Configuring the Active Directory security mode with the Security Configuration tool

Before you begin

• The securityconfig tool requires access to TCP ports 389 and 636 on the Active Directory domain controllers.
• If you use segregated VLANs, for example, MVMM may not be on the same network segment as domain controllers. Additional configuration may then be needed to allow visibility of the domain controllers.

Delegate Mode Security considerations

For Delegate Mode Security the following information is needed:

To configure Active Directory Delegate Mode security

1. From the command line, go to the MVMM installation directory, and type: securityconfig
   
   The securityconfig wizard opens and displays a welcome message, followed by a dialog box requesting the type of security configuration wanted. If the security type has already been set, that type is displayed as the default, which you can override.
   
   
2. Select Active Directory Security, and click Next. 
3. Select Active Directory (Delegate Mode), enter the Active Directory Domain Name, select either SSL, SASL, or SSL/SASL, and enter port numbers to be used for the internal LDAP server, and then click Next.
   
   
   
4. The security configuration wizard then queries an Active Directory Domain Controller (which might take a few seconds) and displays the base Active Directory Fully Qualified Domain Name that the controller returned. If required, you can change the name displayed. Then click Next.
5. You are prompted to enter the TSMA Administrator user credentials. Enter a user and password. Click Next.
6. You may be prompted to enter the CN credentials.  Enter a CN and password. Click Next.
7. You may be prompted to review and alter MVMA security settings.  You may use the substitution values to avoid repeating text string or you may enter the full values.  When the values have been modified to your satisfaction, click Next.
8. You are prompted to choose how to select the list of Domain Controllers. Select from Automatic Configuration, Choose From a List of Generated Domain Controllers, or Specify Domain Controllers. Then click Next.
9. In the displayed list of Domain Controllers (note that if you selected to specify the list of Domain Controllers you now need to enter their names, separating names with a space),select the relevant Controllers, and then click Next.

10. Define how you would like to handle Active Directory Domain Controller security certificates by selecting one of the following: 
    
    Capture Current Set of SSL Certificates (If you select this option, the security config wizard takes a few moments (depending on the length of the list and response times) to query each domain controller; you also need to update the certificates in the keystore file manually if your domain controller certificates are revoked.)
    
    Import Certificate from your Active Directory Administrator (If you select this option, you are prompted to enter one or more security certificate file names and certificate alias; enter an alias (name for documentary purposes) for the certificate and the location of the certificate file, and then click Next).

    Note

    If this is a new installation, you are prompted for the new keystorepassword (Enter the password, and click Next to continue).

    The product cannot connect to the domain controllers using expired certificates. If the used certificates expire (default is one year), you must renew the certificates accordingly using the Security Configuration tool.

    Allow any SSL Security Certificates (If you select this option you will need to manually import any active directory certificates required into the MVMA truststore)

     

11. Review the verification of the security settings, as shown in the following image, and then click Next.
    
    
    
12. In the Configuration Review screen, verify the information is correct and click Next.
    At this point, the service.cfg file is re-written with changes reflecting your configuration decisions.
13. Click Done to exit the wizard.

To configure Internal security

1. From the command line, go to the MVMM installation directory, and type: securityconfig
   
   The securityconfig wizard opens and displays a welcome message, followed by a dialog box requesting the type of security configuration wanted. If the security type has already been set, that type is displayed as the default, which you can override. 
   
   
2. Select Internal Security, and click Next. 
3. Enter a port number to be used for the internal LDAP server, and click Next to display the Configuration Review screen. 
4. After reviewing the information, click Next. The service.cfg file is re-written with changes reflecting your configuration decisions. 
5. Click Done to exit the wizard.