correct PIN for smart card is entered.
    • Authenticator Timeout
      This event is triggered when ESSO-LM's internal timer has expired.
    • Before Session Unlocked
      This event is triggered when a user unlocks their session but before authentication takes place.
    • Cached Credential Session Start
      This event is triggered when a session is started and the user has cached credentials stored on the local computer.
    • Session End
      This event is triggered when the session ends and the timer expires, or when another user starts a session.
    • Session Locked
      This event is triggered when a user manually locks the session via the system tray.
    • Session Start
      This event is triggered when a user starts a new session.
    • Time Expired
      This event is triggered when the locked session timer has reached 00:00:00.
    • Transparent Screen Displayed
      This event is triggered when the transparent lock initiates and the screen is visible to the user in locked mode.
    • Transparent Screen Hidden
      This event is triggered when the transparent lock is ending.
    • User Change
      This event is triggered when a user logs into Kiosk Manager. This event sets two properties on the .NET object if they exist (If the properties do not exist, nothing happens):
      • UserName. The sync user name.
      • DomainName. The sync domain name.

Authentication Manager events run when the authenticator sends a message to Kiosk Manager indicating the event type.


Kiosk Manager >Session States > Authenticators Tab

The Authenticators tab contains a list of all the authenticators that ESSO-LM supports as well as the option to add a custom authenticator. Each authenticator has a checkbox next to it that when checked indicates if the associated action lists should be executed when the selected events occur and the selected authenticator was used to authenticate the user.

When a new session state is created, all authenticators are checked by default.

There are two ways to select authenticators:

  • Create your own custom authenticator by clicking the Add button. Use the Edit button to edit the custom event authenticator and the Delete button to delete a custom authenticator.
  • Select the pre-defined authenticator for this session state. Available authenticator are:
    • Authentication Manager
    • Entrust
    • LDAP
    • LDAP v2
    • Proximity Card
    • Read-Only Smart Card
    • SecurID
    • Smart Card
    • Windows Logon
    • Windows Logon v2


Session State Security

●Using the Console > Kiosk Manager > Session States > Security tab

Kiosk Manager > Session States > Security Tab

Use the Security tab to set the access rights for this session state. You can assign access rights to these items:

  • Application logons (including associated credential sharing groups)
  • Password generation policies
  • Global Agent settings
  • Passphrase question sets
The security tab will only show up if Role/Group Security is enabled.

Controls

Directory | Select the target directory server.
Access information
Name | Lists the groups or users who currently have access to this session state.
ID | The user account name.
Access | Indicates whether the user or group has read/write or read-only access rights to the currently selected session state. To change a user or group's access rights, right-click the user or group and select Read or Read/Write from the shortcut menu.
Actions
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected session state.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.


Oracle Enterprise Single Sign-on Provisioning Gateway Overview

Oracle Enterprise Single Sign-on Provisioning Gateway (ESSO-PG) provides an administrator with the ability to automatically provision ESSO-LM with a user's ID and password by using a provisioning system. An administrator is able to add, modify, and delete IDs and passwords for particular applications within the provisioning system and have the changes reflected in ESSO-LM. From the provisioning system, all usernames and passwords inside of ESSO-LM can also be deleted so that a user’s access to all protected applications is eliminated.

The following ESSO-PG settings are configured through the ESSO-LM Administrative Console:

  • Provisioning tab (for role/group support)
  • Provisioning App tab (for role/group support)
ESSO-PG is an add-on module to ESSO-LM available separately from Oracle. For more detailed information on ESSO-PG, refer to the ESSO-PG product documentation.

Accessing the ESSO-PG Administrative Console

  • Open a Web browser and enter this URL (replacing serverhost with the server where ESSO-PG was installed):
    https://serverhost/ESSO-PG console/overview.aspx


Oracle Enterprise Single Sign-on Universal Authentication Manager

Oracle Enterprise Single Sign-on Universal Authentication Manager (ESSO-UAM) enables enterprises to replace the use of native password logon to Microsoft Windows and Active Directory networks with stronger and easier to use authentication methods. The ESSO-UAM system also enhances enterprise security beyond traditional password authentication by providing two-factor authentication methods. ESSO-UAM enables users to rapidly and securely enroll credentials that will be used to identify and authenticate them. ESSO-UAM offers four built-in and configurable authentication methods: smart cards, passive proximity cards, biometric fingerprint, and other biometric technologies compatible with the BioAPI standard. Native Windows Passwords are also supported.

Smart Cards

A smart card is a credit card-sized token containing a chip or embedded circuits that can store and process data securely. Information stored on a smart card can also be used for identification and authentication. ESSO-UAM enables enrolling and using smart cards for user logon and authentication without writing any data on a smart card chip. ESSO-UAM also supports the option to require a smart card PIN during logon to provide stronger two-factor authentication.

Proximity Cards

A passive proximity card or token is an identity object (such as a workplace ID badge) containing a circuit that a card-reading device can detect and decipher. When the proximity card is placed in close proximity to a reader, the reader detects the token’s presence and recognizes identifying information that is associated with a specific user. This ESSO-UAM method includes the option to require a user to enroll a PIN that is associated with a proximity token enabling two-factor authentication. When so configured, ESSO-UAM prompts the user for the enrolled PIN associated with a token during logon, strengthening user authentication.

Biometrics

The Fingerprint Logon Method supports the use of numerous external and embedded laptop biometric fingerprint devices to provide a convenient and secure fingerprint authentication mechanism to ESSO-UAM.

The BioAPI Logon Method leverages the BioAPI framework , thus enabling support of almost any third-party BioAPI-compliant Biometric Service Provider (BSP) module. In addition to fingerprint biometrics, this logon method can also support other biometric technologies that offer a BioAPI compatible BSP such as palm, facial, and iris recognition solutions.

Configuring Policies for ESSO-UAM Users

ESSO-UAM administrators can configure and apply ESSO-UAM policy settings from a central location using the ESSO-LM Administrative Console. The ESSO-LM Administrative Console contains ESSO-UAM functions that allow administrators to configure policies; these policies specify how strong authentication operates for different users and user groups.


UAM Policies

●Using the Console > Universal Authentication Manager > UAM Policies

ESSO-UAM Policies

Policies control the privileges, restrictions, and enforcement of enrollment and logon rules for Active Directory users who log on to workstations connected to an Active Directory domain. Each policy you create contains a unique set of conditions for using ESSO-UAM that you can apply to users and user groups.

Under Universal Authentication Manager in the left pane, select Policies. The right pane will display the following items:

  • Policy Name: The name you give to a policy.
  • Items Set: The number of settings, or details, that have been configured for that policy.
  • Total Items: The total number of settings available for configuration.
  • Add: Click this button to create a new policy.
  • Delete: Click this button to remove a policy from the list.


Creating a New ESSO-UAM Policy

To create a new ESSO-UAM policy, do one of the following:

  • Click Universal Authentication Manager in the left pane. In the right pane, select Policies; then click Add Policy at the bottom of the screen.

    or

  • Expand Universal Authentication Manager in the left pane and select Policies. Click the Add button at the bottom of the screen.

    or

  • Right-click Policies in the left pane and select New Policy.

    or

  • Select UAM Policy from the Insert menu.

A dialog box appears, prompting you to name the policy. Enter a name for the policy and click OK. The policy you created now appears when you expand the Policies node. It is automatically pre-populated with all available Logon Methods.


Publishing an ESSO-UAM Policy

After you have created a new UAM policy and configured its settings, you can publish it by connecting to Active Directory.

  1. Click Repository in the left pane.
  2. Connect to the repository. See the Repository help file for instructions.
  3. Navigate to the ESSO-UAM repository location ("CN=Program Data, CN=Passlogix, CN=UAM, CN=UAM::Policies"). These containers are created under CN=Program Data when you execute "Initialize UAM Storage" during deployment. Refer to the ESSO-UAM Installation Guide for more information on initializing storage for ESSO-UAM.

  4. Right-click CN=UAM::Policies, and select New UAM Policies Container.

    If you are publishing a policy for a User Group, specify the name of the Active Directory User Group to which you want to apply the policy. Click OK to create the container.

    If you are publishing a policy for a User, click Object Types… in the "Select User or Group" dialog box. In the "Object Types" dialog box, select the Users checkbox, and click OK. Specify the name of the Active Directory User to which you want to apply the policy. Click OK to create the container.

  5. Right-click the policy name in the left pane and select Publish. The Publish to Repository dialog box opens.
  6. For Target Repository, click Browse... and select the user or user group container you created as a target for the policy.
  7. Click Publish to publish the policy. Click Cancel to cancel publishing and return to the repository.
The ESSO-LM Administrative Console allows each policy to be published to multiple repository user groups and/or users; however, only one policy may be applied to each user or user group.


ESSO-UAM Policy Settings

Select a policy to configure or modify its settings.

To select a policy, do one of the following:

  • Double-click the policy name in the right pane, then double-click the Logon Method you wish to modify.

    or

  • Expand Policies in the left pane. Under Policies, click the policy name. Under the policy name, click the Logon Method you wish to modify.

When you select a policy, two tabs appear in the right pane: General and Security. The General tab lists all available Logon Methods for configuration:

  • Fingerprint
  • BioAPI
  • Proximity Card
  • Smart Card
  • Windows Password

This is the same list that appears under the policy name in the expanded tree of the left pane.

The Security tab lists security parameters for the policy's configuration. For details, see General Tab (for a Selected Policy) and Security Tab (for a Selected Policy). Refer to each Logon Method's help section for instructions to configure its settings.


General Tab (for a Selected Policy)

From the General tab for a selected policy, you can review how many settings have been configured for the Logon Methods for that policy. Specifically, this tab displays the following information:

  • Path: The name of each Logon Method that makes up a group of related settings.
  • Set: The number of settings that have been configured (even if a setting is set to its default value).
  • Total: The total number of settings per Logon Method
  • Add Notes: Launches the "Notes" dialog box should you want to make any notes about this policy.

After settings are configured, re-selecting the policy in the left pane will display a summary of settings on the "General" tab that were changed. The text in the columns changes its color to blue to highlight where changes were made to the policy.


Security Tab (for a Selected Policy)

From the Security tab for a selected policy, you can modify a user's or user group's access to objects in the directory database. To change access rights, click the Security tab. Right-click the name of a user or user group and select Read or Read/Write from the shortcut menu.

  • Directory: points to the specific directory server where user data is stored. Select the directory server of the user or user group from the drop-down list in this field.
  • Name: lists the groups or users who currently have access to the database object.
  • ID: shows the user account name.
  • Access: indicates whether the user or group has read/write or read-only access.
  • Copy Permissions To…: enables you to copy permissions set for a database object to another Application Template. Click this button and select the application template to which you wish to apply the permissions.
  • Add: displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected policy.
  • Remove: removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.


ESSO-UAM Logon Methods

Expand the node for your policy set. Options for all Logon Methods appear below the policy name:

  • Fingerprint
  • BioAPI
  • Proximity Card
  • Smart Card
  • Windows Password

Using these options, you can configure settings for users within that particular policy set. See the individual Logon Method section for instructions on configuring its settings.


Fingerprint Settings

When you select Fingerprint for a chosen policy, the page that opens displays fingerprint biometric settings for you to edit. All settings will be disabled by default and set to default values; to change a setting, select the check box next to the setting and configure a value. You can configure the following settings:

Logon Method Enabled

Allows administrators to enable or disable an installed authenticator on an ESSO-UAM Client. This policy setting enhances security by controlling the specific logon methods that end-users are allowed to use.

Options:

  • Yes (default)
  • No

If you select No , the end-user is not allowed to log on to or enroll on the workstation using this logon method. If users attempt to log on with a disabled logon method, they will receive an error message.
Enrollment Prompt

Controls whether a user is prompted to enroll and whether enrollment is optional or required.

Options:

  • Never
  • Optional (default)
  • Required
Grace Period

Allows end-users to defer a required enrollment for a configured number of days (the grace period).

Allows administrators to require enrollment with a desired logon method without immediately restricting end-users’ access to workstations. Administrators can configure a suitable number of days in which an end-user will be allowed to defer enrollment until they are able to, or until they are familiar with the new logon method.

The Enrollment Grace Period is disabled if any of the following conditions are met:

• The Enrollment Prompt policy setting is NOT configured to "Required."

• This setting is configured to zero.

• The Logon Method does not support one of the enrollment capabilities.

Default is 0. Maximum grace period is 365 days.
Number of Fingers Specifies the number of fingers the user is required to enroll. This policy requires the user to enroll exactly the specified number of finger samples during enrollment. Default is 1.


BioAPI Settings

When you select BioAPI for a chosen policy, the page that opens displays the BioAPI settings for you to edit. All settings will be disabled by default and set to default values; to change a setting, select the check box next to the setting and configure a value. You can configure the following settings:

Logon Method Enabled

Allows administrators to enable or disable an installed authenticator on an ESSO-UAM Client. This policy setting enhances security by controlling the specific logon methods that end-users are allowed to use .

Options:

  • Yes (default)
  • No

If you select No , the end-user is not allowed to log on to or enroll on the workstation using this logon method. If users attempt to log on with a disabled logon method, they will receive an error message.
Enrollment Prompt

Controls whether a user is prompted to enroll and whether enrollment is optional or required.

Options:

  • Never
  • Optional (default)
  • Required
Grace Period

Allows end-users to defer a required enrollment for a configured number of days (the grace period).

Allows administrators to require enrollment with a desired logon method without immediately restricting end-users’ access to workstations. Administrators can configure a suitable number of days in which an end-user will be allowed to defer enrollment until they are able to, or until they are familiar with the new logon method.

The Enrollment Grace Period is disabled if any of the following conditions are met:

• The Enrollment Prompt policy setting is NOT configured to "Required."

• This setting is configured to zero.

• The Logon Method does not support one of the enrollment capabilities.

Default is 0. Maximum grace period is 365 days.


Proximity Card Settings

When you select Proximity Card for a chosen policy, the page that opens displays proximity card settings for you to edit. All settings will be disabled by default and set to default values; to change a setting, select the check box next to the setting and configure a value. You can configure the following settings:

Logon Method Enabled

Allows administrators to enable or disable an installed authenticator on an ESSO-UAM Client. This policy setting enhances security by controlling the specific logon methods that end-users are allowed to use.

Options:

  • Yes (default)
  • No

If you select No , the end-user is not allowed to log on to or enroll on the workstation using this logon method. If users attempt to log on with a disabled logon method, they will receive an error message.
Removal Action

Controls how the computer responds to a proximity card event when a user is logged on.

Options:

  • No Action
  • Lock Workstation (default)
  • Force Logoff
Enrollment Prompt

Controls whether a user is prompted to enroll and whether enrollment is optional or required.

Options:

  • Never
  • Optional (default)
  • Required
Grace Period

Allows end-users to defer a required enrollment for a configured number of days (the grace period).

Allows administrators to require enrollment with a desired logon method without immediately restricting end-users’ access to workstations. Administrators can configure a suitable number of days in which an end-user will be allowed to defer enrollment until they are able to, or until they are familiar with the new logon method.

The Enrollment Grace Period is disabled if any of the following conditions are met:

• The Enrollment Prompt policy setting is NOT configured to "Required."

• This setting is configured to zero.

• The Logon Method does not support one of the enrollment capabilities.

Default is 0. Maximum grace period is 365 days.
PIN Required

Controls if a user is required to enroll a PIN that is associated with the card. If a PIN is required, after the proximity card is presented to reader, the user will be challenged to submit the PIN to authenticate.

Options:

  • Yes (default)
  • No

PIN Minimum Length

The minimum allowed length of the proximity card PIN.

Options:

  • Possible values 4-16 (default is 4)
PIN Allowed Characters

The character sets allowed for users to enroll a PIN that is associated with a proximity card.

Options:

  • Any characters (default)
  • Alphanumeric only
  • Numeric only


Smart Card Settings

When you select Smart Card for a chosen policy, the page that opens displays smart card settings for you to edit. All settings will be disabled by default and set to default values; to change a setting, select the check box next to the setting and configure a value. You can configure the following settings:

Logon Method Enabled

Allows administrators to enable or disable an installed authenticator on an ESSO-UAM Client. This policy setting enhances security by controlling the specific logon methods that end-users are allowed to use.

Options:

  • Yes (default)
  • No

If you select No , the end-user is not allowed to log on to or enroll on the workstation using this logon method. If users attempt to log on with a disabled logon method, they will receive an error message.
Removal Action

Controls how the computer responds when the smart card is removed from a card reader.

Options:

  • No Action
  • Lock Workstation (default)
  • Force Logoff
Enrollment Prompt

Controls whether a user is prompted to enroll and whether enrollment is optional or required.

Options:

  • Never
  • Optional (default)
  • Required
Grace Period

Allows end-users to defer a required enrollment for a configured number of days (the grace period).

Allows administrators to require enrollment with a desired logon method without immediately restricting end-users’ access to workstations. Administrators can configure a suitable number of days in which an end-user will be allowed to defer enrollment until they are able to, or until they are familiar with the new logon method.

The Enrollment Grace Period is disabled if any of the following conditions are met:

• The Enrollment Prompt policy setting is NOT configured to "Required."

• This setting is configured to zero.

• The Logon Method does not support one of the enrollment capabilities.

Default is 0. Maximum grace period is 365 days.
PIN Required

Controls if a user is required to enroll a PIN that is associated with the card. If a PIN is required, after the smart card is inserted into reader, the user will be challenged to submit the PIN to authenticate.

Options:

  • Yes (default)
  • No


Windows Password Settings

When you select Windows Password for a chosen policy, the page that opens displays a Windows Password setting for you to edit. The setting will be disabled by default and set to a default; to change the setting, select the check box next to it and configure a value.

Logon Method Enabled

Allows administrators to enable or disable an installed authenticator on an ESSO-UAM Client. This policy setting enhances security by controlling the specific logon methods that end-users are allowed to use.

Options:

  • Yes (default)
  • No

If you select No, the end-user is not allowed to log on to or enroll on the workstation using this logon method. If users attempt to log on with a disabled logon method, they will receive an error message.

If you disable Windows Password and a user is not enrolled in any other methods, the password is still allowed until a user enrolls in at least one ESSO-UAM method.


Shared Accounts

Use this node to manage shared account rights for users. There is one tab to set the rights:

  • Default Rights

Default Rights

Use this tab to define the shared account rights for each new application. This feature sets standard rights for each application. After each application is created, change the rights as needed.

Controls
Directory Select the target directory server.
Access Information
Name | Lists the groups or users who currently have access to this item.
ID | Lists the user’s account name.
Access | Indicates the permissions that have been granted to the user or group (Add Logon, Modify Logon, or Delete Logon). To change a user’s or group’s access rights, right-click the user or group and select Add Logon, Modify Logon, or Delete Logon from the shortcut menu.
Actions
Copy Permissions to | Use this button to easily apply the shared account rights for the current application to multiple applications. Clicking this button displays a dialog listing all the applications. Select the applications that you want these shared account rights to be copied to. Use Ctrl+click to select multiple entries. Click OK.
Add | Displays the Add User or Group dialog box (for Active Directory or ADAM) to select the users or groups who should have access to the currently selected item.
Remove | Removes selected users or groups from the list. Select a user or group to remove; use Ctrl+click to select multiple entries.
Add User or Group Dialog Box | The Select User or Group dialog varies based on the directory server being used: For AD/ADAM, use this control to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, Delete Logon).
Controls
Search Base | The base (highest-level) directory to begin searching for user or group accounts. All subdirectories of the base directory are searched. Enter a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search. Use this dialog to browse to and select the base (highest-level) directory for user or group names. Click OK when finished.
Search | Begin searching the base directory for users and groups.
Users or Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.
Active Directory or ADAM | Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, Delete Logon).
Controls
List Names From

Select an Active Directory domain or server.

Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add | Copies users and groups selected in the Names list to the Add Names list. Use Ctrl+click of Shift+click to select multiple entries.
Members | When a group is selected, the Names list displays the Global Group Membership dialog box, which list the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names

Display the names of the users or groups for whom you have added so far. Click OK to add these names to the access list for the current configuration item.

You can type or edit user names in this list. However, entries are checked for invalid account names and duplicate account selections are automatically removed when you click OK.


Password Generation Policies

Displays the currently available password generation policies and provides access to policy settings. Click Password Generation Policy in the left pane to display the current password policies in the right pane.

See Setting Password Policies for more information.

To add a new password policy:

  1. Do one of the following:

    • Click Add in right pane

      or

    • In the left pane, right-click Password Generation Policy then click New Policy on the shortcut menu.
  2. Enter a Policy Name and click OK. The Policy Subscribers tab appears in the right pane, where you can add applications that will use the new policy

To modify a listed password policy's configuration:

  • Click a policy, then click Edit. The Policy Subscribers tab appears in the right pane.

To delete one or more password policies:

  • Select a policy (use Ctrl+click or Shift+click to select multiple entries), then click Remove.


Add Password Policy

●Using the Console > Password Generation Policies > Add Password Policy

Adding a Password Policy

Use this dialog box to add and name a new password generation policy.

  • Enter a Policy Name and click OK.


Password Policy (selected)

●Using the Console > Password Generation Policies > Password Policy (selected)

Selected Password Policy

Represents a configured password generation policy. You can use the tabs in the right pane to view or modify this policy's properties, add or remove applications that use this policy, or change security settings.

See Setting Password Policies for more information.

Selecting a Password Policy for Viewing or Editing

  1. Click Password Generation Policies in the left pane
  2. Select a policy from the list in the right pane, then click Edit. The Policy Subscribers tab appears in the right pane.

or

  1. In the left pane, click the plus sign (+) next to the Password Generation Policies icon (or double-click Password Generation Policies) to display the configured policies.
  2. Click a policy icon to select it. The Policy Subscribers tab appears in the right pane.
Add | Create another policy.
Delete | Delete the selected policy.
Add Note | Attach notes about this policy for future reference.


Password Policy Subscribers tab

●Using the Console > Password Generation Policies > Selected Policy > Policy Subscribers

Policy Subscribers

Use the Policy Subscribers tab to add or manage the applications that use the selected password generation policy.

See Setting Password Policies for more information.

To add applications to a policy:

  1. Click Add. The Select Application dialog box appears.
  2. Select the applications that will use this policy. (Use Ctrl+click or Shift+click to select multiple entries.)
  3. Click OK.

To remove applications from a policy, select a policy (use Ctrl+click or Shift+click to select multiple entries) and click Remove.

Click Add Notes to enter notes.


Password Constraints

●Using the Console > Password Generation Policies > Selected Policy > Password Constraints

Password Constraints Tab

Use the Password Constraints tab to set or modify the allowed type, number, position, and repetition of characters in passwords. These constraints apply to new passwords that ESSO-LM automatically generates for applications that subscribe to the selected policy.

To view a set of test passwords based on the passwords constraints for this policy, click the Test Policy button.

See Setting Password Policies for more information.

To set password constraints:

  1. Do one of the following:

    • Select a password policy.

      or

    • Create a new password policy.
  2. Click the Password Constraints tab in the right pane.
  3. Select constraint options from the displayed controls.

Password Constraint Options

Length Constraint
Minimum Length | Minimum number of characters a password most contain: 1-128, default: 8
Maximum Length | Maximum number of characters a password can contain: 1-128, default: 8
Repeat Constraint
Maximum repeated non-consecutive characters | Maximum number of times a given character can be repeated in a password (in any position): 0-127, default: 7
Maximum repeated consecutive characters | Number of times a given character can be repeated consecutively (adjacent to itself): 0-127, default: 7
Alphabetic Characters
Allow Uppercase Characters | Check to allow uppercase characters to be included in a password, and enter or select the minimum quantity to permit.
Allow Lowercase Characters | Check to allow lowercase characters to be included in a password, and enter or select the minimum quantity to permit.
Numeric Characters
Allow Numeric Characters | Check to allow numeric characters to be included in a password, and enter or select the minimum and maximum quantity to permit.
Can Start Password | Check to allow password to begin with numeric characters. Default: numeric characters are allowed to begin a password.
Can End Password | Check to allow password to end with numeric characters. Default: numeric characters are allowed to end a password.
Special Characters
Allow Special Characters | Check Allow Special Characters to allow special characters (non-alphabetical, non-numeric). and enter or select the minimum and maximum quantity to permit. Default: special characters are not allowed.
Can Start Password | Select to allow password to begin with a special character. Default: special characters are not allowed to begin a password.
Can End Password | Select to allow password to end with special a character. Default: special characters are not allowed to end a password.
Other Characters
Check to allow other characters to be included in a password.
Excluded Characters
Enter the specific characters to exclude from a password.
Previous Password Constraints
Password must not be the same as previous password | Select to prevent reusing the previous password.
Limit the amount of characters that are the same as the previous password | Select to limit repetition of characters from the previous password.
Number of characters that can be the same from the previous password

If some number of characters from the previous password is permissible, select the maximum number of characters to allow.

ESSO-LM recognizes multiple occurrences of a character as the same character and will therefore permit more than one occurrence of that character in the new password.

So, if the previous password contained three "A"s, and you specify that one character from the previous password can repeat, ESSO-LM will allow more than one instance of "A" in the new password.
Test Policy
Displays the Test Password Policy dialog box, which lets you generate and view a set of test passwords based on the current policy settings.

This setting is changed in version 11.1.1.1.0.


Passphrase Sets

You can create groups of questions to present to the user upon password reset request. Create, configure, modify, and delete, these groups, called Passphrase Sets, using the Passphrase Questions screens.

Use this option for Windows Authenticator v2 and LDAP Authenticator v2 only.

Use this option in Authentication Manager for Smart Card authenticator (SCAuth).

For increased security, the current authenticator checks the SecondaryAuth.dll signature to verify its authenticity before loading it. If you choose to use a secondary authentication extension other than the one that ships with the product, you must submit it to Oracle for signing before you can implement it.


Add a Passphrase Set

To add a passphrase set:

  1. Do one of the following:

    • In the left pane, right-click Passphrase Questions and select New Passphrase from the shortcut menu.

      or

    • Right-click in the right pane and select New Passphrase from the shortcut menu.

      or

    • Click the Add button at the bottom of the right pane.

      or

    • From the INSERT menu, select Passphrase.
  2. In the Add Passphrase Set dialog box, type a passphrase set name and click OK.
  3. Use the Questions tab in the right pane to add questions to the current passphrase set.


Delete a Passphrase Set

●Using the Console > Passphrase Questions > Delete a Passphrase Set

Deleting a Passphrase Set

To delete a passphrase set, do one of the following:

  1. In the left pane, select Passphrase Questions.
  2. From the list of passphrase sets in the right pane, select a set and click the Delete button.

or

  • Select a set, right-click, and select Delete from the shortcut menu.

or

  1. Double-click (or click the "+" sign next to) Passphrase Questions in the left pane.
  2. From the expanded Passphrase Questions menu, right-click an existing passphrase set, and select Delete from the shortcut menu.


Modify a Passphrase Set

To modify a passphrase set:

  1. Double-click a passphrase set under the Passphrase Questions menu. The questions in that set display in the Questions tab in the right pane.
    • To add a question to the set, click the Add button and type your question into the Add a Question dialog box. Then click OK.
    • To edit a question in the set, select it and click the Edit button. Make changes to the question in the Add a Question dialog box. Then click OK.
    • To delete a question in the set, select it and click the Remove button. ESSO-LM asks you to confirm the deletion. Click OK.


Setting a Default Passphrase Set

Use this option to designate a Passphrase set as the default. The default set contains passphrase questions that users answer during First-Time Use (FTU). The FTU wizard is invoked when:

  • You start the Agent for the first time after installation

or

  • When the administrator deploys a ftulist object (for example, the ftulist.ini file).

On first-time use, ESSO-LM users select a passphrase question and supply an answer. This stored passphrase answer can be used to reset ESSO-LM authentication if the user later changes the primary logon password. The next time single-sign-on re-authentication is required, the user enters the new password, and ESSO-LM displays the passphrase question to confirm the user's identity.

The Agent uses only one passphrase set. You must decide which set of questions you want the user to answer and designate that set as the default passphrase set. The set you designate as the default is the only one written to the ftulist.

If you import an ftulist to the ESSO-LM Administrative Console and change the passphrase set before you re-export the ftulist to the repository, the passhprase set is not included in the export if you do not reset it as the default.

To assign a default passphrase set, do one of the following:

  • In the right pane, right-click on the set name, then select Set As Default from the shortcut menu.

or

  • In the left pane, right-click on the set name, then select Set As Default on the shortcut menu.
    The passphrase set name will appear in bold type in both the right and left panes, indicating that it is the default set.


Passphrase Questions Tab

●Using the Console > Passphrase Questions > Passphrase Questions Tab

Questions Tab

Use the Questions tab to manage questions and settings in the selected passphrase set. To display this tab, from the left pane, select Passphrase Questions and select the Default Set displayed in bold.

To add questions to a passphrase set:

  1. Select a language from the drop-down menu.
  2. Click Add or select Passphrase from the Insert menu.
  3. In the Add Question dialog box, enter a question.
  4. Select or enter a minimum length for the reply.
  5. Click OK.

Controls

Language | Select language for passphrase questions.
Default Question | Lists current default passphrase question, which is checked by default. When a new passphrase question is added the default passphrase is unchecked. When checked, the default passphrase is disabled for the current passphrase set. When unchecked the default passphrase is enabled for the current passphrase set.
Enabled Question | Lists current passphrase questions. Checked items are the enabled passphrases for the current set. To disable a passphrase click the checkbox to clear it. To modify a passphrase question, double-click it, or select it and click Edit.
Add | Add a new passphrase question. Displays the Add Question dialog box
Remove | Delete the selected passphrase question. Displays a confirmation prompt.
Edit | Modify the selected passphrase question. Displays the Edit Question dialog box.
Set This Passphrase Set as Default | Sets the current set as the default. The default passphrase set name in the left pane displays in bold.
Remove or Disable? | Once a passphrase question has been created, deployed, and put into use by end-users, it should not be deleted. Users who have selected a passphrase question that has been deleted will not be able to change their passwords without losing access to their ESSO-LM credentials. Instead, to remove an in-use passphrase question (and keep it from being displayed during first-time use), disable the question by clearing its checkbox in the list in the Questions tab.


Credential Sharing Groups

Displays the currently available credential sharing groups and provides access to group settings.

Credential sharing groups are sets of applications that share the information of one or more fields to facilitate account management. For each group that you create, you can include any number of applications and designate which credentials they have in common.

See Settings for a Selected Credential Sharing Group for the procedure to configure a group.

Creating Credential Sharing Groups

  1. Select Credential Sharing Groups in the left pane to display current password groups in the right pane.
  2. Do one of the following:
    • Click Add in the right pane.
    • In the left pane, right-click Credential Sharing Groups, then select New Group on the shortcut menu.
  3. In the "Add Sharing Group" dialog box, enter a Group Name and click OK.
  4. With a group selected, click Add in the right pane to add applications to the group. See Adding Applications to a Sharing Group for more information.

Selecting a Sharing Group for Viewing or Editing

  1. SelectCredential Sharing Groups in the left pane.

    • Select a group from the list in the right pane, then click Edit.

      or

    • In the left pane, click the plus sign (+) next to the Credential Sharing Groups icon (or double-click Credential Sharing Groups) to display the configured groups.
  2. Do one of the following:

    • Select a group icon. The list of applications for this group appears in the right pane.

      or

    • Right-click a group icon to display a shortcut menu with these options:

      • Delete. Delete the selected group.
      • Rename. Rename the selected group.

Deleting a Sharing Group

  • Select a group (use CTRL+CLICK or SHIFT+CLICK to select multiple entries), then click Remove.

You cannot delete the default groups, Domain or LDAP.


Domain

●Using the Console > Credential Sharing Groups > Domain

Domain Sharing Group

The Domain sharing group is the predefined credential sharing group for the Windows authenticator.

See Adding Applications to a Sharing Group in Settings for a Selected Credential Sharing Group for more information on using this panel.

To select the Domain credential sharing group:

  1. Select Credential Sharing Groups in the left pane.

  2. Select Domain from the list in the right pane, then click Edit.

    or

  1. In the left pane, click the plus sign (+) next to the Credential Sharing Groups icon (or double-click Credential Sharing Groups) to display the configured groups.
  2. Click Domain.


LDAP Password

●Using the Console > Credential Sharing Groups > LDAP Password

LDAP Sharing Group

The LDAP sharing group is the predefined credential sharing group for the Directory Service authenticator. See Credential Sharing Groups for more information on using this panel.

To select the LDAP credential sharing group:

  1. Click Credential Sharing Groups in the left pane.

  2. Select LDAP from the list in the right pane, then click Edit.

    or

  1. In the left pane, click the plus sign (+) next to the Credential Sharing Groups icon (or double-click Credential Sharing Groups) to display the configured groups.
  2. Click LDAP.


Settings for a Selected Credential Sharing Group

ESSO-LM provides flexibility and granularity for you to control how credential sharing groups work. You can configure the following options:

  • Sharing any or all fields for a group of applications:
    • Username
    • Password
    • Third Field
    • Fourth Field
  • Pre-filling all shared fields when a user first encounters an application in a sharing group, thus requiring the user to enter information only for fields that are not shared by the group.
  • Automatically creating an account when a user encounters an application for which all credentials are pre-determined.
  • Designating a "key" field; that is, a field that the ESSO-LM Administrative Console uses when updating shared credentials, changing credentials only for accounts with the same key value.

See Creating Credential Sharing Groups for more information.

Controls

Group account management
Shared credentials

List of fields that can be included in a credential sharing group. Check the appropriate boxes.

  • Username
  • Password
  • Third Field
  • Fourth Field
Key credential within group

Designates a field that indicates to the ESSO-LM Administrative Console to update shared credentials only for accounts that share this field value.

If the user wants to create an account that is not constrained by the key field, that account must have a new key field to avoid updating all existing accounts.
Pre-fill shared credentials

Specifies that shared fields be pre-populated with the shared credentials when the user creates a new account for an application.

This setting is enabled by default.
Automatically create accounts when all credentials are known

Specifies that ESSO-LM should create an account automatically when the user encounters an application that has all fields pre-determined.

In order for ESSO-LM to complete account creation, you must also enable the "Auto-Submit" setting. Otherwise, the "New Logon" dialog box appears as usual.

This field is available only if "Key credential within group" is set to "None."

Adding Applications to a Sharing Group

  1. Click Add. The Select Application dialog box appears.
  2. Select the applications to include in the selected group. (Use CTRL+CLICK or SHIFT+CLICK to select multiple entries.)
  3. Click OK.

Editing Applications in a Sharing Group

  1. Select a group from the left pane, and click Add.
  2. Select the applications that you want to add to this group. (Use CTRL+CLICK or SHIFT+CLICK to select multiple entries.) Click OK after you finish making your selections.
  3. In the "Shared credentials" section under "Group account management," check the boxes next to Username, Password, Third Field, and Fourth Field as required.
  4. To specify a field as the key credential field, select from the "Key credentials within group" dropdown list.
  5. Optionally, if you did not specify a key credential (by selecting "None" in the previous step):
    • Check Pre-fill shared credentials if you want ESSO-LM to fill shared credentials automatically.

    • Check Automatically create accounts when all credentials are known if you want ESSO-LM to create an account without prompting the user with the "New Logon" dialog box.

      The "Pre-fill shared credentials" and "Automatically create accounts when all credentials are known" settings are unavailable if you select a key credential.

      In order to create accounts automatically when all credentials are known, you must also enable "Auto-Submit" for the application.

Removing Applications from a Sharing Group

  1. Select an application to remove from the selected group. (Use CTRL+CLICK or SHIFT+CLICK to select multiple entries.)
  2. Click Remove.


Working with User Exclusions

Using the Exclusions settings, you can prevent specific users from saving credentials for specific applications. The process for creating and publishing an Exclusion list follows the same workflow as that for other objects in the ESSO-LM Administrative Console.

Use exclusions only for applications for which you want some, but not all, users excluded.

If you want to exclude an application from the entire enterprise, turn on the Global Agent Setting, "Limit user to predefined applications for…" under User Experience > Application Response > Initial Credential Capture. Any application for which you do not create a template will be excluded globally.

Ordinarily, when ESSO-LM first detects an application, it prompts the user to enter the credentials to be stored and automatically injected for future use. Using exclusions, if the user enters a username that you have added to the Exclusion list for a specific application, ESSO-LM does not permit the user to save credentials.

After you publish an Exclusion list to ESSO-LM:

  • Users can log on to applications manually, using excluded credentials, but the Agent does not respond to the application with credentials on the Exclusion list, and users cannot save credentials that appear on the Exclusion list.
  • Excluded credentials that the user already has saved, prior to the policy being put in place, will no longer be presented to the application, and those excluded credentials are deleted from the user's credential list.
  • Silent credential capture will not capture excluded credentials.

Creating an Exclusion List

To create a new Exclusion list, in the ESSO-LM Administrative Console:

  1. Do one of the following:
    • From the Insert menu, select Exclusion List.
    • Select the Exclusions node in the left pane, and click Add at the bottom of the right pane.
    • Right-click on the Exclusions node, and select New List from the contextual menu.
    • Select the Exclusions node and right-click in the empty space in the right pane.
  2. Enter a name for the list in the Add Exclusion List dialog box.

The Exclusion list name appears under the Exclusions node of the tree in the left pane. The right pane contains three tabs associated with each Exclusions list:

  • Exclusion Subscribers
  • Excluded Usernames
  • Security

Use these tabs to configure each Exclusion list.

Publishing an Exclusion List

The procedure for publishing exclusions is identical to that for publishing any other configuration object. For the procedure to publish an Exclusion list, see Publish to Repository.

Special Considerations for Active Directory Users

Active Directory users who publish Exclusion lists must be members of the "SSOExclusionAdmins" Global Security Group, if the group exists. ESSO-LM handles the SSOExclusionAdmins group as follows:

  • If you are using Active Directory and the SSOExclusionAdmins group exists, a user must be a member of this group to publish exclusions.
  • If you are using Active Directory and the SSOExclusionAdmins group does not exist, or if you are using another directory service, anyone with publishing rights can publish an Exclusion list.
  • If you are using Active Directory, the SSOExclusionAdmins group exists, and a non-group member attempts to publish several objects that include an Exclusion object, the other objects will be published without the Exclusion object.

Publishing Exclusion Lists with Configuration Files

You cannot publish Exclusion lists as standalone configuration (entlist.ini) files. When you publish configuration files (that is, you have checked the box in the File mode section of the "Publish to Repository" screen), Exclusion lists are published as a subset of an application for which you've configured exclusions.

This feature has been added as of ESSO-LM version 11.1.1.5.0.


Adding an Exclusion List

Use this dialog box to add and name a new exclusion list.

  • Enter an Exclusion List name and click OK.


Selected Exclusion List

Represents a created Exclusion list. Use the tabs in the right pane to view this list's properties, add or remove applications and users to which the list applies, or change security settings.

See Using Exclusions for more information.

Selecting an Exclusion List for Viewing or Editing

  1. Click Exclusions in the left pane.
  2. Select an Exclusion list from the list in the right pane, then click Edit; or double-click the Exclusion list name in the right pane. The Exclusion Subscribers tab appears in the right pane.

or

  1. In the left pane, click the plus sign (+) next to the Exclusions icon (or double-click Exclusions) to display the created Exclusion lists.
  2. Click an Exclusion list to select it. The Exclusion Subscribers tab appears in the right pane.
Add | Create another Exclusion list.
Remove | Delete the selected list.
Add Notes | Attach notes about this list for future reference.


Exclusion Subscribers

Use this tab to add applications to an Exclusion list.

  1. Select an Exclusion list from the Exclusions node in the left pane.
  2. Click Add on the bottom of the tab.
  3. In the Select Application screen, select the application that you want to add to the list. Use Shift+Click or Ctrl+Click to add multiple selections.
  4. Click OK. The applications you selected appear in the tab window.


Excluded Usernames

Use this tab to add users to an Exclusion list.

  1. Select an Exclusion list from the Exclusions node in the left pane.
  2. Click Add on the bottom of the tab.
  3. In the Excluded Usernames screen, select the users that you want to add to the list. Use Shift+Click or Ctrl+Click to add multiple selections.
  4. Click OK. The users you selected appear in the tab window.


Global Agent Settings

The Global Agent Settings contain Agent configuration information and provide access to stored sets of Global Agent Settings.

