Home

www.oracle.com

What's New?

See the ESSO-LM Release Notes to learn about the latest features.

Explore Help

  • Console Overview
  • First-Time Setup
  • Global Agent Settings
  • Troubleshooting

Latest Documentation

See the latest ESSO-LM documentation in the online documentation center.

Copyright ©2006-2009, Oracle. All rights reserved.

Version 11.1.1.1.0


Introduction and Features

Oracle Enterprise Single Sign-on Logon Manager (ESSO-LM) provides users with one password to log on to every application on both the company network and the Internet. It works "out-of-the-box" (without programming or additional network infrastructure) with virtually any Windows, Web, proprietary, and host-based application, lowering IT and Help Desk costs without the expense and burden of integration.

ESSO-LM is intelligent agent software that works by responding to logon requests on behalf of the user, directly from the desktop. The agent responds to each software applications logon request by providing the correct credentials (that is, username/ID, password, and other fields) directly and automatically. A strong authentication mechanism controls access to the agent, ensuring access by only the designated user.

Feature | Benefits
Single Sign-On | Provides one password to log on to networks, applications, and Web sites.
Authenticator Choice | Authenticate using a Windows logon or LDAP Directory Server logon. (ESSO-AM accepts strong authenticators for its primary authentication – including smart cards.)
Mobility Support | Users can log on from any workstation and use their ESSO-LM credentials via directory servers, database systems, file systems, and Windows Roaming Profiles. (ESSO-AM users can log on using smart cards.)
Workstation Sharing | Multiple users can share the same workstation.
Automated Password Change | Users can choose a new password or the agent can select one automatically using approved password rules (Password Policies).
Strong Authentication | Soft token-based, two-factor authentication protects against unauthorized access.
Event Logging | Automatically log events such as logons, password changes, and so on.
Auto Prompt | Automatically prompts users to configure logons when they encounter a new password-protected application.
Credential Sharing | Multiple applications can share the same credentials.
Central Administration | All configurations and settings are centrally manageable via the ESSO-LM Administrative Console.
Automatic Backup/Restore | Automatically back up user credentials to a remote location including a directory server, relational database, or file system, and automatically restore user credentials after a system crash.
User Configuration of Logons | In addition to logons predefined by the administrator, users can add individual logons that they may have to other applications and Web sites.
Customization | Many aspects of the user experience, including user setup, are customizable to tailor the product to the security needs of the organization and technical sophistication of the user population.
Secure Architecture | The agent is designed to be highly secure, including allowing the Administrator to prevent revealing of any passwords, calling modern encryption algorithms, and using tamper-resistant modules.


What's New in ESSO-LM

What's New in ESSO-LM 11.1.1.1.0

ESSO-LM version 11.1.1.1.0 is the latest edition of Oracle Enterprise Single Sign-on Logon Manager Agent and the ESSO-LM Administrative Console. See the ESSO-LM Release Notes for information on what's new in this release.


Console Overview

About the Console

The ESSO-LM Administrative Console enables both agent and server configuration of most agent options, including:

  • Easy creation, management, and deployment of:
  • Application configurations and application configuration lists
  • Credential-Sharing Groups
  • Password Policies
  • Bulk-add lists
  • Agent configuration settings (through registry settings)
  • Easy setup and management of synchronizer extensions:
  • LDAP Directory Servers, including Tivoli Directory Server, Novell eDirectory, Oracle Directory Server, Sun Java System Directory Server, and OpenLDAP Directory Server
  • Microsoft Active Directory Server systems (including Application Mode)
  • Relational database systems, including Microsoft SQL Server, IBM DB2, and Oracle 9i/10g
  • File systems

The console obsoletes the need for editing configuration files or the registry by hand, with the associated risks of errors such as "fat-fingering" or providing invalid parameters.

The console's functionality is divided into the areas listed below, with their associated topics.

Action | Console Feature | Related Topic
Creating and managing application configurations | Applications | Configuring Application Logons
Creating and managing password generation policies | Password Generation Policies | Setting Password Policies
Creating and managing passphrase sets | Passphrase Questions | Passphrase Sets
Creating and managing credential sharing groups | Credential Sharing Groups | Creating credential sharing groups
Creating and managing bulk-add lists | Applications, Bulk-Add tab | First time use
Agent configuration settings | Global Agent Settings | Configuring Global Agent Settings
Setting up and managing synchronizer extensions | Synchronization | Synchronization
Setting up and managing repositories | Repository | Repository


Audience

These topics are intended for experienced administrators responsible for the planning, implementation and deployment of ESSO-LM. Administrators are expected to understand single sign-on concepts, such as password policies, logon methods, credential sharing groups, and application configuration, as well as have familiarity configuring directory servers, databases and repositories. The person completing the installation and configuration procedure should also be familiar with the company's system standards. Readers should be able to perform routine security administration tasks.


