Skip to main content
Version: Omada Identity on-premises 16.0.1

Configure Enterprise Server

Initial configuration​

The Enterprise Server installation installs two services:

  • Omada Identity Timer Service
  • Omada Role and Policy Engine (RoPE) Service

The default startup type of these services is Manual. For this reason, you may want to change this property for the Timer Service and the RoPE Service. See the image below:

Timer Service Properties dialog box on the General tab, with the Startup type list and the Start button
note

The services are set to manual startup by default. After an installation, upgrade, or patch has been applied, you must start the Timer Service and any other services that you require.

If you are using Microsoft Security Support Provider Interface (SSPI), you must assign a specific user to two of these services.

The service account(s) used for the Omada Services must be given the right to Log on as a service in Local Policies and the db_owner role in the Enterprise Server database.

These services require you to configure the following settings to ensure that the software reflects local preferences.

To configure the customer settings, go to Setup -> Administration -> More... -> Customer Settings.

The most relevant customer settings to configure are listed in the table below.

SettingDescription
Mail senderThe email address that you provide here is used as the From address for any emails that are sent from the system.
Support emailType the email address used for reporting errors.
Support email (auto)Type the email address to which automatic, system-generated error reports should be sent.
Website URLType the full URL to the site. Example: http://OIS.somecompany.com/
Disable full text index searchingIf you set this setting to False, you enable the full-text search.
Important

When enabling OpenID or Security Assertion Markup Language (SAML), you must perform additional mandatory changes to tblCustomer and tblCustomerAuth. These tables must be edited using SQL Server Management Studio.

Any changes to authentication settings take immediate effect, and hasty changes may lock the user who is changing the Master Settings out of the Omada Identity system.

Maintain the Omada platform​

To ensure that Omada Identity runs well, it is important to maintain the SQL Server continuously. Because schedules vary from customer to customer, the requirements listed here are only basic requirements.

A more advanced setup of maintenance plans should be discussed between the customer's IT department and Omada Consultants.

Set up SQL server maintenance plans​

From SQL Server Management Studio, you can set the database maintenance plans to match the local requirements and service windows. You can do this in Management -> Maintenance Plans.

  1. Set up a plan to update the statistics on a regular basis, preferably every night.

    SQL Server Management Studio with the Update Statistics maintenance plan scheduled to run every day at 12:00 AM

  2. Set up another plan to reorganize data and index pages at least once a week.

    SQL Server Management Studio with the Reorganize Index maintenance plan scheduled to run every week on Sunday

Using SSPI​

Using the Security Support Provider Interface (SSPI) requires you to configure the following settings.

Configure Active Directory settings​

  1. Create an Active Directory (AD) service account to be used for the integrated authentication between the web or application server and the SQL Server.

  2. Log on to the Domain Controller with Domain Admin rights and execute the following command, where <webserver fqdn> is the fully qualified domain name (FQDN) of the web server:

    setspn -s HTTP/<webserver fqdn> <DOMAIN>\<service account>

Configure Web/Application server settings​

  1. Add the newly created AD account to the local user group IIS_IUSRS on the web server.

  2. Set up an application pool in the IIS to use the newly created AD service account. Setting up an application pool in IIS is described at the end of this section.

  3. Change the Enterprise Server web application to use the newly created application pool.

  4. Change the connection string to:

    Initial Catalog=<db name>;Data Source=<db server name>\<DB INSTANCE>;Integrated Security=SSPI;

    Example

    Initial Catalog=OISTST;Data Source=DBSRV01\TST;Integrated Security=SSPI;

  5. Run the following command in the folder C:\inetpub\AdminScripts:

    cscript adsutil.vbs set w3svc/NTAuthenticationProviders "Negotiate"

Authentication with Kerberos on Windows 2016 or newer​

When you use Windows Integrated Authentication with Kerberos on Windows Server 2016 or newer, you may need to change the ASP.NET authentication function to use the application pool credentials.

  • Open a command prompt and enter:

    cd %windir%\system32\inetsrv

    appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true

Alternatively, you can disable kernel-mode authentication in IIS:

  1. In Internet Information Services (IIS) Manager, expand the local computer's node, expand Sites, and click the website.
  2. In the center pane, under IIS, double-click Authentication.
  3. Click Windows Authentication.
  4. In the right-side pane, under Actions, click Advanced Settings.
  5. Clear the check box Enable Kernel-mode authentication. Click OK.

SQL Server Settings​

  1. On the SQL Server instance, you must create a new login equal to the newly created AD service account.
  2. Go to the Enterprise Server database and create a new user with the newly created login.
  3. Assign the database role membership db_owner to the newly created user.

Omada Identity Windows Services​

After configuring all the settings listed here, you must change the Timer Service to use the newly created Active Directory service account.

Remember to set the Windows services as described here each time you apply a patch to Enterprise Server.

Configuring SSL​

  1. Start Internet Information Services Manager, then select the relevant server and double-click Server Certificates in the main pane.

    IIS Manager server home page with the Server Certificates feature in the IIS section of the main pane

  2. In the right-side menu, click one of the available options to launch a wizard that helps you create a request for a server certificate. The request is delivered to a certificate authority that can grant a certificate. The response is brought back to the wizard, and the certificate is then installed.

    note

    The certificate's common name must match the DNS common name on the web server. Certificates are typically issued by public certificate authorities, such as VeriSign or Thawte. However, internal solutions often choose an internal certificate authority, which requires that all internal PCs must have the appropriate root certificate installed. This is Omada's best practice advice.

    It is critical that you select the correct setup to match your security and usability needs. Therefore, contact your own IT support to ensure that the best solution is chosen for your enterprise.

  3. After the certificate is installed, select the website, and open the Site Bindings dialog box. Click Add and create an https site binding using the installed certificate.

    Add Site Binding dialog box with the type set to https, port 443, and the installed SSL certificate selected

  4. Select SSL Settings in the main pane and select Require secure channel (SSL). If you enable this setting, all network traffic is encrypted with the server certificate.

    IIS Manager SSL Settings page for the OIS site with the Require SSL check box selected
note

The described solution does not cover client certificates.

Check the system security​

When your Enterprise Server installation is complete, you can apply security to the installation.

  1. Change any blank passwords that were used during installation into secure passwords. Your company should already have a password policy in place. Omada recommends following password best practices such as:

    • Periodic password changes and no recycling of passwords
    • No dictionary words or names
    • Minimum 6 characters
    • No passwords that contain user names, real names, or company names
    • The inclusion of English uppercase and lowercase characters (A-Z and a-z), Base 10 digits (0-9), and symbols found on the keyboard, such as !, $, #, or %.

  2. Contact your auditors to include your Enterprise Server installation in future routine audits that include security checks.

Right after Omada Identity is installed, the PswEncryptionKey has the default value DefaultEncryptionKey. You need to change this value as soon as possible after the installation, preferably before performing any other actions within Omada Identity.

The PswEncryptionKey change must be performed manually in all the places where it is used.

For more information about PswEncryptionKey, refer to the Password encryption key section.

The following table shows a sample checklist for ensuring the security of your implementation:

ActionNotesResult
Change the PswEncryptionKey from the default one.Refer to the Password encryption key section.
Change administrator password from <blank>.See the password best practices described in step 1 above.
Use SSPI connection instead of username/password.To avoid having the username and password stored in clear text in the registry.
Activate SSL.Optimize security.
note

This is security for your environment and is therefore unrelated to the security settings within the installation. For information about security in Omada Identity, go to Security settings.