  1. Click Global Agent Settings in the left pane to display a list of sets of Global Agent Settings in the right pane.
  2. Right-click Global Agent Settings in the left pane to display a shortcut menu with these options:

New Settings | Create a new set of Global Agent Settings. Displays the Add Set of Settings dialog box.
Import | Import a set of Global Agent Settings from an external source:
 | From File | Import a set of settings from an administrative override object (INI) file or a registration-entries (REG) file. Navigate to the file and click Open. Registry node: S
 | From Live HKLM | Import the current Agent configuration from the local-machine registry (HKLM) as a set of settings named Live. Registry node: S

If the imported settings have the same name as an existing set in the current configuration, the imported set is named "Copy of existing settings.

If this version of the ESSO-LM Administrative Console is installed on a foreign OS (any OS other than English), do not use the New Settings option. Rather, use the Import option. If the New Settings option is used, the path for the synchronization extension points to an invalid path, which results in a synchronization failure.


Working with a Set of Global Agent Settings

Represents a stored set of Global Agent Settings: defaults, switches, and other configuration information that modify the behavior of ESSO-LM on the desktop. Double-click items in the list in the right pane to view or modify the individual settings. Click Add Notes to type notes about this set of settings.

Viewing a Set of Global Agent Settings

  1. Do one of the following:

    • Click Global Agent Settings in the left pane, then double-click a set of settings from the right pane.

      or

    • In the left pane, click the plus sign (+) next to the Global Agent Settings icon (or double-click Global Agent Settings) to display the sets of settings.
  2. Do one of the following:

    • Select a Global Agent Settings icon. The list of individual settings appears in the right pane.

      or

    • Right-click a Global Agent Settings icon to display a shortcut menu with these options:
Export | Save the selected set of settings to a registry file or administrative override object.
Write to Live HKLM | Export the current Agent configuration to the local-machine registry (HKLM).
Delete | Delete the selected set of settings.
Make copy | Duplicate the selected set of settings.
Rename | Rename the selected set of settings.
Global Agent Settings Updates for this Version

ESSO-LM version 11.1.1.5.0 introduces a new Global Agent Settings layout. Settings have been grouped by function instead of listed alphabetically on each screen. In some cases, the screens and setting have been renamed, or default values have changed.

The new ESSO-LM Global Agent Settings Reference Guide provides comprehensive information about each setting, including:

  • The Display Path (the node in the Console's left pane navigator) and Display Name (the setting in the right pane property sheet).
  • The actual registry path and value name, and a description of the setting, defaults, and options (the actual value and its definition).
  • Whether the setting is overridable (that is, can be included in an administrative override object or file).
  • The Registry Type (DWORD, String, or Binary) and Data Type.

The guide includes an index for fast and easy reference to locate the settings that you want to configure, and appendices that list nodes that have been modified, and settings that have been removed or whose default values have changed.


Adding a Set of Global Agent Settings

Use this dialog box to add and name a new set of Global Agent Settings.

  • Enter the Set of Settings Name and click OK.

To display this dialog box:

  • Right-click Global Agent Settings and choose New Settings from the shortcut menu.

    or

  • Choose Global Agent Settings from the Insert menu.


User Experience

The User Experience settings control the Agent as a Windows application, including its interactions with the end user and with other programs.

System tray icon

Display icon in system tray

Specifies whether to show the ESSO-LM icon in the system tray.

Options:

  • Yes (default)
  • No
Registry node: Shell:ShowTrayIcon

User server icon

Specifies whether to use the alternative server icon, as opposed to the standard system tray icon.

Options:

  • No (default)
  • Yes
Registry node: Shell:TrayIconUseRemote

Tooltip text

Specifies the text to display when the mouse hovers over the system tray icon. (Recommended use: Label each Citrix Server/Terminal Services/Remote server.)

Default is Oracle Enterprise Single Sign-on Logon Manager.

Registry node: Shell:TrayIconName

Show system name

Specifies whether to append the computer name to the tooltip text, separated by a space-dash-space.

Options:

  • No (default)
  • Yes
Registry node: Shell:TrayIconDisplaySysName

Allow shutdown

Specifies whether the “Shut Down” option is enabled on the system tray icon menu for the end user.

Options:

  • Yes (default)
  • No
Registry node: Shell:AllowShutdown
Title bar button

Show title bar button

Specifies whether to show the ESSO-LM button on all window title bars. This button can be configured for single-click application recognition and response, or it can provide a menu similar to the system tray menu, by changing the “Provide Dropdown Menu” setting.

Options:

  • No (default)
  • Yes
Registry node: Shell:ShowAccessBtn

Always show for

Identifies a list of applications (by executable filename, such as "notepad.exe") for which the title bar button should always be displayed. This setting will override the “Show title bar button” setting

Click the ... button to enter the application names. Separate application names with a carriage return.

Registry node: Shell:ShowTitleIconAlwaysForModuleN

Provide dropdown menu

Specifies whether to show the menu from the title bar button. If turned off, the title bar button acts as a single-click button for application recognition and response.

Options:

  • No (default)
  • Yes
Registry node: Shell:ShowAccessBtnMenu

Tooltip text

Specifies the text to display when the mouse hovers over the title bar button.

Default is Oracle Enterprise Single Sign-on Logon Manager.

Registry node: Shell:TitleIconName


Application Response

The Application Response settings control the behavior of the Agent when the end user provides credentials for new logons and when detecting applications requiring logons.

Log on to waiting applications upon Agent startup

Enables the Agent, at startup, to submit credentials to a Windows or Java application that has already presented its logon form before the Agent was initialized and ready.

Options:

  • No (default)
  • Yes
Web and host/mainframe application logons are not affected by this setting.
Registry node: Shell:LogonOnStartup
SendKeys event interval

Specifies the minimum time to allow between SendKeys key events. This is especially useful for eastern languages where keystrokes are sometimes lost.

Options:

  • Best speed (default)
  • Typical for eastern languages
  • Use for slow system
  • Use for very slow system
ESSO-LM does not support credential submission using Journal Hook SendKeys
Registry node: Extensions\AccessManager:SendkeysEventInterval

Respond to hidden and minimized windows

Specifies whether the Agent should respond to hidden and minimized windows.

Options:

  • Yes (default)
  • No
Registry node: Shell:StrictWindowDetect
Applications that hooks should ignore

Specifies applications that are incompatible with hooks, and which ESSO-LM should therefore ignore. Click the ellipsis "…" and enter the list of paths to exclude, separating items with semi-colons. This list can include full paths or sub-strings of paths.

Example:

To exclude all applications from all folders whose paths contain "C:\Program Files\Java," and all folders whose paths contain "ESSO-LM Administrative Console," enter the following:

C:\Program Files\Java;ESSO-LM Administrative Console

This setting is specifically for applications that might cause loss of functionality for compatibility reasons. Such applications might be discovered only in a production environment.

Do not use this setting for applications that are compatible with ESSO-LM functionality; for these applications, use the exclude/ignore settings on the appropriate application-type settings pages.

Registry node: Shell:HookIgnorePathsContain


Initial Credential Capture

The Initial Credential Capture settings control the behavior of the Agent when it first encounters an application.

User interface
Credential capture mode*

Configures silent credential capture behavior by using one of the following modes:

Options:

  • Do not capture silently. Presents the New Logon dialog box in which the user enters credentials manually.
  • Capture, but do not inform user. The Agent captures the credentials as the user enters them, and does not inform the user of the process.
  • Capture, and inform user with balloon tip. The Agent captures the credentials as the user enters them, and displays a balloon tip near the system tray to inform the user during the process. (default)
  • Capture, and present New Logon dialog box. The Agent captures the credentials as the user enters them, and displays a balloon tip near the system tray to inform the user during the process. After capturing the credentials, the Agent displays the New Logon dialog box with the user's entries pre-filled. The user can accept, change, cancel, or disable.
  • Silent credential capture mode is not compatible with applications that require SendKeys. For this reason, you cannot use this mode for host/mainframe applications, nor for any Web or Windows application for which you use SendKeys.
  • You should not use silent credential capture for applications where the username and password are obfuscated.
  • Silent Credential Capture for on-the-fly Web applications requires a "Submit" element with one of the following tags:
    • <input type=submit>
    • <button type=submit>

    • <input type=image>

    You must create a template for a Web application if the "Submit" element has an underlying tag of <img> or <a>.

Registry node: Shell:CaptureType

*This setting is new as of version 11.1.1.5.0.

Enable Auto-Prompt

Specifies whether to automatically prompt the user to add a logon when a new application is detected.

Options:

  • Yes (default)
  • No
Registry node: Shell:UseAutoSense
Enable Auto-Enter

Specifies whether to log on to an application after configuring it (adding its credentials).

The end-user can override this setting by deselecting it in the Logon Manager "Response" tab.

Options:

  • Yes (default)
  • No
Registry node: Extensions\AccessManager:LogonAfterConfig
Enable Auto-Recognize

Specifies whether to provide credentials to applications automatically.

The application configuration-specific setting overrides the global setting.

Options:

  • Yes (default)
  • No
Registry node: Shell:UseActiveLogin
Allow creating multiple accounts during credential capture

Specifies whether to enable the checkbox that allows the user to add another set of credentials in the "New Logon" dialog box.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager:ShowAddAdditionalLogon

Prohibit canceling the addition of new accounts

Specifies whether the user has the option to click "Cancel" or close the "New Logon" dialog box to defer entering credentials. This permits current access to an application and re-prompts the user to enter credentials at the next appropriate instance.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager:EnableCancelButton
Prohibit disabling the addition of new accounts

Specifies whether the "Disable" button is available in the "New Logon" dialog box, allowing the user to reject adding credentials for applications permanently.

Disabling an application adds it to the Exclusions list in Agent settings.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager: EnableNeverButton
Prohibit excluding accounts from credential sharing groups

Specifies whether to disable the checkbox in the "New Logon" dialog box that allows an account to be excluded from credential sharing groups. This checkbox will be available for the account properties dialog box.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager:DisableAllowExcludePWSG
Limit response to predefined applications for…
All application types

Sets the following options:

  • Whether the Agent responds to an application automatically.
  • Whether the user is allowed to create logons for applications that the administrator has not predefined.

Options:

  • Unlimited. Allows both options. (default)
  • Predefined applications only. Prevents both options.
Registry node: Extensions\AccessManager:AllowUnknown
Windows applications

Specifies whether the users is allowed to add credentials for Windows applications that are not predefined by the administrator.

Options:

  • Unlimited (default)
  • Predefined applications only
Registry node: Extensions\AccessManager:AllowUnknownApp
Web applications

Sets the following options:

  • Whether the Agent responds to a Web application automatically.
  • Whether the user is allowed to create logons for applications that the administrator has not predefined.

Options:

  • Predefined applications only. Prevents both options.
  • Unlimited. Allows both options. (default)
  • Manually add undefined. Prevents the first option and allows the second option.
Registry node: Extensions\AccessManager:AllowUnknownWeb
Allowed Web pages

Click "…" to add the Web pages that the Agent should allow. Enter the regular expressions that match the URLs. (There is no default for this setting. )

Use this setting only when you select "All application types" or "Web applications" for "Predefined applications only."
Registry node: Extensions\AccessManager\BHOAllowedWebPages:WebPageN


Web Application Response

The Web Applications Response settings control the behavior of the Agent with Web applications.

Because some Web applications contain content that changes with each visit, you can configure a Web template to re-scan dynamic Web pages, detect changes, and respond appropriately.

Credential field identification

Show Border

Specifies whether to display a highlighted border around the credential fields of a Web form during logon.

Options:

  • Yes (default)
  • No
Registry node: Extensions\AccessManager\BHO:ShowBorder

Border Appearance

Default border color/size/style for highlighting detected web page fields.

See Border Values for more information.

Registry node: Extensions\AccessManager\BHO:FeedbackColor
Behavior

URL Matching Precision

Number of levels of host portion of the URL used for application detection and response.

For the URL http://mail.company.co.uk:

  • 2=match to *.co.uk (Default)
  • 3=match to *.company.co.uk
  • 4=match to *.mail.company.co.uk

Note: Values below 2 are treated as 2.

Registry node: Extensions\AccessManager:DNLevelsToMatch
Scroll Into View

Enables/disables scrolling the browser window to bring the logon fields into view.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager\BHO:ScrollIntoView
Activate Tab

Enables/disables activating the tab that identifies the logon fields.

Options:

  • Yes (default)
  • No
Registry node: Extensions\AccessManager\BHO:ActivateTab
Respond to IE Modal Dialogs

Enable this setting to have the Agent respond to a web page that displays as a modal dialog or HTML application.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager\BHO:RespondToIEModalDialogs
Response control
Applications to ignore

Comma-delimited list of applications (without path or extension) that the Browser Helper Object (BHO) should not attach to when searching for logons. Used when the BHO causes conflicts with certain applications.

Example: ws_ftp, customapp1

Registry node: Extensions\AccessManager:BHOIgnoredApps
Web pages to ignore

Use this setting to list the Web pages that the Agent should ignore. Used when the BHO causes conflicts with specific web applications or sites. Click the ellipsis (“…”) button to enter the regular expressions that match the URLs to be ignored (one per line).

Examples:

  • .*http://login\.company\.com/.*
  • .*http://.*\.company\.com/.*
Registry node: Extensions\AccessManager\BHOIgnoredWebPages:WebPageN
Allowed dynamic Web pages

Use this setting to list the dynamic (DHTML) Web pages allowed by the Agent. By default, the BHO will not detect changes made to a dynamic page after the initial presentation of the page.

Click the ellipsis (“…”) button to enter the regular expressions that match the URLs.

Examples:

  • .*http://logon\.company\.com/.*
  • .*http://.*\.company\.com/.*
Registry node: Extensions\AccessManager\BHOAllowedDynamicWebPages:DynamicWebPageN


Windows Application Response

The Windows Applications Response setting controls the behavior of the Agent with Windows applications.

Allow fallback from control IDs to SendKeys

Specifies whether to fall back to SendKeys if direct injection of credentials using control IDs fails.

Options:

  • Yes (default)
  • No
Registry node: Extensions\AccessManager:AllowSendKeysFallback


Java Application Response

The Java Application Response settings control the behavior of the Agent with Java applications.

Exclusions
Excluded Java versions

Java versions to exclude, listed as regular expressions. Separate expressions with a line return. (There is no default for this setting.)

Registry node: Extensions\AccessManager\JHO:JhoExcludeJavaVersionN

This setting is new as of ESSO-LM version 11.1.1.1.0.
Excluded Java vendors

Java vendors to exclude, listed as regular expressions. Separate expressions with a line return. (There is no default for this setting.)

Registry node: Extensions\AccessManager\JHO:JhoExcludeJavaVendorN

This setting is new as of ESSO-LM version 11.1.1.5.0.
Response delays
Time allowed for Java applets to load

Maximum time (in seconds) that the Agent waits for a Java applet to be fully loaded in the browser. Default is 6.

Registry node: Extensions\AccessManager:MaxAppletLoadTime
Delay after Java runtime startup

Amount of time (in milliseconds) the JHO should wait before listening to window events at Java startup. Adding a delay can resolve timing conflicts during Java runtime initialization. Default is 0.

Registry node: Extensions\AccessManager:JHOAttachDelay
Delay between retries

Amount of time (in milliseconds) the JHO should wait between retries of credential injection into a form control. Default is 500.

Registry node: Extensions\AccessManager:JhoRetryTimeout
Retry behavior
Maximum times to retry credential injection

Number of times to retry credential injection. Default is 0.

Registry node: Extensions\AccessManager:JhoRetryMaxAttempts
Java events to respond to
Hierarchy events

Specifies which Java events to recognize. Default is 0.

Example:

HIERARCHY_EVENT_CHANGED=0x1

This value instructs the JHO to recognize all hierarchy events.

Registry node: Extensions\AccessManager:JhoHierarchyEventProcessing
Window events

Specifies which Java window events to recognize. This flag is a combination of the following values:

  • WINDOW_EVENT_OPENED = 0x1
  • WINDOW_EVENT_CLOSED = 0x2
  • WINDOW_EVENT_ACTIVATED = 0x4
  • WINDOW_EVENT_DEACTIVATED = 0x8
  • WINDOW_EVENT_CLOSING = 0x10
  • WINDOW_EVENT_ICONIFIED = 0x20
  • WINDOW_EVENT_DEICONIFIED = 0x40

By default, ESSO-LM recognizes all events. The recommended setting for new installations of ESSO-LM is 3.

Registry node: Extensions\AccessManager:JhoWindowEventProcessing
Component events

Specifies which Java component events to recognize. This flag is a combination of the following values:

  • COMPONENT_EVENT_SHOWN = 0x1
  • COMPONENT_EVENT_HIDDEN = 0x2
  • COMPONENT_EVENT_ADDED = 0x4
  • COMPONENT_EVENT_REMOVED = 0x8

By default, ESSO-LM recognizes all component events. The recommended setting for new installations of ESSO-LM is 0x8 (11).

Registry node: Extensions\AccessManager:JhoComponentEventProcessing
Injection type

Specifies the injection type that the JHO uses to submit data to the controls. This flag takes one of the following values:

  • INJECT_TYPE_DEFAULT = 0
  • INJECT_TYPE_METHOD = 1
  • INJECT_TYPE_ACCESSIBLE = 2
  • INJECT_TYPE_NONACCESSIBLE = 3
  • INJECT_TYPE_ROBOT = 4

By default this flag is set to INJECT_TYPE_DEFAULT, which causes the JHO to attempt injection using each of the following methods, in the order shown, until injection is successful:

  • INJECT_TYPE_METHOD (if an appropriate set method had been found for the control)
  • INJECT_TYPE_ACCESSIBLE (if the control supports accessibility)
  • INJECT_TYPE_NONACCESSIBLE
  • INJECT_TYPE_ROBOT
For combo and list boxes, the JHO always uses INJECT_TYPE_METHOD.
Registry node: Extensions\AccessManager:JhoInjectType


Host/Mainframe Application Response

The Host/Mainframe Response settings control the behavior of the Agent with host/mainframe applications.

16-bit screen capture attempts

Specifies the number of times to attempt the 16-bit screen capture. If an attempt is unsuccessful after the allotted number of tries, the Agent reverts to the 32-bit method. (Default is 5)

Registry node: Extensions\AccessManager\MHO\ConXP:16BitTimeouts_ToFallback

Credential request delay interval

Specifies the interval (in milliseconds) between prompts to the user to create a logon for a mainframe session.

When a user logs on to a mainframe session that matches a configured application for which a stored password does not exist, ESSO-LM prompts the user with the following question: "Would you like ESSO-LM to remember your logon information for this application?" If the user selects Not now, the next time the user presses any key on the mainframe screen, ESSO-LM prompts the user again. This delay setting is the amount of time ESSO-LM should wait before displaying the question again (Default is 60000).

Registry node: Extensions\AccessManager\MHO:NotNowDelay
Polling interval

Specifies the interval (in milliseconds) between instances when the Agent checks the host emulator for changes. Lower values use more CPU time; higher values increase the time between when a screen appears and when the Agent provides credentials (Default is 700).

Registry node: Extensions\AccessManager\MHO:CycleInterval


Password Change

The Password Change settings control the Agent behavior and policies for password generation and credential maintenance.

Password change behavior
Default password policy

Name of Password Generation Policy that application templates will use when no policy is defined in the application template. To define this setting, ensure that you currently have a defined/named policy loaded in the console, so the dropdown allows you to select the policy.

If no policy is defined here or in the template, a default policy of exactly eight alpha-only characters applies. For this reason, it is important to define a more appropriate policy.
Registry node: Extensions\AccessManager:DefaultPolicy
Allow user to exclude accounts from credential sharing groups

Allows the end-user to exclude an application logon from the administrator-assigned credential sharing group.

Allowing this option causes a check box to appear on the "New Logon" and "Properties" dialog boxes, giving the user the choice to omit accounts from credential sharing groups.

Options:

  • No (default)
  • Yes
Registry node: Extensions\AccessManager:AllowExcludePWSG
Change passwords automatically

Specifies the level of control given to the user in the password change process.

Options:

  • No. The user has full control; ESSO-LM will not automatically change passwords. User must initiate password change. (default)
  • Yes, with user confirmation. The user has partial control; ESSO-LM will automatically initiate password change and prompt the user to either accept the auto-generated password, request to generate another, or enter one manually.
  • Yes, without user confirmation. The user has no control; ESSO-LM will automatically initiate password change, generate a password, and submit it to the application without permitting user interaction.
Registry node: Extensions\AccessManager:QuietGenerator
Manual password change behavior

Specifies the behavior of the Password Change Wizard when a user encounters a password-change request.

Options:

  • Prompt. Prompts user with the Password Change Wizard (default).
  • Manual, offer auto.Prompts user to select a new password, but also allows the Password Change Wizard to offer to generate the password automatically.
  • Auto, offer manual. Generates the new password automatically, but also allows the user to select the new password.
  • Manual only. Prompts user to select a new password; does not allow Password Change Wizard to automatically generate the password.
Registry node: Extensions\AccessManager:CPWFlag
Pop-up dialog text after submission

Specifies the text to display after the user changes a password.

To change the default text, select the checkbox and highlight the current text, then type in new text. To restore default text, deselect the checkbox.

The default text reads: "After closing this message, verify that the application accepted the password. Select OK if it was accepted. If it was rejected please try again."

Registry node: Extensions\AccessManager:CPVerifyMessage
Allowed character sets

Lowercase characters

Specifies the list of lowercase alphabet characters to allow in passwords.

(default: abcdefghijklmnopqrstuvwxyz)

Registry node: Extensions\AccessManager:LowerAlphaChars
Uppercase characters

Specifies the list of uppercase alphabet characters to allow in passwords.

(default: ABCDEFGHIJKLMNOPQRSTUVWXYZ)

Registry node: Extensions\AccessManager:UpperAlphaChars

Numeric characters

Specifies the list of numeric characters to allow in passwords.

(default: 1234567890)

Registry node: Extensions\AccessManager:NumericChars

Special characters:

List of non-alphanumeric (special) characters to allowed in passwords

(default: !@#$^&*()_-+=[]\|,?).

Registry node: Extensions\AccessManager:SpecialChars


User Interface

The User Interface settings control the appearance of the Agent when performing a logon and of the information presented in the Logon Manager and "Logon Chooser" dialog box.

Language

Language in which to display the Agent. English is always installed and is the default.

Other values may be acceptable based on localized versions.

The display font should support the desired characters in the specified language.

Options:

  • Brazilian Portuguese
  • Czech
  • Dutch
  • English
  • Finnish
  • French
  • German
  • Italian
  • Japanese
  • Korean
  • Polish
  • Simplified Chinese
  • Spanish
Registry node: [Root]:Language

Allow refresh in My Accounts

Enables/disables the Logon Manager "Refresh" button.

Options:

  • Yes (default)
  • No
Registry node: Extensions\AccessManager:AllowRefresh

Columns in "Details" view of My Accounts

Click "…" to display the "Edit Columns" dialog box to choose the appearance and order of columns in the Logon Manager.

  • Application Name
  • URL/Module
  • Username/ID
  • Password
  • Modified
  • Last Used
  • Description
  • Reference
  • Group
  • Third Field
  • Fourth Field

(Default is all columns, except Third Field and Fourth Field, in the order above.)

Registry node: Extensions\AccessManager\LogonManager:Columns

Columns in Logon Chooser

Click "…" to display the Edit Columns dialog box to choose the appearance and order of columns in the Agent's "Logon Chooser" dialog box.

  • Username/ID
  • Application Name
  • Description

(Default is Username/ID, Application Name, Description.)

Registry node: Extensions\AccessManager\LogonChooser:Columns

Logon animation's duration

Duration (in milliseconds) the animated spinner appears (pausing response). A value of 0 (the default) disables the spinner.

Registry node: Shell:AutoLogonAnimationTime


Setup Wizard

The Setup Wizard settings control the behavior of the First-Time-Use Wizard, which launches when you start ESSO-LM for the first time. See First Time Use for more information.

Show first-time-use (FTU) wizard

Controls whether the Setup Wizard launches when first-time-use is invoked.

Options:

  • Yes (default)
  • No

If more than one authenticator (primary logon method) is installed, then the first authenticator in the list is automatically selected as the end user's primary logon method.

You must have the FTU Wizard enabled in order to use the Bulk-Add feature.

Registry node: Extensions\SetUpManager:HideWizard

Selected authenticator

Enables the selected logon method as the primary logon method and hides all other installed logon methods. The default is no selection (i.e., end-users select their own primary logon method).

To hide the primary logon method selection menu, use the "Show first-time-use (FTU) wizard" setting. If the primary logon method selection page is hidden, and this setting is blank, then the first installed logon method in the list is automatically selected.
Registry node: AUI:FTUShowOnly

Skip selection page if only one authenticator is installed

Hide the Select Primary Logon Method step in the Setup Wizard if only one authenticator (primary logon method) is installed.

Options:

  • No (default)
  • Yes
Registry node: AUI:HideSingleSelection


Authentication

Use the Global Agent Authentication Settings to configure the overall authentication environment and individual authenticators' settings. Select a topic below to learn more about authentication options.

  • Authentication Manager . This pane and its sub-panes contain settings that apply to your overall authentication configuration.
    • Enrollment
    • Grade
    • Order
  • Authenticator Panes. Each pane contains settings applicable to a specific authenticator.
    • Windows v2
    • Windows v2 Passphrase
    • Windows
    • LDAP v2
    • LDAP v2 Special Purpose
    • LDAP
    • LDAP Special Purpose
    • Smart Card
    • Read-Only Smart Card
    • Proximity Card
  • Secure Data Storage


Authentication Manager

The Authentication Manager setting controls the number of authenticators and their priority.

Allowed number of authenticators

Specifies the maximum number of logon methods that the Agent offers the user to select. If the user receives and skips this number of logon methods, a "Choose Logon" dialog box appears. (Default is 1.)

This setting is only used for the Multi-Authenticator primary logons.
Registry node: AUI\MultiAuth:MaxPreferred


Authentication Manager Enrollment Settings

The Authentication Manager Enrollment settings specify the primary logon methods (authenticators) that can be used by the Multi-Authenticator primary logon.

The settings on this page will determine whether a user will be required to set up a specific logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method.

For each primary logon method, select one of the following:

  • Disabled. The logon method will not be presented to the user during the FTU Wizard.
  • Optional. ESSO-LM will have the option to configure this logon or to skip it. If the user defers the logon request, ESSO-LM will not ask again. (default)
  • Required. The user will be required to configure this logon. If this logon is not configured, the user will not be able to complete enrollment.
  • Incremental. ESSO-LM will have the option to configure this logon or to skip it. If the user defers the logon request, ESSO-LM will ask for credentials each time the application starts.

Windows v2

Specifies whether a user will be required to set up Windows v2 as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\MSauth:AuthState

Windows

Specifies whether a user will be required to set up Windows as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\WinAuth:AuthState

LDAP v2

Specifies whether a user will be required to set up LDAP v2 as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\LDAPauth:AuthState

LDAP

Specifies whether a user will be required to set up LDAP as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\LDAP:AuthState

Smart card

Specifies whether a user will be required to set up Smart card as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\SCauth:AuthState

Read-only smart card

Specifies whether a user will be required to set up Read-only smart card as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\ROSCauth:AuthState

Proximity card

Specifies whether a user will be required to set up Proximity card as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\ProxCardAuth:AuthState

RSA SecurID

Specifies whether a user will be required to set up RSA SecurID as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\SecureIDAuth:AuthState

Entrust

Specifies whether a user will be required to set up Entrust as a primary logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method. Select Optional, Incremental, Required, or Disabled. This setting is only used for Multi-Authenticator primary logons.

Registry node: AUI\Entrust:AuthState


Authentication Manager Grade Settings

The Authentication Manager Grade settings specify an authentication grade for each primary logon method.

Authentication Grades are numeric values:

  • An authentication grade will automatically default to grade level 1 if authentication grading is turned on and no grade level is specified.
  • The higher the grade level specified, the stronger the authentication level that is being requested.
  • The grading scale can be arbitrarily configured. For example, an expected normal scenario would be a scale of 1-3, but you have the flexibility to make this 1-5 or 1-n, as required. Any grade less than 1 will be converted to 1.

The Multi-Authenticator logon supports the authentication grades by mapping the grades to the authentication methods used, if you choose Authentication Manager as the primary logon method.

If a user tries to access credentials with a grade level that is too low, he will be asked to authenticate at a higher grade and only gain access if successful.

Lockouts occur as per normal ESSO-LM authentication lockout policy. Since graded authentication uses the core SSO authentication process, this will happen naturally.

Set a number grade value (>=1) for each logon method.

Windows v2

Assigns an authentication grade to Windows v2. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\MSauth:AuthGrade

Windows

Assigns an authentication grade to Windows. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\WinAuth:AuthGrade

LDAP v2

Assigns an authentication grade to LDAP v2. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\LDAPauth:AuthGrade

LDAP

Assigns an authentication grade to LDAP. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\LDAP:AuthGrade

Smart card

Assigns an authentication grade to Smart card. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\SCauth:AuthGrade

Read-only smart card

Assigns an authentication grade to Read-only smart card. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\ROSCauth:AuthGrade

Proximity card

Assigns an authentication grade to Proximity card. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\ProxCardAuth:AuthGrade

RSA SecurID

Assigns an authentication grade to RSA SecurID. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\SecureIDAuth:AuthGrade

Entrust

Assigns an authentication grade to Windows v2. Set a number grade value (>=1). The higher the grade level specified, the stronger the authentication level. This setting is only used for Multi-Authenticator primary logons. (Default is 1.)

Registry node: AUI\Entrust:AuthGrade


Authentication Manager Order Settings

The Authentication Manager Order settings specify the sequence in which the installed logon methods will be presented to the end user during reauthentication scenarios, if Authentication Manager is chosen as the primary logon method.

For each primary logon method, select or enter a number to indicate the logon method's position in the FTU/logon order.

Windows v2

Sets the ordered position for Windows v2. This will be the order in which Windows v2 will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 2.

Registry node: AUI\MSauth:AuthState

Windows

Sets the ordered position for Windows. This will be the order in which Windows will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 2.

Registry node: AUI\WinAuth:AuthState

LDAP v2

Sets the ordered position for LDAP v2. This will be the order in which LDAP v2 will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 3.

Registry node: AUI\LDAPauth:AuthState

LDAP

Sets the ordered position for LDAP. This will be the order in which LDAP will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 3.

Registry node: AUI\LDAP:AuthState

Smart card

Sets the ordered position for Smart Card. This will be the order in which Smart Card will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 1.

Registry node: AUI\SCauth:AuthState

Read-only smart card

Sets the ordered position for Read-Only Smart Card. This will be the order in which Read-Only Smart Card will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 1.

Registry node: AUI\ROSCauth:AuthState

Proximity card

Sets the ordered position for Proximity Card. This will be the order in which Proximity Card will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 6.

Registry node: AUI\ProxCardAuth:AuthState

RSA SecurID

Sets the ordered position for RSA SecurID. This will be the order in which RSA SecurID will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 6.

Registry node: AUI\SecureIDAuth:AuthState

Entrust

Sets the ordered position for Entrust. This will be the order in which Entrust will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons.

Defaults to 4.

Registry node: AUI\Entrust:AuthState


Windows v2 Authenticator Settings

The Windows v2 authenticator settings are the primary controls for the Windows Authenticator version 2.

Windows Authenticator version 2 is the preferred authenticator for ESSO-LM and is installed by default. For more information about this authenticator, refer to the Best Practice guide in the ESSO-LM online documentation center.
Recovery
Recovery method

Specifies the reset method to use when the user’s password changes.

Options:

  • User passphrase (default)
  • Passphrase suppression using user's SID
  • Passphrase suppression using secure key
Registry node: AUI\MSauth\ResetMethods:ResetMethodGUID
Use Windows Data Protection (DPAPI)

Set to Yes to use a DPAPI key to protect the ESSO-LM encryption key, instead of the normal two-key system of User Password and Recovery Key.

Options:

  • No (default)
  • Yes

Consult Microsoft and Oracle DPAPI best practices to ensure your Active Directory and desktop infrastructure is capable and configured to use DPAPI.

Registry node: AUI\MSauth:UseDPAPI
User interface
Window title

Use this setting to customize the window title name for this authenticator.

This entry is not required.

Registry node: AUI\MSauth:WindowTitle
Window subtitle

Use this setting to customize the window subtitle name for this authenticator.

This entry is not required.
Registry node: AUI\MSauth:WindowSubTitle
Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click "…" and browse to the image file.

The image file must be in bitmap (.bmp) format. The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

Registry node: AUI\MSauth:ImagePath

This setting is new as of ESSO-LM version 11.1.1.1.0.

Reauthentication dialog

Select which method to use when ESSO-LM requires the end-user to re-authenticate.

Options:

  • Use SSO dialog: The user is presented with an authentication dialog box whenever reauthentication is needed, including at initial enrollment.
  • Use GINA: The Windows desktop is locked, and the user must reauthenticate to the operating system (using whatever GINA or Credential Provider is installed) before ESSO-LM is unlocked.
While the setting is called “Use GINA,” it also applies to the Credential Provider mechanism in operating systems newer than Windows XP and Windows 2000.
Registry node: AUI\MSauth:AuthOptions
Credential sharing
Include in Domain credential sharing group

Enables credential sharing from the authenticator to credentials in a special credential sharing group called “Domain.” Whenever a new password is detected by the authenticator, the new password is automatically shared to the Domain credential sharing group.

Options:

  • Yes (default)
  • No
Registry node: AUI\MSauth:PWSEnable
Share credentials with other authenticators

This setting provides a way to eliminate the double authentication that takes place when using authenticators that have the same credentials.

This setting links authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, please see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).

Registry node: AUI\MSauth:ShareCredsToAuths
Share credentials with synchronizers

This setting provides a way to eliminate double authentication when an authenticator and one or more synchronizers use the same credentials.

Enter a comma-separated list of synchronizers to share the credentials with, for example ADEXT, LDAPEXT.

To locate other synchronizer names, see the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Registry node: AUI\MSauth:ShareCredsToSyncs


Windows v2 Authenticator Passphrase Settings

The Advanced Windows v2 Primary Logon Methods settings control special-case options for the Windows Authenticator version 2.

User interface
Message

Use this setting to display a user agreement style dialog box where users must check a checkbox to continue. This is typically used to suggest the importance of the passphrase that they enter.

This message can contain multiple lines, 180 character maximum. The character sequence "\n" will be replaced with carriage return and new line characters. If this setting is not set, the dialog box is skipped.
Registry node: AUI\MSauth\Reset:PassphraseMessage
Message dialog title

Use this setting to customize the user agreement style dialog title.

Registry node: AUI\MSauth\Reset:PassphraseDialogTitle
Checkbox label

Use this setting to customize the user agreement style dialog checkbox.

This checkbox must be checked before the dialog can be dismissed. The OK button is disabled until this checkbox is checked.

Registry node: AUI\MSauth\Reset:PassphraseChkboxMsg
Options
Minimum length

Default required length of a passphrase. This setting can be overridden by setting the required length for a specific question. Default is 8.

Registry node: AUI\MSauth\Reset:MinPassphraseLength
User can change passphrase

Toggles availability of the user’s option to change the answer to the verification question.

Options:

  • Yes (default)
  • No
Registry node: AUI\MSauth:ShowChangeAnswerOption
Reset with old password

Allows the user to use the previous password in the passphrase process.

Options:

  • No (default)
  • Yes
Registry node: AUI\MSauth:ResetWOP
Force password re-enrollment when using old password to reset

Specifies whether users can skip the ESSO-LM passphrase prompt. Enabling this feature ensures that after a user enters the previous Windows password, ESSO-LM will prompt to enter a new passphrase.

Disabling this feature runs the risk of a complete lockout to ESSO-LM. This can happen if a user no longer remembers his passphrase, and subsequently forgets his Windows password. In this scenario, a user would be completely locked out of ESSO-LM.

Options:

  • Yes (default)
  • No
Registry node: AUI\MSauth:RWOPSkipReset


Windows Authenticator Settings

The Windows authenticator settings are the primary controls for the Windows Authenticator.

User interface
Window title

Use this setting to customize the window title name for this authenticator.

This entry is not required.

Registry node: AUI\WinAuth:WindowTitle
Window subtitle

Use this setting to customize the window subtitle name for this authenticator.

This entry is not required.
Registry node: AUI\ WinAuth:WindowSubTitle
Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click "…" and browse to the image file.

The image file must be in bitmap (.bmp) format. The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

Registry node: AUI\ WinAuth:ImagePath

This setting is new as of ESSO-LM version 11.1.1.1.0.

Require old password when Windows password changes

Provides enhanced security by requiring the user to enter the previous password when changing to a new one.

Options:

  • No (default)
  • Yes
Registry node: AUI\WinAuth:PWEnable
Credential sharing
Share credentials with other authenticators

This setting provides a way to eliminate the double authentication that takes place when using authenticators that have the same credentials.

This setting links authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, please see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).

Registry node: AUI\WinAuth:ShareCredsToAuths
Share credentials with synchronizers

This setting provides a way to eliminate double authentication when an authenticator and one or more synchronizers use the same credentials.

Enter a comma-separated list of synchronizers to share the credentials with, for example ADEXT, LDAPEXT.

To locate other synchronizer names, see the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Registry node: AUI\WinAuth:ShareCredsToSyncs


LDAP v2 Authenticator Settings

The LDAP v2 authenticator settings are the primary controls for enabling LDAP version 2 authentication.

Connection information

Servers

Servers to try, in the format computer[:port] (one server per line), where computer is the server name or IP, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified.

Examples:

127.0.0.1
127.0.0.1:456
somewhereelse.com:8080
anotherplace.com

At least one server must be specified for this extension to work.

Registry node: AUI\LDAPauth\Servers:ServerN
User paths

Fully-qualified path to where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If the account is not found, the extension will search the directory tree.

You must specify a value for either UserPrepend or at least one value for UserPaths for this extension to work.

If using UserPaths, do not use UserLocation.

Registry node: AUI\LDAPauth:UserPathN

Use SSL

Specifies whether to connect via SSL.

Options:

  • No. (insecure) (default to port #389) (default)
  • Yes. (default port #636)
Registry node: AUI\LDAPauth:UseSSL
User Interface

Window title

Use this setting to customize the Window title name for this authenticator.

This entry is not required.

Registry node: AUI\LDAPauth:WindowTitle
Show user path

Enable this setting to display the User path combo box control in the LDAP v2 authentication dialog box.

Options:

  • Yes (default)
  • No
Registry node: AUI\LDAPAuth:ShowUserPath

This setting is new as of ESSO-LM version 11.1.1.1.0.
Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click the "…" and browse to the image file.

The image file must be in bitmap (.bmp) format. The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

Registry node: AUI\LDAPAuth:ImagePath

This setting is new as of ESSO-LM version 11.1.1.1.0.
Credential sharing
Share credentials with other authenticators

Enter a comma-separated list of authenticators to share the credentials with, for example "WinAuth, MSAuth".

To locate other authenticator names, refer to the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Registry node: AUI\LDAPauth:ShareCredsToAuths
Share credentials with synchronizers

Enter a comma-separated list of synchronizers to share the credentials with, for example "ADEXT,LDAPEXT".

To locate other synchronizer names, refer to the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Registry node: AUI\LDAPauth:ShareCredsToSyncs
Include in LDAP credential sharing group

Enables credential sharing from the authenticator to credentials in the group domain. (Also requires AccessManager:PWSEnable to be enabled.)

Registry node: AUI\LDAPauth:PWSEnable


LDAP v2 Authenticator Special Purpose Settings

The LDAP v2 Authenticator Special Purpose settings control special-case options for enabling standard LDAP v2 authentication.

Naming attribute string

String to prepend to UserPaths. This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer;

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string). If needed, set to cn.

This value usually needs to be set to cn for Novell eDirectory.

If using UserPrepend, you must use UserPathN and do not use UserLocation.

Registry node: AUI\LDAPauth:UserPrepend

BIND Timeout

The timeout (in milliseconds) of LDAP BIND call (default depends on the operating system).

Registry node: AUI\LDAPauth:Timeout

Alternate User ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set this location to

empid=%user,ou=people,dc=computer

instead of to

uid=user,ou=people,dc=computer

For Novell eDirectory, UserLocation should be: uid=%user,path to the object.

If using UserLocation, do not use UserPrepend or UserPaths.

Registry node: AUI\LDAPauth:UserLocation


LDAP Authenticator Settings

The LDAP authenticator settings are the primary controls for enabling standard LDAP authentication. These settings must be used in order for the Agent to use LDAP as a primary logon method.

Connection information
Directory type

The specific type of directory server. If the directory server is not listed, select "Generic LDAP Directory."

Registry node: AUI\LDAP:DirectoryType

Servers

Servers to try, in the format computer[:port] (one server per line), where computer is the server name or IP, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified.