Product Overview

ESSO-LM uses a patented process for detecting requests for credentials, analyzing the response necessary, responding reliably, logging events, and administering settings.

Architecture/Modules

The ESSO-LM component architecture provides maximum flexibility to meet your organization's needs.

The ESSO-LM architecture consists of seven areas: authentication, encryption, intelligent agent response, core (including storage), credential synchronization, event logging, and miscellaneous components. In addition, administration is facilitated by the ESSO-LM Administrative Console.

Authentication

Authentication is how the system validates users so they gain access to ESSO-LM. It consists of three layers: (1) the authenticator itself; (2) the authentication service; and (3) the ESSO-LM Authenticator API. Once the system validates the user, it passes the users validation information to the core shell.

ESSO-LM ships with these authenticators:

  • Windows Domain (same password used to log on to the network)
  • Windows Authentication v2
  • LDAP Directory Server
  • LDAP Directory Server v2
  • Authentication Manager

ESSO-AM ships with these authenticators:

  • Entrust Entelligence
  • Proximity Card
  • Read-Only Smart Card
  • RSA SecurID
  • Smart Card

You determine which authenticators to support, which to install on each computer, and which to enable for each user. (Default: Windows Domain installs)

For details, see Configuring for Windows Authentication.

[ view diagram ]

Encryption

Encryption secures user credentials in the data store. The Shell (core) requests that credentials be encrypted/decrypted based on the appropriate Crypto Library algorithm. The agent automatically migrates credentials to a new algorithm/strength (for example, from Triple-DES to AES).

ESSO-LM supports a variety of encryption algorithms and algorithm strengths to suit your corporate, legal, security, performance, and other requirements.

ESSO-LM ships with several popular algorithms:

  • Cobra 128-bit
  • Blowfish 448-bit
  • Triple-DES 168-bit
  • AES 256-bit
  • Triple-DES (MS CAPI) (ALL OSs)
  • Triple-DES (MS CAPI) (XP/2003 only)
  • RC-4 (MS CAPI) (ALL OSs)
  • RC-4 (MS CAPI) (XP/2003 only)
  • AES (MS CAPI) (XP/2003 only)

Other algorithms can work as encryption modules.

You determine which encryption algorithms a user can use and which encryption new/modified credentials should use. (Default: Triple-DES)

For details on setting the default algorithm and strength, see Settings Controlling Security.

Top

Intelligent Agent Response

When an application presents a request for credentials, the agent detects this event, determines the appropriate action, and responds with the correct credentials. The interface that performs these evaluations is the Intelligent Agent Response. It interfaces with Access Manager to supply the proper credentials to each application. Access Manager acquires the credentials from the Shell.

Windows support installs automatically. You determine whether support for Web and/or Host applications installs. (Default: All modules install, but Host support is disabled.)

ESSO-LM ships with the configuration information for popular applications built in.

For more information on built-in applications, see Application Configurations Included. For more information on adding additional application configurations, see Configuring Application Logons.

Top

Application Configuration

ESSO-LM can work with its default install settings. However, ESSO-LM provides the flexibility to tailor its functionality to the specific needs of any organization. Some of the most commonly-customized functions are:

  • Predefined logons, which improves usability by letting users select from a predefined logon list. Applications include Windows applications , host applications, and Web applications .
  • Mobility Support, to provide location transparency and automatic backup and restore.
  • Event Logging, which enables ESSO-LM to log various events such as logons, password changes, and so on.
  • First-time use, which customize the user setup process to meet an organizations needs and improve usability.
  • Password policies, which propagate enterprise security policies, improve security, and (when automated) improve usability.
  • ESSO-LM settings, which control the UI, implement security, enable, disable, and configure features, and more.

Each of these decisions impacts multiple stages of planning, deployment, use, and management.