Examples:

127.0.0.1
127.0.0.1:456
somewhereelse.com:8080
anotherplace.com

At least one server must be specified for this extension to work.

Registry node: AUI\LDAP\Servers:ServerN
User paths

Fully-qualified path to where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If the account is not found, the extension will search the directory tree.

You must specify a value for either UserPrepend or at least one value for UserPaths for this extension to work.

If using UserPaths, do not use UserLocation.

Registry node: AUI\LDAP:UserPathN

Use SSL

Specifies whether to connect via SSL.

Options:

  • No. (insecure) (default to port #389) (default)
  • Yes. (default port #636)
Registry node: AUI\LDAP:UseSSL
Active Directory

Enable Domain name support

Enables Active Directory domain-name support. End users can specify the domain name (for example, domainname\username) at primary logon. Alternatively, the administrator can specify a default domain name (see Active Directory: Set domain name) to let end users log on by username alone. If no domain is specified, then the local workstation's domain is used.

Options:

  • No (default)
  • Yes
Registry node: AUI\LDAPauth:UsingAD
Default Domain name

The Active Directory domain name to use for primary logon if no domain is specified for the username/ID credential (for example, domainname\username). This setting is used only if "Active Directory: Domain name support enabled" is set to "Use AD domain names." If domain-name support is enabled and this setting is blank (and the end user does not specify a domain), then the local workstation's domain is used.

Registry node: AUI\LDAP:ADDomain
User Interface

Window title

Use this setting to customize the Window title name for this authenticator.

This entry is not required.

Registry node: AUI\LDAP:WindowTitle
Password change window title

Use this setting to customize the Active Directory Change Password Window title name for this synchronizer.

This entry is not required.

Registry node: AUI\LDAPauth:CAP_WindowTitle
Password change window subtitle

Use this setting to customize the Active Directory Change Password Window subtitle name for this authenticator.

This entry is not required.
Registry node: AUI\LDAPauth:CAP_WindowSubTitle
Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click the "…" and browse to the image file.

The image file must be in bitmap (.bmp) format. The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

Registry node: AUI\LDAPauth:CAP_WindowSubTitle

This setting is new as of ESSO-LM version 11.1.1.1.0.
Show user path

Use this setting to show/hide User Path combo box control in the LDAP authentication dialog box.

Options:

  • Yes (default)
  • No
Registry node: AUI\LDAP:ShowUserPath

This setting is new as of ESSO-LM version 11.1.1.1.0.
Credential sharing
Share credentials with other authenticators

Enter a comma-separated list of authenticators to share the credentials with, for example "WinAuth, MSAuth".

To locate other authenticator names, refer to the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Registry node: AUI\LDAP:ShareCredsToAuths
Share credentials with synchronizers

Enter a comma-separated list of synchronizers to share the credentials with, for example "ADEXT,LDAPEXT".

Registry node: S

To locate other synchronizer names, refer to the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Registry node: AUI\LDAP:ShareCredsToSyncs


LDAP Authenticator Special Purpose Settings

The LDAP Authenticator Special Purpose settings control special-case options for enabling standard LDAP authentication.

Naming Attribute string

String to prepend to UserPaths. This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string).

This value usually needs to be set to cn for Novell eDirectory.

If using UserPrepend, you must use UserPathN and do not use UserLocation.

Registry node: AUI\LDAP:UserPrepend

BIND Timeout

The timeout (in milliseconds) of LDAP BIND call (default depends on the operating system).

Registry node: AUI\LDAP:Timeout

Alternate user ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set UserLocation to

empid=%user,ou=people,dc=computer

instead of to

uid=user,ou=people,dc=computer

For Novell eDirectory, UserLocation should be:
uid=%user, path to the object.

If using UserLocation, do not use UserPrepend or UserPaths.

Registry node: AUI\LDAP:UserLocation
Enable directory search for users

Enables or disables directory search for the user account. When the user account is not found in the given path, the authenticator will search for it from that location down the directory tree. The search is performed whether using "User Paths" or "Alternate User ID location."

Options:

  • No (default)
  • Yes
Registry node: AUI\LDAP:LDAPBindSearch


Smart Card Authenticator Settings

The Smart Card authenticator settings control special-case options for smart card authentication.

Options

Smart card library

Specifies whether to use the Cryptographic Service Provider (CSP) or the PKCS #11 library to perform cryptographic operations on the smart card.

Options:

  • CSP (default)
  • PKCS #11
Set this to PKCS # 11 only if using SafeSign/RaakSign middleware.
Registry node: AUI\SCauth:SmartCardAPI

Use default certificate for authentication

Specifies whether to use the default logon certificate (provided by the administrator) on the card for authentication. If not enabled (the default), the public/private keys in the SSO container on the card will be used (and created if necessary).

Options:

  • No (default)
  • Yes
Registry node: AUI\SCauth:UseCertOnCard

Store synchronization credentials

Specifies whether to store the user's synchronization repository credentials on the smart card.

Store credentials when using smart card authorization in conjunction with Kiosk Manager and/or if using the read-only smart card authenticator.

Performance improves when credentials are not stored on the smart card because the read/write operation adds time to the authentication process.

Options:

  • No (default)
  • Yes
Registry node: AUI\SCauth:StoreSyncCreds

Store the PIN

Specifies whether to store the smart card PIN (creating the possibility that the Agent might prompt for the PIN), or to let the smart card drivers handle the PIN request.

Options:

  • No (default)
  • Yes
Registry node: AUI\SCauth:AuthOptions
PKCS #11 Library Path

Use this setting to configure the path to the smart card middleware file, which implements the PKCS#11 standard.

This entry is not required unless "Smart card library" is set to PKCS #11, "Store synchronization credentials" is set to Yes, or smart cards are being used with Kiosk Manager.
Registry node: AUI\SCAuth:PKCS11Path
User interface

Window title

Use this setting to customize the window title name for this authenticator.

This entry is not required.

Registry node: AUI\SCauth:WindowTitle

Window subtitle

Use this setting to customize the window subtitle name for this authenticator.

This entry is not required.

Registry node: AUI\SCauth:WindowSubTitle
Recovery

Recovery method

Specifies the supplier of the reset passphrase to be used: the user (entering the passphrase in a dialog box) or the newest non-default encryption certificate on the card itself.

Options:

  • Passphrase (default)
  • Encryption certificate
Registry node: AUI\SCauth:ResetEnable
Recovery certificate object identifier

Configures the object identifier that identifies the certificate used for the certificate-based passphrase feature. The authenticator searches the "Enhanced Key Usage" attribute of each certificate on the smart card for this object identifier.

The "Recovery method" option must be set to "Encryption certificate." This entry is not required.

Registry node: AUI\SCAuth:ResetCertOID


Read-Only Smart Card Authenticator Settings

The Read-Only Smart Card authenticator settings control special-case options for read-only smart card authentication.

Options
Store synchronization credentials

Specifies whether to store the user's synchronization repository credentials using Secure Data Storage.

Secure Data Storage must be enabled and configured.

Options:

  • No (default)
  • Yes
Registry node: AUI\ROSCauth:StoreSyncCreds
PKCS #11 Library Path

Use this setting to configure the path to the smart card middleware file, which implements the PKCS#11 standard.

This entry is not required unless "Store synchronization credentials" is set to Yes or read-only smart cards are being used with Kiosk Manager.
Registry node: AUI\ROSCAuth:PKCS11Path
Recovery
Recovery method

Allow the Reset passphrase to be used. The passphrase can be supplied either by the user (entering the passphrase in a dialog box) or by the newest non-default encryption certificate on the card itself.

Options:

  • Passphrase (default)
  • Encryption certificate
Registry node: AUI\ROSCauth:ResetEnable
Reset certificate object identifier

Specifies the object identifier used to identify the certificate to use for the certificate-based passphrase feature. The authenticator searches the "Enhanced Key Attributes" of each certificate on the smart card for this object identifier.

The "Recovery method" option must be set to "Encryption certificate." This entry is not required.

Registry node: AUI\ROSCAuth:ResetCertOID


Proximity Card Authenticator Settings

The proximity card authenticator settings are used for configuring proximity card authentication.

Options

Card family

Specifies the proximity card family type.

Options:

  • HID ISO/DUO PROX (default)
  • iClass
  • Indala/EM
Registry node: AUI\ProxCardAuth:ProximityCardFamily

Reader type

Specifies the name of the proximity card reader to use.

Options:

  • Omnikey CardMan 5125
  • Omnikey CardMan 5121
  • Omnikey CardMan 5321
  • RFIdeas (all readers)
Registry node: AUI\ProxCardAuth:ReaderName

Second factor authentication

Specifies whether to use the Active Directory password or a user-defined PIN for the second factor in authentication.

Options:

  • AD password (default)
  • User-defined PIN
Registry node: AUI\ProxCardAuth:AuthenticationMethod
PIN settings

Minimum length

Specifies the minimum length of the user-defined PIN. The default is 4.

Registry node: AUI\ProxCardAuth:MinPINLength

Maximum length

Specifies the maximum length of the user-defined PIN. The default is 8.

Registry node: AUI\ProxCardAuth:MaxPINLength

Maximum retries

Specifies the number of correct PIN attempts before the authentication fails. The default is 3.

Registry node: AUI\ProxCardAuth:RetryPINCount

Alphanumeric constraints

Specifies the alphanumeric requirements of the user-defined PIN.

Options:

  • Numbers only
  • Letters only
  • Numbers and letters (default)
Registry node: AUI\ProxCardAuth:AlphabeticRequirements


Secure Data Storage Settings

These settings are used for configuring secure data storage.

Enable data storage

Configures whether to store users' synchronization credentials within the repository securely.

Options:

  • No (default)
  • Yes
Registry node: DataStorage:PasslogixSecureDataStorage
Data storage location

Fully-qualified path to the location in the repository where the data will be stored.

Registry node: SecureDataStorage:LocationDN


Agent Synchronization Settings

The Synchronization settings are the general options for credential synchronization for all synchronizer extensions. Use these settings to control the following functions and features:

Performance Options
  • Synchronizer Order
  • Aggressive Synchronization
  • Optimized Synchronization
  • Interval for automatic resynchronization
  • Resynchronize when network or connection status changes
  • Wait for synchronization at startup
  • Roaming Profile Synchronization Support
User Mobility Options
  • Delete local cache
  • Deleted-credential cleanup
  • Disconnected operation
Security and Management Options
  • Enable role/group security support
Options
Synchronizer order

Sets the order of synchronization extensions to use. If no value is specified, all extensions are used (in an unpredictable order). For reads, the first operational synchronizer is authoritative, and no other synchronizer is queried. For writes, all synchronizers are updated, in the order specified in this setting.

Examples:

LDAPExt,ADExt FileSync Remote,AD,FileSync Local,SmartCard MySmartCard,ADExt,ADExtRemote

Extensions\SyncManager:SyncOrder
Use configuration objects

When turned off, all templates and policies are consolidated into one of two objects: CN=vgoentlist and CN=vgoadminoverride.

When turned on, all template and policies are independent objects for directory-based synchronizers. In this mode, additional features are available, including role/group security and directory hierarchy support.

Options:

  • No (default)
  • Yes
Extensions\SyncManager:RetrieveCO
Allow disconnected operation

Specifies whether the offline cache is usable or whether the First-Time-Use setup wizard executes when the Agent is unable to connect to any synchronizer repository. If set to No, and the repository is not available, the Agent shuts down.

Options:

  • Yes (default)
  • No
Extensions\SyncManager:AllowDisconnected
Delete local cache

Specifies whether to delete the user's data files and registry keys upon shutdown of the Agent.

Options:

  • No (default)
  • Yes
Shell:CleanupOnShutdown
Deleted-credential cleanup

Length of time (in days) for which a credential's "deleted" flag is retained, after a credential is deleted. Used to ensure that the credential is deleted from all of a user’s local caches on multiple systems. (Default is 30 days)

Shell:nDelDays
Location of entlist.ini file

Fully-qualified path and filename to the entlist.ini file. Only applicable in standalone (no synchronizer) mode.

This setting should be used only to deploy ESSO-LM Administrative Console templates locally to the workstation when synchronization is not installed.

The setting should NOT be used when synchronization is installed and application templates are deployed via a repository such as Active Directory. See Configuring Application Templates for more information."

Extensions\AccessManager:EntList
Behavior
Wait for synchronization at startup

Specifies whether to wait for synchronization at startup, which ensures that the user's data is current, and new templates and policies are put into effect before ESSO-LM logs on to applications.

When set, ESSO-LM does not respond until the synchronization is complete; synchronization times vary based on your synchronization infrastructure and the number of templates and policies in the repository.

Options:

  • Yes (default)
  • No
Extensions\SyncManager:WaitForStartupSync
Interval for automatic resynchronization

Interval (in minutes) between automatic resynchronizations. This synchronization interval is not reset if a manual, user-generated sync event (such as an ESSO-LM refresh) takes place.

A value of zero (0) disables this setting, which means that synchronization occurs only during normal sync events such as ESSO-LM startup or user credential update. Generally set when ESSO-PG is in use, to ensure that updates are delivered in a timely manner.

Extensions\SyncManager:CycleInterval
Optimize synchronization

When enabled, the synchronization function uses a checksum object called SyncState to determine changed credentials, rather than retrieving all credentials. Changed credentials are then independently synchronized without synchronizing all credentials. Note that templates and policies are always synchronized in full during each sync event.

Options:

  • Yes (default)
  • No
Extensions\SyncManager:OptimizedSync
Use aggressive synchronization

When turned on, each time ESSO-LM detects a logon event, a synchronization occurs before the target application credential is decrypted and passed to the application. This feature ensures that the most current credentials or settings are used at all times. The feature is normally only used in special cases where a user uses multiple systems to simultaneously access the same application (such as through a Citrix farm).

This feature can have a significant performance impact on both client and server computers.

Options:

  • No (default).
  • Yes
Extensions\SyncManager:AggressiveSync
Resynchronize when network or connection status changes

Enables or disables monitoring for changes in the network connection status. With this setting enabled, the Agent performs resynchronization when a status change occurs (for example, re-connecting to the network).

Options:

  • No (default)
  • Yes
Shell:MonitorNetwork


Active Directory Synchronization Settings

Use these settings to configure a Microsoft Active Directory (AD) synchronization.

Data storage configuration
Base location(s) for configuration objects

Where to begin the search for Configuration Objects (templates and policies). This is a fully-qualified, distinguished path, such as:

OU=SSOConfig,DC=Domain,DC=com

The search starts from the specified location(s) and searches all subordinate OUs (if any) for Configuration Objects. To specify multiple locations, place one entry on each line.

Extensions\SyncManager\Syncs\%AD%\COBaseLocations:LocationN
Location for storing user credentials

Credentials can either be stored as objects subordinate to the Active Directory user object, or as specified by an Oracle locator object.

Options:

  • As specified by locator object (default)
  • Under respective directory user objects
Extensions\SyncManager\Syncs\%AD%:LocateInUser
Prepend Domain when naming objects

Enables prepending of the user's domain to the username in naming the user's container.

Example:

For the domain company and user jamesk, the container is named jamesk with this flag disabled and company.jamesk with this flag enabled.

Options:

  • No (default)
  • Yes
Extensions\SyncManager\Syncs\%AD%:AppendDomain
Connection information
Credentials to use

Which credentials to use when authenticating to the Active Directory server.

Options:

  • Local computer credentials
  • Use Active Directory server account only (recommended that UserPathN be set)
  • Try local computer credentials; if it fails, use Active Directory server account (default)
Extensions\SyncManager\Syncs\%AD%:AuthType
Prompt when disconnected

Allow the user to work offline without prompting/notification if a synchronization event fails.

Options:

  • No (default).
  • Yes
Extensions\SyncManager\Syncs\%AD%:AllowOffline
Servers

Servers to try, in the format "computer[:port]" (one server per line), where “computer” is the server name, and “port” is assumed to be the default (636 for SSL, 389 for no SSL) if not specified.

Examples:

  • DC1.company.com
  • DC2.company.com
  • company.com:8080
  • companylab.com

This setting is not normally used when storing Oracle data in Active Directory.

Active Directory requires use of computer names (not IP addresses).

Extensions\SyncManager\Syncs\%AD%\Servers:ServerN
User Paths

Fully-qualified path to where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree.

This entry is not required for this extension.
Extensions\SyncManager\Syncs\%AD%:UserPathN
Use SSL

Select whether to connect using SSL.

Options:

  • No (insecure) (default to port #389) (default)
  • Yes (default to port #636)
Extensions\SyncManager\Syncs\%AD%:UseSSL
Logon attempts

Number of times to present the Synchronization dialog box to the user. The default value is 3, meaning the synchronization dialog box will appear a maximum of 3 times if incorrect credentials are submitted.

Extensions\SyncManager\Syncs\%AD%:RetryLockCount
User interface
Descriptive name

Logon dialog box title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.

Extensions\SyncManager\Syncs\%AD%:DisplayName
Password change window title

Use this setting to customize the Active Directory Change Password Window title name for this synchronizer.

This entry is not required.

Extensions\SyncManager\Syncs\%AD%:CAP_WindowTitle
Password change window subtitle

Use this setting to customize the Active Directory Change Password Window subtitle name for this synchronizer.

This entry is not required.

Extensions\SyncManager\Syncs\%AD%:CAP_WindowSubTitle
Credential sharing
Share credentials with authenticators

This setting provides a way to eliminate the double authentication that takes place when using synchronizers and authenticators that have the same credentials.

This setting links synchronizer and authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Extensions\SyncManager\Syncs\%AD%:ShareCredsToAuths
File mode configuration
Limit search to server root

Controls how the Agent searches for locator and override objects.

Options:

  • Yes (default)
  • No
Extensions\SyncManager\Syncs\%AD%:StopAtRoot


ADAM Synchronization Settings

Use these settings to configure a Microsoft Active Directory Application Mode (ADAM) synchronization.

Data storage configuration
Base location(s) for configuration objects

Where to begin the search for Configuration Objects (templates and policies). This is a fully-qualified, distinguished path, such as:

OU=SSOConfig,DC=Domain,DC=com

The search starts from the specified location(s) and searches all subordinate OUs (if any) for Configuration Objects. To specify multiple locations, place one entry on each line.

Extensions\SyncManager\Syncs\%ADAM%\COBaseLocations:LocationN
Prepend Domain when naming objects

Enables prepending of the user's domain to the username in naming the user's container.

Example:

For the domain company and user jamesk, the container is named jamesk with this flag disabled and company.jamesk with this flag enabled.

Options:

  • No (default)
  • Yes
Extensions\SyncManager\Syncs\%ADAM%:AppendDomain
User Domain name to use

Domain name to use in the container name (e.g., "DomainName.UserName") when "Prepend Domain when naming objects" is enabled. The user can specify another domain the in the logon dialog box.

Example:

If the user domain is MyDomain (with Prepend Domain enabled) and the user logs on as jamesk, the container name is MYDOMAIN.jamesk. If the user logs on as HISDOMAIN\jamesk the container name is HISDOMAIN.jamesk.

Extensions\SyncManager\Syncs\%ADAM%:UserDomain
Connection information
Credentials to use

Which credentials to use when authenticating to the ADAM server.

Options:

  • Local computer credentials
  • ADAM server account
  • Try local computer credentials; if it fails, use ADAM server account (default)
Extensions\SyncManager\Syncs\%ADAM%:AuthType
Prompt when disconnected

Allow the user to work offline without prompting/notification if a synchronization event fails.

Options:

  • No (default).
  • Yes
Extensions\SyncManager\Syncs\%ADAM%:AllowOffline
Servers

Servers to try, in the format "computer[:port]" (one server per line), where “computer” is the server name, and “port” is assumed to be the default (636 for SSL, 389 for no SSL) if not specified.

Examples:

  • Adam1.company.com
  • Adam2.company.com
  • Adam3.company.com:50389
Extensions\SyncManager\Syncs\%ADAM%\Servers:ServerN
Use SSL

Select whether to connect using SSL.

Options:

  • No (insecure) (default to port #389) (default)
  • Yes (default to port #636)
Extensions\SyncManager\Syncs\%ADAM%:UseSSL
User interface
Descriptive name

Logon dialog box title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.

Extensions\SyncManager\Syncs\%ADAM%:DisplayName
Password change window title

Use this setting to customize the ADAM Change Password Window title name for this synchronizer.

This entry is not required.

Extensions\SyncManager\Syncs\%ADAM%:CAP_WindowTitle
Password change window subtitle

Use this setting to customize the ADAM Change Password Window subtitle name for this synchronizer.

This entry is not required.

Extensions\SyncManager\Syncs\%ADAM%:CAP_WindowSubTitle
Credential sharing
Share credentials with authenticators

This setting provides a way to eliminate the double authentication that takes place when using synchronizers and authenticators that have the same credentials.

This setting links synchronizer and authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Extensions\SyncManager\Syncs\%ADAM%:ShareCredsToAuths


Database Synchronization Settings

Use these settings to configure database synchronization.

Servers

Specify the database servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the "Edit List" dialog box. Enter the full connection address (computerName.dbServerName) for one database server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

You must specify at least one server for the extension to work.

For Oracle:

  • To connect to an Oracle database, use the following connection string:
  • Provider=OraOLEDB.Oracle;Data Source=%MachineName%;Extended Properties='OSAuthent=1' where the "Data Source" value will be different for each configuration.
  • To connect to the Oracle database, the Oracle 10g client must be installed on the same machine as the ESSO-LM Administrative Console.

For SQL Server:

To connect to a SQL Server that is hosting multiple instances, use the following connection string (with no manual line break):

Provider=SQLOLEDB; Data Source="ServerName\Instance"; Initial Catalog="DatabaseName";

Trusted_Connection=Yes;

Extensions\SyncManager\Syncs\%DB%\Servers:Server
Append Domain when naming objects

Enables appending of the user's domain to the username in naming the user's container.

Example:

For the domain company and user jamesk, the container is named jamesk with this flag disabled and jamesk.company with this flag enabled.

Options:

  • No (default)
  • Yes
Extensions\SyncManager\Syncs\%DB%:AppendDomain


File System Synchronization Settings

Use these settings to configure a File System synchronization.

Data storage configuration
Prepend Domain when naming user folders

Enable/disable prepending of the user's domain to the username in naming the user's container.

Example:

For the domain company and user jamesk, the container is named jamesk with this flag disabled and company.jamesk with this flag enabled.

Extensions\SyncManager\Syncs\%File%:AppendDomain
Connection information
Prompt when disconnected

Allow the user to work offline without prompt or notification if a synchronization event fails.

Options:

  • No (default).
  • Yes
Extensions\SyncManager\Syncs\%File%:AllowOffline
Server

The list of UNC paths to try for synchronization. You must specify Server1 for this extension to work.

Examples:

\\FS1\Users

\FS2\Extras

D:\Backup

The File System extension requires use of proper UNC paths.

As of ESSO-LM4.0, only one path is supported.

Extensions\SyncManager\Syncs\%File%\Servers:Server1
Logon attempts

Number of times to present the "Retry" dialog box to the user (Default is 3).

Extensions\SyncManager\Syncs\%File%:RetryLockCount
User interface
Descriptive name

Logon dialog box title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.

Extensions\SyncManager\Syncs\%File%:DisplayName


LDAP Synchronization Settings

The LDAP/IBM Synchronization settings must be set for all LDAP synchronizer extensions.

You can bind to a directory before or after searching for a specific user account. If you choose to search for a user account before binding, ESSO-LM begins searching at the user path you specify and continues down the tree until it locates the user account and binds to that directory, or it exhausts all paths. If ESSO-LM does not find the user account you specify, the user receives a message that the system has been configured incorrectly and to contact the administrator.

Typically, ESSO-LM uses anonymous binding for LDAP directories, but it also allows you to create a "browse-only" account to search for a user in scenarios where anonymous binding is disabled. In such cases, the account name is not the user's name and therefore is not readily identifiable (for instance, an employee ID or social security number). The browse-only account facilitates user searches when the alternate user ID option is enabled, identifying the user who belongs to the alternate user ID. Use the Alternate User ID location, BIND User Name, and BIND User Password settings to configure the browse-only account.

Base location(s) for configuration objects

Where to begin the search for Configuration Objects (templates and policies). This is a fully-qualified, distinguished path, such as:

OU=SSOConfig,DC=Domain,DC=com

The search starts from the specified location(s) and searches all subordinate OUs (if any) for Configuration Objects. To specify multiple locations, place one entry on each line.

Extensions\SyncManager\Syncs\%LDAP%\COBaseLocations:LocationN
Connection information
Prompt when disconnected

Allows the user to work offline without prompting or notification if a synchronization event fails.

Options:

  • No (default)
  • Yes
Extensions\SyncManager\Syncs\%LDAP%:AllowOffline
Directory type

The specific type of directory server. If the directory server is not listed, select Unspecified LDAP Directory (the default) for backwards compatibility in upgrade scenarios; otherwise select Generic LDAP Directory.

Options:

  • Unspecified LDAP Directory (LDAP default)
  • Novell eDirectory
  • Generic LDAP Directory
  • Oracle Directory Server Enterprise Edition
  • IBM Tivoli Directory Server (IBM default)
  • Oracle Internet Directory
  • Siemens DirX Directory Server
Extensions\SyncManager\Syncs\%LDAP%:DirectoryType
Servers

Servers to try, in the format "computer[:port]" (one server per line), where “computer” is the server name, and “port” is assumed to be the default (636 for SSL, 389 for no SSL) if not specified.

Examples:

  • LDAP1.company.com
  • LDAP2.company.com
  • LDAP3.company.com:50389
Extensions\SyncManager\Syncs\%LDAP%\Servers:ServerN
User paths

Fully-qualified (distinguished) path to the location of the user account when LDAP Directory Search is not enabled. There can be unlimited paths to search. The extension searches these in order, looking for the user account. When using LDAP Directory Search, if the user account is not found in the given userpath, the extension searches down the directory tree from that path.

Example:

OU=Users,DC=Domain,DC=com

You must specify at least one value for UserPath for this extension to work.

Extensions\SyncManager\Syncs\%LDAP%:UserPathN
Use SSL

Select to connect via SSL.

Options:

  • No (insecure) (default to port #389) (default)
  • Yes (default to port #636)
Extensions\SyncManager\Syncs\%LDAP%:UseSSL
Administrative security
Administrative group DN

Distinguished Name for the Administrative group. This value is placed in the ACI.

Example:

cn=configuration administrators, ou=groups, ou=topologymanagement, o=netscaperoot

Extensions\SyncManager\Syncs\%LDAP%:AdminGroup
Security version

This setting in used in conjunction with the Admin Group DN setting to update of the security rights on the people container used by ESSO-LM to store LDAP user credentials for deployed environments.

To do this:

  1. Provide the new Admin Group DN to be used for the new security. This is the Distinguished Name of the security group.
  2. Set the Security Version to one higher than its current value.
  3. Deploy the settings.

The next time ESSO-LM performs a synchronization, it updates the security to the new Admin Group DN and sets its current internal Security Version to the one configured. This forces the security update to run only once.

This setting is not meant to be used as a normal upgrade path for the security change. It is recommended that you use in-place mechanisms that exist for the various servers.

Extensions\SyncManager\Syncs\%LDAP%:SecurityVersion
User interface
Descriptive name

Logon dialog box title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.

Extensions\SyncManager\Syncs\%LDAP%:DisplayName
Show user path

When set to Yes, the User path field is displayed when the user is prompted to authenticate.

Options:

  • Yes (default)
  • No
Extensions\SyncManager\Syncs\%LDAP%:ShowUserPath

This setting is new as of ESSO-LM version 11.1.1.1.0.
Logon attempts

Number of times to present the "Retry Logon" dialog box to the user. The default value is 3, meaning the user has a maximum of three times to re-enter credentials after entering incorrect ones.

Extensions\SyncManager\Syncs\%LDAP%:RetryLockCount
Credential sharing
Share credentials with authenticators

This setting provides a way to eliminate the double authentication that takes place when using synchronizers and authenticators that have the same credentials.

This setting links synchronizer and authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example “WinAuth, MSAuth.”

To locate other authenticator names, see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).

Extensions\SyncManager\Syncs\%LDAP%:ShareCredsToAuths


LDAP Special Purpose Synchronization Settings

Naming attribute string

String to prepend to User Paths. This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer;

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string). If needed, set to cn.

This value usually needs to be set to cn for Novell eDirectory.

If you use UserPrepend, you must use User PathN and not use UserLocation.

Extensions\SyncManager\Syncs\%LDAP%:UserPrepend
BIND timeout

The timeout (in milliseconds) of the LDAP BIND call (default depends on the operating system).

Extensions\SyncManager\Syncs\%LDAP%:Timeout
BIND user DN

Specifies the LDAP "browse only" account user DN. This must be in the format:

"uid=%username%,ou=people,dc=%CompanyName%" (for example, uid=jsmith,ou=people,dc=yourcompany,dc=com.)

LDAP Directory Search functionality requires anonymous binding to be enabled on the directory. If anonymous binding is not enabled you must use this account to perform the directory search. The search is performed whether using "User Paths" or the "Alternate User ID location."

Extensions\SyncManager\Syncs\%LDAP%:BindUserName
BIND User Password

Specifies LDAP "browse only" account user password.

LDAP Directory Search functionality requires anonymous binding to be enabled on the directory. If anonymous binding is not enabled, you must use this account to perform the directory search. The search is performed whether using "User Paths" or the "Alternate User ID location."

Extensions\SyncManager\Syncs\%LDAP%:BindUserPassword
Alternate user ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set UserLocation to:

empid=%user,ou=people,dc=computer

instead of to

uid=user,ou=people,dc=computer

For Novell eDirectory, the Alternate User ID location should be:
uid=%user,path to the object%

If you use UserLocation, do not use UserPrepend or UserPaths.

Extensions\SyncManager\Syncs\%LDAP%:UserLocation
Enable directory search for users

Enables or disables directory search for the user account. When the user account is not found in the given path, the extension will search for it from that location down the directory tree. The search is performed whether using "User Paths" or the "Alternate User ID location.

If you enable this setting and have moved a user to a different OU in the LDAP directory since the last synchronization, the user will receive a prompt for credentials at the next logon.

Extensions\SyncManager\Syncs\%LDAP%:LDAPBindSearch

Options:

  • No (default)
  • Yes
Extensions\SyncManager\Syncs\%LDAP%:LDAPBindSearch


Security Settings

The Security settings control the frequency with which end-users must re-enter their primary logon passwords, their access to view their application logon passwords, and the preferred encryption provider and strength.

Options
Store user data on disk in encrypted file

Specifies to store a copy of user data (for example, credentials) locally in an encrypted database file in each user's ApplicationData folder.

Options:

  • Yes (default)
  • No
Extensions\StorageManager\InMemShr:LocalStorage
Default encryption algorithm

Select the default encryption algorithm from the dropdown menu.

Non-MS CAPI algorithms have been deprecated and are listed for upgrade scenarios only. Do not select these algorithms.

Options:

  • Cobra 128-bit
  • Cobra 128-bit (also)
  • Blowfish 448-bit
  • Triple-DES 168-bit
  • AES 256-bit
  • Triple-DES (MS CAPI) (All OSs) (default)
  • Triple-DES (MS CAPI) (XP/2003 only)
  • RC-4 (MS CAPI) (All OSs)
  • RC-4 (MS CAPI) (XP/2003 only)
  • AES (MS CAPI) (XP/2003 only)
CSP:PreferredCSP
Reauthentication timer

Time (in milliseconds) between reauthentication requests.

If set to 4,294,967,295 (0xFFFFFFFF), the time will never expire and the user will never need to reauthenticate, except in forced authentication scenarios.

Default value for client-side installation is 900000 (15 minutes)

Default value for client-side installation is 900000 (15 minutes).

Default value in a Terminal Services environment is 4,294,967,295 (disabled).

Extensions\AccessManager:AutoLogin
Require reauthentication before updating account credentials

When enabled, forces the user to provide ESSO-LM credentials before updating any stored application credentials, even if the reauthentication timer has not yet expired.

Options:

  • Yes
  • No (default)
Extensions\AccessManager:RequireAuthCred

This setting is new as of ESSO-LM version 11.1.1.1.0.

Masked fields
Obfuscate length

Specifies whether to display encrypted fields with a string of blank characters different from the length of the obfuscated data.

Options:

  • Yes (default)
  • No
Extensions\AccessManager:HideMaskedFieldLength

This setting is new as of ESSO-LM version 11.1.1.1.0.

Allow revealing

Specifies whether the user is permitted to reveal masked fields.

Options:

  • Yes (default)
  • No
Extensions\AccessManager:AllowReveal
Require reauthentication to reveal

Specifies whether the user must enter ESSO-LM credentials in order to reveal masked fields, assuming that you have set "Allowed revealing" to "Yes.".

Options:

  • Yes (default)
  • No
Extensions\AccessManager:ReauthOnReveal


Custom Actions

The Custom Actions settings control the tasks (lists of commands) that should execute when specific Agent actions occur.

For each event, select the checkbox and click "…" to open the list dialog box for that event. Enter one command on each line; end each line by pressing Enter. Do not use any other delimiter characters. They run one at a time, sequentially.

ESSO-LM will not respond until all of the tasks complete.

After Agent starts

Command(s) that will run every time the background task starts (the Tray Icon appears).

Shell\Tasks:StartupTaskN

Before Agent starts

Command(s) that will run before any Agent process starts (any time a new instance of SSOShell is launched). Every background synchronization and every opening of ESSO-LM will execute this command before continuing.

The Agent will not continue if any of these tasks fails (as indicated by the resultant registry value located at License:PreCheck).
Shell\Tasks:PreTaskN

When logons are deleted

Command(s) that will run every time a user deletes an application configuration.

Shell\Tasks:DeletionTaskN

When logons change (add, delete, copy, modify)

Command(s) that will run every time a user modifies credentials and configurations.

Shell\Tasks:RefreshTaskN


Audit Logging

The Audit Logging settings let you specify the retry interval and size of the logging cache.

Cache limit

Maximum number of event log entries to be cached before discarding old events. Default is 200 entries.

Extensions\EventManager:CacheLimit

Retry interval

Interval (in minutes) between retries for all Event Logging extensions. Default is 30 minutes.

Extensions\EventManager:Retry


Configuring the Windows Event Logging Server

Windows Event Logging Extension

To configure a Microsoft Windows 2000 or XP server to receive Event Log messages:

  • Install the Agent on that server.

    or

  1. Copy SSOeventmessage.dll from an Agent installation to the server, preferably in the System32 directory.
  2. Create the following registry keys under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\v-GO SSO:
Name | EventMessageFile
Type | STRING
Value | Full path to the file SSOeventmessage.dll, including filename (recommended: %WinDir%\System32\SSOeventmessage.dll)
Name | TypesSupported
Type | DWORD
Value | 7
Name | CategoryMessageFile
Type | STRING
Value | Full path to the file SSOeventmessage.dll, including filename (recommended: %WinDir%\System32\SSOeventmessage.dll)
Name | CategoryCount
Type | DWORD
Value | 4


Reporting Server

The Reporting tool allows you to generate reports on user activities. Refer to the ESSO-LM Reporting documentation for complete information on using this tool.

Database
Connection string

Database connection string in the OLE DB format:

"Provider=sqloledb; Data Source=myServerName; Initial Catalog=myDatabaseName; User Id=myUsername; Password=myPassword".

Reporting\Extensions\Database:ConnectionString
Stored procedure

The name of the stored procedure used to populate the database with events. When encoded events are sent to the database, the stored procedure is called to decode the XML file and store the events in the database. (Default is dbo.sp_WriteEvents)

Reporting\Extensions\Database:StoredProcedure
Options
Batch size

Defines the group size of events to be sent to the database Stored Procedure at one time. For example, if you have 1000 events in the Reporting Service cache and the Batch Size = 100, you will have 10 database Stored Procedure calls. (Default is 100.)

Location: Reporting:BatchSize
Cache limit

Maximum number of reporting events to be cached. Once this number is reached, the oldest events are discarded. For example, if the batch size is 100, and an end-user's system cannot connect to the reporting service, it will keep logging events. Once it gets to 1000, the oldest events will be discarded. (Default is 1000.)

Reporting:CacheLimit
Retry interval

Defines timeout in minutes between sequential operations of the Reporting Service Cache offloading events to the database. An interval is necessary to reduce database connection load. (Default is 30.)

Reporting:RetryInterval


Windows Event Viewer

The Windows Event Viewer settings enable event logging on a remote server. Specify which events should be logged. You can also change the default path to the Windows Event logging extension and Windows event message components, and you can modify the retry interval of the logging cache.

Windows event logging server

Server name for the Windows Event Logging extension (do not provide leading "\\" characters). If you do not specify a server, logging is performed on the local workstation.

The server should have a trusted relationship with the user's account and the user's workstation, depending on access rights and restrictions.

Extensions\EventManager\WindowsEvent:EventServer

Retry interval

Interval (in minutes) between retries for Windows Event Logging. (Default is 30 minutes.)

Extensions\EventManager\WindowsEvent:Retry

Events to log

Check the box and click "…" to open the "Events to log" window, which presents a checklist of events for you to select.

Extensions\EventManager\WindowsEvent:Filter


Syslog Server

The Syslog settings control how the Agent records program events.

Destination host

Specifies the hostname to send messages to. Either a hostname or dotted IP v4 address can be used. Use 0.0.0.0 to disable sending to Syslog-Daemon, or use 255.255.255.255 to send to any daemon that is set up to receive broadcast messages. It must be on your local network as broadcast does not reach beyond a router. Default is localhost.

Extensions\EventManager\Syslog:RemoteAddress

Destination port

Specifies the destination port for syslog messages using a number. Default port is 1468.

Extensions\EventManager\Syslog:RemotePort

Protocol for sending messages

Specify whether to send messages via TCP or UDP protocol. Note that the UDP protocol is connectionless, so it is impossible to tell whether the Syslog Daemon is reachable at the specified hostname and port.

If the UseTCP parameter is set to "Use UDP," the Syslog Extension returns S_OK on both success and failure. If it is necessary to make the Syslog Extension return the correct state, enable TCP in the Syslog Daemon and set this parameter to "Use TCP."

Options:

  • Use TCP (default)
  • Use UDP
Extensions\EventManager\Syslog:UseTCP

Retry interval

Specifies the interval (in minutes) between retries for the Syslog extension. Default is 30 minutes.

Extensions\EventManager\Syslog:Retry

Events to log

Event Logging filter delineating which events (of those logged by the root Filter setting) to log to the Syslog extension. Click the "…" button to see a list of events to log.

Extensions\EventManager\Syslog:Filter


XML File Event Logging

The XML File Event Logging settings let you specify which events should be logged locally. You can also change the default path to the local logging extension, and you can modify the retry interval of the logging cache.

Retry interval

Interval (in minutes) between retries for Local (XML) File Logging extension. Default is 30 minutes.

Extensions\EventManager\LocalStorage:Retry

Events to log

Event Logging filter delineating which events (of those logged by the root Filter setting) to log to the Local (XML) File Logging extension. Click the "…" button to see a list of events to log.

Extensions\EventManager\LocalStorage:Filter


Database Event Logging

Use the Database Event Logging menu to specify the server instance and table name where you want to send log data, as well as the fields to write to the database.

In addition to the fields, users must specify the server instance and table name. These are previously defined in the Database Setting and should not be required for Database Fields. If the database and table name are not specified for each field, events will not be written to the database.

The XML File Event Logging settings let you specify which events should be logged locally. You can also change the default path to the local logging extension, and you can modify the retry interval of the logging cache.

Servers

Click the ellipsis ("…") button to open a window in which to enter Database servers. Enter one server name per line, using the OLE DB format "Provider=sqloledb; Data Source=myServerName; Initial Catalog=myDatabaseName; User Id=myUsername; Password=myPassword".

Extensions\EventManager\Database\Servers:ServerN
Default server

If no other server is specified, the server to which the database log will be written. (OLE DB connection string) Default is Server1.

Extensions\EventManager\Database:Default Server
Default table

If no other table is specified, the table to which the database log will be written.

Extensions\EventManager\Database:Default Table
Retry interval

Interval (in minutes) between retries for Database extension. The default is 30.

Extensions\EventManager\Database:Retry
Events to log

Event Logging filter delineating which events (of those logged by the root Filter setting) to log to the Database extension. Click "…" to see a list of events to log.

Extensions\EventManager\Database:Filter

You must specify the database instance and table name in the Database Fields in order for events to be written to the database.


Event Fields

The Event Fields screen lists the data assigned to each field in the event log. The fields are mapped to the log information as specified in the table below.

You can select which events to include in your log by checking the box next to the desired field(s). Fields 9 and 10 have no pre-assignment. Assign categories to these fields by checking their boxes and entering the name of the desired field next to the check box. Refer to the "Events to log" list on the Database screen for the available event names.

AppName

The name of the application of the event log.

Extensions\EventManager\Database\EventFields:AppName
Category

The category of the event.

Extensions\EventManager\Database\EventFields:Category
Type

The specific type of event.

Extensions\EventManager\Database\EventFields:Type
TimeStamp

The time of the event.

Extensions\EventManager\Database\EventFields:TimeStamp
Field1

EventType

Extensions\EventManager\Database\EventFields:Field1
Field2

UserID

Extensions\EventManager\Database\EventFields:Field2
Field3

ThirdField

Extensions\EventManager\Database\EventFields:Field3
Field4

FourthField

Extensions\EventManager\Database\EventFields:Field4
Field5

WindowsUser

Extensions\EventManager\Database\EventFields:Field5
Field6

Domain

Extensions\EventManager\Database\EventFields:Field6
Field7

ComputerName

Extensions\EventManager\Database\EventFields:Field7
Field8

SSOSyncUser

Extensions\EventManager\Database\EventFields:Field8
Field9

Open

Extensions\EventManager\Database\EventFields:Field9
Field10

Open

Extensions\EventManager\Database\EventFields:Field10


Kiosk Manager

Use the Kiosk Manager settings to configure sessions in a kiosk environment.

Session termination
Allow administrator to close Kiosk Manager

Specifies whether an administrator has the ability to close Kiosk Manager.

With this setting enabled, the administrator is prompted to enter credentials. Only a user with administrator credentials can close the Agent.

Options:

  • Yes (default)
  • No
SM\Agent:AdministrativeClose

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Number of times to process termination

Enter the number of times that Kiosk Manager should process the termination of an application. This setting instructs the termination process to loop a certain number of times or until it is done (whichever comes first). This allows Kiosk Manager to react to an application if it displays multiple screens during the termination process. (Default is 1.)

SM\Agent:TerminationIteration
Timeout for locked session

Enter the amount of time (in seconds) of inactivity after which Kiosk Manager should close a session. (Default is 600.)

SM\Agent:ExpireTerm
Multisession Configuration
Maximum number of sessions

Specifies the maximum number of sessions allowed at one time.

A setting of zero will be interpreted as one session. (Default is 1.)

There is no maximum number for this setting.

SM\Agent:MaxSessions
Track memory consumption

Specifies the level of memory usage at which Kiosk Manager should automatically close sessions. When system memory use has reached the percentage as set by this value, Kiosk Managerautomatically closes the oldest user sessions.

Minimum = 0 (disabled)

Maximum = 100

Default is 90.

SM\Agent:TrackMemoryConsumption

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Cached credentials
Use cached credentials

Specifies whether cached credentials should be used. If cached credentials are enabled, users logging into Kiosk Manager are presented with a list of cached users to choose from. If cached credentials are disabled, the list is not displayed and users enter their user name into the text entry user field. Enabling cached credentials improves performance.

Options:

  • No (default)
  • Yes
SM\Agent:UseCachedCredentials
Storage path

The default folder to store the cached credentials. Default is an empty string. If this value is empty, the default folder will be C:\Documents and Settings\<Kiosk User>\Local Settings\ Application Data\ Passlogix\ SessionData\ Kiosk Manager User.

SM\Agent:CachedCredentialsStoragePath
Expiration date

Specifies the number of days for which cached credentials should be kept. Zero indicates that this feature is disabled. (Default is 30.)

SM\Agent:CachedCredentialExpiration
Strong authentication options

Lock session on smart card removal

Specifies whether Kiosk Manager will lock a session when the session owner removes the smart card from the smart card reader. By default, this value is set to lock. If set to not lock, the session remains open when the smart card is removed. This setting is useful in a scenario where employees must have their smart cards displayed at all times, and therefore cannot leave them in a reader.

Options:

  • Yes (default)
  • No
AUI\SCauth:LockSMOnRemoval
Lock session on read-only smart card removal

Specifies whether Kiosk Manager will lock a session when the session owner removes the read-only smart card from the smart card reader. By default, this value is set to lock. If set not to lock, the Kiosk Manager session will remain open when the read-only smart card is removed. This setting is useful in a scenario where employees must have their read-only smart cards displayed at all times, and therefore cannot leave them in a reader.

Options:

  • Yes (default)
  • No
AUI\ROSCauth:LockSMOnRemoval
Pre-populate on startup

Specifies whether to run a pre-populate step at startup. If an authenticator requires this step and Authentication Manager is not installed, this setting enables Kiosk Manager to perform the required pre-population, eliminating the need for the synchronization manager to reauthenticate.

Options:

  • Always
  • Never
  • On device-in event (default)
SM\Agent:Prepopulate
Audit logging
Event log name

Enter the name of the Windows event log where Kiosk Manager events should be logged.

SM\Agent:EventLogName
Event log machine name

Enter the name of the local machine where Kiosk Manager events should be logged.

SM\Agent:EventLogMachine


Kiosk Manager User Interface

The User Interface settings control the appearance and interaction of Kiosk Manager with end-users.

Options
Allow computer restart

Specifies whether the restart computer option is enabled in the Kiosk Manager Desktop Manager. You can also choose to allow only an administrator to have privileges to restart the computer by selecting Administrator must supply password.

Even if this setting is enabled, the option may still be disabled if the Kiosk account does not have sufficient privileges.

Options:

  • Yes
  • No (default)
  • Administrator must supply password
SM\Agent:AllowRestart
Allow computer shutdown

Specifies whether the shutdown computer option is enabled in the Kiosk Manager Desktop Manager. You can also choose to allow only an administrator to have privileges to shut down the computer by selecting Administrator must supply password.

Even if this setting is enabled, the option may still be disabled if the Kiosk account does not have sufficient privileges.

Options:

  • Yes
  • No (default)
  • Administrator must supply password
SM\Agent:AllowShutdown
Show confirmation message when restarting kiosk

Specifies whether a user should be prompted with a confirmation message after choosing to restart the kiosk.

Options:

  • Yes
  • No (default)
SM\Agent:ConfirmRestart
Show confirmation message when shutting down kiosk

Specifies whether a user should be prompted with a confirmation message after choosing to shut down the kiosk.

Options:

  • Yes
  • No (default)
SM\Agent:ConfirmShutdown
Lock session when screen saver times out

Specifies whether Kiosk Manager should lock a session when the screen saver timeout occurs.

Options:

  • Yes
  • No (default)

If this value is set to "No" or does not exist (default value), Kiosk Manager will not lock the session after the screen saver timeout occurs if device detection is used to control the session.

If this value is set to "Yes," Kiosk Manager will lock the session.

SM\Agent:LockOnScreenSaver
Timeout for authentication prompt

Enter the amount of time (in seconds) of inactivity after which Kiosk Manager should close a synchronization or authentication dialog box. (Default is 600.)

SM\Agent:AuthTerm
Status window
Show desktop status window

The status window displays during a Kiosk Manager session. It displays the current session owner's name and contains a Lock Session button, which allows users to lock a session conveniently, with one click from the desktop.

Options:

  • Yes
  • No (default)
SM\Agent:DisplayDesktopStatus

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
X coordinate

The X coordinate for the status window. This is the horizontal location of the status window on the desktop. (Default is 0.)

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

SM\Agent:DesktopStatusX

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Y coordinate

The Y coordinate for the status window. This is the vertical location of the status window on the desktop. (Default is 0.)

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

SM\Agent:DesktopStatusY

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Transparent screen lock
Use transparent lock

Specifies whether to enable the transparent screen lock feature. Transparent screen lock provides the ability to lock the desktop inputs (keyboard and mouse) in view mode; so for example, a monitoring application can be viewed without starting a session.

When there are multiple sessions running, the last active session is displayed when transparent screen lock engages.

Options:

  • Yes
  • Yes, but only for active session
  • No (default)

If the setting is set to "Yes," the transparent screen lock will only be enabled with or without an active session.

SM\Agent:TransparentLock

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Delay period

Specifies the number of seconds to wait for mouse and keyboard inactivity before showing the desktop. (The default is 5.)

The Transparent Lock setting above must be turned on in order for this feature to work.

SM\Agent:TransparentLockTime

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Ignore delay period if authentication is canceled

Specifies whether transparency should take effect immediately when an authenticator or synchronizer dialog box is canceled.

Options:

  • Yes. The desktop will be viewable instantly.
  • No. The desktop will be

The Transparent Lock setting above must be turned on in order for this feature to work.

SM\Agent:TransparentDisplayAfterCancel

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Only Recognize Ctrl-Alt-Del

This setting determines whether clicking Ctrl+Alt+Delete is the only method to turn off the transparent screen lock and display the Desktop Manager.

Options:

  • Yes. All keyboard and mouse activity will be ignored. Only Ctrl-Alt-Del and authenticators that support "device-in" will be recognized to display the Desktop Manager.
  • No. Any keyboard or mouse activity results in displaying the Desktop Manager. (default)
SM\Agent:TransparentOnlyRecognizeCAD

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.


Setting the Kiosk Manager Background Image

Use this panel to place a background image on the Kiosk Manager Desktop Manager.

Location of image file

Fully-qualified path, including the filename, to the image file. Click the ellipsis "…" to locate the file.

SM\Agent\Desktop:LogoPath
X coordinate

The X coordinate for the image.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

SM\Agent\Desktop:LogoX
Y coordinate

The Y coordinate for the image.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

SM\Agent\Desktop:LogoY
Width

The width of the image (in pixels). Default is 300.

SM\Agent\Desktop:LogoWidth
Height

The height of the image (in pixels). Default is 300.

SM\Agent\Desktop:LogoHeight
Placement behavior

The placement of the logo image.

Options:

  • Normal. Image is placed in upper left corner of coordinates and clipped if larger than specified height and width. (default)
  • Autosize. Image is placed in upper left corner of coordinates.
  • Center. Image is centered within coordinates and clipped if larger than specified height and width.
  • Stretch. Image is stretched or shrunk to fit within specified coordinates.
  • Maximize. Image is stretched to full screen size.
SM\Agent\Desktop:LogoMode


Adding a Customized Message to the Kiosk Manager Desktop

Use this panel to upload a message around the Kiosk Manager Desktop Manager, for example, a HIPAA compliance reminder. This message will be displayed when the Desktop Manager is active.

Some relevant sizes:

Desktop Manager Logon Window Size

Width = 476 Pixels

Height = 404 Pixels

Desktop Manager Logon Window Origin

XOrigin = (ScreenWidth – 476)/2

YOrigin = (ScreenHeight – 404)/2

Desktop Manager Logon Window Extent (Lower right corner)

XExtent= XOrigin+476-1

YExtent= YOrigin+404-1

Example on an 800x600 display:

Desktop Manager Logon Window is:

Width: 476 Pixels x Height: 404 Pixels.

On an 800x600 display, this appears at coordinates 161, 97.

Message
Message text

Message text to provide on the Kiosk Manager Desktop Manager. This message will be displayed when the Desktop Manager is active.

SM\Agent\Desktop:MOTDText
Font
Name

The font that the text message will display in. Select a font from the drop-down list.

SM\Agent\Desktop:MOTDFontName

*This setting is new as of version 10.1.4.1.0.
Size

The font size the text message will display in. Default is 0.

SM\Agent\Desktop:MOTDFontSize

*This setting is new as of version 10.1.4.1.0.

Style

The font style the text message will display in.

Options:

  • Regular (default)
  • Bold
  • Italic
SM\Agent\Desktop:MOTDFontStyle

*This setting is new as of version 10.1.4.1.0.

Color

Background

Click the ellipsis "…" button to select the background color for the text message.

SM\Agent\Desktop:MOTDBackColor

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Foreground

Click the ellipsis "…" button to select the foreground color for the text message.

SM\Agent\Desktop:MOTDForeColor

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.
Placement
X coordinate

The X coordinate for the text message. This is positioned relative to the Status image on the Kiosk Manager Desktop screen. If this value is negative, the message will appear to the left of the Status image.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

SM\Agent\Desktop:MOTDX
Y coordinate

The Y coordinate for the text message. This is positioned relative to the Status image on the Session Manager Desktop screen. If this value is negative, the message will appear above the Status image.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

SM\Agent\Desktop:MOTDY
Width

The width of the text message (in pixels). Default is 300.

SM\Agent\Desktop:MOTDWidth
Height

The height of the text message (in pixels). Default is 300.

SM\Agent\Desktop:MOTDHeight
Size automatically

Select whether to size the text automatically based on the size of the message.

Options:

  • Yes
  • No (default)
SM\Agent\Desktop:MOTDAutoSize

This setting is new as of ESSO-LM version 7.0.10.1.4.1.0.


Repository

Displays and provides connection to a synchronization repository.

  • Click Repository in the left pane to display the current ESSO-LM synchronization repository.

Or, if no connection is active:

  • Right-click Repository in the left pane and choose Connect to… from the shortcut menu.

Repository Actions and Options

Right-click an object in the Repository window in the right pane to display a shortcut menu of commands and options.

With a Container Selected

Publish SSO Objects Here | Opens the “Publish to Repository” dialog box, which allows you to publish configuration objects, such as application templates and Agent setting overrides to the repository. This setting is new as of ESSO-LM version 11.1.1.1.0.
Bring Multiple Objects to Console | Displays a list that allows you to select multiple configuration objects that you wish to import into the current ESSO-LM Administrative Console settings. This setting is new as of ESSO-LM version 11.1.1.1.0.
Add Locator Object | Create locator objects (directory servers only).
Create People Container | Creates the ou=People container used for application credential storage on directory systems other than Microsoft Active Directory. This setting is new as of ESSO-LM version 11.1.1.1.0.
New Container | Create a new container within the selected container.
Delete | Remove a container and all objects within.
Refresh | Update the Directory window.
Filter Subnodes… | Opens the "Subnodes Filtering Options" dialog box, which allows you to refine the criteria that the ESSO-LM Administrative Console uses to display the subnodes of the repository.

With an Override Object Selected

Configure

Create Administrative Override objects from ESSO-LM Administrative Console settings or a data file.

View

Quickly view the selected object, with an option to save it to an INI file.

Bring to Console

Import the object to the current ESSO-LM Administrative Console settings.

  • If the imported file contains items (applications, policies, groups) with same names as those in current configuration, the Import/Merge Conflict dialog box appears.
  • If the imported file contains a set Global Agent Settings with the same name as an existing set in the current configuration, the imported set is named "Copy of existing settings."

Save as File

Save the object to a local INI file.

Delete

Remove the object from the repository.


Add Container

●Using the Console > Repository > Add Container

New Container

Use this prompt to name a new container object at the selected node in the current repository.

To name a new container:

  • Type a container name, then click OK.

See Repository for more information.


Bring Multiple Objects to Console

Select Objects to Bring to the ESSO-LM Administrative Console

This dialog box displays, in a flat list, all objects residing in the selected container and all of its child containers, and allows you to select multiple objects for import to the current ESSO-LM Administrative Console settings.

To select multiple objects from the list and bring them to the ESSO-LM Administrative Console:

  • Ctrl+click each desired object.

    or

  1. Shift+click the first and last objects in the desired range.
  2. Click OK.


Browse for Repository

This dialog box allows you to navigate to a specific target repository container within the currently connected directory server’s hierarchy. It also allows you to connect to a different server, if necessary.

To select the target repository container:

  1. (Optional) If the directory server to which the ESSO-LM Administrative Console is currently connected is not the desired target server, click Change Server, fill in the connection information, and click OK to connect to the desired server.
  2. In the directory tree, navigate to and select the target container.

  3. Click OK.

This setting has changed as of ESSO-LM version 11.1.1.1.0.


Connect to Repository

●Using the Console > Repository > Connect to Repository

Connecting to the Repository

Connects the ESSO-LM Administrative Console to a synchronization repository.

Connecting to a Synchronization Repository

  1. Right-click Repository and select Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.

Connection Controls

SyncPath or Server Name

  • If you selected a directory service for Repository Type, enter or select a server name ().

    or

  • If you selected a database for Repository Type, enter or select an instance name (for Oracle), or the server and instance names separated by a backslash (for SQL Server).

    or

  • If you selected File Service for Repository Type, enter or select the path to the synchronization folder.

Select Edit List to remove directories/servers from the drop-down list.

For SQL Server, if the database server is the only instance on the computer you're connecting to, then type just the computer name. If there is more than one database server instance on the target computer, then enter the full connection address (computerName\dbServerName).

You must specify a file system server as a UNC path, not as a drive-letter and directory path. For example: \\ServerName\ShareName not D:\ShareName

Repository Type

Select File System Sync, a directory service, or a database server from the drop-down list.

If you select OpenLDAP Directory Server, and an Extend Schema Status error appears, extend the schema manually.

Port | (Directory server only) Enter the port number .
Database | (Database server only) The name of the database to connect to; enter the name of an existing database (default vGOSSO).
Use secure channel (SSL) | Select to enable secure socket layer (directory server only).
User ID | Enter your username.
Password | Enter your password.


Subnodes Filtering Options

The subnodes filtering settings control the number of items that display in repository trees. Using filtering, you can refine the criteria that the ESSO-LM Administrative Console uses to display the subnodes of these trees, so that they display more manageable results.

You can limit displayed subnodes in two ways:

  • Filter list. Uses the asterisk (*) and question mark (?) wildcards.

    The wildcard filter is node-specific. You can use a different wildcard for each node that you want to filter. The wildcard filter is discarded when you switch repository nodes and expires at the end of the ESSO-LM Administrative Console session.

  • Truncate list. Limits the number of nodes to display.

    Specify a threshold for the maximum number of child nodes to display in a tree. This number governs all repository nodes and remains in effect between ESSO-LM Administrative Console sessions. The minimum value is 1; the maximum value is 65,535; and the default value is 1,000. This means that the ESSO-LM Administrative Console will display no more than 1,000 entries in a subnode unless you configure it differently.

    If you enter a value less than the minimum or greater than the maximum allowable values, ESSO-LM Administrative Console uses whichever limit is closer.

To filter a subnode:

  1. Connect to a Repository.
  2. Right-click on a node in the repository and select Filter Subnodes ….
  3. In the "Subnodes Filtering Options" dialog box, do either or both of the following:
    • In the Filter List field, enter a wildcard expression.
    • In the Truncate list field, select the maximum number of nodes to display. The maximum number that you can specify is 65,535. The default is 1,000.
  4. Click OK.
  5. Expand the subnode to view the results.

Working with Filtered Subnodes

The icon of a filtered subnode contains an "F" next to its standard icon to indicate a filtered state:

Icon Type | Unflitered State | Filtered State
Program |  |
Server |  |
Folder |  |
User |  |

If you choose to expand a node containing a number of subnodes greater than the threshold that you set in the "Truncate list" setting, the "Subnodes Filtering Options" dialog box appears, displaying the following:

Warning: The number of items to be displayed is XXXX (the number you specified), which exceeds the limit defined below.

Click OK to expand the subnode using the limit that you previously set, or change the maximum number of nodes to accommodate the list, and then click OK.If you did not set a threshold for this subnode, the ESSO-LM Administrative Console uses the system default of 1,000.

This feature is new as of ESSO-LM version 11.1.1.5.0.


Edit Repository List

Select Objects to Bring to the ESSO-LM Administrative Console

This dialog box displays the list of most recently used target repositories and allows you to delete unwanted entries from the list.

To delete an unwanted entry from the list:

  1. Select the entry in the list.
  2. Click Delete.
  3. Repeat steps 1-2 for any other unwanted list entries.
  4. When you have finished, click OK.

This setting has changed as of ESSO-LM version 11.1.1.1.0.


Publish to Repository

This screen allows you to publish configuration objects of your choice to the selected target container, either in a directory-style hierarchy (default), or as a flat configuration file.

For considerations when publishing an Exclusion list, refer to Using Exclusions.

To select and publish the desired objects to the repository:

  1. Do one of the following:

    • From the tree, right-click on the configuration object that you want to publish, and select Publish or Publish To….

    or

    • Select a configuration object from the tree and select Tools>Publish to Repository.

  2. In the Available configuration objects list of the Publish to Repository screen, navigate to and select the desired objects.

    Only categories for which objects have been configured will appear in this list. For example, if no password generation policies exist, the corresponding category will not appear in this list.
  3. Click >> to move the selected objects to the Selected objects to be published list. (To remove an object from this list and not publish it, select the object and click <<.)
  4. (Optional) If you did not invoke the Publish SSO Objects Here command by right-clicking on the target container, select the desired container from the Target repository drop-down list.

If the target container path does not appear in the list, click Browse to find and select the desired container.

To remove unwanted entries from this list, select the Edit list option from the list.
  5. (Optional) If your environment calls for storing configuration objects in flat-format, select the check box Store selected items in configuration files, rather than as individual objects.
Selecting this option will overwrite all items stored in existing configuration files, if present, in the target container.
  6. (Optional) If you want to create the first-time-use object (FTUList), select the corresponding check box.
This option only becomes active if you choose to store your configuration objects in flat format in step 4.
  7. Click Publish. The ESSO-LM Administrative Console publishes the selected objects to the target repository.
Do not attempt to dismiss the dialog or close the ESSO-LM Administrative Console until the publishing process completes. The dialog disappears automatically when the objects have been published.

To quickly publish an object or a group of objects, select it in the left-hand tree, right-click it, and select Publish (single objects and groups) or Publish To (single objects only) from the context-menu.

This will invoke the "Publish to Repository" dialog and automatically add the object(s) to the list of objects to be published. Keep in mind that:

  • If you select the Publish option, the "Publish to Repository" dialog appears.
  • If you select the Publish To option and select a repository, the selected object is automatically published to that repository and the "Publish to Repository" dialog is not displayed. (If you are not currently connected to the selected repository, you will be prompted to authenticate to the directory server.)

This setting has changed as of ESSO-LM version 11.1.1.1.0.


Publishing to the Repository from the Administrative Console

●Using the Console > Repository > Publishing to the Repository > Publishing to the Repository from the Administrative Console

Publishing to the Repository from the ESSO-LM Administrative Console

Use this window to export an Agent configuration to a selected synchronizer container using the current ESSO-LM Administrative Console settings as the source. You can export:

  • One or more application logons
  • A first-time use (bulk-add) object.
  • A set of Global Agent Settings.

Exporting Administrative Overrides from the ESSO-LM Administrative Console

  1. Do one of the following:

    • Select Send All Applications.

      or

    1. Select Send Some Applications, then:

    2. Click Select Apps.

      or

    1. From the Select Applications dialog box, select the applications to send, and click OK.
    2. Choose Send No Apps.
  2. Optionally, select Create First-Time-Use (FTUList) object.
  3. Optionally, choose a set of Global Agent Settings from the Admin Overrides drop-down list box.
  4. Select Next. The wizard displays a summary of the Override configuration.
  5. Select Finish to complete the export.


Publishing to the Repository from a Data File

Use this window to export an Agent configuration to a selected synchronizer container using one or more data files as the source. You can export:

  • One or more application logons
  • A first-time use (bulk-add) object
  • A set Global Agent Settings (from an .ini or .reg file)

Exporting Administrative Overrides from Data Files

  1. Enter the file names (or select Browse to select a data file) as the source for each administrative override object you want to export: You can export:

    • First-Time Use (from an ftulist.ini file).

    • Administrative overrides (from a valid INI or REG file).
    • Applications (from an entlist.ini file).
  2. Click Next. The wizard displays a summary of the override configuration.
  3. Click Finish to complete the export.


Publishing Administrative Overrides to the Repository

●Using the Console > Repository > Publishing to the Repository > Publishing Administrative Overrides to the Repository

Configuring ESSO-LM Support

Use the Publish to Repository window to deploy administrative overrides and application configurations to end users using file-system, database, or directory service synchronizers. The objects you can export include:

  • One or more application logons
  • A first-time use (bulk-add) object
  • A set of Global Agent Settings.

The Publish to Repository window helps you export the overrides, from current ESSO-LM Administrative Console settings or from one or more data files, to a selected synchronizer container object.

See Synchronization for more information.

Exporting Administrative Overrides to a Synchronizer Container

  1. Connect to the ESSO-LM synchronizer repository.
  2. In the right pane, right-click a container object and select Publish to Repository from the shortcut menu to open the window.
  3. Choose the Data Source of the administrative overrides and provide the information requested:
    • Administrative Console
    • Data File


Select Applications, Password Policies, and Session Lists to Publish to Repository

Use the Publish to Repository window to select application logons, password policies, and Kiosk Manager lists from the current ESSO-LM Administrative Console session to deploy to the current synchronization repository. You can choose all applications and policies, select applications and policies individually, or remove items from either list. When your selection is complete, select Next to continue.

Lists
Applications | Lists the application logon configurations to be deployed.
Password Generation Policies | Lists the password policies to be deployed.
Kiosk Manager Application List | Lists the Kiosk Manager applications lists to be deployed.
Controls
Applications | Lists the application logon configurations to be deployed.
Password Generation Policies | Lists the password policies to be deployed.
Kiosk Manager Application List | Lists the Kiosk Manager applications lists to be deployed.


Select Global Agent Settings to Publish to Repository

Use the Publish to Repository window to select a set of global Agent settings from the current ESSO-LM Administrative Console session to deploy to the current ESSO-LM synchronization repository.

  1. From the list, select a set of Global Agent Settings.
  2. Select Next to continue.


Including Passphrase Questions to Publish to the Repository

Use the Publish to Repository window to deploy the passphrase questions from the current ESSO-LM Administrative Console session to the current synchronization repository. See Passphrase Questions for more information.

Send the Passphrase questions Select this checkbox to deploy the current set of passphrase questions. Select Next to continue.


Publish to Repository Summary Page

●Using the Console > Repository > Publishing to the Repository > Publish to Repository Summary Page

"Publish to Repository" Summary Page

Use this page to review the configuration. To make changes, use the Back and Next buttons to display a page. When your configuration is complete, select Finish.


Configuring Applications for an EntList

Use the "Configure Applications" dialog box to select the application logons to include in an EntList object for synchronization.

  1. Do one of the following:

    • Choose Send All Applications.

      or

    • Choose Send Some Applications.

      Either of these options overwrites all applications in the selected directory. To create a First-Time-Use list object without overwriting applications in the directory, select Do not send apps.
  2. Click Select Apps.
  3. In the Select Applications dialog box, select the applications to package and click OK.
  4. If desired, select Create First-Time-Use (FTUList) object.
  5. Click OK.


Edit Server List

Use this dialog box to remove servers that are listed in the Server Name drop-down box on the Connect to Repository dialog box.

  • Select a server and click Delete. Click OK when finished.


OpenLDAP Manual Schema Extension

In the Connect to Repository dialog box, if OpenLDAP Directory Server is selected as the Repository Type and an Extend Schema Status error appears, the schema will have to be manually extended.

The Error message appears as follows:

============= ERROR =============
Automated schema extention is not supported by this server. Use the file located at "C:\Program Files\Passlogix\v-GO SSO Console\DirectorySchema\vgo\OLDAP\sso.schema" to extend the schema manually.
Extend Schema ABORTED!

If you receive this error, follow these steps to extend the schema manually:

  1. Copy the sso.schema file to the OpenLDAP server. The sso.schema file can be located in the following location:
    C:\Program Files\Passlogix\v-GO SSO Console\DirectorySchema\vgo\OLDAP\sso.schema
  2. Place the sso.schema file in the following directory (or other schema directory for OpenLDAP configuration):
    /usr/local/etc/openldap/schema
  3. The OpenLDAP configuration file must be modified to include the new schema file. Open the file, and add the following line:
    include <path>/sso.schema
    where <path> is the path specified in the previous step.

On UNIX machines, this file is called slapd.conf.


Add Locator Object

Use the Add Locator Object dialog box to create a locator, a directory object that points the Agent to the container in which user credentials are (or can be) stored. You can create a default locator for all end users or a locator for a specific end user.

See Directory Servers: Create Locator Objects for more information.

Controls

Locator Name | Enter default to create a locator for all users. To create a locator for a specific end user, type the user's distinguished name.
Forwarding Location | Navigate to the container where user credentials are stored. and click OK.
Store data under the user objects (AD only)

(Active Directory only) Select this checkbox to store the user's credentials (or all users if Locator Name is "default") in the container under the respective user object, rather than in a specific Forwarding Location.

This setting requires updating the directory schema and modifying the directory-root security settings. To do this, use the Enable Storing Credentials under User Object command on the Repository menu.

You can use this setting to specify individual users whose credentials are to be stored under their respective User objects. All other user credentials will be stored as specified by the default locator.

To store all users' credentials under their respective user objects without using a locator object, use the Location for storing user credentials setting (under Synchronization\Selected Active Directory sync\Advanced).


View Configuration Object

●Using the Console > Repository > View Configuration Object

View Object

Use this dialog box to view the contents of the selected configuration object. To save the object to an INI (text) file, click Save To. See Repository for more information.

You can edit the displayed configuration information, but your changes can only be saved to an INI file, not to the object itself.


●Table of Contents

ESSO-LM Administrative Console Reference Topics

Global Agent Settings

Setting Registry Settings and Admin Overrides

Overriding Settings

Configuring Host Emulators

Telnet Support

Attachmate EXTRA!

BlueZone Web-to-Host

BOSaNOVA

Ericom PowerTerm

G&R Glink

Hummingbird HostExplorer

IBM Client Access

IBM Client Access Express

IBM Host On-Demand

In Microsoft Internet Explorer

In Host On-Demand

IBM Personal Communications

Jolly Giant QWS3270 PLUS

NetManage Rumba

Net Soft NS Elite

Newhart Systems BLUES 2000

Novell LAN Workplace

PuTTY

Scanpak Aviva for Desktops

Seagull Bluezone

WRQ Reflection

Zephyr PC to Host

Zephyr Web to Host

Configuring SAP

Command-Line Options

Configuring the Windows Event Logging Server

Windows Event Logging extension

Directory Server Schema Definition

vGOSecret

vGOUserData Object

vGOConfig Object

vGOLocatorClass

entlist.ini Keys

Root Keys

Application Type Section Keys

Windows Application Keys

Windows Application Keys for SectionN subsection

Windows Application Keys for MatchN subsection

Host/Mainframe Application Keys

Host Application Keys for PageN subsection

Web Application Keys

Web Application Keys for SectionN subsection

Password Policy Keys

Error Loop

ftulist.ini Keys

Root Keys

Password Windows Section Keys

My Logons Section Keys

Bulk Add Logon Section Keys

MSI Package Contents

Pre-configured Applications and Templates

Troubleshooting

Installation

Authenticators

Synchronizer Extensions

Uninstall

Agent Performance

Application Response

Authentication

Initial Authentication

Reauthentication

Application Configuration

All Applications

Windows Applications

Web Applications

Host Applications

Credential Sharing Groups

Synchronizer Extensions

Directory Extensions

File System Server

Event Logging


Application Compatibility Considerations

While Oracle officially tests and supports only the applications for which we provide templates, we have an exceptionally high success rate enabling the vast majority of business and productivity applications for Windows, the Web, Java applications and mainframe/AS400 emulators. Our support team will assist you in configuring any application template unless or until we determine that the application as it exists is incompatible with ESSO-LM.

The following table identifies characteristics of applications for which ESSO-LM is known to have support issues:

High Risk | Medium Risk
Application characteristics that generally hinder successful application template configuration | Application characteristics that often result in incomplete SSO functionality or require an action on the part of the end-user to complete the sign-on or password change
  • XWindows
  • Flash applications
  • Outdated Java (earlier than 1.3.1)
  • Non-HLLAPI emulators
  • Emulator applications that already use HLLAPI, when used in conjunction with emulators that allow only one application to connect to HLLAPI
  • DOS GUI applications and DOS applications not run in CMD
  • Web Applications that:
    • Require SendKeys

    • Require a delay.

      ESSO-LM does not inject credentials until it sees that the page has fully loaded. With some Web sites, the page appears to be fully loaded from the perspective of the browser, but fields are not yet ready for credential injection.

  • Applications that require matching to fix an issue (for example, logon looping, ignore, password change, etc.), but unique criteria is not available for matching.
  • Applications hosted on Terminal Server or Citrix, if ESSO-LM cannot be installed on the Terminal Server or Citrix box.
  • Applications where the OK Button is missing and ENTER is not accepted. ESSO-LM cannot process the submission and the user must manually submit the credentials or SendKeys must be used.
  • Applications where the logon or password change fields are on a dialogue box tab. SendKeys can be used for Windows applications.
  • Applications where logon or password change requires an action (for example, a checkbox). SendKeys can be used for Windows applications.
  • Password Change: Applications where other user profile information fields are present along with the password change fields. ESSO-LM processes the password change and bypasses the other fields.
  • Applications where the window title of the target application changes after creation but before the logon screen is active.
  • Applications where logon fields are on a page with other logon or credential entry fields. ESSO-LM cannot distinguish between multiple logons if they are on the same screen.
  • Applications where the Submit button is in an image tag with a fully-qualified path and ENTER is not accepted. If the image path changes, ESSO-LM will not insert and submit the credentials properly.
  • Password Change:
    • Applications where ESSO-LM logs the user on and bypasses the password change on the logon screen (run as a service, change title bar, etc.)
    • Applications where the application password policy does not match the SSO capabilities, and the user is responsible for password selection (for example, if the application has a password history or dictionary requirement)
  • SendKeys for Windows applications (Web applications are high risk and Mainframe applications lose the password change).
  • Logon looping: The application shows exactly the same logon screen after logoff, requiring a workaround.
  • Firefox Pop-Up Windows. ESSO-LM can only detect these windows if “Limit users to predefined applications” is set to “Do not limit.”
  • In versions prior to ESSO-LMversion 10.1.4.0.4:
    • Applications with Dynamic Window Classes that also need Service Logons functionality (run as a service, change title bar, etc.)
    • Dynamic Control IDs
    • Duplicate Control IDs on Target Credentials


Pre-Configured Applications and Templates

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

Preconfigured logons for Windows and Web application are provided in ESSO-LM Administrative Console templates. Configurations for common network/web pop-up logons and for online service logons are stored in the configuration file applist.ini, which is located in the installation directory.

Predefined application logons that had been stored in applist.ini on the client in previous ESSO-LM versions are now stored as templates in the ESSO-LM Administrative Console. See Compatibility with Previous Product Versions for more information.

The following applications are included in ESSO-LM, either as Templates with the ESSO-LM Administrative Console, or in applist.ini.

Applications With ESSO-LM Administrative Console Templates

The following applications are configured to work, but need to be added to user configurations. Some of these require customization to meet your environment (for example, specifying internal URLs or application Window Titles).

Application Logon Forms
Adobe Acrobat Reader
  • Adobe Acrobat Unlock
AIM
  • AIM Logon
Citrix ICA Client/Program Neighborhood (2-field)
  • CICA2 Logon (admin supplies WindowTitle)
Citrix ICA Client/Program Neighborhood (3-field)
  • CICA3 Logon (admin supplies WindowTitle)
Entrust
  • Entrust Entelligence Logon
Eudora
  • Eudora Logon
  • Eudora Change
  • Eudora Confirm
GoldMine
  • GoldMine Logon
  • GoldMine Clhange Password
ICQ
  • ICQ Logon - Registration
  • ICQ Logon
  • ICQ Logon (Password Only)
Lotus Notes
  • Lotus Notes
Lotus Organizer
  • Lotus Organizer Logon (admin supplies WindowTitle)
Lotus Sametime
  • Log In To Sametime
Meeting Maker
  • MM Logon
Microsoft FrontPage
  • Microsoft FrontPage Logon
Microsoft Outlook
  • Logon
  • Change Password
Microsoft Word
  • Microsoft Word Logon
MSN Messenger
  • MSN Messenger Logon
Novell Client
  • Novell Login
Novell GroupWise
  • Novell GroupWise Logon
Oracle
  • Oracle Logon
  • Oracle 10g SQL*Plus Logon
Oracle ESSO-LM Administrative Console
  • Administrative Console
PKZIP
  • PKZIP Logon
QuickBooks Pro (Password-Only)
  • QBPPO Change Password
  • QBPPO Logon
Sage ACT!
  • Act Logon
  • Act Set Password
Siebel Sales
  • Siebel Sales Logon
  • Siebel Sales Change Password
Windows Logon
  • WL MPR Logon
  • WL MPR Change Password
  • WL WinLogon Logon
  • WL WinLogon Change Password
WinZip
  • WinZip Set Password Confirm
  • WinZip Set/Use Password
  • WinZip Decrypt File(s) Password
Yahoo! Messenger
  • Yahoo! Messenger Logon

Preconfigured Logons in applist.ini

Online Services

  • AOL
  • Compuserve
  • Earthlink
  • MSN
  • Prodigy
  • ATT WorldNet
  • Internet Explorer logons


Backing Up and Restoring

It is possible to back up or restore your information either from the command line or from a file. See Command Line Options or File-Based Backup/Restore for more information on these procedures.


Character Codes

Codes for VTabKeyN (Windows)

Code | Meaning
`DELAY=N` | N is the number of milliseconds to delay
`VKEY=N` | N is the virtual key code to send

Example sending a Tab, End, Space, a 1.5 second delay, Logon username , Space, the username/ID, Home, a 0.35 second delay, Tab, and then the password:

VTabKey1=`VKEY=9``VKEY=35` `DELAY=1500`Logon username`VKEY=32`

VTabKey2=`VKEY=36``DELAY=350``VKEY=9`

Codes for VirtualKeyCode and VKEY (Windows)

These codes are used in the application configuration file (entlist.ini) to send specific keystrokes to Windows logon or password change form fields. They are listed here for reference only. Use the SendKeys (Windows) dialog box to specify keystrokes for a Windows application. See Adding Windows Applications for more information.

Key | Code | Key | Code | Key | Code | Key | Code
Break | 3 | 5 | 53 | V | 86 | F5 | 116
Backspace | 8 | 6 | 54 | W | 87 | F6 | 117
Tab | 9 | 7 | 55 | X | 88 | F7 | 118
Clear | 12 | 8 | 56 | Y | 89 | F8 | 119
Enter | 13 | 9 | 57 | Z | 90 | F9 | 120
Shift | 16 | A | 65 | Left Windows | 91 | F10 | 121
Ctrl | 17 | B | 66 | Right Windows | 92 | F11 | 122
Alt | 18 | C | 67 | NumPad 0 | 96 | F12 | 123
Caps Lock | 20 | D | 68 | NumPad 1 | 97 | F13 | 124
Esc | 27 | E | 69 | NumPad 2 | 98 | F14 | 125
Spacebar | 32 | F | 70 | NumPad 3 | 99 | F15 | 126
Page Up | 33 | G | 71 | NumPad 4 | 100 | F16 | 127
Page Down | 34 | H | 72 | NumPad 5 | 101 | F17 | 128
End | 35 | I | 73 | NumPad 6 | 102 | F18 | 129
Home | 36 | J | 74 | NumPad 7 | 103 | F19 | 130
Left | 37 | K | 75 | NumPad 8 | 104 | F20 | 131
Up | 38 | L | 76 | NumPad 9 | 105 | F21 | 132
Right | 39 | M | 77 | Asterisk (*) | 106 | F22 | 133
Down | 40 | N | 78 | Plus (+) | 107 | F23 | 134
Print Scrn | 44 | O | 79 | Minus (-) | 109 | F24 | 135
Help | 47 | P | 80 | Period (.) | 110 | Num Lock | 144
0 | 48 | Q | 81 | Slash (/) | 111 | Scroll Lock | 145
1 | 49 | R | 82 | F1 | 112 | Left Shift | 160
2 | 50 | S | 83 | F2 | 113 | Right Shift | 161
3 | 51 | T | 84 | F3 | 114 | Left Ctrl | 162
4 | 52 | U | 85 | F4 | 115 | Right Ctrl | 163

Codes for PreKey and TabKey (Host/HLLAPI)

These codes are used in the application configuration file (entlist.ini) to send specific keystrokes to HLLAPI-enabled Mainframe/Host logon or password change form fields. They are listed here for reference only. Use the SendKeys (Host/Mainframe) dialog box to specify keystrokes for a host application. See Adding Host/Mainframe Applications for more information.