Top

Host Emulators

ESSO-LM supports many host emulators. You determine which, if any, the Agent will recognize. (Default: The Agent works with all supported emulators but requires emulator configuration for some emulators

It is recommended that you configure host emulators to work with the Agent before deploying ESSO-LM.

For more information on host emulators, see Configuring Host Emulators.

Top

Core (Including Storage)

Using your preferred encryption algorithm, the Agent encrypts and stores user credentials locally in the encrypted Local Credential Storage; it never maintains credentials unencrypted on disk or in memory. The credentials are stored in a user-specific secure database file. Within this file are the encrypted records for each set of user credentials, user settings, and additional configuration information.

Top

Credential Synchronization

While the Agent stores user credentials and settings locally, it can synchronize the credentials and settings with remote file systems, directories, databases, devices, and so on. Synchronization can be of the entire user database file (which contains all user credentials) or of individual records within the database. The synchronization is triggered by a change to the Local Credential Storage or settings. Synchronization can be extended to any storage mechanism via the Synchronization API.

Agent administration is fully supported via the Synchronization component and allows the administrator to dynamically deliver updated settings and configuration data to the agent through the central storage mechanism.

Top

Synchronization Extensions

The Agent works with a variety of synchronization extensions, providing users access to their credentials from any desktop.

ESSO-LM includes the following synchronizer extensions:

  • LDAP-compliant directory servers, including:
  • IBM Tivoli Directory Server
  • Oracle Directory Server
  • Novell eDirectory
  • Sun Java System Directory Server
  • OpenLDAP Directory server
  • Microsoft Active Directory Server
  • SQL-compliant relational database system, including
  • Microsoft SQL Server
  • IBM DB2
  • Oracle
For specific version information, refer to the latest ESSO-LM Release Notes.

ESSO-LM also includes a synchronizer extension supporting a file system, such as on a remote network drive share.

You determine which synchronization modules to install on each computer, which modules to enable for each user, and how to configure each extension. (Default: The synchronizer module installs but no synchronization extensions install)

  • For information on Mobility in general, see Mobility Configuration.
  • For details on synchronization, see Storing User Credentials and Settings.
  • For details on directory servers, see Directory Server Synchronization Support.
  • For details on database systems, see Database Synchronization Support.
  • For details on the File System synchronization extension, see File System Synchronization Support.

Top

Event Logging

When notified by the Shell, the agent can log all SSO system events, including credential use, credential changes, global credential events, agent events, and agent feature use. The agent can also log specified fields. Events can be logged locally or to any external destination through the Event Logging API. These destinations can include an SNMP service, a Windows server (for viewing via the Windows Event log), or even a local XML log file for simplified parsing and reporting.

The Agent can log all events through its Event Logging API.

ESSO-LM works with a variety of Event Logging extensions and includes two Event Logging extensions writing to both local and remote servers:

  • Local File extension, to an XML file
  • Windows Event Logging extension, to a Windows Event Logging server
  • Passlogix may release additional extensions (for example, SNMP and Oracle), and you can easily write your own extensions.

You determine which Event Logging modules to install on each computer, which modules to enable for each user, how to configure the extensions, how frequently t>he agent will write to these extensions, how much data the agent will cache, where the agent will write the log, and more. (Default: No Event Logging modules install, and no logging occurs)

See Event Logging for details.

Top

Miscellaneous Components

ESSO-LM also contains the following miscellaneous modules:

Backup/Restore

For users who do not perform any Credential Synchronization, the Backup/Restore component enables archiving and restoration of user credentials.

Citrix and Windows Terminal Services Tools

For environments that require usage of the agent within a Citrix MetaFrame or Windows Terminal Services environment, additional components are supplied to allow ESSO-LM to interact appropriately within each session.

Installer Package

ESSO-LM ships within a Windows Installer package that supports the flexibility of that technology for easier deployment and customization.

Top

Common Scenarios

First-Time Use

The agent can prompt the user for current credentials for predefined applications. You determine which, if any, credentials to request. (Default: The agent does not request credentials for any applications)

For more information on first-time use issues, see First Time Use (Bulk-Add).

User Work Modes

ESSO-LM supports work modes ranging from "One Workstation, One or Multiple Users" to "Frequent Movement Among Many Workstations" and from always-connected to frequently-disconnected.

For more information on first-time use issues, see User Work Modes.

Usability vs. Security

ESSO-LM lets you choose the balance between usability and security that is appropriate for your organization.