Char/Cmd | Code | Char/Cmd | Code | Char/Cmd | Code
Alt Cursor | @$ | Local Print | @P | PF12/F12 | @c
Backspace | @< | Reset | @R | PF13/F13 | @d
@ | @@ | Shift | @S | PF14/F14 | @e
Alt | @A | Dup | @S@x | PF15/F15 | @f
Field - | @A@- | Field Mark | @S@y | PF16/F16 | @g
Field + | @A@+ | Tab (Right Tab) | @T | PF17/F17 | @h
Field Exit | @A@E | Cursor Up | @U | PF18/F18 | @i
Alt Cursor | @$ | Cursor Down | @V | PF19/F19 | @j
Erase Input | @A@F | Cursor Left | @L | PF20/F20 | @k
Sys Request | @A@H | Cursor Right | @Z | PF21/F21 | @l
Insert Toggle | @A@I | Page Up | @u | PF22/F22 | @m
Cursor Select | @A@J | Page Down | @v | PF23/F23 | @n
Attention | @A@Q | End | @q | PF24/F24 | @o
Print Screen | @A@T | Home | @0 | PA1 | @x
Hexadecimal | @A@X | PF1/F1 | @1 | PA2 | @y
Cmd/Func Key | @A@Y | PF2/F2 | @2 | PA3 | @z
Print (PC) | @A@t | PF3/F3 | @3 | PA4 | @+
Back/Left Tab | @B | PF4/F4 | @4 | PA5 | @%
Clear | @C | PF5/F5 | @5 | PA6 | @&
Delete | @D | PF6/F6 | @6 | PA7 | @'
Enter | @E | PF7/F7 | @7 | PA8 | @(
Erase EOF | @F | PF8/F8 | @8 | PA9 | @)
Help | @H | PF9/F9 | @9 | PA10 | @*
Insert | @I | PF10/F10 | @a |  |
New Line | @N | PF11/F11 | @b |  |


Directory Server Schema Definition

The following are Directory Server Container and Class Objects, their rights, and their attributes.

vGOSecret

Stores all user secrets. This includes an object that stores all deleted objects and their logon credentials. This is added to the SSOUserData object as an auxiliary class. All users can read this object, but only the owner can write to this object, and only the owner or administrator can delete this object.

Rights: The rights are inherited from the vGOUserData object.

Attribute Name | Syntax | Flag
vGOSecretData | Case Ignore String | Singled Valued, Synchronize
vGOSharedSecretDN | Not Used
Other optional attributes | ou, dn, cn, o

vGOUserData Object

A container allowing users to store their individual/personal secured credentials.

Rights: Users have write access to these attributes for their own user objects. The administrator has full rights but will not be able to read the secrets due to encryption.

Attribute Name | Syntax | Flag
vGOSecretData | Case Ignore String | Singled Valued, Synchronize
vGORoleDN | Not Used
Other optional attributes | ou, dn, cn, o

vGOConfig Object

Used to hold all configuration information that the Agent needs. This includes the application-supported list, mainframe/host application supported list, first-time use setup instructions, Password Policies, and admin overrides. All of these settings control Agent behavior.

Rights: All users have read-only rights to the attributes within this object. The administrator has full rights.

Attribute Name | Syntax | Flag
vGOConfigType | Case Ignore String | Singled Valued, Synchronize
vGOConfigData | Case Ignore String | Singled Valued, Synchronize
vGORoleDN | Not Used
Other optional attributes | ou, dn, cn, o

vGOLocatorClass

This is used to specify where to store user credentials.

Rights: All users have read/compare/search access to these attributes for all of this class of object. The administrator has full rights.

Attribute Name | Syntax | Flag
vGOLocatorAttribute | Case Ignore String | Single Valued
Other optional attributes | dn, cn, o


Configuring Host Emulators

● Reference > Configuring Host Emulators

Configuring Host Emulators to Enable HLLAPI Short Session Names

ESSO-LM provides single sign-on functionality for the following host/terminal emulators using built-in HLLAPI (high-level language application programming interface) support. The topics listed here outline how to enable HLLAPI support in each emulator.

  • Telnet Support
  • Attachmate Extra! / myExtra! / Xtra! X-Treme
  • BlueZone Web-to-Host
  • BOSaNOVA
  • Ericom PowerTerm
  • G&R Glink
  • Hummingbird HostExplorer
  • IBM Client Access
  • IBM Client Access Express
  • IBM Host on-Demand
  • IBM Personal Communications
  • Jolly Giant QWS3270 PLUS
  • NetManage Rumba
  • Net Soft's NS/Elite
  • Newhart Systems BLUES 2000
  • Novell LAN Workplace
  • PuTTY
  • Scanpak Aviva for Desktops
  • Seagull Bluezone
  • WRQ Reflection
  • Zephyr PC to Host
  • Zephyr Web to Host
For emulators that do not implement HLLAPI support, you can configure a host/mainframe application as a Windows application (to detect the form by its window title) and using SendKeys (to supply user credentials). See Adding Windows Applications: Special Issues for more information.


Attachmate EXTRA!

● Reference > Configuring Host Emulators > Attachmate EXTRA!

Attachmate EXTRA!/ myExtra!

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up each session of Attachmate EXTRA! to work with ESSO-LM:

In the emulator:
  1. Open the session.
  2. Select Global Preferences from the Options menu.
  3. Select Advanced, select the Short name (for example, A), select Browse, select the session document, and click OK.

This setting needs to be saved with each session configuration file.

Background processes sometimes remain running after a mainframe or host session has ended. This may disrupt the Auto-Logon process and prevent the session from restarting.


BlueZone Web-to-Host Emulator

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To install and configure BlueZone Web-to-Host emulator:

  1. Launch the BlueZone Web-to-Host setup.
  2. In the Setup Type section, select Install BlueZone Web-to-Host and click Next.
  3. Read the end-user license agreement carefully. If you agree to the terms, select the button next to Yes, I agree with the terms of this software license, and click Next.
  4. Select a location to install the software. The installer defaults to your C: drive's Program Files directory.
  5. Direct the installer to the location of the Seagull Activation File (SAF), or leave it blank if you do not have an SAF yet.
  6. Select whether the installer should create a program group to use, and whether it should create a desktop shortcut for the BlueZone Web-to-Host Wizard, and click Next.
  7. In the Sites dialog box, select a language for the site from the dropdown menu.
  8. Do one of the folllowing:
    • Click Create and enter a path and folder name.
    • Click Import and navigate to the site you want to import.
    • Click Copy and navigate to the site you want to copy.
    • Click Upgrade and navigate to the site you want to upgrade.
    • If you want to delete an existing site, select it and click Delete .
  9. In the Launch Folders dialog box, select an existing launch folder, or click Create to create a new one. Click Next.
  10. In the New BlueZone Launch Folder dialog box, enter the folder name, and select from the folder options whether to distribute as a standard web-to-host or as a served desktop. Click OK.
  11. When you return to the Launch Folders dialog box, which now displays your new launch folder, click Next.
  12. In the Sessions dialog box, click Create.
  13. In the New BlueZone Session dialog box, select Mainframe Display from the dropdown menu and click OK.
  14. Enter a name for the session and specify whether to use an existing profile. Select an existing profile if appropriate. Select whether to allow local saves. Click OK.
  15. In the Define New Connection dialog box, enter your connection information and click OK.
  16. Review the information in the Session Properties window. Edit any information that you want to change. Click OK when you are done.
  17. Select Session in the BlueZone Mainframe Display and click Connect.

Support for this emulator is new as of version 11.1.1.1.0.


BOSaNOVA

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports BOSaNOVA emulator. No steps are necessary to set up BOSaNOVA to work with ESSO-LM.

There is an open issue with the BOSaNOVA emulator when used with ESSO-LM. When closing the emulation, the following warning message appears: "There are active applications connected to the emulation via the HLLAPI/DDE interface. Closing the emulation now may cause unpredictable results. Are you sure?"

If you click Yes, ESSO-LM stops responding to the BOSaNOVA emulator and you must restart it. Note that the restart may take a few additional seconds. Another workaround for this issue is to shut down ESSO-LM before closing the emulation, close the emulation, and then restart ESSO-LM.


Reference\Ericom_PowerTerm

● Reference > Configuring Host Emulators > Ericom PowerTerm

Ericom PowerTerm

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

Setting Up Ericom PowerTerm to Work with ESSO-LM

In the emulator:

  1. Select Terminal from the Setup menu.
  2. Select the General tab.
  3. Under HLLAPI Names, set Short to a unique value.
  4. Click OK.
In order to enable ESSO-LM support for PowerTerm InterConnect, Plus, and Lite editions, the complete and exact path to the emulator must be specified in the Agent's host/mainframe-configuration file, MfrmList.ini. The default path in the mainframe configuration is C:\Program Files\Ericom Software\PowerTerm.

If one of these editions of the PowerTerm emulator is installed in any other directory or on any other drive, you must modify this default path in MfrmList.ini. This file can only be edited using th ESSO-LM Administrative Console.

  1. On the Tools menu, point to Modify Configuration, then click MfrmList.
  2. In the INI editor, select Ericom PowerTerm Lite/Plus/InterConnect from the Section dropdown list.
  3. For ValueName= edit the path to the emulator as needed.
  4. Click Save (click OK to restart the Agent if prompted), then Close.


G&R Glink

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up G&R Glink to work with ESSO-LM:

  1. Configure short names in the glHLLAPI.ini file, which is found in the GLWin\WHLLAPI directory within the G&R Glink installation path. This file must be copied to the user's %WinDir% directory to take effect. Oracle recommends that the default values be left as they are, except for those values that refer to the short names, which take the form of:

A]
Name=HLLAPI long name
Config=config file name

where 'A' represents the short name.


Hummingbird HostExplorer

● Reference > Configuring Host Emulators > Hummingbird HostExplorer

Hummingbird Host Explorer

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up Hummingbird HostExplorer to work with ESSO-LM:

In the emulator:
  1. Select API Settings from the Options menu.
  2. Under HLLAPI Options, select Update screen after PS update.
  3. Under EHLLAPI Compatibility, select Attachmate
  4. Click OK.


IBM Client Access

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports IBM Client Access. No steps are necessary to set up IBM Client Access to work with ESSO-LM.


IBM Client Access Express

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports IBM Client Access Express. No steps are necessary to set up IBM Client Access Express to work with ESSO-LM.


IBM Host On-Demand

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM support for IBM Host On-Demand is tested with Microsoft Windows, Microsoft Internet Explorer or Mozilla Firefox, and the updated JVM (Java Virtual Machine). If Microsoft Internet Explorer is installed, the JVM should not have to be updated.

One issue with these methods is that clients might not be able to save configured sessions, and entering the auto-start name each time a session is used is quite tedious. Alternatively, administrators can replicate the existing sessions that are available to the client, and HLLAPI-enable these sessions as explained below. Clients can then be offered both standard and HLLAPI-enabled sessions.

To set up IBM Host On-Demand to work with ESSO-LM:

In Microsoft Internet Explorer or Mozilla Firefox

  1. Launch the browser.
  2. Go to IBM FixCentral and download the Host On-Demand EHLLAPI Bridge Download for the particular version of IBM Host On-Demand.
  3. Unzip the downloaded file to the ESSO-LM installation directory.
  4. Install Ehllapibridge.exe.
  5. Select Internet Options from the Tools menu.
  6. Select the Advanced tab.
  7. Under Microsoft VM, select Java console enabled (requires restart).
  8. Click Apply, then OK. If necessary, exit the browser.
  9. Restart the computer.

In Host On-Demand

  1. Configure each individual session to run the HLLAPI enabler through the Host On-Demand applet.
  2. Select Properties from the menu.
  3. Select the Advanced tab.
  4. Select Applet from the Auto-Start drop-down list box.
  5. Enter com.ibm.eNetwork.hllbridge.HLLAPIEnabler in the Name text box.
  6. Enter ENABLE_PCSAPI=YES in the Parameter (Optional) text box.
  7. Select Yes in the Auto-start HLLAPI Enabler check-box.
  8. Alternatively, run this applet after the session starts by selecting Assist, then Run applet.


IBM Personal Communications

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up IBM Personal Communications to work with ESSO-LM:

  1. From the Edit menu in the emulator, point to Preferences and select API Settings.
  2. Select the DDE/EHLLAPI checkbox.
  3. Click OK.


Jolly Giant QWS3270 PLUS

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Jolly Giant QWS3270 PLUS emulator. No steps are necessary to set up Jolly Giant QWS3270 PLUS to work with ESSO-LM.


NetManage Rumba

● Reference > Configuring Host Emulators > NetManage Rumba

NetManager Rumba

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.
Setting Up NetManage in the Emulator
  1. Select API from the Options menu.
  2. Select the Identification tab.
  3. Set the Session Short Name.
  4. Click OK.

NetManage Rumba appears to have an incomplete implementation of HLLAPI. NetManage Rumba connects and sees the Presentation Space (emulator screen), but it does not appear to support connections for more than one session. ESSO-LM can only provide single sign-on support to the last session started.


Net Soft's NS/Elite

● Reference > Configuring Host Emulators > Net Soft's NS/Elite

Net Soft NS/Elite

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Net Soft NS/Elite. No steps are necessary to setup NS/Elite to work with ESSO-LM.


Newhart Systems BLUES 2000

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Newhart Systems BLUES 2000S emulator. No steps are necessary to set up Newhart Systems BLUES 2000S to work with ESSO-LM.


Novell LAN Workplace

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

In order to enable ESSO-LM support for Novell LAN Workplace Pro, the complete and exact path to the emulator must be specified in the Agent's host/mainframe-configuration file, MfrmList.ini. The default path in the mainframe configuration is c:\Program Files\Novell\LAN Workplace\Terminals\Bin.

If the Novell LAN Workplace emulator is installed in any other directory or on any other drive, you must modify this default path in MfrmList.ini. This file can only be edited using the ESSO-LM Administrative Console.

  1. On the Tools menu, point to Modify Configuration, then click MfrmList.
  2. In the INI editor, select Novell LAN Workplace Pro 5.2 from the Section dropdown list.
  3. For ValueName= edit the path to the emulator as needed.
  4. Click Save (click OK to restart the Agent if prompted), then Close.


● Reference > Configuring Host Emulators > PuTTY

PuTTY

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

Creating Application Templates for the PuTTY Terminal Emulator

Due to the way PuTTY and support for PuTTY in ESSO-LM have been designed, you must keep the following information in mind when creating templates for applications accessed via PuTTY.

Use PuTTY’s Copy All to Clipboard feature when creating a PuTTY-based template.

PuTTY Treats Fixed-Screen Applications as Scrolling-Screen

Because PuTTY treats all applications as scrolling-screen, you must create scrolling-screen templates even if the application in question is fixed-screen.

PuTTY Does Not Support Detection or Setting of Cursor Position

Because PuTTY cannot detect nor set the cursor position, you must do the following when creating templates:

  • Fixed-screen applications. Configure the template to manually position the cursor into the target row and column by sending appropriate keyboard characters such as tabs and spaces.
  • Scrolling-screen applications. Configure the template with the assumption that the cursor is always positioned after the last character on the last line of the screen, plus a separating space.

Screen Updates in PuTTY Are Not Immediate

Because PuTTY does not update its screen display immediately due to host echo (text entered is first sent to the server then returned back to the terminal and displayed), it is necessary to add delays when switching fields and/or submitting the credentials, depending on the latency of the echo. If you need to delay the “Submit” action, you must disable the “Auto Submit” feature.


Scanpak Aviva for Desktops

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Scanpak Aviva for Desktops (formerly Eicon Aviva). To set up Scanpak Aviva for Desktops to work with ESSO-LM:

In the emulator:

  1. Select Settings, then Properties from the menu.
  2. Select Automation.
  3. Ensure the Choose first available short name checkbox is selected.

Only the session and destination parameters must be configured.


WRQ Reflection

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up WRQ Reflection to work with ESSO-LM:

In the Emulator:

  1. Select Setup, then Terminal from the menu.
  2. Set the HLLAPI names for Short and Long. (Short must be unique, Long can be anything the program permits.)
  3. Click OK.


Zephyr PC to Host

● Reference > Configuring Host Emulators > Zephyr PC to Host

Zephyr PC to HostZephyr to PC Host

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up Passport to work with ESSO-LM:

In the emulator:

  1. Select Communication, then Setup from the menu.
  2. Select HLLAPI (If Automatically Select is checked there is not additional steps necessary. If Manually Specify is checked, you must select either a Short Name or Long Name.


Zephyr Web to Host

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Passport Web to Host. No steps are necessary to setup Web to Host to work with ESSO-LM.


SAP Configuration

ESSO-LM supports SAP applications. In order for ESSO-LM to work with SAP applications, scripting must be turned on. (Note that in your environment, scripting may be turned off by default.) The following configuration changes must be made to all SAP desktops that will run ESSO-LM. If these configuration changes are not made, end users will receive an SAP error unless ESSO-LM is shut down. To set up SAP to work with ESSO-LM

To set up SAP to work with ESSO-LM:

Configuring the Client

  • Open the SAP Client and log on (SAPGUI Front End).
  • On the SAP Easy Access screen, open the Options dialog box. (Click Alt F12 or select Customizing of local layout from the Standard Toolbar on any SAP screen).
  • Select the Scripting tab.
  • Under User Settings, make sure that Enable Scripting is checked and that Notify when a script attaches to a running GUI is not checked.
  • Click Apply.

Configuring the Server

  • Open the SAP Application Server.
  • Start transaction RZ11.
  • On the Maintain Profile Parameters screen, in the Param. Name, enter sapgui/user_scripting and click Display.
  • On the Display Profile Parameter Attributes screen, select Change Value from the Application Toolbar.
  • On the Change Parameter Value screen, enter TRUE in the New Value field.
  • Click Save (lower left hand corner).

Editing the Registry

  • Open the Registry.
  • Drill down to HKCU\software\SAP\SAPGUI Front\SAP Frontend Server\Security:WarnOnAttach.
  • Set the WarnOnAttach value to 0.
  • Push out this change to all desktops that will use SAP applications with ESSO-LM.

The SAP Helper must be present for this process. Run the ESSO-LM Agent Installer, select Custom Setup, expand the Extensions tree and drill down to Logon Manager. Select SAP Helper and choose This Feature will be installed on the local hard drive. Select Next and follow the onscreen instructions to complete the installation.


CommandLine Options

● Reference > Command-Line Options

Command-Line Options

You can invoke ESSO-LM from the command line to perform certain tasks.

Items in [brackets] are optional in this section only.

Task | Use/Description
Backup | ssoshell.exe /mobility /backup [path] /silent [confirm]
 | Example: [path] | The actual path to the directory where the backup file is placed. (Default: the last directory in which a command line backup file was stored, or where Shell:AutoBackupPath points.)
 | Example: silent | Do not show the Backup/Restore Wizard when performing the backup.
 | Example: [confirm] | Show all dialog boxes. When doing a silent backup where the confirm switch is not present, the user does not see the Yes/No dialog box and the Agent defaults to Yes. (Example of a confirm dialog: "Overwrite backup file?
Logon Manager | ssoshell.exe
 | Example | Show Logon Manager
No FTU | ssoshell.exe /background /noftu
 | Description | Prevents the Agent from starting twice when logging on to the computer. Enable in the Userinit registry key, which is located in HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon.
 | Description | Prevents the Agent from starting twice when logging on to the computer. Enable in the Userinit registry key, which is located in HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon.
 | Description | Using /noftu ensures that the Agent does not run for users who do not have it in their Windows Startup folder. This allows the administrator to roll out ESSO-LM to only specific (not all) users of a particular computer.
 | Description | This command applies only to Microsoft Windows 2000/XP.
Options | ssoshell.exe /options
 | Example | Show the Settings property page.
Restore | ssoshell.exe /mobility /restore [path] /silent [confirm]
 | Example:[path] | The actual path to the directory where the backup file exists. (Default: the last directory to which a command line backup file was stored, or where Shell:AutoBackupPath points.)
 | Example: silent | Do not show the Backup/Restore Wizard when performing the backup.
 | Example: [confirm] | Show all dialog boxes. When doing a silent backup and the confirm switch is not present, the user will not see the Yes/No dialog box and the Agent will default to Yes. (Example of a confirm dialog: "Backup file has been restored")
 | Example: Notes | The restore password submitted by default is the Windows password. The restore command is executed with a startup task (see Shell\Tasks:StartupTaskN).
Setup | ssoshell.exe /setupmgr
 | Example | Show the Setup Wizard.
Shutdown | ssoshell.exe /shutdown
Startup | ssoshell.exe /background
Synchronize | ssoshell.exe /syncmgr /sync | Execute synchronization with the first synchronizer in the Sync Order list (see Synchronization in Global Agent Settings); displays a logon to connect to the first-listed synchronizer.


Smart Card Monitor Utility (ssoSCDetect.exe)

The utility program ssoSCDetect monitors a workstation's smart card reader, making it possible to use the workstation as a multiple-user "kiosk" that can access and synchronize the remote SSO credential store of any user authenticated by a smart card.

When a user inserts a card into the reader, the ssoSCDetect utility starts the Agent and prompts for the user's primary logon credentials. It then synchronizes the user's credentials with the remote repository. When the user logs out of the workstation (for example, by removing the card from the reader), ssoSCDetect shuts down the Agent.

To run the utility, copy the executable file ssoSCDetect.exe from the Utilities directory of the ESSO-LM CD to the installation directory (%ProgramFiles%/Passlogix/v-GO SSO) then launch the program.

Recommended Global Agent Settings for SSO Kiosk Operation

For best performance and security, the following global Agent settings should be applied to the ESSO-LM Agent running on a workstation configured as a kiosk:

User Paths (Active Directory only) For best performance, specify one or more fully-qualified paths to begin searching for user accounts. See the Advanced options, under Synchronization\Active Directory.


DB2 Setup

● Reference > IBM DB2 Setup

IBM DB2 Setup

To extend the central repository schema for ESSO-LM and prepare IBM DB2 as the central repository, follow the steps in this section.

IBM DB2 Setup Requirements:

  • You must install the IBM DB2 Client on the local machine.
  • The DB2 client must have OLE DB (Object Linking and Embedding Database) support installed and configured. This support provides a set of interfaces that allow applications to uniformly access data stored in different data sources. To install OLE DB support, run the DB2 setup wizard and navigate to Client support > Interfaces > OLE DB Support. See your DB2 documentation for more information.
  • The currently logged-in user (to Windows) that is extending the schema, must have the appropriate rights to the database in order to connect to the repository and extend the schema. The DB2 User Account must have “Database Administrator Authority” rights.
  • A DB2 administrator must create a database named “vGOSSO.”
  • Refer to the IBM DB2 instructions for detailed information on any of these instructions.

Extending the Database Schema

  1. Open the ESSO-LM Administrative Console.
  2. From the Repository menu, select Extend Schema.
  3. From the Connect to Repository menu, enter or select the required IBM DB2 connection information:
    • Server name: Enter the server name.
    • Repository Type: Select DB2 Database.
    • Port: The port number only needs to be entered if it is not the default port (normally 50000). If the port is the default, this field can be left blank.

  4. Click OK.
You must have Administrator-level authentication to connect the ESSO-LM Administrative Console to the database server. The ESSO-LM Administrative Console connects to the database, creates the necessary objects, and confirms successful configuration.

The ‘Extend Schema’ function uses the following SQL commands to extend the schema:

CREATE SCHEMA vGOSSO;

CREATE TABLE vGOSSO.SSO_ADMIN (ConfigType VARCHAR(128) NOT NULL, Data CLOB, PRIMARY KEY(ConfigType));

CREATE TABLE vGOSSO.SSO_USERS (UserID VARCHAR(128) NOT NULL, ObjectID VARCHAR(255) NOT NULL, Data CLOB, PRIMARY KEY (UserID, ObjectID));
  5. After schema extension, grant “full” rights to SSO_USERS table and its indexes and “read-only” rights to SSO_ADMIN table and its indexes in the DB2 database.

Publishing to the Repository

  1. In the left pane of the ESSO-LM Administrative Console, right-click Repository and select Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the root (server name).
  4. Right-click on the root and select Publish to Repository from the shortcut menu. The People container object will already exist under the root.
  5. Choose the Data Source of the Administrative Overrides and provide the information requested:
    • Administrative Console. Use this wizard page to export an Agent configuration to a selected synchronizer container using the current ESSO-LM Administrative Console settings as the source.
    • Data File. Use this wizard page to export an Agent configuration to a selected synchronizer container using one or more data files as the source.
  6. When you complete the configuration procedure, entries for any overriding settings appear in the Repository pane. Right-click on any object and choose Refresh if necessary.

Required Settings for connecting to IBM DB2 Database

You must set the Required Database Synchronization settings for all database synchronizer extensions.

To add the synchronizer and configure it for IBM DB2:

  1. Open the ESSO-LM Administrative Console and select a set of global Agent settings.
  2. Expand Synchronization > DBExt > Required.
  3. Enter the following information:
    • Extension location: Make sure this is checked. It is the Path\filename of the IBM DB2 database synchronizer extension.
      Default: C:\Program Files\LocalDirectory\v-GO SSO\Plugin\SyncMgr\ DBEXT\DBExt.dll)
    • Servers: Specify the connection string for the database server in the order to attempt connection for synchronization. Select the checkbox and click ... to open the Edit List dialog box. Type the full connection string for one database server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

You must specify at least one connection string for the extension to work.

To connect to an IBM DB2 database, use the following connection string:
Provider=IBMDADB2;Data Source=vGOSSO;CurrentSchema=vGOSSO;Location=<DB2ServerName>[:port];Extended Properties="trusted_connection=yes";Where <DB2ServerName> is the name of the server and [:port] is the optional port.
  4. Expand Synchronization > DBExt > Advanced. The Advanced Database Synchronization settings control special-case options for all database synchronizer extensions. This setting is not required.

Append Domain when naming objects: Enables appending of the user's domain to the username in naming the user's container. Example: For the domain "company" and user "user1", the container is named "user1" with this flag disabled and "user1.company" with this flag enabled. Default is set to Disable. Select Enable to activate this feature.


Error Loop Quick Reference

This section serves as a quick-reference to the basic Error Loop settings.

Configure these settings in the ESSO-LM Administrative Console. The table is provided only for reference.

The settings are inherited downward from global to application type to application. More-specific settings override more-general (application overrides application type, which overrides global).

For security settings (for example, MaskPW), the most-secure setting is used, regardless of whether it is set globally, for an application type, or for an application.

Place the application-type settings in the entlist.ini [*Root] section.

Example

[*Root]

AppsTimeout=8

WebMaxRetry=3

Place the Application settings in the specific application's entlist.ini section.

Example

[Payroll]

WindowTitle1=Payroll

MaxRetry=3

Timeout=30

IDCtrl=203

...

Global (Registry) | Application Type ([*Root])
Parameter Purpose | Extensions\ AccessManager\ Dlg | Windows | Web | Host/Mainframe | Application | Default
Max # of retries (after first try) beforeError Loopdialog box appears | MaxRetry | AppsMaxRetry | WebMaxRetry | MainframeMaxRetry | MaxRetry | 1
Max time between successive logon attempts beforeError Loop dialog box appears | Timeout | AppsTimeout | WebTimeout | MainframeTimeout | Timeout | 30
Setting to indicate whether to hide the password confirmation field in theError Loop dialog box | HideConfirmPW | AppsHideConfirmPW | WebHideConfirmPW | MainframeHideConfirmPW | HideConfirmPW | 0 (do not hide)


MSI Package Contents

This section documents the basic contents of each package feature. The Feature Name and Title are as in the Custom display of the Installer. For the exact feature details, review the package.

Any child package requires its parent package. For example, Network Provider requires Windows Logon v2.

You must install the following:

  • The Core application
  • At least one authenticator (This can be something other than what ships with the product.)
  • At least one language

Although the above list is all that is required for installation, Oracle recommends installation of the Internet Explorer component.

Also note:

  • Feature names are case-sensitive.
  • Not all features are packaged in all installers.

  • Installing any feature with ADDLOCAL also installs its parents; if you are using a custom MSI you must set parent install levels manually.

    For example, in a custom MSI, if you want to install DOSWindowHelper you must also install DOSHelper and MainframeEmulators; but if using ADDLOCAL from the command line, you only need to specify DOSWindowHelper.
Application Support
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
Core | _TopLevel Feature | Application Support | Mandatory
ssobhohelper | Core |  | Hidden. Regkeys for WTS system
InternetExplorer | Core | Microsoft Internet Explorer | x86 only
InternetExplorer.x64 | Core | Microsoft Internet Explorer | x64 only
JavaHelper.x86 | Core | Java | x86 only
JavaHelper.x64 | Core | Java | x64 only
Mozilla | Core | Mozilla Firefox |
SAP | Core | SAP |
SoftIdHO | Core | SoftID |
MainframeEmulators | Core | Host/Mainframe Emulators |
ConCP | MainframeEmulators |  | Hidden Only installed when using ADDLOCAL/ORCA
Legacy | MainframeEmulators | Legacy Emulators |
PuttySupport | MainframeEmulators | PuTTY |
DOSHelper | MainframeEmulators | Console Windows |
DOSWindowHelper | DOSHelper | DOS Windows |
Authenticators
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
Authenticators | _TopLevel Feature | Authenticators | Installs SecureDataStorage.dll
Entrust | Authenticators | Entrust |
LDAP | Authenticators | LDAP |
LDAPauth | Authenticators | LDAP v2 |
MultiAuth | Authenticators | Authentication Manager |
ProxCardAuth | Authenticators | Proximity Card |
ROSCAuth | Authenticators | Smart Card (Read-Only) |
SCAuth | Authenticators | Smart Card |
SLA | Authenticators | Windows Logon |
SecurID | Authenticators | RSA SecurID |
LocalAuthToolkit | SecurID | Local Authentication Toolkit (LAT) |
MSauth | Authenticators | Windows Logon v2 |
SSONP | MSauth | Network Provider | x86 only
SSONP.x64 | MSauth | Network Provider | x64 only
SSOGina | MSauth | GINA | x86 only
SSOGina.x64 | MSauth | GINA | x64 only
Synchronizers
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
SyncMgr | _TopLevel Feature | Synchronizers | Installs syncmgr.dll
AD_Sync | SyncMgr | Microsoft Active Directory |
ADAM_sync | SyncMgr | Microsoft ADAM |
DB_Sync | SyncMgr | Database |
File_Sync | SyncMgr | File System |
LDAP_Sync | SyncMgr | LDAP |
Roam_Sync | SyncMgr | Roaming Profile |
Audit Logging Methods
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
EventMgr | _TopLevel Feature | Audit Logging Methods | Installs eventmgr.dll
DatabaseEventExt | EventMgr | Database |
LocalFileExt | EventMgr | XML File |
ReportingExt_Debug | EventMgr | ESSO Reporting Server |
ReportingExt_Release | EventMgr | ESSO Reporting Server |
SyslogEventExt | EventMgr | Syslog Server |
WindowsEventExt | EventMgr | Windows Event Manager |
Backup/Restore
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
BackupMgr | _TopLevel Feature | Backup/Restore |
Languages
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
Languages | _TopLevel Feature | Languages |
Chinese_Simplified_Pack | Languages | Chinese (Simplified) |
Czech_Pack | Languages | Czech |
Dutch_Pack | Languages | Dutch |
English_Pack | Languages | English | Mandatory Automatically selected if any other language is selected with ADDLOCAL
Finnish_Pack | Languages | Finnish |
French_Pack | Languages | French |
German_Pack | Languages | German |
Italian_Pack | Languages | Italian |
Japanese_Pack | Languages | Japanese |
Korean_Pack | Languages | Korean |
Polish_Pack | Languages | Polish |
Portuguese_Pack | Languages | Portuguese |
Spanish_Pack | Languages | Spanish |
Unclassified
Feature Name | Feature Parent | Title (as seen in installer) | Additional Information
Not_WTS | _TopLevel Feature |  | Hidden Adds a Start menu shortcut for running the background process at startup (use with non-WTS/metaframe systems only)
SMAgent_Files | _TopLevel Feature | Kiosk Manager |
SMGina | SMAgent_Files | Kiosk Manager GINA |


ftulist.ini Keys

ftulist.ini determines special actions the Agent will take the first time a user starts it. The file can exist as a local file or as a directory server or database object. If it is deployed using synchronization, ftulist.ini is placed in the %AppData/Passlogix% directory.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini) can only be created and edited using the Administrative Console. The information in the topics listed below is provided only for reference.

The tables in the following topics list the keys and acceptable values for each section of ftulist.ini:

  • Root Keys for ftulist.ini
  • Password Windows Section Keys
  • My Logons Section Keys
  • Bulk Add Logon Section Keys


Root Keys for ftulist.ini

● Reference > ftulist.ini Keys > Root Keys

Root Keys

These settings are used strictly within the [FTU] section and are required.

Example

[FTU]

Ver=20020523

Step1=Password Windows

Step2=My Logons

First-Time Use Keys | Description | Acceptable values
Ver = %s | Required. String of the date of the last ftulist.ini file. If the value of this key is higher (newer) than the decimal value in the user's registry (in HKCU\&\Extensions\SetupManager:Completed), then the user will see the bulk add list the next time the user starts up the Agent. Example: 20020523 | %s = string representing the decimal equivalent of a date in yyyymmdd (year-month-date) format, as in 20020523 for May 23, 2002.
Step1 = %s | Required, do not alter. Calls the section that launches Primary Logon Method. This module forces the user to select an authenticator. | %s = "Password Windows"
Step2 = %s | Required, do not alter. Calls the section that launches Access Manager. This module enables bulk adding of credentials. | %s = "My Logons"


Password Windows Section Keys

These settings are required and used strictly within the Password Windows section.

Example

[Password Windows]

ExtensionName=<core>

Action1=Password Window

First-Time Use Keys | Description | Acceptable values
ExtensionName = %s | Required, do not alter. Internal name of the extension module. | %s = "<core>"
Action1 = %s | Required, do not alter. Launches primary logon method. This module forces the user to select an authenticator. | %s = "Password Window"


My Logons Section Keys

These settings are required and used strictly within the [My Logons] section.

Example

[My Logons]

ExtensionName=AccessManager

Section1=Corporate Win App

Section2=Intranet

&

First-Time Use Keys | Description | Acceptable values
ExtensionName = %s | Required, do not alter. Internal name of the extension module. | %s = "AccessManager"
Section%d = %s | Required, do not alter. Specifies logons to include in the bulk add wizard. | %d = consecutive integers %s = application logon section name; link to relevant logon class section


Bulk Add Logon Section Keys

These settings are required and used in each bulk-add logon section.

Example

[My Logons]

ExtensionName=AccessManager

Section1=Corporate Win App

Section2=Intranet

[Intranet]

ConfigKey=*Other Webs

ConfigName=Corporate Intranet

FTU_NeedID=0

FTU_NeedOther=0

FTU_NeedPwd=1

FTU_CONFIRMID=0

FTU_CONFIRMOTHER=0

FTU_CONFIRMPASSWORD=1

URL=Corp Intranet

First-Time Use Keys | Description | Acceptable Values
ConfigKey = %s | Link to logon configuration in entlist.ini | %s = application logon section name in entlist.ini or applist.ini. Use [*Mainframe] for host/mainframe logons, [*Other Webs] for Web logons, [*Online Services] for Online service logons, and [*Other Apps] for other Windows application logons.
ConfigName = %s | The name to use in the First-Time Use Wizard to describe the logon. | %s = application logon name
Description = %s | The name to use in Logon Manager to describe the logon. | %s = application logon name
FTU_CONFIRMID = %b | Flag indicating if the First-Time Use Wizard will require the user to confirm username/ID (optional). | %b = 0, user will not have to confirm username/ID (default) %b = 1, user will have to confirm username/ID
FTU_CONFIRMOTHER = %b | Flag indicating if the First-Time Use Wizard will require the user to confirm a third field, if one exists (optional). | %b = 0, user will not have to confirm third field (default) %b = 1, user will have to confirm third field
FTU_CONFIRMPASSWORD = %b | Flag indicating if the First-Time Use Wizard will require the user to confirm password (optional). | %b = 0, user will not have to confirm password (default) %b = 1, user will have to confirm password
FTU_NeedID = %b | Flag to indicate whether the application requires a username/ID. | %b = 0, application does not require a username/ID %b = 1, logon requires a username/ID (default)
FTU_NeedOther = %b | Flag to indicate whether the application requires a third field (optional). | %b = 0, application does not require a third field (default) %b = 1, application requires a third field
FTU_NeedPwd = %b | Flag to indicate whether the application requires a password. | %b = 0, application does not require a password %b = 1, logon requires a password (default)
URL = %s | Section name in entlist.ini for a Web or Host application, or URL for a Web site that is not predefined in entlist.ini. | %s = Web/Host section name or Web URL


entlist.ini Keys

● Reference > entlist.ini Keys

Keys for entlist.ini

The administrator designates the directory where the entlist.ini file resides. In most instances, this should be a subdirectory under the ESSO-LM program directory.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini) can only be created and edited using the ESSO-LM Administrative Console. The information in the topics listed below is provided only for reference.

This is also the format for synchronizer objects that override local entlist.ini files.

A directory-based object causes the Agent to ignore any local entlist.ini file. The remote object (if it exists) overwrites a local entlist.ini file when downloaded.

Then, entlist.ini is merged with applist.ini to create a new file (aelist.ini) in the %AppData%\Passlogix directory. The aelist.ini file is overwritten periodically, including when ESSO-LM launches, when it re-merges applist.ini and entlist.ini. The Agent then uses aelist.ini to detect known applications.

The tables in the following topics list the keys and acceptable values for each section of entlist.ini.

  • Root Keys for entlist.ini
  • Windows Application Keys
  • Web Application Keys
  • Host/Mainframe Application Keys
  • Password Policy Keys


Root Keys for entlist.ini

● Reference > entlist.ini Keys > Root Keys > Application Type Section Keys

Root Keys

These settings are used strictly within the [*Root] section.

Example

[*Root]

Section1=*Other Apps

Section2=*Other Webs

Section3=*Mainframe

AppsMaxRetry=1

WebMaxRetry=3

HostMaxRetry=2

WebTimeout=90

&

Global Application Keys Description Acceptable values

[*Root]

Root section, from which application types (logon classes) are derived.

N/A

AppsHideConfirmPW = %b

Indicates whether to hide the password confirmation field in the Logon Error dialog for all Windows applications.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

AppsMaxRetry = %d

Indicates the number of logon retries for all Windows applications the Agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

AppsTimeout = %d

Indicates the maximum time between successive logon attempts that will trigger Error Loop detection for all Windows applications.

%d = amount of time in seconds (default: 30)

MainframeHideConfirmPW = %b

Indicates whether to hide the password confirmation field in the Logon Error dialog box for all Host applications.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

MainframeMaxRetry = %d

Indicates the number of logon retries for all Host applications the Agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

MainframeTimeout = %d

Indicates the maximum time between successive logon attempts that will trigger Error Loop detection for all Host applications.

%d = amount of time in seconds (default: 30)

Section%d = %s

Declaration of supported subsections.

Because *Other Webs, *Online Services, and *Other Apps are defined in applist.ini, they need not be defined in [*Root] in entlist.ini.

%d = consecutive integers
%s = *Other Apps | (Windows applications)
%s = *Mainframe | (Host/Mainframe applications)
%s = *Other Webs | (Predefined Web applications)
%s = *Online Services

WebHideConfirmPW = %b

Indicates whether to hide the password confirmation field in the Logon Error dialog for all Web applications.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

WebMaxRetry = %d

Indicates the number of logon retries for all Web applications the Agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

WebTimeout = %d

Indicates the maximum time between successive logon attempts that will trigger Error Loop detection for all Web applications.

%d = amount of time in seconds (default: 30)

Application Type Section Keys

These settings are used for the Windows, Web, and Host application sections that delineate the list of predefined applications.

Example

[*Other Apps]

Section1=Corporate WinApp

&

[*Other Webs]

Section1=Corporate Intranet

&

[*Mainframe]

Section1=Corporate Mainframe

Global Application Keys Description Acceptable Values

[%s]

Section heading that identifies an application category section.

%s = [*Other Apps] | (Windows applications)
%s = [*Mainframe] | (Host/Mainframe applications)
%s = [*Other Webs] | (Predefined Web applications)

Section%d = %s

Declaration of application sections.

%d = consecutive integers

%s = section name


Windows Application Keys

These settings are used within applications delineated in the [*Other Apps] section.

Example

[*Other Apps]

Section1=Corporate WinApp

&

[Corporate WinApp]

(the keys below)

Windows Application Keys Description Acceptable Values

AllowReveal = %b

Flag that enables or disables the Reveal button for password in Wizards and property pages.

%b = 0; disabled

%b = 1; enabled (default)

AppPathKey%d = %s

Windows registry key identifying the application associated with a logon to match against running processes. Used in combination with the WindowTitle for exact matching of logon requests. %d is replaced with a number, starting at 1, so that multiple registry keys can be associated with a single logon.

%d = consecutive integers

%s = application name string used in Windows registry
(typically corresponds to executable name)

AutoOK = %b

Flag instructs the Agent to automatically select OK for this application logon after insertion of logon data.

%b = 0; disabled

%b = 1; enabled (default)

ChangeTitle%d = %s

Text matched against password change window titles to identify password change requests. %d is replaced with a number, starting at 1, so that multiple windows can be identified for a single password change request.

There must be a duplicate WindowTitle entry for each ChangeTitle entry.

%d = consecutive integers

%s = window title string

ChgCtrl0 = %d

Control ID used to identify the username/ID field in a password-change request window.

%d = -1; change request does not require a username/ID

%d = 1; change request requires a username/ID, but it will be sent to the application using Send Keys. If this value is 1, all other Control IDs (IDCtrl, PassKeyCtrl, OtherCtrl1, OtherCtrl2, OKCtrl, ChgCtrl1, ChgCtrl2, and ChgCtrl3) must also be 1 or -1.

%d = 2 - 99,999; control ID value

ChgCtrl1 = %d

Control ID used to identify the old password field in a password change request window.

%d = -1; change request does not require an old password

%d = 1; change request requires a password, but it will be sent to the application using Send Keys. If this value is 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; control ID value

ChgCtrl2 = %d

Control ID used to identify the new password field in a password change request window.

%d = -1; change request does not require a new password.

%d = 1; change request requires a password, but it will be sent to the application using Send Keys. If this value is 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; control ID value

ChgCtrl3 = %d

Control ID used to identify the password confirmation field in a password change request window.

%d = -1; change request does not require a "confirm new password" entry.

%d = 1; change request requires a "confirm new password" entry, but it will be sent to the application using SendKeys. If this value is 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; control ID value

ConfigName = %d

Control ID identifying the control that contains the text used to create the initial configuration name when the user adds this logon.

%d = 1 - 99,999; control ID value

CPWFlag = %d

Determines the behavior of the Password Change Wizard, for specific applications, when a user encounters a password-change request. This key is specified in the application's root section, not in a password-change subsection.

This setting can also be set globally, for all applications, via the Registry. See for instructions.

%d = 1; Prompts user with Password Change Wizard (default).

%d = 2; Prompts user to manually enter a new password, but also provides the option of having the Agent automatically generate the password.

%d = 4; Generates the new password automatically, but also provides the option of manually creating the new password.

%d = 10; Prompts user to manually enter a new password, without providing the option of having the Agent automatically generate the password.

%d = 12; Generates the new password automatically, without providing the option of manually creating the new password.

CtrlOrder = %s1, %s2, %s3&

Determines the order in which fields are sent when UseSendKeys is enabled. For example, specifying CtrlOrder = OtherCtrl1, IDCtrl, PassKeyCtrl tells the Agent that the tab order in the dialog box should be OtherCtrl1, then IDCtrl, followed by PassKeyCtrl.

For logons, the default order is IDCtrl, PassKeyCtrl, OtherCtrl1, OtherCtrl2.

Tony/Drew: What is CtrlOrder default for password change scenario?

For password changes, the default order is ChgCtrl0, ChgCtrl1, ChgCtrl2, ChgCtrl3.

This setting applies only when UseSendKeys is enabled and works only with Windows applications.

%s1 = The first field sent

%s2 = The second field sent

%s3 = The third field sent

etc.

Description = %s

Text describing this application, also stored in the Description field in Logon Manager.

%s = any string

ExtMap = %s

Windows file extension associated with a logon. Allows the Agent to map an icon to the configuration.

%s = three-character string for file extension

ForceReauth = %b

Force the user to reauthenticate before providing credentials to this application.

Applies to all subsections; the user would have to reauthenticate multiple times in a multiple-section password change scenario.

%b = 0; do not require reauthentication (default)

%b = 1; require reauthentication

Group = %s

Group section name that this application is a part of. Used when configuring for credential sharing groups. Special values include:

LDAP: Application uses LDAP Directory Server authenticator password.

Domain: Application uses the Windows authenticator password.

Must set Windows Registry entry PWSEnable=1 to enable Groups

%s = the section name of the application group that the application belongs to.

HideConfirmPW = %b

Determines whether to hide the password confirmation field in the Logon Error dialog box.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

IDCtrl = %d

Identifies the username/ID control field and/or the mechanism to provide the username/ID data to the appropriate username/ID control.

%d = 0; the user must use the Agent's "teaching tool" mechanism during application setup (default)

%d = -1; application does not require a username/ID

%d = 1; application requires a username/ID, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs (PassKeyCtrl, OtherCtrl1, OtherCtrl2, OKCtrl, ChgCtrl0, ChgCtrl1, ChgCtrl2, and ChgCtrl3) must also be 1 or -1.

%d = 2 - 99,999; username/ID control ID value

IDCtrlType = %d

Identifies the control type of the username/ID control field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

IgnoreClassName = %s

Identifies the class name of the logon or password-change window that should be ignored when submitting credentials. Used in cases where an application contains a second, hidden logon or password-change window.

%s = class name string

InteractionMode = %b

Prevents the Agent from attaching to the application's window's message queue.

%b = 0; disabled (default)

%b = 1; enabled

Match%d = %s

Maps to a matching section for the application. Use this method if the same application has multiple logon and password change screens. This is most useful when one set of user credentials is for multiple screens within an application. By using this method, the matching sections could be set up for logons, password change (pick and manual), and ignores.

%d = consecutive integers

%s = application logon name (logon definition sections)

MaxRetry = %d

Determines the number of logon retries the Agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

ModuleName%d = %s

Application module name associated with a logon to match against running processes. Used in conjunction with WindowTitle key to identify a specific application logon or password-change request. %d is replaced with a number, starting at 1, so that multiple application modules can be associated with a single logon.

%d = consecutive integers

%s = application name string
(typically corresponds to executable name)

OKCtrl = %d

Identifies the control ID of the OK button for this application.

%d = 1; use the Agent's internal logic (default)

%d = 2 - 99,999; OK button control ID

%d = -1; requires the user to manually select OK

OtherCtrl1 = %d

Identifies the control ID of a third logon field and/or the mechanism to provide the additional field data to the appropriate control.

%d = -1; application does not require a third field

%d = 1; application requires a third field, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; third field control ID value; can be any value if Send Keys is used

OtherCtrl1Type = %d

Identifies the control type of a third logon field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

OtherCtrl2 = %d

Identifies the control ID of a fourth logon field and/or the mechanism to provide the additional field data to the appropriate control.

%d = -1; application does not require a fourth field

%d = 1; application requires a fourth field, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; fourth field control ID value; can be any value if Send Keys is used

OtherCtrl2Type = %d

Identifies the control type of a fourth logon field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

OtherLabel1 = %s

The text label used by the Agent when displaying a third logon field.

%s = the text the Agent will display

OtherLabel2 = %s

The text label used by the Agent when displaying a fourth logon field.

%s = the text the Agent will display

ParentKey1 = %s

Maps a subsection to its parent section.

%s = parent application/section name

PassKeyCtrl = %d

Identifies the password control field and/or the mechanism to provide the password data to the appropriate password control.

%d = 0; the user must use the Agent's "teaching tool" mechanism during application setup

%d = -1; application does not require a password

%d = 1; application requires a password, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; password control ID value; can be any value if Send Keys is used

PassKeyCtrlType = %d

Identifies the control type of the password control field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

PassPolicy = %s

Identifies which password policy section to associate with this application logon configuration.

%s = Policy Section Name

PresetFocusAll = %b

Specifies whether to set the focus to a logon field before the Agent actually places data in that field.

%b = 0; disabled (default)

%b = 1; enabled

QuietGenerator = %b

When set, this flag instructs the Agent to handle password change requests automatically and not inform the user that a password change request has been handled.

%b = 0; do not use quiet generator, use standard password change process with user intervention (default)

%b = 1; use quiet generator

Section%d = %s

Declaration of application subsections.

%d = consecutive integers

%s = subsection name

SystemLogon = %b

RESERVED. Flag identifying if a logon section is a system logon section.

%b = 0; not a system logon section (default)

%b = 1; system logon section

Timeout = %d

Determines the maximum time period between successive logon attempts that will trigger Error Loop detection.

%d = amount of time in seconds (default: 30)

UseSendKeys = %b

Send fields via keystrokes to the application.

If UseSendKeys is selected, then IDCtrl, PassKeyCtrl, OtherCtrl1, OtherCtrl2, and (if present) ChgCtrl0, ChgCtrl1, ChgCtrl2, and ChgCtrl3 variables must all be set to 1, if needed.

%b = 0; do not use Send Keys; use control IDs (default)

%b = 1; use Send Keys

VTabKey%d0 = %d1

Specifies the character/delay sequence to send before/after each credential field.

Fields are sent in the order specified by CtrlOrder.

UseSendKeys must also be enabled.

To send nothing for the specified value, specify a value of `` (two back-quotes in a row).

%d0 = 1; sequence to send before the first credential field

%d0 = 2; sequence to send after the first field, before the second

- so on; %d is not bound.

%d1 = Code sequence to send (see) (default: standard tab key)

VTabKeyPWC%d0 = %d1

Specifies the character/delay sequence to send before/after each credential field.

Fields are sent in the order specified by CtrlOrder.

UseSendKeys must also be enabled.

To send nothing for the specified value, specify a value of `` (two back-quotes).

%d0 = 1; sequence to send before the first credential field

%d0 = 2; sequence to send after the first field, before the second

- so on; %d is not bound.

%d1 = Code sequence to send (see) (default: standard tab key)

WindowTitle%d = %s

Text matched against logon window titles to identify logon requests. %d is replaced with a number, starting at 1, so that multiple windows can be identified for a single logon.

%d = consecutive integers

%s = window title string

Windows Application Keys for SectionN Subsection

These settings are used within subsections delineated by SectionN.

Example

[Corporate WinApp]

Section1=~Corporate WinApp Logon

Section2=~Corporate WinApp Password Change

&

[~Corporate WinApp Logon]

(the keys below)

Windows Application Keys | Description | Acceptable values
AppPathKey%d = %s | (See in parent section, above) | (See in parent section, above)
ChangeTitle%d = %s | (See in parent section, above) | (See in parent section, above)
ChgCtrl0 = %d | (See in parent section, above) | (See in parent section, above)
ChgCtrl1 = %d | (See in parent section, above) | (See in parent section, above)
ChgCtrl2 = %d | (See in parent section, above) | (See in parent section, above)
ChgCtrl3 = %d | (See in parent section, above) | (See in parent section, above)
CtrlOrder = %s1, %s2, %s3& | (See in parent section, above) | (See in parent section, above)
IDCtrl = %d | (See in parent section, above) | (See in parent section, above)
IDCtrlType = %d | (See in parent section, above) | (See in parent section, above)
IgnoreClassName = %s | (See in parent section, above) | (See in parent section, above)
InteractionMode = %b | (See in parent section, above) | (See in parent section, above)
Match%d = %s | (See in parent section, above) | (See in parent section, above)
ModuleName%d = %s | (See in parent section, above) | (See in parent section, above)
OKCtrl = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl1 = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl1Type = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl2 = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl2Type = %d | (See in parent section, above) | (See in parent section, above)
ParentKey1 = %s | (See in parent section, above) | (See in parent section, above)
PassKeyCtrl = %d | (See in parent section, above) | (See in parent section, above)
PassKeyCtrlType = %d | (See in parent section, above) | (See in parent section, above)
VTabKey%d0 = %d1 | (See in parent section, above) | (See in parent section, above)
VTabKeyPWC%d0 = %d1 | (See in parent section, above) | (See in parent section, above)
UseSendKeys = %b | (See in parent section, above) | (See in parent section, above)
WindowTitle%d = %s | (See in parent section, above) | (See in parent section, above)

Windows Application Keys for MatchN Subsection

These settings are used within subsections delineated by MatchN.

Example

[Corporate WinApp

Section1=~Whatever subsection

Match1=~Corporate WinApp Logon Match

Match2=~Corporate WinApp Ignore Match

&

[~Corporate WinApp Ignore Match]

(the keys below)

Match Section Keys Description Acceptable values

ChangeTitle%d = %s

(See in parent section, above)

(See in parent section, above)

ChgCtrl0 = %d

(See in parent section, above)

(See in parent section, above)

ChgCtrl1 = %d

(See in parent section, above)

(See in parent section, above)

ChgCtrl2 = %d

(See in parent section, above)

(See in parent section, above)

ChgCtrl3 = %d

(See in parent section, above)

(See in parent section, above)

Field%d0 = %d1,%s1,%s2,%s3

The match criteria for the fields. %d1 is replaced with a number, starting at 1, so that multiple matching criteria could be set up for one screen. %d2 is replaced with the control ID of the matching criteria. %s1 is replaced with the control type. %s2 is replaced with the comparison operator. %s3 is replaced with the compare value.

%d0 = consecutive integers

%d1 = control ID of the matching criteria

%s1 = the control type could be the following, with the appropriate value in %s3:

text | actual text from the control
style | numeric value for the style of the control
class | the class of the control, usually Edit or Static
Edit | edit or combobox controls
Static | static controls (for example, text labels).

%s2 = the comparison operator could be the following:

EQ | equals
NE | not equal

%s3 = compared value

IDCtrl = %d

(See in parent section, above)

(See in parent section, above)

OKCtrl = %d

(See in parent section, above)

(See in parent section, above)

OtherCtrl1 = %d

(See in parent section, above)

(See in parent section, above)

OtherCtrl2 = %d

(See in parent section, above)

(See in parent section, above)

ParentKey1 = %s

(See in parent section, above)

(See in parent section, above)

PassKeyCtrl = %d

(See in parent section, above)

(See in parent section, above)

Type = %s

The type of event.

%s = string for the type:

Logon | logon events
Change | password change events
Confirm | confirm the new password
Ignore | bypass all events for the application

WindowTitle%d = %s

(See in parent section, above)

(See in parent section, above)


Host/Mainframe Application Keys

These settings are used within applications delineated in the [*Mainframe] section.

For all keys below that have row/column values, the row/column value starts at 1 (that is, top-left is 1,1).

For Telnet the value must be 1,1.
Example

[*Mainframe]

Section1=Corporate Mainframe

&

[Corporate Mainframe]

(the keys below)

Host Application Keys Description Acceptable values

AllowReveal = %b

Flag that enables or disables the Reveal button for password in Wizards and property pages.

%b = 0; disabled

%b = 1; enabled (default)

AltTabKey = %d

Flag to indicate how to send credentials to the host emulator. Normally, credentials are sent through a direct HLLAPI call but this setting specifies using another method. If this is set to 1, then Enter is pressed in between two fields. This is usually used for password change screens that separate the new password and confirmation password into two screens.

%d=1 is usually used for password-change scenarios that separate the new-password field and confirm-password into two screens.

%d = 0; Use HLLAPI to submit credentials directly to the credential fields (default).

%d = 1; Replace the Tab key with the Enter key between two fields.

%d = 2; Use HLLAPI SendKeys and enable support for CtrlOrder, PreKey, and TabKeyN. This is useful for logon scenarios with non-standard credential delimiters.

AutoOK = %b

Flag instructs the Agent to automatically send Enter for this application logon after insertion of logon data.

%b = 0; disabled

%b = 1; enabled (default)

CPWFlag = %d

Determines the behavior of the Password Change Wizard, for specific applications, when a user encounters a password-change request. This key is specified in the application's root section, not in a password-change subsection.

This setting can also be set globally, for all applications, via the Registry. See for instructions.

%d = 1; Prompts user with Password Change Wizard (default).

%d = 2; Prompts user to manually enter a new password, but also provides the option of having the Agent automatically generate the password.

%d = 4; Generates the new password automatically, but also provides the option of manually creating the new password.

%d = 10; Prompts user to manually enter a new password, without providing the option of having the Agent automatically generate the password.

%d = 12; Generates the new password automatically, without providing the option of manually creating the new password.

CtrlOrder = %s1,%s2,%s3,%s4,%s5

Determines the order in which fields are sent when AltTabKey=2.

For example, specifying CtrlOrder=OtherField1,IDField,PassField tells the Agent that the order in the dialog box should be OtherField1, then IDField, followed by PassField.

%s1 = The first field sent (default: IDField)

%s2 = The second field sent (default: PassField)

%s3 = The third field sent (default: OtherField1)

%s4 = The fourth field sent (default: NewPWField)

%s5 = The fifth field sent (default: NewPWField2)

%s5 = The sixth field sent (default: OtherField2)

DelayField = %d

Numeric value in milliseconds for the Agent to delay between actions (entering value into a field).

%d = integer value in milliseconds

Description = %s

Text describing this application, also stored in the Description field in Logon Manager.

%s = any string

Field%d0 = %d1, %d2, %s

Strings to match against text fields as displayed on the screen for identifying a host/mainframe logon. %d0 is replaced with a number, starting at 1, so that multiple text strings can be used to uniquely identify a logon. For Telnet applications, the values must be 1,1.

%d0 = consecutive integers

%d1 = row of first text string character

%d2 = column of first text string character

%s = text string

ForceReauth = %b

Force the user to reauthenticate before providing credentials to this application.

Applies to all subsections; the user would have to reauthenticate multiple times in a multiple-section password change scenario.

%b = 0; do not require reauthentication (default)

%b = 1; require reauthentication

Group = %s

Group section name that this application is a part of. Used when configuring for credential sharing groups. Special values include:

LDAP: Application uses LDAP Directory Server authenticator password.

Domain: Application uses the Windows authenticator password.

Refer to for detailed instructions.

Must set Windows Registry entry PWSEnable=1 to enable Groups.

%s = the section name of the application group that the application belongs to.

HideConfirmPW = %b

Determines whether to hide the password confirmation field in the Logon Error dialog.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

IDField = %d1, %d2

Location of first input character of username/ID field as displayed on a host/mainframe logon screen. For Telnet applications, this value is ignored and is optional. Set to 1,0 if the field is not present.

%d1 = row of first text string character

%d2 = column of first text string character

MaxRetry = %d

Determines the number of logon retries the Agent makes before displaying the Logon Error dialog.

%d = the number of retries (default: 1)

NewPWField = %d1,%d2

This is the key-value pair that identifies the location of the new password field.

%d1 = row of first text string character

%d2 = column of first text string character

NewPWField2 = %d1,%d2

This is the key-value pair that identifies the location of the new password confirmation field. This is optional. This is not necessary if only one new password field is required.

%d1 = row of first text string character

%d2 = column of first text string character

OtherField1 = %d1, %d2

Location of first input character of third logon field as displayed on a host/mainframe logon screen. For Telnet applications, this value is ignored and is optional.

%d1 = row of first text string character

%d2 = column of first text string character

OtherField2 = %d1, %d2

Location of first input character of fourth logon field as displayed on a host/mainframe logon screen. For Telnet applications, this value is ignored and is optional.

%d1 = row of first text string character

%d2 = column of first text string character

OtherLabel1 = %s

The label presented within the Agent for the third logon field.

%s = text string

OtherLabel2 = %s

The label presented within the Agent for the fourth logon field.

%s = text string

Page%d = %s

Pointer to subsections used for multiple pages for one host/mainframe application. One application logon may have multiple pages.

%d = consecutive integers

%s = name of the subsection

ParentKey1 = %s

Maps a subsection to its parent section.

%s = parent application/section name

PassField = %d1, %d2

Location of first input character of password field as displayed on a host/mainframe logon screen. For Telnet applications, the values must be 1,1. Set to 1,0 if the field is not present.

%d1 = row of first text string character

%d2 = column of first text string character

PassPolicy = %s

Identifies which password policy section to associate with this application logon configuration.

%s = Policy Section Name

PreKey = %d

A string of characters and mnemonics defining what should be sent prior to any credential submission.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

QuietGenerator = %b

When set, this flag instructs the Agent to handle password change requests automatically and not inform the user that a password change request has been handled.

%b = 0; do not use quiet generator, use standard password change process with user intervention (default)

%b = 1; use quiet generator

TabKey1 = %d

A string of characters and mnemonics defining what should be sent after IDField is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey2 = %d

A string of characters and mnemonics defining what should be sent after PassField is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey3 = %d

A string of characters and mnemonics defining what should be sent after OtherField1 is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey4 = %d

A string of characters and mnemonics defining what should be sent after NewPWField is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey5 = %d

A string of characters and mnemonics defining what should be sent after NewPWField2 is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey6 = %d

A string of characters and mnemonics defining what should be sent after OtherField2 is submitted.

Any combination of characters and/or ASCII mnemonics Maximum length is 25 characters.

Timeout = %d

Determines the maximum time period between successive logon attempts that will trigger error loop detection.

%d = amount of time in seconds (default: 30)

Host Applications: Keys for PageN Subsection

These settings are used within subsections delineated by PageN.

Example

[Corporate Mainframe]

Page1=~Corporate Mainframe Logon

Page2=~Corporate Mainframe Password Change

[~Corporate Mainframe Logon]

(the keys below)

Host Application Keys | Description | Acceptable values
AllowReveal = %b | (See in parent section, above) | (See in parent section, above)
AltTabKey = %d | (See in parent section, above) | (See in parent section, above)
AutoOK = %b | (See in parent section, above) | (See in parent section, above)
CPWFlag = %d | (See in parent section, above) | (See in parent section, above)
CtrlOrder = %s1,%s2,%s3,%s4,%s5 | (See in parent section, above) | (See in parent section, above)
DelayField = %d | (See in parent section, above) | (See in parent section, above)
Description = %s | (See in parent section, above) | (See in parent section, above)
Field%d0 = %d1, %d2, %s | (See in parent section, above) | (See in parent section, above)
ForceReauth = %b | (See in parent section, above) | (See in parent section, above)
Group = %s | (See in parent section, above) | (See in parent section, above)
HideConfirmPW = %b | (See in parent section, above) | (See in parent section, above)
IDField = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
MaskPW = %b | (See in parent section, above) | (See in parent section, above)
MaxRetry = %d | (See in parent section, above) | (See in parent section, above)
NewPWField = %d1,%d2 | (See in parent section, above) | (See in parent section, above)
NewPWField2 = %d1,%d2 | (See in parent section, above) | (See in parent section, above)
OtherField1 = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
OtherField2 = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
OtherLabel1 = %s | (See in parent section, above) | (See in parent section, above)
OtherLabel2 = %s | (See in parent section, above) | (See in parent section, above)
Page%d = %s | (See in parent section, above) | (See in parent section, above)
ParentKey1 = %s | (See in parent section, above) | (See in parent section, above)
PassField = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
PassPolicy = %s | (See in parent section, above) | (See in parent section, above)
PreKey = %d | (See in parent section, above) | (See in parent section, above)
QuietGenerator = %b | (See in parent section, above) | (See in parent section, above)
TabKey1 = %d | (See in parent section, above) | (See in parent section, above)
TabKey2 = %d | (See in parent section, above) | (See in parent section, above)
TabKey3 = %d | (See in parent section, above) | (See in parent section, above)
TabKey4 = %d | (See in parent section, above) | (See in parent section, above)
TabKey5 = %d | (See in parent section, above) | (See in parent section, above)
Timeout = %d | (See in parent section, above) | (See in parent section, above)


Web Application Keys

These settings are used within applications delineated in the [*Other Webs] section.

Example

[*Mainframe]

Section1=Corporate Mainframe

&

[Corporate Mainframe]

(the keys below)

Web Application Keys Description Acceptable values

AllowReveal = %b

Flag that enables or disables the Reveal button for password in Wizards and property pages.

%b = 0; disabled

%b = 1; enabled (default)

AutoOK = %b

Flag instructs the Agent to automatically send Enter for this application logon after insertion of logon data.

%b = 0; disabled

%b = 1; enabled (default)

CPWFlag = %d

Determines the behavior of the Password Change Wizard, for specific applications, when a user encounters a password-change request. This key is specified in the application's root section, not in a password-change subsection.

This setting can also be set globally, for all applications, using the Registry.

%d = 1; Prompts user with Password Change Wizard (default).

%d = 2; Prompts user to manually enter a new password, but also provides the option of having the Agent automatically generate the password.

%d = 4; Generates the new password automatically, but also provides the option of manually creating the new password.

%d = 10; Prompts user to manually enter a new password, without providing the option of having the Agent automatically generate the password.

%d = 12; Generates the new password automatically, without providing the option of manually creating the new password.

Description = %s

Text describing this application, also stored in the Description field in Logon Manager.

%s = any string

ForceReauth = %b

Force the user to reauthenticate before providing credentials to this application.

Applies to all subsections; the user would have to reauthenticate multiple times in a multiple-section password change scenario.

%b = 0; do not require reauthentication (default)

%b = 1; require reauthentication

Group = %s

Group section name that this application is a part of. Used when configuring for credential sharing groups. Special values include:

LDAP: Application uses LDAP Directory Server authenticator password.

Domain: Application uses the Windows authenticator password.

Refer to for detailed instructions.

Must set Windows Registry entry PWSEnable=1 to enable Groups.

%s = the section name of the application group that the application belongs to.

HideConfirmPW = %b

Determines whether to hide the password confirmation field in the Logon Error dialog.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

IDField = %s1,%s2,%s3,%s4

Identification of the field for entering a username/ID.

If a frame/form/field name consists solely of digits, the enumerated value must be used.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

MaxRetry = %d

Determines the number of logon retries the Agent makes before displaying the Logon Error dialog.

%d = the number of retries (default: 1)

NewPWField = %s1,%s2,%s3,%s4

Identification of the field for entering a new password.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

NewPWField2 = %s1,%s2,%s3,%s4

Identification of the field for confirming a new password.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

OtherField1 = %s1,%s2,%s3,%s4

Identification of the third logon field.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

OtherField2 = %s1,%s2,%s3,%s4

Identification of the fourth logon field.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

OtherLabel1 = %s

The label presented within the Agent for a third logon field.

%s = text string

OtherLabel2 = %s

The label presented within the Agent for a fourth logon field.

%s = text string

ParentKey1 = %s

Maps a subsection to its parent section.

%s = parent application/section name

PassField = %s1,%s2,%s3,%s4

Identification of the field for entering the password.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

PassPolicy = %s

Identifies which password policy section to associate with this application logon configuration.

%s = Policy Section Name

QuietGenerator = %b

When set, this flag instructs the Agent to handle password change requests automatically and not inform the user that a password change request has been handled.

%b = 0; do not use quiet generator, use standard password change process with user intervention (default)

%b = 1; use quiet generator

Section%d = %s

Declaration of application subsections.

%d = consecutive integers

%s = subsection name

StrictURLCheck = %b

Determines whether to require an exact (case-insensitive) URL match or to use substring matching.

%b = 0; use substring matching (default)

%b = 1; use precise matching

SubmitField = %s1,%s2,%s3,%s4

Identification of the Submit button (or equivalent).

The value format is frame name/number, form name/number, field name/number/URL, and Field type. If the field type is image, the field name must be the entire/exact URL.

This entry is optional. If not specified, the Agent uses its own internal search logic to locate and press this button.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number/URL

%s4 = Field type (submit/image)

Timeout = %d

Determines the maximum time period between successive logon attempts that will trigger Error Loop detection.

%d = amount of time in seconds (default: 30)

URL%d = %s

The address(es) of a Web site's logon page(s).

Note: If the web address consists of spaces or special characters, use the URL quoting method (RFC 2396) to define the web address. This means substituting %20 for each space in the URL and substituting similar "%"-escaped ASCII hexadecimal values for all characters other than the following: : / , . = ? @

%d = consecutive integers starting with 1

%s = Web URL

Web Application Keys for SectionN Subsection

These settings are used within subsections delineated by SectionN.

Example

[Corporate WebApp]

Section1=~Corporate Intranet Logon #1

Section2=~Corporate Intranet Logon #2

&

[~Corporate Intranet Logon #1]

(the keys below)

Web Application Keys | Description | Acceptable values
IDField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
NewPWField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
NewPWField2 = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
OtherField1 = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
OtherField2 = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
ParentKey1 = %s | (See in parent section, above) | (See in parent section, above)
PassField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
SubmitField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
URL%d = %s | (See in parent section, above) | (See in parent section, above)


Password Policy Keys

These settings are used within subsections delineated by SectionN in the [*PasswordPolicies] section.

Example

[*PasswordPolicies

Section1=A policy

Section2=PIN

Section3=Windows

&

[A policy]

(the keys below)

Password Policy Keys | Description | Acceptable values
ALPHA = %s | Flag instructing the Agent to use alphabetic characters when generating a password. | %s = U; use upper case alphabetic characters only %s = L; use lower case alphabetic characters only %s = UL; use upper and lower characters (default) %s = (nothing); use no alphabetic characters
NAME = %s | Descriptive name of this password policy. | %s = any string
NUMCONSMAX = %d | Number of times a given character can be repeated consecutively (adjacent to itself). | %d =0 - 127 (default: 8)
NUMERIC = %b | Flag instructing the Agent to use numeric characters when generating a password. | %b = 0; do not use numeric characters (default) %b = 1; use numeric characters
NUMFLAGFIRST = %b | Flag indicating if a numeric character can start a password. | %b = 0; numeric character cannot start (default) %b = 1; numeric character can start
NUMFLAGLAST = %b | Flag indicating if a numeric character can end a password. | %b = 0; numeric character cannot end (default) %b = 1; numeric character can end
NUMRPTMAX = %d | Number of times a character can be repeated in a password. | %d =0 - 127 (default: 8)
NUMSIZE = %d | Maximum number of numeric characters. | %d =0 - 128 (default: 0)
NUMSIZEMIN = %d | Minimum number of numeric characters. | %d =0 - 128 (default: 0)
SBYE = %s | List of special characters to exclude when generating this password. | %s = any string of special characters, to exclude, such as: !@#$ The Windows registry key pair that holds the list of special characters normally used, but which can be excluded, is AccessManager:SpecialChars.
SCHARFLAGFIRST = %b | Flag specifying if a special character can start a password. | %b = 0; special character cannot start (default) %b = 1; special character can end
SCHARFLAGLAST = %b | Flag specifying if a special character can end a password. | %b = 0; special character cannot end (default) %b = 1; special character can start
SCHARS = %b | Flag instructing the Agent to use special characters when generating a password. | %b = 0; do not use special characters (default) %b = 1; use special characters
SCHARSIZE = %d | Maximum number of special characters. | %d =0 - 128 (default: 0)
SCHARSIZEMIN = %d | Minimum number of special characters. | %d =0 - 128 (default: 0)
SIZE = %d | Maximum total length of a password. | %d = 1 255 (default: 8)
SIZEMIN = %d | Minimum total length of a password. | %d = 1 255 (default: 8)


Global Agent Settings

Various functions and behaviors of ESSO-LM can be centrally defined by using the Settings dialog, setting Windows registry settings on the local workstation, and specifying administrative overrides via a Synchronizer extension.

Configure these settings in the ESSO-LM Administrative Console. The table is provided only for reference.

Registry settings can be set by the Agent, by the ESSO-LM Administrative Console, with the RegEdit Windows utility, and via a centrally managed software distribution mechanism. Registry settings are located in the following Windows Registry locations:

  • HKLM\…\ for computer-specific settings
  • HKCU\…\ for user-specific settings

Administrative override objects from Synchronizer extensions specify settings that override HKLM\…\ Windows Registry settings, which in turn overrides the HKCU\…\ Windows Registry settings.

 | Example:
Synchronizer extension object | Extensions\AccessManager:MFEnable=DWORD:0
overrides |
Computer-specific Registry Location (HKLM\…\) | HKLM\…\Extensions\AccessManager:MFEnable
overrides |
User-specific Registry Location (HKCU\…\) or User setting in Settings dialog in ESSO-LM Mainframe Enable | HKCU\…\Extensions\AccessManager:MFEnable

Setting Registry Settings and Administrative Overrides

The ESSO-LM Administrative Console can be used to configure HKLM\&\ values and deploy them to synchronizer extensions.

  1. In the ESSO-LM Administrative Console, create a new set of settings (right click Global Agent Settings and choose New Settings), load a saved set of settings (right click Agent Settings and select Import), or select an existing set of settings (by selecting it in the left pane).

  2. In the left pane, select and open the set of settings, and select and open the desired registry key.

    Registry entries beginning with Extensions\ are displayed in the ESSO-LM Administrative Console without the leading Extensions\.
  3. In the right pane, select the desired registry value, select the checkbox, and enter the desired value.
  4. Export to the desired format (Admin Override or HKLM Registry format):
  5. Select the set of settings in the left pane
  6. Choose Export from the File menu and choose an export format.

To deploy an administrative overrides file to a synchronizer extension, see the following topics:

  • Directory Server Support
  • Database Synchronization Support
  • File Server Support.

To use an HKLM Registry format file, either launch it (for example, double-click on the file from Explorer), import it (for example, from RegEdit), or deploy it using your deployment tool.

Refer to the Global Agent Settings Reference Guide for a complete description of these settings, including:

  • Screen layouts
  • Setting names
  • Setting descriptions
  • Registry names
  • Setting options and defaults
  • Registry and Data Types


Troubleshooting

Installation

Authenticators

Synchronizer Extensions

Uninstall

Agent Performance

Application Response

Authentication

Initial Authentication

Reauthentication

Application Configuration

All Applications

Windows Applications

Web Applications

Host Applications

Event Logging

Windows Event Viewer

Credential Sharing Groups

Synchronizer Extensions

Directory Extensions

File System Server

Roaming Profile Extension


Regular Expression Syntax

The following operators and meta-characters can be used to specify a text string pattern that the Agent uses to detect specific application windows. See Add Edit Window Title for more information.

The following explanations are adapted for the .NET regular expression reference. The complete description and syntax of regular expressions can be found on the Microsoft Developer Network website (www.msdn.microsoft.com).

Grouping
[ ] | Indicates a character class that matches any character inside the brackets. Example: [abc] matches "a," "b," and "c."
( ) | Indicates a character grouping operator. Example: (\d+,)*\d+ matches a list of numbers separated by commas (such as "1" or "1,23,456").
{ } | Indicates a match group. Example: {0-9+}-{0-9+} matches "100-1234", where the two match groups are "100" and "1234," respectively.
| | Separates two expressions, exactly one of which matches. Example, T|the matches "The" or "the").
Matching
. | Matches any single character.
^ | If ^ occurs at the start of a character class, it negates the character class. A negated character class matches any character except those inside the brackets. Example, [^abc] matches all characters except "a", "b", and "c"). If ^ is at the beginning of the regular expression, it matches the beginning of the input. Example, ^[abc] will only match input that begins with "a," "b," or "c").
$ | At the end of a regular expression, $ matches the end of the input. Example: [0-9]$ matches a digit at the end of the input.
- | In a character class, a hyphen indicates a range of characters. Example: [0-9] matches any of the digits "0" through "9."
Repeat operators
! | Negates the expression that follows.
? | Indicates that the preceding expression is optional: it matches once or not at all. Example: [0-9][0-9]? matches "2" and "12").
+ | Indicates that the preceding expression matches one or more times. Example: [0-9]+ matches "1," "13," "666," and so on.
* | Indicates that the preceding expression matches zero or more times.
??, +?, *? | "Non-greedy" versions of ?, +, and *. These match as little as possible, unlike the greedy versions which match as much as possible. Example: given the input "<abc><def>," <.*?> matches "<abc>" while <.*> matches "<abc><def>."
Escape and abbreviation

\

Escape character that forces the next character to be interpreted literally. Example: [0-9]+ matches one or more digits, but [0-9]\+ matches a digit followed by a plus character).

If \ is followed by a number n, it matches the nth match group (starting from 0).

Example: <{.*?}>.*?</\0> matches "<head>Contents</head>".

The \ is also used for abbreviations as described in the following table.

Abbreviation | Meaning | Matches
\a | Any alphanumeric character | [a-z A-Z 0-9]
\b | White space (blank) | [ \\t]
\c | Any alphabetic character | [a-z A-Z]
\d | Any decimal digit | [0-9]
\h | Any hexadecimal digit | [0-9 a-f A-F]
\n | New line | \r|\r?\n
\q | A quoted string | \"[^\"]*\"|\'[^\']*\'
\w | A simple word | [a-z A-Z]+
\z | An integer | [0-9]+


Troubleshooting: Installation

● Reference > Troubleshooting > Installation > Authenticators

Installation

Authenticators

An authenticator is not installed when selected
  • By default, the installer does not install authenticators that will not work on the system. For example, if the Entrust Entelligence client is not installed, then the authenticator for the Entrust PKI will not be installed (Entrust Entelligence is available with Authentication Manager only).

Synchronizer Extensions

The Microsoft Active Directory extension is not installed when selected
  • By default, the installer does not install synchronizer extensions that will not work on the system. For example, if the Microsoft Active Directory client is not installed, then the synchronizer extension for the Microsoft Active Directory Server will not be installed.

Uninstall

User credentials remain after uninstall

  • Only the current user's credentials can be removed by the standard uninstall. A simple batch file can handle removing other credentials. For Windows 2000, for example:

    CD /D %UsersProfile%

    CD .

    For /D %Z in (*.*) do Del /F/S/Q "%Z\Application Data\SSO"

  • You will need to manually delete registry entries for other users. This can be done in RegEdit or RegEdit32 (RegEdt32.exe), or you can push the following *.reg file to each user:

    Windows Registry Editor Version 5.00

    HKey_Current_User\Software\Passlogix]


Troubleshooting: Agent Performance

● Reference > Troubleshooting > Agent Performance > Application Response

Agent Performance

Application Response

The Agent responds slowly, applications are slowed, or specific functions within applications are slowed, when the Agent is running.

  • Some antiviral software programs check Agent modules too aggressively. To resolve this, disable checks of ssoshell.exe and/or of the %ProgramFiles%\Passlogix\v-GO SSO directory tree.
  • Some antiviral software programs check *.mdb files too aggressively. The Agent stores user credentials in *.mdb files. To resolve this, disable checks of *.mdb files, of the file %UserName% aml.mdb, and/or of files in the %AppData%\Passlogix directory.


Troubleshooting: Authentication

● Reference > Troubleshooting > Authentication > Initial Authentication

Authentication

Initial Authentication

User logs onto a computer with different domain/workgroup accounts but sees the same credentials.

  • The problem is that the local computer's Windows account provides the user's Registry Hive (HKCU), not the domain/workgroup account. There are two workarounds: use the CleanupOnShutdown feature or use a different Windows account for each domain/workgroup logon.

Reauthentication

Users are never asked to reauthenticate.

  • Make sure Extensions\AccessManager:AutoLogin is set to the desired value. The value is in milliseconds; a value of 900000 (default for client-side installations) is 15 minutes.

Users have to reauthenticate too frequently.

  • Make sure Extensions\AccessManager:AutoLogin is set to the desired value. The value is in milliseconds; a value of 900000 (default for client-side installations) is 15 minutes.
  • Make sure other force-reauth settings are set appropriately. These settings include:
    • Overriding settings: Extensions\AccessManager:ReauthOnReveal.
    • Application configuration settings: ForceReauth.


Troubleshooting: Application Configuration

● Reference > Troubleshooting > Application Configuration > All Applications

Application Configuration

All Applications

The Agent doesn't recognize pre-existing logon credentials after an upgrade

After an upgrade of the Agent, users report that applications for which they have previously provided credentials no longer function. Instead, a message box appears, advising that the credentials do not correspond to configured logons. The applications appear in Logon Manager in grey, italicized text.

  • Create a Bulk Add list to update the user's entlist.ini. Also note that in ESSO-LM, preconfigured logons for Windows and Web applications are provided in ESSO-LM Administrative Console templates, rather than in the Agent's applist.ini. Create the required application logons, using templates. then create the Bulk Add list to update the user's entlist.ini.
An application is not available in the list of predefined applications when you add credentials.
  • Shut down the Agent making sure that no ssoshell.exe processes are running, and restart the Agent.
The Agent can be started and Logon Manager can be opened without the user authenticating.
  • Shut down the Agent, kill any running ssoshell.exe or SSObho.exe processes, and restart the Agent.

Windows Applications

Predefined Windows Applications

The Agent does not recognize a password change window

The Agent does not respond to an application's configured password-change dialog

This can be remedied by adding the password-change form's window title to the main logon form's window-title matching list.

  • In the ESSO-LM Administrative Console, select the application in the left pane and click the General tab. Double-click the Password Change form for the application to open the form configuration dialog box. Note the Window Titles of the form, then click Cancel. Double-click the Logon form for the application and, under Window Titles, click Add. Enter the window title of the Password Change form, click OK, then click OK to close the form configuration dialog box.