For more information on first-time use issues, see Settings Controlling Usability.

Packaging/Distribution/Installation

ESSO-LM supports most deployment tools and methods. You determine which components deploy to which desktops.

For more information on deployment, see Deploying the Agent.

Top

Resources

ESSO-LM stores all program files, settings, and data in the following places:

  • The %ProgramFiles%\Passlogix\v-GO SSO directory contains ESSO-LM program files. (Default: C:\Program Files\Passlogix\ESSO-LM)
  • The %ProgramFiles%\Passlogix\v-GO SSO\Console directory contains ESSO-LM Administrative Console program files. (Default: C:\Program Files\Passlogix\v-GO SSO\Console)
  • The %ProgramFiles%\Passlogix\SSO File Sync Service directory contains SSO File Sync Service program files. (Default: C:\Program Files\Passlogix\SSO File Sync Service)
  • The %AppData%\Passlogix directory contains user data files. (Default: depends on OS; Windows 2000: C:\Documents and Settings\%UserName%\%AppData%\Passlogix)
  • The HKCU registry tree stores user default settings.
  • The HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix registry tree stores overriding setting (settings that override user settings) and ESSO-LM defaults.
  • The SSOLocator objects on a directory server direct ESSO-LM to where each users' credentials are stored (an SSOConfig object).
  • The SSOConfig objects on directory servers and similar objects on File Systems store overriding settings and user data.

Settings in SSOConfig objects override registry settings.

SSOConfig is the default name, but can be named anything.

Top


Important Topics

Considerations Before Deploying ESSO-LM

The topics in this section discuss important concepts and considerations regarding the deployment and administration of ESSO-LM.

User Work Nodes | Understanding the different ways to set up the agent side of supporting users working in different configurations, and how to optimize your configuration for each set of scenarios.
Configuration | Understanding the different ways to set up the server side of supporting users working in different configurations, and how to optimize your configuration for each set of scenarios.
Rollout | Understanding the process and issues surrounding rolling out ESSO-LM to an organization.
Administration and Management | Understanding the post-rollout issues for ESSO-LM deployments.


User Work Modes

Users access their computers in a variety of work modes:

  • Some users are always at a given workstation and are the sole user
  • Some users move frequently among a limited number of workstations (for example, nurses in a department) or move to a different workstation every day or few hours (for example, a call center).
  • Multiple users may share a single workstation, for example, in shifts. Such a workstation may be used as a kiosk, that is, by multiple users who log on on using a smartcard or other token.
  • Some users are not always connected to the network.

ESSO-LM supports all these scenarios and can be optimized for each user's most common scenario. (Default: Users are always at a given workstation, but share with others)

One Workstation, One User

When users are always at a given workstation, their credentials can be backed up to a remote location using an SSO synchronizer extension. See Synchronization for more information.

Alternately, the Backup/Restore facility module can store credentials on the workstation without the use of a remote repository. The Backup/Restore module is not installed by default. Users can perform backups manually, or the backup can be automated. See File-Based Backup/Restore for more information.

Frequent Movement Among Few Workstations

When users move frequently among a few workstations, but are always on those few workstations, you have two basic options for supporting their ESSO-LM credentials.

The recommended option is to utilize a remote SSO repository. Both starting the agent and any change to credentials force a record-level comparison (synchronization) of all records, ensuring that the user always has the most current credentials possible.

One other option is to configure automated silent backup to a network file share. With proper configuration, the agent will perform a silent backup to a remote store (network drive) with each change of credentials (Refresh Task). When the agent first starts, it will see if the remote store is newer than the local store; if so, it will perform a silent restore; either way, the user will have the current credentials. Because this is a file-level (as opposed to record-level) comparison, this option is not safe if the user logs onto more than one computer at the same time.

Frequent Movement Among Many Workstations

When users move frequently among many workstations, you have two basic options for supporting their credentials.

The recommended option is to utilize a remote SSO synchronization repository. Both starting the agent and any change to credentials force a record-level comparison (synchronization) of all records, ensuring that the user always has the most current credentials possible. In addition, to increase security and to reduce disk space use, enable the Delete Local Cache (on Shutdown) option.

Alternately, if your Windows environment is already set up with Windows Roaming Profiles, user data is automatically available to the user since it is included in the %AppData% file directory. However, due to the bandwidth-intensive nature of Windows Roaming Profiles, it is not recommended for use with SSO credentials.