Double-Logon or Wrong Window

The Agent responds twice to an application or responds to a previously-invisible window or to the wrong window
  • Use one or more (additional) Match sections and Field keys to specify more precise matching criteria.
  • Specify the window class that should be ignored in Ignore this Window Class in the Miscellaneous tab (see) on the application configuration.
The Agent does not respond to any Windows application.
  • Shut down the Agent, kill any running ssoshell.exe or SSObho.exe processes, and restart the Agent.
The Agent does not respond to a specific Windows application
  • Use fewer matching criteria.
  • Check that the application configuration values that are numbers are in decimal, not hexadecimal.
  • Check that the application configuration values that are strings are the exact ones in the application dialog boxes.
  • If using multiple sections, try a test with just one section.
The Agent provides credentials but does not submit
  • Verify that Auto Submit is set in the Miscellaneous tab of the application configuration and AutoOK is set in the specific set of credentials.

SendKeys Issues

Web Applications

In order for ESSO-LM to respond correctly to ActiveX-based logon forms, you must configure these forms as Windows applications, with the template targeting the Web browser window.

Refer to the Oracle best practice document for Web templating for complete instructions.

Responding to Any Web Applications

The Agent does not detect or respond to a specific Web page
  • Check that the page has a password field (Field Type of Password); without it, the Agent will ignore the page.
  • Check that SSObho.exe is running.
  • Try disabling Java, JavaScript, and/or ActiveX support.
The Agent responds slowly to a specific Web page
  • Check that the page has finished loading. The Agent does not respond to a page until the page finishes loading completely.
  • Try turning off images.
  • Try disabling Java, JavaScript, and/or ActiveX support.
The Agent doesn't respond to a loaded Web Application
  1. Start the Agent, then trigger the Agent from Title Bar Button.
  2. Log On Using ESSO-LM.
  3. Refresh the Browser Page.
The Agent doesn't respond to a selected logon using ESSO-LM
  • There is a known issue in the Agent where it does not respond to Web Applications in this way. The Agent still responds via the other triggers.
If the browser is embedded within another application, the Agent might respond as if the browser is a Windows Application.
SSObho.exe does not run

If the Agent does not recognize web pages properly, make sure that SSObho.exe is running. If it is not, the Agent may think the user is in a Terminal Services session. To correct this:

  1. Shut down the Agent. (Verify no SSO* tasks are running in Task Manager.)
  2. Uninstall the Agent.
  3. Make sure the following files are not present on the user's computer:
    • SSOwts.exe
    • SSOwts.exe
    • SSOwts.exe

  4. Search using RegEdit in the system hives of the registry (for example, NOT in HKEY_CURRENT_USER or HKEY_USERS) for references to SSO, vGO, and Passlogix. Delete all inappropriate references, especially:

    HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix and its children

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04EB19CE-B3B3-11D2-8A09-006008C7059E} and its children

    HKEY_CLASSES_ROOT\CLSID\{04EB19CE-B3B3-11D2-8A09-006008C7059E} and its children

    HKEY_CLASSES_ROOT\AppID\SSO WTS.EXE and its children

    HKEY_CLASSES_ROOT\AppID\{6B9E3EFF-C54A-472C-821B-6FC464B58235} and its children

    HKEY_CLASSES_ROOT\SSObho.HelperObject and its children

    HKEY_CLASSES_ROOT\SSObho.HelperObject.1 and its children

  5. Reinstall the Agent.

When Predefining Web Applications

The Agent provides credentials but does not submit
  • If a Submit field is of type Image, make sure that the URL is exact, including the protocol.
  • If a Submit field is not present, add one.
Instead of submitting the page, the Agent triggers a link to another page or some other action (for example, cancel/clear).
  • Add a Submit field to the application configuration.
The Web page uses more than three fields (for example, a Social Security # as three fields and a password).
  • Break the logon up into two (or more) logons. Then the user will select (via the Logon Chooser) first the credential lacking the password (with Auto Submit disabled) and then the credential with the password.

Web Applications that are not predefined

The Agent provides credentials but does not submit
  • Keep the system focus on the window that is requesting the credentials; if you switch to another window, the Agent will supply the credentials but not tell the page to submit.
Instead of submitting the page, the Agent triggers a link to another page or some other action (for example, cancel/clear)
  • Turn off Auto Submit for that credential, and manually trigger page submission.
  • Predefine the page, specifying the Submit field.
  • When adding credentials, the window title is stored instead of the URL.
    • Check that SSObho.exe is running. (See above.)

    Host Applications

    Responding to Any Host Applications

    The Agent does not respond to any Host application
    • Shut down the Agent, kill any running ssoshell.exe or SSObho.exe processes, and restart the Agent.
    • Check that HLLAPI is properly enabled in the host emulator.
    • Check that MFEnable=1.
    • Check that the coordinates are relative to the top-left corner, where the top-left corner is (1,1) (row 1, column 1).
    The Agent does not respond at all to any Telnet application
    • Check that the Host emulator supports Telnet through HLLAPI or through a scripting language. Note: The Agent supports Telnet through HLLAPI only for ScanPak Aviva and NetManage Rumba

    Responding to a Specific Host Application

    One or more credential fields are not inserted, or are partially inserted
    • Check that the coordinates are relative to the top-left corner, where the top-left corner is (1,1) (row 1, column 1).
    • Check that application configuration coordinates are for the exact place where credentials are inserted; usually, there is a space after the field prompts (for example, "Username:Space"), and the credential field needs to be inserted after the space.
    • If a special character sequence is used between fields, check that the sequence is valid, that Delay Field is set to a sufficiently-high value.
    The Agent does not respond at all to a specific Host application.
    • Check that the coordinates are relative to the top-left corner, where the top-left corner is (1,1) (row 1, column 1).
    • Use fewer matching criteria.
    The Agent does not respond at all to a specific Telnet application
    • Check that the coordinates for all fields are set to (1,1).


Troubleshooting: Event Logging

● Reference > Troubleshooting > Event Logging

Event Logging

All Extensions

No events are recorded
  • The Filter setting is not set. For testing purposes, set to 0xFFFFFFFF (to log all events) and restart the Agent.
  • The Agent has not reached the Retry setting (default: 30 minutes). To change the value from the default, set Extensions\EventManager:Retry or Extensions\EventManager\%Extension%:Retry to a lower value. To verify that the Event Logging is occurring, open the user's %UserName% AML.mdb file, look in the SSOSection column for entries with the name starting with CacheItem (for example, CacheItem1). These items are the events, cached until the retry time is reached. At the retry time, the cached events will be sent to the extension(s).
The wrong events are recorded
  • The Filter setting is set improperly. Review the Event Logging Filter , note the precise bit order and conversion from binary to hexadecimal/decimal.

Windows Event Viewer

Credentials do not arrive at the server
  • The server name is not properly set. Do not use leading "\\" characters. Specify the proper NetBIOS name (not the TCP/IP name).
Credentials do not arrive at the server
  • The server name is not properly set. Do not use leading "\\" characters. Specify the proper NetBIOS name (not the TCP/IP name).
Credentials on the server are missing data; category and event labels are only numbers and the Description is similar to "The description for Event ID ( ### ) in Source (ESSO-LM) cannot be found.

The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event:"

  • The server is not properly configured. See Windows Event Logging extension for instructions on configuring the server.


Usage Reports

● Reference > Troubleshooting > Usage Reports

Usage Report Dialog Box

The usage report is helpful in monitoring access of users and applications, and also troubleshooting problems.

Use this dialog box to generate usage reports with information about the user, application, modified date, and the date last used. In the Output File field, enter a descriptive name for the output file and use the Browse button to select a place to save the report. Optionally, check the Include header row box to include a header row for the report.


Troubleshooting: credential sharing groups

● Reference > Troubleshooting > Credential Sharing Groups

Credential Sharing Groups

Credential Sharing Groups are not working
  • Make sure Extensions\AccessManager:PWSEnable=1.
A Password Change within an application in the Domain or LDAP groups does not notify the authenticator of the change
  • Make sure AUI:ShareToAuth=1.


Troubleshooting: Synchronizer Extensions

● Reference > Troubleshooting > Synchronizer Extensions > Directory Extensions

All Synchronizer Extensions

Directory Extensions—All Directory Support

User Connections

Cannot connect via SSL
  • Make sure the directory connection works without SSL.
A user cannot create an object on the directory
  • Make sure the user is connecting to the directory.
  • Make sure UserPaths points to a valid location.
  • A SSOlocator object for the user does not exist, either specifically for the user or as a default object. Put a default object in the location UserPaths points to; if this works, you can move the default object up the tree or put a user-specific object on the tree.

Admin Objects

Admin objects (vGOAdminOverride, vGOentlist, vGOftulist) cannot be altered.

Existing objects cannot be overwritten. Instead, delete the old objects and then push new ones.

User Objects

  • Microsoft Active Directory Server
  • Oracle Directory Server Enterprise Edition
  • Novell eDirectory

File System Server

User connections

A user cannot create an object on the directory
  • Make sure the user can connect to the File System share directly (for example, in Explorer).


Configuring Your System with Settings and Registry Values

You can configure ESSO-UAM using a variety of tools.

Managing Settings Configured in Multiple Locations

It is important to be aware of how policies and settings interact with each other (if you set values for the same settings in more than one location). Some settings will always overwrite others.

In Local Mode:

Administrative per-user settings take precedence over any administrative per-computer settings. However, administrative settings, either per-user or per-computer, always take precedence over user settings (those that are configured through the Client application).

There are no roaming policies in local mode.

In Enterprise Mode:

Roaming policies (those that are configured from the administrative console) take precedence over any administrative per-computer settings. Administrative per-computer settings take precedence over any enterprise user settings (those that are configured through the Client application).

Administrative per-user settings are ignored in enterprise mode.

Global Client Settings

These are general ESSO-UAM application configuration settings. Generally per-machine values, in most cases they modify the behavior of various UAM features for all users on a particular computer. Often these are values that most customers may never need to modify, or they are values that cannot be expressed on a per-user basis (UAM roaming policy only supports per-user values).

Target | Category | Type | Name | Values | Description | Path
Framework | General | DWORD | Client Mode | Enterprise Client Mode (1) (default) or Local Client Mode (0) | Client Mode may be set to Local or Enterprise during install. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Logging | DWORD | Logging Enabled | Yes (1) or No (0) (default) | Turn debug logging on or off. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Logging | DWORD | Logging Level | Fatal Errors Only (1), Business Logic Errors (2), Warnings - Recoverable Error Conditions (3), Informational - Business Logic Flow (4) (default), Debug - Extra Debugging Information (5), Verbose - Maximum Debugging Information (6) | Maximum logging verbosity. Each level includes all preceding levels of a lesser numeric value. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Logging | SZ | Logging Path | default is c:\uamlog.txt | Specify debug log path and filename. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Logging | SZ | Logging Filter Process (Show) | N/A | Regular expression to only show matching log entries by process name. Default is to show all entries. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Logging | SZ | Logging Filter Process (Hide) | N/A | Regular expression to hide matching log entries by process name. Default is to show all entries. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Logging | SZ | Logging Filter Source (Show) | N/A | Regular expression to only show matching log entries by source filename. Default is to show all entries. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Logging | SZ | Logging Filter Source (Hide) | N/A |  | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix
Framework | Communication | DWORD | IPC Timeout | Default is 5000 ms Allowed range is 1-60000 ms | Controls the communication timeouts between ESSO-UAM client applications and the ESSO-UAM auth service. It is unlikely this will ever need to be modified, but it is possible that on extremely slow computers, it may need to be increased in order for client applications to function. | HKLM\SOFTWARE\Passlogix\UAM
Framework | Communication | DWORD | IPC Retries | Default is 3 retries Allowed range is 0-10 retries | Service connect retries. It is unlikely this will ever need to be modified, but it is possible that on extremely slow computers, it may need to be increased in order for client applications to function. | HKLM\SOFTWARE\Passlogix\UAM
Framework | User Resolution | DWORD | User ID MRU Cache Size | Default is 5 users Allowed range is 1-2147483646 users | Number of user identities to cache in the disconnected MRU. Also used during synchronization. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | User Resolution | DWORD | User ID Timeout 1 | Default is 1000 ms Allowed range is 1-2147483646 ms | How long to wait for live resolution before falling back to cache. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | User Resolution | DWORD | User ID Timeout 2 | Default is 5000 ms Allowed range is 1-2147483646 ms | Additional time to wait for live results when cache is empty. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Enrollment | DWORD | Prompt Token Description | Prompt User for Description (1) or Do Not Prompt User for Description (0) (default) | Ask user to enter a token description during enrollment. If not prompted, the default description is automatically used. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Enrollment | SZ | Default Token Description | N/A | Default description to associate with each token. Used only if specific authenticator has no default description. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Enrollment | SZ | Default Proximity Card Description | N/A | Default description for each proximity card. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Enrollment | SZ | Default Smart Card Description | N/A | Default description for each smart card. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Reauthentication | DWORD | Max Auth Attempts | Default is 3 attempts Allowed range is 1-2147483646 attempts | Number of consecutive credential capture attempts allowed during reauthentication. Note: Windows Password always has unlimited attempts. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Reauthentication | SZ | Default Authenticator | None (default), Fingerprint, BioAPI, Proximity Card, Smart Card, Windows Password | Default authenticator to use in preference to remembering the last used method. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Framework | Reauthentication | DWORD | Hide Always Use Method | Hide Checkbox (1) or Show Checkbox (0) (default) | Hide or show the Always Use Method checkbox. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM
Synchronization | ASDI Sync | SZ | Global Data Container Path | N/A | Optional LDAP path to global data in format "LDAP:\\[host[:port]\]CN=path,DC=domain". Blank will contact any available domain controller on default port and will use the default path of "CN=UAM,CN=Passlogix,CN=Program Data,DC=domain". | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager\Synchronizers\ADSI
Synchronization | ASDI Sync | DWORD | User Data Storage Location | Store with Global Data (1) or Store Under User Objects (0) (default) | Choose where to store per-user credentials. Note: User Objects are only supported in AD. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager\Synchronizers\ADSI
Synchronization | Sync Timeouts | DWORD | Data Sync Timeout | Default is 10000 ms Allowed range is 1-2147483646 ms | Time to wait for any foreground data sychronization to complete. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Sync Timeouts | DWORD | Policy Sync Timeout | Default is 10000 ms Allowed range is 1-2147483646 ms | Time to wait for any foreground policy sychronization to complete. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Per-Logon Sync | DWORD | Per-Logon Data Sync Interval | Default is 5 minutes Allowed range is 1-2147483646 minutes | Sync user data at logon only if data sync not performed with past X minutes. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Per-Logon Sync | DWORD | Per-Logon Data Sync Asynchronous | Asynchronous Update (1) (default), or Synchronous Update (0) | Sync user data at logon synchronously or asynchronously. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Per-Logon Sync | DWORD | Per-Logon Policy Sync Interval | Default is 5 minutes Allowed range is 1-2147483646 minutes | Sync user policy at logon only if policy sync not performed with past X minutes. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Per-Logon Sync | DWORD | Per-Logon Policy Sync Asynchronous | Asynchronous Update (1) (default), or Synchronous Update (0) | Sync user policy at logon synchronously or asynchronously. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Background Sync | DWORD | Background Sync Enabled | Disabled - No background sync (0) (default), Enabled - Sync Policy and Data (1), Sync User Data Only (2), Symc User Policy Only (3) | Enable or disable periodic background service update of cached user policy and data. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Synchronization | Background Sync | DWORD | Background Snyc Interval | Default is 90 minutes Allowed range is 1-2147483646 minutes | Set time interval between periodic background service update of cached user policy and data | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\SyncManager
Client | Enrollment | DWORD | Enroll Success Dialog Timer | Default is 5 seconds Allowed range is 1-2147483646 seconds | Hide or display enroll success dialog and configure auto-submit timer. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Client
Logon | General | SZ | Default Authenticator | None, Fingerprint, BioAPI, Proximity Card, Smart Card, Windows Password | Default authenticator to use in preference to remembering the last used method. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Gina
Fingerprint | BIO-key BSP | DWORD | BIO-key Fingers to Enroll | Default is 3 fingers Allowed range is 1-10 fingers | WARNING: MUST BE DEFINED AND SET TO 1 OR ESSO-UAM WILL NOT WORK. Internal BIO-key fingers per enrollment setting with default of 3. This setting is NOT related to the policy to control the number of fingers required for enrollment. | HKEY_LOCAL_MACHINE\SOFTWARE\BIO-key\Biometric Service Provider\Setting
Proximity Card | General | DWORD | Insertion Delay | Default is 0 ms Allowed range is 1-2147483646 ms | Rest period between accepting consecutive proximity token insertions. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{4A8F93E4-2328-44CA-8DBE-FBFA4E5FD334}\Settings
Proximity Card | Omnikey Provider | DWORD | Omnikey Enabled | Enabled (1) (default), or Disabled (0) | Enable or disable the Omnikey proximity card provider. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{4A8F93E4-2328-44CA-8DBE-FBFA4E5FD334}\Settings
Proximity Card | Omnikey Provider | DWORD | Minimum Presence | Default is 0 ms Allowed range is 1-2147483646 ms | Minimum token presence before accepting a proximity token. Note: Use 1500 or greater to resolve Omnikey 5125 driver defect. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{4A8F93E4-2328-44CA-8DBE-FBFA4E5FD334}\Settings
Proximity Card | RFIdeas Provider | DWORD | RFIdeas Enabled | Enabled (1) (default), or Disabled (0) | Enable or disable the RFIdeas proximity card provider. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{4A8F93E4-2328-44CA-8DBE-FBFA4E5FD334}\Settings
Proximity Card | RFIdeas Provider | DWORD | RFIdeas Min Serial Bit Count | Default is 8 bits Allowed range is 0-64 bits | Minimum number of bits to accept as a serial number. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{4A8F93E4-2328-44CA-8DBE-FBFA4E5FD334}\Settings
Proximity Card | RFIdeas Provider | DWORD | RFIdeas Serial COM Enabled | Enabled (1), or Disabled (0) (default) | Enable or disable RFIdeas serial COM port devices. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{4A8F93E4-2328-44CA-8DBE-FBFA4E5FD334}\Settings
Smart Card | General | DWORD | UAM PIN Mode Enabled | Disabled - User Smart Card PIN (0) (default), Enabled - Use UAM PIN (1) | Configure smart card authenticator to use CARD PIN or a virtual UAM PIN. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Settings
Smart Card | Microsoft Base CSP Provider | DWORD | Microsoft Base CSP Enabled | Enabled (1) (default), or Disabled (0) | Enable or disable smart card authenticator support for Microsoft Base CSP. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\BaseCSP
Smart Card | PKCS#11 Provider | DWORD | PKCS#11 Enabled | Enabled (1) (default), or Disabled (0) | Enable or disable smart card authenticator support for PKCS#11. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11
Smart Card | PKCS#11 Provider | SZ | Module Filename | N/A | Relative or full path to PKCS#11 DLL. Appended to Registry Key/Value contents, if any. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11
Smart Card | PKCS#11 Provider | SZ | Module Registry Key | N/A | Registry key to read PKCS#11 DLL path and/or filename from. Used with Registry Value. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11
Smart Card | PKCS#11 Provider | SZ | Module Registry Value | N/A | Registry value to read PKCS#11 DLL path and/or filename from. Used with Registry Key. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11
Smart Card | PKCS#11 Provider | DWORD | PKCS#11 Card Timeout | Default is 2000 ms Allowed range is 0-5000 ms | Registry value to read PKCS#11 DLL path and/or filename from. Used with Registry Key. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Settings
Smart Card | PKCS#11 Provider | DWORD | PKCS#11 Serial Number Timeout | Default is 500 ms Allowed range is 0-5000 ms | Max time to wait for a PKCS#11 module to report serial information for an inserted card. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Settings
Smart Card | PKCS#11 Provider | DWORD | PKCS#11 Never Unload Module | Unload DLLs After Use (0) (default), Never Unload DLLs (1) | Option to keep each PKCS#11 DLL permanently loaded in each process. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Settings
Smart Card | PKCS#11 Provider | DWORD | External Authentication Mode | Smart Card PIN Authentication (0) (default), PKCS#11 Protected Auth Flag (1), Force External Authentication (2), Create Session Object (Morpho) (3) | Smart card authentication behavior. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11
Smart Card | PKCS#11 Provider | DWORD | External Authentication Dialog | Hide Status Dialog (0) (default), Show Status Dialog (1) | Show or hide status dialog when performing external authentication. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11
Smart Card | PKCS#11 Provider | DWORD | External Enrollment Mode | Auth Mode Reauthentication (0) (default), PIN + Morpho Fingerprint Enroll (1), Force Smart Card PIN Auth (2), No Auth (Register Card ID Only) (3) | Smart card enrollment behavior. | HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\UAM\Authenticators\{A1B34553-8D40-42A9-8ED5-F70E3497E138}\Providers\PKCS#11

Global Branding Settings

These are general settings related to branding. They allow customers to modify certain brandable text or graphical elements of UAM on a per-deployment or per-computer basis.

Target | Category | Name | Values | Description | Path

Per-Computer Admin Settings

These are the system-wide Admin Settings (overrides to user settings). In Local Mode, these can be overridden by Per-User Admin Settings. In Enterprise Mode, they can instead be overridden by Roaming Policy. See Page 2/3 of the above doc for a table of how this works (copied above).

Target | Category | Name | Values | Description | Path


Add-on modules

ESSO-LM Add-On Modules

Oracle offers several add-on modules to customize ESSO-LM functionality for individual environments. Settings that are specific to these add-on modules exist within the ESSO-LM Administrative Console. These settings only function with their corresponding modules.

Oracle Enterprise Single Sign-on Anywhere | Oracle Enterprise Single Sign-on Anywhere (ESSO-Anywhere) enables deployment of Oracle Enterprise Single Sign-on Logon Manager (ESSO-LM) and other Agents to end users' desktops using a deployment package that you configure through the ESSO-LM Administrative Console.
Oracle Enterprise Single Sign-on Provisioning Gateway | Oracle Enterprise Single Sign-on Provisioning Gateway (ESSO-PG) provides an administrator with the ability to provision ESSO-LM with a user’s usernames and passwords automatically, using a provisioning system. An administrator is able to add, modify and delete usernames and passwords for particular applications within the provisioning system and have the changes reflected in ESSO-LM.
v-GO Shared Accounts Manager | v-GO Shared Accounts Manager (v-GO SAM) provides system and application access for administrators, temporary workers, and others who share account IDs.
Oracle Enterprise Single Sign-on Universal Authentication Manager | Oracle Enterprise Single Sign-on Universal Authentication Manager (ESSO-UAM) enables enterprises to replace the use of native password logon to Microsoft Windows and Active Directory networks with stronger and easier to use authentication methods. The ESSO-UAM system also enhances enterprise security beyond traditional password authentication by providing two-factor authentication methods.


About ESSO-Anywhere

Oracle Enterprise Single Sign-on Anywhere (ESSO-Anywhere) is the latest innovation in portable single sign-on (SSO) technology, enabling deployment of Oracle Enterprise Single Sign-on Logon Manager (ESSO-LM) and other Agents to end users' desktops.

Using the ESSO-Anywhere Console, the administrator creates a deployment package configured with the Oracle products needed by users of an enterprise, making the package available over a Web server or file share. Users download this deployment package from an HTML interface that is included with the ESSO-Anywhere package, and which the administrator customizes. Users can then perform installations of the Oracle product suite on their own workstations at the click of a button, with assurance that configurations are correct and ready to run, and without administrator intervention.

ESSO-Anywhere is designed for compatibility with Windows Authenticator v1. It is not designed to work with ESSO-LM features that require installing system services or GINAs, adding registry entries outside of Live HKLM\Software\Passlogix, or additions to Program Files or Windows system folders.

The Visual C++ Runtime Library and .NET 2.0 Framework are prerequisites for running ESSO-Anywhere. The installation package includes the Visual C++ Runtime Library, however you must make the .NET 2.0 Framework available to users. See the ESSO-Anywhere Release Notes for a complete list of software and hardware requirements.

The final output of the deployment package is not an .MSI file. You must ensure that you supply any additional requirements that your end users will need to run their ESSO-LM and additional Agent software.

Due to security restrictions in Vista, you must change group policy settings in order for end users running Vista client to use the ESSO-Anywhere deployment package. See the Technical Notes section in ESSO-Anywhere Release Notes for more information.


Creating a Deployment Package Using the ESSO-Anywhere Console

Following is the general procedure for creating a deployment package. Use the settings in the three tabs of the ESSO-Anywhere Console for your deployment configurations. See the ESSO-Anywhere documentation for complete instructions to create an on-demand deployment.

To create a deployment package:

  1. Create a certificate file to be submitted when you generate the deployment package.
  2. Install the ESSO-LM Administrative Console and Agent on a clean workstation.
  3. Optionally, install additional Agents: Authentication Manager, and ESSO-PG.
  4. Configure all Oracle products as you want them for deployment.
  5. Make your ESSO-LM, Authentication Manager, and ESSO-PG configuration settings available to ESSO-Anywhere by doing one of the following:
    • To have ESSO-Anywhere import configuration settings from the local registry, write the Global Agent Settings to the registry;

    • To have ESSO-Anywhere import configuration settings stored in a .REG file, export your settings from the ESSO-LM Administrative Console to a .REG file. For more information, see the ESSO-LM Administrative Console Help file.

      Test your configuration before proceeding to create the deployment package.

  6. Install the ESSO-Anywhere Console. ESSO-Anywhere reads the Oracle software configuration on the workstation where you installed it.
  7. Verify in the General tab that the products and versions installed are the ones that you want to deploy.
  8. From the Options tab, specify:
    • The deployment version and location, the installation location, and the installation type
    • The update schedule preferences
    • Which registry settings ESSO-Anywhere will use (the settings from the live registry, or the registry file you optionally created previously).
  9. On the Generate tab:
    The ESSO-Anywhere Console creates a deployment package in the location you specified in the Output folder setting.
    • In the Summary window, review all settings.
    • Enter the directory path where the deployment package will be created, or click the Browse… button to navigate to the directory.
    • Click the Generate button.
    • At the prompt, enter the location for the certificate file that you created, and the password.
  10. From the File menu, click Save or Save As… to save the deployment configuration settings.
  11. Copy the deployment package to the virtual directory or file share that you specified in the Target location setting.
  12. If deploying from a web server, customize the index.html file in the deployment directory, replacing the generic text with the information that you want end users to see.
  13. If this is a first installation, notify users that the deployment package is available.
  14. To create additional deployment packages, reconfigure settings on the ESSO-LM Administrative Console, and click New on the ESSO-Anywhere File menu.
Users do not have the option to alter the installation. If you want different users to install different packages, create a separate deployment package for each installation.


Provisioning Management

Managing Provisioning

Use this node to manage provisioning rights for users. There are two tabs to set the rights:

  • Default Rights
  • Delete SSO User Right

Default Rights

Use this tab to define the provisioning rights for each new application created. This feature sets standard rights for each application created. Once each application is created, change the rights as needed.

Controls
Directory | Select the target directory server.
Access information:
Name | Lists the groups or users who currently have access to this item.
ID | Lists the user account name.
Access | Indicates the permissions that have been granted to the user or group (Add, Modify or Delete Logon). To change a user or group's access rights, right-click the user or group and select Add Logon, Modify Logon or Delete Logon from the shortcut menu.
Actions
Copy permissions to | Use this button to easily apply the provisioning rights for the current application to multiple applications. Clicking this button displays a dialog listing all the applications. Selects the applications that you want these provisioning rights to be copied to. Use Ctrl+click or Shift+click to select multiple entries. Click OK.
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected item.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.

Add User or Group Dialog Box

The Add User or Group dialog box varies based on the directory server being used:

  • LDAP
  • Active Directory/ADAM

LDAP

Use this dialog to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls
Search Base | The base (highest-level) directory to begin searching for user/group accounts. All subdirectories of the base directory are searched. Type a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search. Use this dialog to browse to and select the base (highest-level) directory to search for user/group names. Click OK when finished.
Search | Begin searching the base directory for users and groups.
Users or Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.

Active Directory/ADAM

Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls
List Names From | Select an Active Directory domain or server.
Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add | Copies user(s) and group(s) selected in the Names list to the Add Names list. Use Ctrl+Click or Shift+Click to select multiple entries.
Members | When a group is selected the Names list, displays the Global Group Membership dialog box, which lists the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names | Display the names of the user(s) or group(s) for whom you have you have added so far. Click OK to add these names to the access list for the current configuration item. Note: You can type or edit user names in this list. However, entries are checked for invalid account names, and duplicate account selections are automatically removed when you click OK.

Delete SSO User Right

Use this tab to define the users to grant the Delete SSO User functionality to in the ESSO-PG Administrative Console. The controls function the same as on the Default Rights tab.


Add/Edit Notes

Use this dialog box to add or modify notes about the selected configuration item or settings.

  • Type or edit your notes, then click OK.

Use this dialog with the following configuration items:

  • General tab for (selected application)
  • Password Policy Subscribers tab
  • Selected Credential Sharing group
  • Selected Set of Global Agent Settings


Installing an ADAM Instance

  1. Launch ADAMSetup.exe
  2. Select A unique instance and click Next.
  3. Enter your instance name and click Next.
  4. Specify port numbers of 10000 and 10001 (10,000 range, for easy recall) and click Next.
  5. Specify the root DN (for example, OU=SSPR, DC=Oracle,DC=Com) and click Next.
  6. Specify an easy-to-find base location (for example, %RootDrive%\ADAM\Instance) and click Next.
  7. Specify the run privileges and click Next.
  8. Specify the administrative permissions and click Next.
  9. Select Do not import LDIF files for this instance of ADAM and click Next.
  10. Click Next as requested to proceed.
  11. Click Finish.


Edit Columns

Use the Edit Columns dialog box to select and order the logon details that appear as columns in the Agent's Logon Manager and Logon Chooser dialog boxes.

  • To add detail columns, select the columns in the Available list, then click >> to move your selections to the Selected list.
  • To remove detail columns, select the columns in the Selected list, then click << to move your selections to the Available list.
  • To change the order of the columns, select a column in the Available list and click Up or Dn.


Select Application for Password Policies, Exclusion Lists, or Session Lists

Select Applications, Password Policies, Exclusion Lists, or Session Lists

Use the Select Application (or Password Policies, Exclusion Lists, or Session Lists) dialog box to do one of the following:

  • Select one or more application logon configurations to include in a group or policy, or for export to an installer package
  • Select individual applications and password policies for deployment to a directory using role/group support
  • Add Kiosk Manager application lists to send.
  • Add an application to an Exclusion list.

Adding Applications to a Policy, Session List, or Exclusion List Group or Package

  1. Select the applications to add to this group. (Use Ctrl+click or Shift+click to select multiple entries.)
  2. Click OK.
  3. Click Add in one of these dialog boxes to open Select Applications:
    • Bulk-Add tab
    • Policy Subscribers tab
    • Selected credential sharing group
    • Configure Applications (Generate MSI)
    • Manage Templates
    • Publish to Repository: Select Applications and Password Policies


Generate MSI

Create a new .MSI file (a Windows Installer package), from an existing MSI package in order to add configured application logons and/or Agent configuration settings.

Generate MSI is typically used to modify the ESSO-LM installation package (\Full\setup.msi on the ESSO-LM distribution disk) to include logons or settings in the initial desktop installation of ESSO-LM. The MSI file you create can include:

  • Selected application logons from an entlist.ini file or from the current ESSO-LM Administrative Console configuration.
  • Agent settings from an administrative overrides (.ini) file or from the current ESSO-LM Administrative Console configuration.

Generating an MSI Package

  1. Select or type the names of the Base (input) and Output .msi files.
  2. Do either or both of the following:

    • Choose one or more configured Applications to include in the .msi package.

      or

    • Choose a set of Global Agent Settings to include in the .msi package.
  3. Click OK.
Files
Base (MSI)… | The base installer package to customize. Type the filename or click the … button to select the .msi file.
Output (MSI)… | The customized installer package that you will send to end users. Type a filename or click the … button to select an existing .msi file.
Configuration
Applications | Applications to be packaged. Click Choose to display Configure Applications dialog box.
Global Agent Settings | Set of Global Agent Settings to be packaged. Click Choose to display Configure Global Agent Settings dialog box.


Select Global Agent Settings (for an MSI package)

Selecting a Set of Global Agent Settings

Use the Configure Global Agent Settings dialog box to select the set of Global Agent Settings to include in an AdminOverride object for synchronization or for a customized Windows Installer package (.msi file).

From the drop-down menu, select an available set of Global Agent Settings, and click OK.


Event Logging Filter

Event Logging: Filter Options

Select the events you want to log, then click OK. The table below groups the filters by function.

You must select Event Types Info to enable Event Logging.

Type | Name
Changes to user data (Credential) | Credential Add
 | Credential Copy
 | Credential Delete
 | Credential Edit
Agent controls used (Feature) | Help
 | Reauthentication
 | Settings Change
 | Startup / Shutdown
Credential data supplied (Logon) | Logon Field: Fourth Field
 | Logon Field: System Domain
 | Logon Field: System Username
 | Logon Field: Third Field
 | Logon Field: Username
 | Sync User Information
Agent actions and changes (Application) | Primary Logon Method Change
 | Backup/Restore
 | Application Password Change
Event Types | Event Types Info (must be selected to enable Event Logging)


Selecting Role/Group Support Mode When Publishing to a Repository

The Publish to Repository window offers the option to apply role/group access control support for ESSO-LM configuration information.

If Standard mode (the default) is selected, configuration information is stored on the directory as standard ESSO-LM objects: EntList (for logons and policies), FTUList (for bulk-add and passphrase questions), and AdminOverride (global Agent settings).

Select Advanced mode to enable role/group support. All application logons, password policies, global Agent settings, and passphrase question sets are added to the current synchronization repository as individual objects.

Enable Role/Group Support
  • Select this checkbox to enforce role/group access-control settings for all logons, policies, global Agent settings, and passphrases.
  • Clear this checkbox to deploy configurations information without enforcing access control. Click Next to continue.


Creating a Template for a Running Application

You can create a new template, or edit an existing one, on-the-fly for a Windows or Web application while the application is running.

This procedure applies only to Windows and Web applications. If you attempt this procedure for a host or mainframe application, the Host/Mainframe Form Wizard launches.

In order to perform this procedure, both the ESSO-LM Administrative Consoleand the ESSO-LM Agent must be running, and you must configure the Agent settings to display the Title Bar Button [image] .

Creating a Template for a Windows Application

  1. Launch the application for which you want to create a template.

  2. Select Create Template from the application's Title Bar Button menu.

    Two things happen:

    • In the application's window, ESSO-LM detects the credential fields and highlights them.
    • A condensed version of the Form Wizard appears. Enter information for the following fields:
      • Form Name. This field is pre-filled with the name of the selected application. You can leave this as it is or change it if you want to.

      • Form Type. Select the form type from the drop-down menu:

        Logon

        Logon Success

        Logon failure

        Password change

        Password change success

        Password change failure

    • Add to Template.

      This field defaults to the New Template selection. Alternatively, the drop-down menu contains the list of all configured Windows application templates to which you might want to add this form.

    • Edit Fields/Hide Details.

      Toggle this button to expand the window to display the entire Form Wizard, or collapse the window to the simpler Form Wizard.

Creating a Template for a Web Application
  1. Launch the application for which you want to create a template.

  2. Select Create Template from the application's Title Bar Button menu.

  3. The Web Form Wizard launches. Continue
    • In the Web page, ESSO-LM detects the credential fields and highlights them.
    • A condensed version of the Form Wizard appears. Enter information for the following fields:
      • Form Name. This field is pre-filled with the name of the selected application. You can leave this as it is or change it if you want to.

      • Form Type. Select the form type from the drop-down menu:

        Logon

        Logon Success

        Logon failure

        Password change

        Password change success

        Password change failure

    • Add to Template.

      This field defaults to the New Template selection. Alternatively, the drop-down menu contains the list of all configured Windows application templates to which you might want to add this form.

    • Edit Fields/Hide Details.

      Toggle this button to expand the window to display the entire Form Wizard, or collapse the window to the simpler Form Wizard.


Graded Authentication

Graded authentication lets you define grades or levels to authentication in Authentication Manager. Graded authentication controls what functions of Authentication Manager users can execute based upon the type of authenticator presented. Levels, or grades, can be applied and used to ensure the correct level of authentication has been performed for specific events or activities.

Configuring Application-Level Authentication Grades

Configuring Applications

Authentication grades are numeric values. An authentication grade will automatically default to grade level 1 if authentication grading is turned on and no grade level is specified. The higher the grade level specified, the stronger the authentication level that is being requested.

You can arbitrarily configure the grading scale. For example, an expected normal scenario would be a scale of 1-3, but you have the flexibility to make this 1-5 or 1-n, as you require. To be consistent, any grade less than 1 will be converted to 1.

Authentication Manager supports the authentication grades by mapping the grades to the authentication methods used. By default, most authenticators require a specific authenticator to manage grade levels, as they do not support this on their own.

If a user tries to access credentials with a grade level that is too low, that user will be asked to authenticate at a higher grade and only gain access if successful.

Lockouts occur as per normal authentication lockout policy. Since graded authentication uses the core SSO authentication process, this will happen naturally.

A potential security problem exists with graded authentication and multiple primary logon methods. If multiple authenticators are set up with different grades, a user with a lower grade authenticator has the ability to change the primary logon method from multiple authentication to single authentication, thereby gaining access to logons that require higher grades.

This potential issue can be avoided through settings in the ESSO-LM Administrative Console.

Right-click the Global Agent Settings icon to display a shortcut menu, point to Import and click From Live HKLM.

Once the list has been imported, expand Live, then expand End User Experience, and then click Setup Wizard. Set the Selected Primary Logon (Registry Location: AUI:Selected) setting to Authentication Manager. As long as this is selected, the user cannot change the primary logon method.

Graded authentication:

  • Supports an unbounded number of authentication grades or levels.
  • Supports setting required authentication grades on a per application basis.
  • Supports setting-required authentication grades on SSO processes that require re-authentication.
  • Supports administration setup for the authentication level for every application.
  • Supports administration setup for the authenticator grade.
  • Supports logging of graded authentication events.
  • Provides administrators the ability to:
    • Enable graded authentication support to be turned on or off.
    • Configure graded authentication on a per-application basis.

Authentication Manager and Graded Authentication

  • Authentication Manager controls application logons, which can be initiated by the user, based upon the authenticator used by the end user on the most recent authentication request. The most recent authentication request may be the initial logon, the last re-authentication, or the forced authentication requested by Authentication Manager.
  • Authentication Manager has an authentication grading scheme to which different authenticators are mapped and, separately, to which application logons are mapped. Authentication Manager only allows users to log on to an application when the grade of the authenticator used equals or exceeds that of the application logon.
  • When a user does not respond to an authentication request with an authenticator of sufficiently high grade, Authentication Manager prompts the use to either re-authenticate with an authenticator of sufficiently high grade or cancel the requested logon.
  • If a user repeatedly attempts to initiate a logon or function with an authenticator of insufficient grade, Authentication Manager locks out the user, logs an event in the Event Manager, and notifies the user and administrator.
  • If a user does not have Authentication Manager installed, but his application logons have been configured to require strong authentication, the user will not have access to those applications (for example, strong authentication is deployed in the enterprise, but not to that user).
  • Logon Manager only displays the application logons that are currently available, based upon the authenticator used in the most recent authentication request.
  • The following Authentication Manager functions can be configured to be accessible or inaccessible based upon the grade of authenticator used in the most recent authentication request:
  • System Tray: Logon Manager
  • Logon Manager: Delete, Properties, and Reveal All functions
  • Logon Manager | Properties Page: Reveal Password function
  • If the Reveal All function is accessible based upon a grade of authentication used, it only reveals passwords for those applications whose grade is equal to or lower than the grade used to authenticate for that function.


Authentication Manager

The Authentication Manager enables organizations to seamlessly bridge strong authentication to all of their applications, including smart cards, biometric devices, and Entrust authenticators. Users employ different authenticators at different times; the authenticator in use controls application access.

The Authentication Manager adds the following capabilities to ESSO-LM:

  • Strong authentication support from a variety of strong authenticators, including smart cards and biometric devices for all authentication events: initial authentication, re-authentication, and forced authentication.
  • Multiple Authenticator support, enabling:
    • Multiple logon methods for authenticating an end-user
    • Support for graded authentication
    • Alternative logon methods allowing end-users the ability to mix and match multiple logon methods on-the-fly.
    • Definition of grades, or levels to authentication methods and applications. This provides the ability to control which (Authentication Manager functions users can execute based upon the type of authenticator presented.


Multiple Authenticator Support

Multiple authentication supports the use of multiple logon methods to authenticate an end-user. This feature provides an authenticator that is capable of supporting graded authentication as well as alternative authentication methods.

The Multiple Authenticator:

  • Accepts authentication using different authenticators.
  • Supports Graded Authentication.
  • Allows multiple authenticators to be used interchangeably during a user session, between the initial logon and the logoff.
  • Allows multiple authenticators to be used interchangeably between sessions.
  • Provides administrators the ability to:
    • Allow or disallow the use of multiple authenticators
    • Specify the default primary authenticator
    • Specify which authenticators are mandatory for enrollment
    • Restrict access to applications based upon the strength of the authenticator used
    • Allow or disallow the use of multiple authenticators interchangeably during a single session
    • Allow or disallow the use of multiple authenticators interchangeably between sessions.


Select AD Users or Groups (for AD role/group support)

Add User or Group (for Active Directory Role/Group Support)

Use this dialog box to select the individual users or user groups to add to the access list for the current configuration item (application logon, password policy, global Agent settings or passphrase set).

Controls
List Names From | Select an Active Directory domain or server.
Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add

Copies user(s) and group(s) selected in the Names list to the Add Names list. Use Ctrl+click or Shift+click to select multiple entries.
Members | When a group is selected the Names list, displays the Global Group Membership dialog box, which lists the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names

Display the names of the user(s) or group(s)that you have already selected. Click OK to add these names to the access list for the current configuration item.

You can type or edit user names in this list. However, your entries are checked for invalid account names, and duplicate account selections are automatically removed when you click OK.


Global Group Membership (for AD Role/Group Support)

The Global Group Membership dialog box lists the members of a group selected in the Add User or Group dialog box. Use this dialog box to select the individual members to add to the access-control list for the current configuration item. (use Ctrl+click or Shift+click to select multiple entries). Click Add to copy the selected named to the Add Names list in the Add User or Group dialog box.


Find Account (for AD role/group support)

Find Account (for Active Directory Role/Group Support)

Use the Find Account dialog box to search for a specific individual user account or user group in a specific domain or across multiple domains, then add any or all of the search results to the access-control list for the current configuration item (application logon, password policy, global Agent settings or passphrase set).

1. Search for names
Find a User or Group | Enter the name of a user or group to search for. Only exact user/group name matches are allowed.
Search All/Search Only in | Search all available domains (displayed in the list box below) or select specific domains to search. Use Ctrl+click or Shift+click to select multiple entries.
Search | Begin searching for the user/group name.
2. Add results to list
Search Results | Lists the user and group accounts that match the search criteria.
Add | Add user(s) and group(s) selected in the Search Resultslist to the Add Names list in the Add User or Group dialog box. Use Ctrl+click or Shift+click to select multiple entries.


Select Users or Groups (for LDAP role/group support)

Add Users or Groups (for LDAP Role/Group Support)

Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (application logon, password policy, global Agent settings or passphrase set).

Controls

Search Base | The base (highest-level) directory to begin searching for user/group accounts. All subdirectories of the base directory are searched Type a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search.
Search | Begin searching the base directory for wsers and groups.
Users and Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.


Select Search Base (for LDAP Role/Group Support)

Use this dialog to browse to and select the base (highest-level) directory to search for user/group names. Click OK when finished to return to the Select Users or Groups dialog box.


Add Sharing Group

Use this dialog box to add and name a new credential sharing group.

  • To add a sharing group, enter a Group Name and click OK.

To display this dialog box:

  • Right-click Credential Sharing Group and choose New Group from the shortcut menu.

    or

  • Choose CredentialSharing Group from the Insert menu.


Home

www.oracle.com

What's New?

See the ESSO-LMRelease Notes to learn about the latest features.

Explore Help

  • ESSO-LM Administrative Console Overview
  • First-Time Setup
  • Global Agent Settings
  • Troubleshooting

Latest Documentation

  • See the latest ESSO-LM documentation in the online documentation center.
  • See the latest Best Practice Guides in the online documentation center.
  • See the latest Knowledgebase articles in the online documentation center.


Adding a Synchronizer

Use the Add Synchronizer dialog box to include a synchronizer in the Agent's search list. (available with a set of Global Agent Settings selected).

  1. Enter a Name for the new synchronizer.
  2. Select a Sync Type from the list.
  3. Click OK to add the synchronizer and return to the Synchronizers dialog box.

To display this dialog box:

  1. Select a set of Global Agent Settings.
  2. Do one of the following:

    • Right-click Synchronization and select Manage Synchronizers from the shortcut menu.

      or

    • Choose Synchronizer from the Insert menu.
  3. Click Add. The Add Synchronizer dialog box displays.


Synchronization\Ora\Advanced

Advanced (Synchronization - DBEXT/ORA)

The Advanced Database/Oracle Synchronization settings control special-case options for all database/Oracle synchronizer extensions.

Append Domain when naming objects

Enables appending of the user's domain to the username in naming the user's container. Example: For the domain company and user jamesk, the container is named jamesk with this flag disabled and jamesk.company with this flag enabled. (default: 0)

Options:

  • Disable
  • Enable


Synchronization\Ora\Required

Required (Synchronization - ORA)

You must specify the Required Oracle Synchronization settings for all Oracle synchronizer extensions.

Extension location

Path\filename of the database synchronizer extension.

(Default: C:\Program Files\Passlogix\v-GO SSO
 \Plugin\SyncMgr\DBEXT\DBExt.dll)
Servers

Specify the database servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Enter the full connection address (computerName.dbServerName) for one database server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

At least one server must be specified for the extension to work.

To connect to an Oracle database, use the following connection string:

Provider=OraOLEDB.Oracle;Data Source=%MachineName%;Extended Properties='OSAuthent=1'

where the "Data Source" value will be different for each configuration.

To connect to the Oracle database, the Oracle 10g client must be installed on the same machine as the ESSO-LM Administrative Console.


Edit List

Use this dialog box to enter items described in the window title bar (for example, Servers).

  1. Type one item for each line. Press Enter at the end of each line. Do not use any other delimiter characters.
  2. Click OK when finished.

Use this dialog box with the following global Agent settings:

LDAP Synchronizer | UserPaths
LDAP Synchronizer Servers | Servers
LDAP Authenticator Servers | Servers
Active Directory Synchronizer | UserPaths
Active Directory Synchronizer Servers | Servers
Database Synchronizer Servers | Servers
Shell Tasks | Deletion Tasks PreTasks RefreshTasks StartupTasks


Synchronizers

Displays the current set of available synchronizers and the order by which the Agent searches them.

To add a synchronizer:

  • Click Add. The Add Synchronizer dialog box appears.

To change the search order:

  • Select a synchronizer and click the up or down buttons to reposition it.

To display this dialog box:

  1. Select a set of Global Agent Settings.
  2. Do one of the following:

    • Right-click Synchronization and choose Manage Synchronizers from the shortcut menu.

      or

    • Choose Sync Extension from the Insert menu.


Export Format

Use this dialog box to select an output format for the selected set of settings.

Options

Administrative Override Object | Export the settings as an administrative override object (INI) file.
HKLM Registry | Export the settings as a registration-entries (REG) file.
Both | Export both file types.
Unicode encoding (.REG format only) | Export the .REG file in Unicode format.

Exporting a Set of Global Agent Settings

  1. (Optional) Select Unicode format for the .REG file, if desired.
  2. Click an option.
  3. In the File Save dialog box, locate and open the folder for each file, name the file, and click Save.


Options Tab

Options Tab (for Configuring a Host/Mainframe Logon Form)

Use the Host/Mainframe Options tab to set emulator options for a host/mainframe logon.

To display this tab, do one of the following:

  1. Create a new host/mainframe application logon.

or

  1. In the left pane, click Applications and select a host/mainframe application.
  2. Click the General tab in the right pane.
  3. Select a logon form from the list and click Edit.
  4. In the Host/Mainframe form-configuration dialog box, select the Options tab.

Controls

Delay Field (ms) Enter the delay in milliseconds for the Agent to pause between actions; for example, entering value into a field (default 0 ms).
Screen Type

Choose one of the following:

  • Fixed for static (non-scrolling) terminal emulation screen
  • Scrolling for scrolling terminal emulation screens; for example Telnet.
Column Position of Cursor Type the starting column number of the text cursor when logon or password change begins.
If this position varies (for example, most Unix systems include the affected username as part of the "New Password" and "Confirm Password" field labels when changing passwords), you can use a regular expression to wildcard the variable portion of the field label so that ESSO-LM always injects credentials in the correct spot.


Host/Mainframe Wizard (Cursor Position) 870

Cursor Position (Host/Mainframe Form Wizard)

Use this Form Wizard page to indicate the row and column of the cursor for the logon/password-change form of a host/mainframe application that uses a scrolling screen.

  1. Click or use the arrow keys to place the text cursor in the exact position that it appears in the Telnet application's window.
  2. Click Next to display the next wizard page. Click Back to re-paste the screen text.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Field Matching - Fixed Screen (Host/Mainframe Form Wizard)

Use this Form Wizard page to define the fields of a fixed-screen logon or password-change form.

  1. Place the cursor at the starting position of a field.
  2. Right-click and choose the field type (Username/ID, Password, Third Field, Fourth Field) from the shortcut menu. Repeat this procedure for each required field.
  3. To remove a defined field click Remove.
  4. Select a Tab Character to move from one field to the next; the options are Tab, Enter, and None.
  5. When your selections are complete, click Next to display the Summary page. Click Back to modify the matching text for the form itself.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Field matching - scrolling screen (Host/Mainframe Wizard)

Field Matching - Scrolling Screen (Host/Mainframe Form Wizard)

Use this Form Wizard page to define the text position and the sequence of logon prompts of a scrolling screen logon or password-change form.

  1. In the ESSO-LM Administrative Console Fields wizard page, place the cursor at the prompt-entry position. Click Add, then select the first field type requested. Repeat this procedure for each required prompt.
  2. To modify a defined field's settings, click Edit.
  3. To remove a defined field click Remove.
  4. When your selections are complete, click Next to display the Summary page. Click Back to modify the matching text for the form itself.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Paste Screen Text (Host/Mainframe Form Wizard)

Use this Form Wizard page to paste the text of the host/mainframe application's logon or password change screen into the ESSO-LM Administrative Console for configuration.

  1. Start the target application in the host/mainframe emulator or Telnet.
  2. In the target application, all of the onscreen text and copy it to the Windows Clipboard.
Some emulators provide a Copy command or button; others let you select Ctrl+C to copy. In Windows Telnet, select the text and select Enter.
  3. In the ESSO-LM Administrative Console, click Paste Text.
If the emulator screen does not use return or line-feed characters, adjust the Characters per Line to set proper text wrapping.
  4. Click Next to display the next wizard page or click Back to change the screen type.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


context\HostWizard_Screen

Screen Type (Host/Mainframe Form Wizard)

Use this Form Wizard page to select the host/mainframe application's screen type for a logon or password change window.

Choose one of the following:

  • Fixed Screen. For applications running on a host/mainframe emulator that present logon forms as static text pages.
  • Scrolling Screen. For applications running on Telnet or other scrolling-screen comsole that request logon information as a series of prompts.

If you have already selected a screen type in this Wizard session, click Next to display the next Wizard page. Click Back to change the form type.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Summary (Host/Mainframe Host Wizard)

Use this Form Wizard page to review the configuration. To make changes, use the Back and Next buttons to display a page. When your configuration is complete, click Finish.


Abbreviations and Terminology

Following is a list of commonly used abbreviations and terminology.

Abbreviation or Term | Full Name
Administrative Console | ESSO-LM Administrative Console
Agent | ESSO-LM Agent or Logon Manager
FTU | First Time Use Wizard
Microsoft AD | Microsoft Active Directory
Microsoft ADAM | Microsoft Active Directory Application Mode
LDAP | Lightweight Directory Access Protocol
ESSO-Anywhere | Oracle Enterprise Single Sign-on Anywhere
ESSO-PG | Oracle Enterprise Single Sign-on Provisioning Gateway
ESSO-LM | Oracle Enterprise Single Sign-on Logon Manager
ESSO-PR | Oracle Enterprise Single Sign-on Password Reset
ESSO-UAM | Oracle Enterprise Single Sign-on Universal Authentication Manager


Matching offset example

Offset Matching Example

Following is a sample portal page that contains three windows. The goal is to log on to the Sales Database window. In order to do that, isolate that window from all the others windows on the page.

Like most portal sites, the windows can be rearranged and windows can be added or removed by the user so the order and the existence of windows can change. This can be done using both Detection Matching and Offset Matching (collectively referred to as Web Matching). This example describes Offset Matching.

Below is an HTML fragment that is shown when you click View > Source from the browser’s toolbar (the HTML has been greatly simplified to illustrate the important elements):

<div name=”portalLogon1”>

<p>

Accounting Database

</p>

<form>

Username: <input type=”text” name=”username”>

Password: <input type=”password” name=”password”>

<input type=”submit” >

</form>

</div>

<div name=”weatherStation”>

<form>

Zip Code: <input type=”text” name=”zipCode”>

<input type=”submit” >

</form>

<p>Temperature is now 72°</p>

</div>

<div name=”portalLogon2”>

<p>

Sales Database

</p>

<form>

Username: <input type=”text” name=”username”>

Password: <input type=”password” name=”password”>

<input type=”submit” >

</form>

</div>

Each window is represented by a <div> tag and each <div> tag has a name attribute, which you use to filter out windows that are not pertinent to your task.

To do this, add an Offset Match to look for all <div> tags with the name attribute that contains the word portalLogon. Click Add to match this criterion.

For this example, all the windows are now filtered out except the two portalLogon windows. The Agent now focuses only on the following windows:

<div name=”portalLogon1”>

…

</div>

<div name=”portalLogon2”>

…

</div>

To isolate the Sales Database window, you must add another offset match form. The HTML source indicates that the window to isolate contains a <p> tag that contains the text Sales Database. Click Add to match this criterion.

The Agent now sees only one window:

<div name=”portalLogon2”>

…

</div>

Since the targeted window is isolated, this is all the matching that you need to add.

The remaining task is to set the Offset Start values. To set this, determine at which match the form you want is visible. In this example, there are two matches.

The first matches the <div> tag, and the second match matches the <p> tag. In this match, the <form> tag is visible since it is contained in the <div> tag:

<div name=”portalLogon2”>

…

<form>

…

</form>

</div>

In the second match, the <form> tag cannot be seen since it is not contained in the <p> tag.

<p>

Sales Database

</p>

The Offset Match cannot be set to 2. It must be set to 1. This tells the Agent that the form offset for the fields is relative to the first match (the <div> match), as follows:

<div name=”portalLogon2”>

<p>

Sales Database

</p>

<form>

Username: <input type=”text” name=”username”>

Password: <input type=”password” name=”password”>

<input type=”submit” >

</form>

</div>

All the form offsets and field offsets in the Fields list (found in the General tab) are relative to the above HTML.


Edit Passphrase Question

Edit Passphrase Questions

Use this dialog box to add or edit the passphrase question that appears during First-Time Use , the setup wizard that is invoked when (a) the Agent is started for the first time after installation or (b) the administrator deploys a ftulist object (for example, the ftulist.ini file). This option is used for Windows Authenticator v2 and LDAP Authenticator v2 only. In Authentication Manager, this option is used for Smart Card authentication (SCAuth).

On first-time use, ESSO-LM users select a passphrase question and supply an answer. This stored passphrase answer can be used to reset ESSO-LM authentication if the user later changes the primary logon password. The next time single-sign-on re-authentication is required, the user enters the new password, and ESSO-LM displays the passphrase question to confirm the user's identity.

Adding a Windows/LDAP Authenticator Passphrase

  1. Select a Language, then click Add.
  2. In the Edit Question dialog box, type a Question.
  3. Select or enter a Minimum Length for the reply.
  4. Click OK.

Controls

Language | Select language for passphrase questions.
Enabled/Question | Lists current passphrase questions. Checked items are the enabled passphrases for the current password set. To disable a passphrase click the checkbox to clear it (see Note below. To modify a passphrase question, double-click it, or select it and click Edit.
Add | Add a new passphrase question; displays the Edit Question dialog box.
Remove | Delete the selected passphrase question; displays a confirmation prompt. See Note below.
Edit | Modify the selected passphrase question; displays the Edit Question dialog box.
Remove or Disable? Once a passphrase question has been created, deployed, and put into use by end-users, it should not be deleted. Users who have selected a passphrase question that has been deleted will not be able to change their passwords without losing access to their ESSO-LM credentials. Instead, to remove an in-use passphrase question (and keep it from being displayed during first-time use), disable the question by clearing its checkbox in the list in Tools>Edit Passphrase Questions dialog box.


Add Passphrase Question

Edit Question (For Passphrase)

  1. Type a Question.
  2. Select or type a Minimum Length for the reply.
  3. Click OK.


Password Change

Password Change Tab (for a Selected Application)

Use the Password Change tab to set or modify options that control how the Agent manages password changes.

The Agent distinguishes between logon and password change fields that appear on the same screen or on different tabs of a dialog box. In the instance of this type of screen, the Agent prompts the user, through the Action Chooser dialog box, to select a password change or logon. You can configure a period of time for which the user will not need to change passwords, and hence will not receive the Action Chooser.

Controls

Password Change Options
Wizard Behavior

Controls how the Agent responds when an application prompts the end user to change passwords. The options are:

  • Prompt User: Prompts the user with the Password Change Wizard.
  • Manual w/Auto Option: Prompts user to select a new password, but lets the Password Change Wizard offer to generate a password automatically.
  • Auto only: Generates a new password automatically, and does not allow the user to select the new password.
  • Auto w/Manual Option: Generates a new password automatically, but first allows the user to select a new password.
  • Quietly Generate and Submit Password: Generates and submits password without prompting the user.
  • Manual only: Prompts the user to select a new password; does not let the Password Change Wizard automatically generate a password.
Enable Password verify pop-up dialog | Check this box if you want to display the password change verification pop-up dialog box, which provides an additional confirmation that the password has been changed.
Password Generation Policy | Select a password generation policy. To subscribe multiple applications to a policy, see Policy Subscribers.
Credential Sharing Group | Select a credential sharing group. To assign multiple applications to a password group, see Credential Sharing Groups.
Password Expiration Options
Enable Password Expiration | Select this check box to require users to change passwords after a specified period.
Number of days until password expires | Enter or select the number of days for which a user's password is valid.
Run this command when the password expires | Type the full path and command (or click Browse to locate the executable file) that should be invoked when the user attempts to log on after the Number of days setting has elapsed. (Example C:\Program Files\PassChange\passchange.exe. )
Action Chooser Grace Period
Days Enter the length of the grace period (in days) for which the Agent will not display the Action Chooser dialog box.


Password Generation Policy

Displays the currently available password generation policies and provides access to policy settings. Click Password Generation Policy in the left pane to display the current password policies in the right pane.

See Setting Password Policies for more information.

To add a new password policy:

  1. Do one of the following:
  • Click Add in right pane

or

  • In the left pane, right-click Password Generation Policy then click New Policy on the shortcut menu.
  2. Enter a Policy Name and click OK. The Policy Subscribers tab appears in the right pane, where you can add applications that will use the new policy

To modify a listed password policy's configuration:

  1. Click a policy, then click Edit. The Policy Subscribers tab appears in the right pane.

To delete one or more password policies:

  1. Select a policy (use Ctrl+click or Shift+click to select multiple entries), then click Remove.


Test_Password_Policy

Use the Test Password Policy dialog box to generate a set of test passwords based on the currently-selected password policy. This lets you preview how the Agent will respond to a password change request from an application that subscribes to this policy. You can choose the number of test passwords to generate.

If the password constraints you have set are contradictory or too restrictive to generate any passwords, a message appears explaining how many passwords failed the test and why.

Generating Test Passwords

  1. Select or enter the Number of test passwords to generate.
  2. Click Generate Passwords. The test passwords display in the output window.
  3. When you are finished, click Done to close the dialog box.


SmartCardAuth

Smart Card Authenticator (SCAuth)

1535/property sheet

Use the settings in this dialog box to specify how ESSO-LM authenticates user through a smart card.

Controls
ResetEnable Enable the passphrase challenge for additional security. Users must provide a passphrase answer during First Time Use. This is the default setting.


Architecture

Copyright ©2011, Oracle and/or its affiliates. All rights reserved.

Version 11.1.1.5.0


Border Values for Web Logon Credential Fields

Values for Feedback Color follow the standard for the border attribute in cascading style sheets (CSS). The table below lists valid colors and their RGB values. See Web Applications (End-User Experience - Response) for the Feedback Color setting in which these values are used.

Attribute Possible Values
Width
  • Thin
  • Medium
  • Thick
  • A unit of pixels, inches, etc (examples: 3px. ).
Style
  • none
  • dotted
  • dashed
  • solid
  • double
  • groove
  • ridge
  • inset
  • outset
Color

A color keyword or RGB value; common examples include the following:

Keyword | RGB Equivalent | Keyword | RGB equivalent
aqua | #00FFFF | navy | #000080
black | #000000 | olive | #808000
blue | #0000FF | purple | #800080
fuchsia | #FF00FF | red | #FF0000
gray | #808080 | silver | #C0C0C0
green | #008000 | teal | #008080
lime | #00FF00 | white | #FFFFFF
maroon | #800000 | yellow | #FFFF00


Directory Tree

Return to text


SSL_support

ESSO-LM supports the use of Secure Sockets Layer (SSL) and enables it by default. When deciding whether to use SSL, consider the following:

  • ESSO-LM encrypts all credentials locally through the user’s configured authentication method, and transmits and stores those credentials in encrypted form.
  • For repositories that use pass-through authentication (for instance, Active Directory or ADAM), ESSO-LM secures all transactions with the central repository (including authentication to the repository); no credentials of any type are transmitted in clear text.
  • When using LDAP repositories or pass-through repositories in conjunction with Kiosk Manager, the repository authentication will be a clear-text LDAP transaction if SSL is not enabled. If this authentication must be secure, enable SSL for transactions between the client and the repository.

For complete instructions on setting up SSL certificates, refer to the following documentation:

  • Microsoft Active Directory Server: Microsoft MSDN
  • Oracle Directory Server Enterprise Edition: Oracle Directory Server Enterprise Edition Administrators Guide
  • Novell eDirectory: eDirectory 8.5 Administration Guide

SSL is configured with the registry keys UseSSL and SSLFallback.


Seagull BlueZone

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Seagull BlueZone. No setup steps are necessary.


Session Manager Actions

Kiosk Manager Actions

This panel contains the list of actions that have been created. An action tells Kiosk Manager to do something, such as run a program, call a .NET method, or terminate a specific application.

Use this panel to create, edit, copy and delete action lists:

  1. Click Create to define a new action list. The three types of actions that can be created are Terminate lists, Run lists, and Special Actions lists.

    or

  1. Highlight an action name, and:
    • Click Edit to make changes to this action.
    • Click Copy to quickly make a copy of an action. To change the name, right-click the action in the left pane and click Rename. You can also perform a copy by right-clicking the action in the left pane and clicking Copy.
    • Click Delete to delete an action. A confirmation message dialog will appear before the action is deleted. If this action was associated with a session state, it will be deleted from the session state as well.


Session Manager Add App to LeaveDefault

Kiosk Manager > Keep Running List > Select Default Applications

Use this dialog box to add default applications to the list of applications to keep running on session end.

  • Select the desired applications to keep running on session end and click OK.

    The selected applications are then listed in the AppPath Keys dialog box.


Session Manager Add AppPathKeys

Process Path Key

The Process Path Key is the name of the process executable, such as IEXPLORE.EXE is the process path key for Internet Explorer. Use this dialog to add an application to the list of applications.

  • Type a Process Path Key and click OK.

    The Process Path Key is then created in the AppPath Keys dialog box.


Add Custom Authenticator

Custom authenticators allow you to filter events based on that authenticator. To add a custom authenticator, click the Add button on the Authenticators tab. This opens the Custom Authenticator dialog box:

  1. Enter an Authenticator Name. This is the authenticator name that displays.
  2. Enter an Authenticator Value. The authenticator value is the name that the authenticator is known by within the code. This name comes from the authenticator itself. For example, the value for Windows Authenticator v1 is WinAuth, for Windows Authenticator v2 is MSAuth, and for Smart Card is SCAuth.
  3. Click OK.


Add Custom Event

To add a custom event, click the Add button on the Events tab. The Custom Event dialog box opens.

  1. Enter an Event Name. This is the event name that displays.
  2. Enter an Event Value. An external application generates the custom event, sending a message to the Kiosk Manager hidden window. The value is the custom value that the other application sends.
  3. Click OK.


Session Runlist netapi example

.NET API Sample C# code with properties for the "User Change" event.

using System;

using System.Collections.Generic;

using System.Text;

using System.Windows.Forms;

namespace ClassLibraryTest

{

public class TestClass

{

private string m_userName;

private string m_domainName;

public string UserName

{

set

{

m_userName = value;

}

get

{

return m_userName;

}

}

public string DomainName

{

set

{

m_domainName = value;

}

get

{

return m_domainName;

}

}

public void UserChange()

{

MessageBox.Show("UserChange called with user: " + DomainName + "\\" + UserName);

}

public void SessionStart()

{

MessageBox.Show("SessionStart called");

}

public void SessionEnd()

{

MessageBox.Show("SessionEnd called");

}

public void SessionLocked()

{

MessageBox.Show("SessionLocked called");

}

public void SessionUnlocked()

{

MessageBox.Show("SessionUnlocked called");

}

public void PreSessionUnlocked()

{

MessageBox.Show("PreSessionUnlocked called");

}

public void AuthLogon()

{

MessageBox.Show("AuthLogon called");

}

public void AuthTimeout()

{

MessageBox.Show("AuthTimeout called");

}

public void DeviceIn()

{

MessageBox.Show("DeviceIn called");

}

public void DeviceOut()

{

MessageBox.Show("DeviceOut called");

}

public void GracePeriod()

{

MessageBox.Show("GracePeriod called");

}

}

}


Session Select Action List

Kiosk Manager > Session States > Actions > Associate Select Actions

Use this dialog box to select one or more actions to associate to this session state. Select the actions to add to this session state (use Ctrl+click, or Shift+click to select multiple entries). Click OK.

If actions are associated with this session state, and you are adding new actions, ALL actions need to be re-selected, otherwise the list of actions will be replaced with the newly selected actions.


Session Management Overview

Kiosk Manager

Kiosk Manager manages user sessions in a kiosk environment. The following Kiosk Manager settings are configured through the ESSO-LM Administrative Console:

  • Actions
  • Session States
  • General operation settings
  • Confirmation messages
  • Kiosk Manager Desktop Manager UI customization
  • Kiosk Manager Desktop Manager Text Message


Edit Server List

Use this dialog box to remove servers that are listed in the Server Name drop-down box on the Connect to Repository dialog box.

  1. Select a server and click Delete.
  2. Click OK when finished.


First_Time_Use_Apps

First Time Use Tab

Use the First Time Use tab (under Applications) to control specific behaviors of the Setup Wizard.

To display the First Time Use tab:

  • Click Applications in the left pane, then click the First Time Use tab in the right pane.

Controls

Minimize number of steps during Setup Wizard

Select to have Setup Wizard display the minimum number of pages necessary to set up ESSO-LM after installation:

If this option is selected:

  • Only one (default) primary logon method is available. If multiple authenticators have been installed, only the first authenticator in the registry is presented for user setup.
  • Bulk add applications are not presented for user selection.
  • The summary screen does not appear at the end of the Setup Wizard.

If this option is cleared:

  • All installed authenticators are presented for user setup.
  • Bulk add applications are presented for user selection.
  • The summary screen appears at the end of the Setup Wizard.


Matching tab (for configuring a Web application)

Matching Tab (for a Selected Web Application)

Use the Matching (Web) tab to distinguish among similar forms within the same Web application. The supported form types, referred to here as target forms, are:

  • Logon
  • Password change
  • Password change success
  • Password change failure

This tab is typically used to refine the detection match criteria, that is, the set of HTML tags and values you use to identify a specific page. You can then create an offset match that uses a subset of the detection match to identify the desired logon or password-change form on the page.

To display this tab:

  • Create a new Web application logon.

    or

  1. In the left pane, select Applications and select a Web application.
  2. Click the General tab in the right pane.
  3. Select a form from the list and click Edit.
  4. From the General tab in the Web form-configuration dialog box, select the Matching tab.

Creating or Modifying Detection-Matching Criteria

  1. In the Detection Match list, do one of the following:
  2. Click Add to create a new matching criterion.
  3. Select a match and click Edit to modify an existing match.
  4. From the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  5. If necessary, adjust the match criteria order.
  6. Select a match to move.
  7. Click the up or down arrows.
  8. Click OK.

Use the AND, OR, and NOT operators to specify the conditions under which the Agent should respond to Web match combinations.

If you assign a match value of AND to a match criterion, that criterion must be present for the Agent to respond to a page. So, when several fields are assigned an AND operator, all those criteria must be present.

If you assign a match value of OR to several match criteria, the Agent responds if any one of the criteria is present.

The NOT operator is used as an excluder when performing a match. The Agent responds to any criteria that are assigned the AND and OR operators, unless the conditions of the NOT criteria are present. The Agent excludes the instances specified by the NOT operator.

Offset Matching

Offset matching should only be used with portal Web pages.

This type of matching is used with portal pages that have multiple windows that the user can rearrange, add, and remove. If the site you are matching on is not a portal, leave the offset matching section on this panel blank.

With regular match detection, the forms must always appear in the same order. With offset matching, you can rearrange the forms (which look like a window) and isolate a specific window from all the others. This only applies to portal pages because these pages are dynamic, and ordinal values are used to match instead of field names.

Use the Offset Start field to tell ESSO-LM which match result's forms to use for the form offsets. The offset start value should be the number of the offset matches. For example, if there are 3 offset matches, the offset start value should be 3.

Creating or Modifying Offset Matching Criteria

  1. In the Offset Match list, do one of the following as needed:
    • Click Copy from Detection to copy defined Detection Match criteria.
    • Click Add to create a new matching criterion.
    • Select a match and click Edit to modify an existing match.
  2. In the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  3. If necessary, adjust the match criteria order.
  4. Select a match to move.
  5. Click the up or down arrows.
  6. Select an Offset Start.
  7. Click OK.


context\HostWizard_TextMatch

Text to Match (Host/Mainframe Form Wizard)

Use this Form Wizard page to indicate text that identifies the screen as a logon or password change form.

  1. Select a block of text that identifies the screen as a logon or password change form. Right-click the selection, and select Add as Text Match.
  2. Repeat this step for additional text blocks.
  3. To remove a text match, select the match in the lower pane and click Remove.
  4. Click Next to define the form fields. Click Back to display the previous wizard page.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host and mainframe application logons.


Selecting a Host or Mainframe Application from the Application List

Use this option to select a host or mainframe application from a list of running applications, rather than entering the application name manually.

Make certain that the application you want to configure is running.
  1. Select the host or mainframe application for which you want to configure a form from the "Window Title" list.
  2. (Optional) Click Refresh to refresh the list.
  3. (Optional) Check the Show hidden windows box to add hidden windows to the list.

  4. Click OK after you select the desired window title.

    or

    Click Cancel to cancel the selection.


Web Field Editor

Use the Fields (Web) tab to define how the Agent interacts with the fields of the logon form. You can identify one of the following for the currently-selected application form:

  • Up to four logon fields (user ID, password, etc.), using Control IDs
  • A series of keystrokes (with optional timings) that fill-in and submit the logon form, using SendKeys.

Controls

Transfer method
(choose one)

Options:

  • Control IDs: Use standard Windows control IDs to identify and transmit credentials to a field. Click Add to add a field and enter its Control ID or Edit to modify existing field settings.
  • SendKeys: Configure fields by transmitting a keystroke series to the form. Click Edit to enter or change the series.
  • SendKeys using Journal Hook: Configure fields by transmitting a keystroke series to the form using Journal Hook. Click Edit to enter or change the series.
Fields

One or more credential fields (including the Submit button) with transfer methods and their identifying information. You can:

  • Select a field and click Edit to modify Control ID or SendKeys settings.
  • Click Add to add a field (for Control ID only).
  • Click Delete to remove a field (for Control ID only).
  • Use the Up [image] and Down [image] arrows to re-order the fields.


Credential field

Credential Field (Windows Form Wizard for RSA-securID Applications)

Use this Form Wizard page to select the fields of the application's logon or password change window.

See Windows Form Wizard (RSA-securID applications) for details of the procedure for configuring Windows applications.

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, or Text, to sort the list. Right-click a field in the list to display a shortcut menu of field types and the submit control:

  • SecurID Username
  • Passcode
  • Tokencode
  • Next Passcode
  • Next Tokencode
  • Confirm New PIN
  • SecurID Other Field
  • OK (submit control)

Refresh

Updates the field list.

Use "Send Keys" for this form, do not use Control IDs

Indicates that the Agent should transmit logon data to this form as a series of keystrokes, rather than by addressing individual fields by Control ID. See SendKeys for more information.

Refresh | Updates the field list.
Back | Go back to the previous Wizard page
Next | Go forward to the next Wizard page.


SendKeys for Sessions in a Windows Application

Kiosk Manager SendKeys (for a Windows Application)

Use the SendKeys dialog box to specify a series of keystrokes that Kiosk Managershould transfer to the logon form.

See Adding Telnet Applications for information about configuring logons for Telnet applications.

The tabs in the right pane of the SendKeys dialog box provide the keystroke options. Select or type the options you need on each tab. Click the Insert button to add the key or action to the series.

Your selections appear in the list in the left pane. To change the order of the series, select an item and click the up or down arrows to move it. To delete an item, select it and click Remove.

Controls

Text tab

Enter text to insert

Type any literal text to add to the series.

Insert

Add the text to the series.
Delay tab

Length of delay (in seconds)

Type or select a delay between keystrokes.

Insert

Add the delay to the series.
Special Keys tab

Category/Keys

Choose a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Page Down) from the right list.

Key Press

Insert the key as a single keystroke (default)

Key Down/Up

Insert the key as a pair of actions: key-press and key-release. This option lets you insert other keystrokes between these actions to indicate one or more keys held down as another is typed, as for a "hot key" combination that moves the focus to a specific text box.

For example, to insert the keystroke "Alt+P", choose the Key Down/Up option, then select Modifier for the Category and Alt for the Key. and click Insert. This inserts two actions: [Down:Alt] and [Up:Alt]. Select the Text tab and type P in the text box. In the left pane, select [Up:Alt] then click Insert. The P is inserted between the two Alt-key actions, producing "Alt-P.

Insert

Add the keystroke to the series.


Matching tab

Matching Tab (for Configuring a Windows Logon Form)

Use the Matching (Windows) tab to map user credentials of the currently selected logon to other logon, password-change, or password-confirmation forms (referred to here as target forms) within the same application. The Agent uses the match criteria you supply to distinguish among similar forms that use the same credential data. This lets the Agent apply a single set of user credentials appropriately to these multiple forms. You can use also use matching to identify forms that the Agent should ignore.

Do one of the following:

  • Click Add to create a new matching criterion.

    or

  • Select a Match and click Edit.

The Matching dialog box appears.

The easiest and most efficient way to create match criteria is by using the Control Match Wizard. The Wizard lets you specify match criteria by selecting elements from the target form itself. You can also create and modify match criteria manually.


Matching Tab for Configuring a Windows Application

Use the Matching (Windows) tab to distinguish among similar forms within the same Windows application. The supported form types, referred to here as target forms, are:

  • Logon
  • Password Change
  • Password Confirmation
  • Logon Success
  • Logon Failure
  • Password Change Success
  • Password Change Failure
Unlike the “Logon,” “Change Password,” “Confirm,” and “Ignore” match types, these matches cannot be explicitly selected by the user. They are determined by form type.

Controls

Allowable Class | Click Choose to identify the logon or password-change window class that must be present in order to execute this logon. This is useful for applications that present logon or password-change windows with non-standard class names. Displays the Select Window dialog box.
Regular Expression | Select whether the Allowable Class uses a regular expression.
Ignore this Window Class | Click Choose to select the logon or password-change window to ignore when executing a logon. This is useful for applications that use hidden logon or password-change dialog boxes or that present duplicate dialogs. Displays the Select Window dialog box.
Regular Expression | Select if the ignored Window Class uses a regular expression.
Attach to window's Message Queue | Select to hold on to the target window while sending credentials.
Preset Focus | Select to set the focus on a logon field before the Agent places data in the field.
System Logon | (Reserved)
Use WM_CHAR messages to fill controls | Some applications require that you enter passwords via a keyboard and not set text commands. Enabling this setting simulates keyboard entry in an alternate way by setting text within controls.
Allow fallback from ControlIDs to SendKeys | Indicates whether to use SendKeys to enter credentials if direct injection using ControlIDs fails. Default is Yes.
Sort Order | Specify the order in which ESSO-LM searches templates for window class titles containing regular expressions. By setting sort order, you increase the efficiency of your search without eliminating less precise matches. If you do not assign a sort order to a template, ESSO-LM checks templates in ascending order (lower values are checked first). Default is 1000.

The Agent uses the match criteria you supply to distinguish among similar forms. This lets the Agent apply a single set of user credentials appropriately to these multiple forms. You can use also use matching to identify forms that the Agent should ignore.

Do one of the following:

  • Click Add to create a new matching criterion.

    or

  • Select a Match and click Edit.

    The Matching dialog box appears.

The easiest and most efficient way to create match criteria is by using the Control Match Wizard. The Wizard lets you specify match criteria by selecting elements from the target form itself. You can also create and modify match criteria manually.


Select Window [Class]

The Select Window dialog box lets you select the class name for an onscreen window. Use this dialog to specify a window class that the Agent should allow or that it should ignore.

The Select Window dialog box displays when you select one of the following options in the Miscellaneous tab (for a Windows logon).

  • Allowable Class: Select a logon or password-change window class that must be present in order for the Agent to execute a logon.
  • Ignore this Window Class:Select a logon or password-change window class that should be ignored when detecting credential fields.
Controls
Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.


Windows Form Wizard

Use the Windows Form Wizard to perform any of these tasks:

  • Configure new logons for Windows applications or for Java applets and applications.
  • Add new forms to existing logons
  • Create forms for automatic password changes.
  • Create forms for supporting a password confirmation field displayed in a separate window.
  • Create forms for automatic detection of password change success and failure.

The Windows Form Wizard lets you use the application itself to identify its forms, the individual fields, and the submit OK button.

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Windows Applications for specific information about configuring Windows application logons.

To configure a form:

  1. Start the target application and navigate to the target form. Arrange the ESSO-LM Administrative Console and target application windows so that you can see both at once.
  2. In the Form Wizard, select the type of form you want to configure. The available options are:
    • Logon. Configures a logon form.
    • Logon success. Configures a form that detects a match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's entries and displays the Logon Success dialog box. If this form is not present, the Agent captures credentials immediately after the user enters them and clicks OK.
    • Logon failure. Configures a form that detects a non-match during silent credential capture. In the presence of this form, the Agent delays credential capture until it verifies the user's incorrect entries and displays the Logon Failure dialog box. If this form is not present, the Agent immediately informs the user that the credentials are incorrect, displaying either the New Logon dialog box or the Retry Logon dialog box to allow the user to re-enter credentials.
    • Password change. Configures a password change form.
    • Password confirmation. Configures a new password confirmation form for applications that display their "Confirm password" field in a separate window.
    • Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Windows Form Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
    • Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Windows Form Wizard in which you will configure the necessary fields.
  3. In the Application Window list, select the window to configure. Note that a blinking outline indicates the application window you select.
  4. Confirm that you have selected the correct window, then click Next.
  5. In the Credential Fields page list, click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • Username/ID
    • Password (Logon forms only)
    • Old Password (password change forms only)
    • New password (password change forms only)
    • Confirm new password (password change and password confirmation forms only)
    • Submit button.
  6. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. Select a field to configure; for example, the logon window's user ID field. In the application's window, a blinking outline indicates the field corresponding to your current selection.

    2. Confirm that you have selected the correct field, then right-click the selected item and choose the field type (for example, UserID) from the shortcut menu. The corresponding icon appears to the left of the item. To deselect an item, right-click the item and choose None from the shortcut menu.

      Password change success forms do not inject credentials and thus do not require you to configure any fields. In such cases, proceed to step 8, as the Credential Fields page will not be displayed.

      The Class and Text columns provide cues to the fields. For example, text boxes appear as "Edit" Class; password fields usually have the Text value *** HIDDEN ***
  7. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  8. Confirm that you have configured the necessary fields and button, then click Next. A summary page appears, listing your configuration.
  9. Do one of the following:
    • Click Back to return to a previous page and make corrections.
    • Click Finish to complete the logon configuration and close the Form Wizard.