One Workstation, Many Users

A single workstation may be accessed by a number of users, such as a kiosk. A smart card (or other token) and a PIN can be used to log on to a kiosk (ESSO-AM only). To enable these users' access to the remote SSO repository the ssoSCDetect utility can be used to start the ESSO-LM Agent and prompt for primary logon whenever a smart card is inserted in the reader. When the card is removed, the user is automatically logged out of the agent. See ssoSCDetect (smartcard monitor utility) for more information.

Disconnected

When users use laptops or are in remote locations, they often stay disconnected from the network for long periods of time.

The ESSO-LM agent stores credentials locally, providing full independence for mobile users who cannot rely on a network connection. ESSO-LM modules like Storing User Credentials and Settings and Event Logging support occasional reconnecting, ensuring reliability.

With File-Based Backup/Restore, users can save their own data to a floppy or zip drive. With ESSO-AM, users can save their own data to a smart card.

The ESSO-LM synchronizer extensions are configured for offline users using Synchronization options, including Disconnected Operation (See Settings Controlling Mobility).

Usability and Security

Security: Locked Down vs. User Freedom

You can customize ESSO-LM to provide the balance of security appropriate to your organization's policies and risk/trust level. For example, some organizations need to insure that a user cannot deny having taken a given action, whereas others are not as security-conscious.

Usability: User Flexibility vs. Simplicity

You can customize ESSO-LM to provide the balance of usability appropriate to your organization's policies and user skill level. For example, some organizations largely employ users who are confused by all but the simplest user interface, whereas others are staffed by more experienced users and might wish to offer flexibility in their environment.

Other Settings

You can customize ESSO-LM in many ways, and you can enforce these settings at the user, computer, or group level. (The "group" level can include the entire enterprise.) See Global Agent Settings for details.


Mobility Configuration

Some organizations configure their SSO repository components (directory servers, relational databases, file system share) in a very centralized fashion (for example, all user data store objects under one parent object). Other organizations use a decentralized structure (for example, a parent object for each department, location, level of employee). Each has its advantages and disadvantages, depending on your specific current and future network topology. Below are some general advantages and disadvantages.

Centralized

Advantages

Disadvantages

  • Easy to configure globally
  • Easy to manage
  • Hard to load balance
  • Bandwidth-intensive when user population is dispersed and user data isn't locally replicated (for example, retrieving data on a New York server from Tokyo)
Decentralized

Advantages

Disadvantages

  • Granular control (for example, different security for different users)
  • Can reallocate resources easily (for example, move user data objects as the users move closer to different servers, split data among several servers)
  • Harder to manage
  • Easier to make mistakes with one set of data and not realize the disparity

ESSO-PG

ESSO-PR

Oracle Enterprise Single Sign-on Password Reset

ESSO-LM

Oracle Enterprise Single Sign-on Logon Manager

FTU

First Time Use Wizard

First-Time Use Scenarios

You can control users first-time use scenario from the ESSO-LM repository. Determine your first-time use scenarios and then push the object to the ESSO-LM repository. If using a centralized environment, only one object is needed; if using a decentralized environment, you can customize the first-time use scenario configuration to meet each group's needs. See First Time Use (Bulk-Add) for more information.

System Configuration

You can provide ESSO-LM configuration settings to users from the ESSO-LM repository. Determine your overriding settings and then push to an object in the ESSO-LM repository. If you are using a centralized environment, only one object is needed, providing ideal top-down security controls; if you are using a decentralized environment, you can customize the settings to meet each group's needs. See Settings Controlling Mobility for more information.

Application Configurations

You can provide application configurations to users from the ESSO-LM repository. Determine your application configurations and then push to an object in the ESSO-LM repository. If using a centralized environment, you need only one object; if you are using a decentralized environment, you can customize the list of supported applications to meet each groups needs. See Configuring Application Logons for more information.


Software Rollout

The Basics

You can introduce yourself to ESSO-LM by accessing its basic functions; that is, log on to your computer and the Agent provides the logon to all other applications.

To see examples of this, observe the Agent responding to some predefined applications (for example, Outlook and Lotus Notes 4/5) and some Web sites (for example, Yahoo! and EudoraMail.com). Install ESSO-LM with its typical configuration and then start these applications.

Application Configuration

Once you see the Agent respond to some predefined applications and common web sites, you can easily configure the Agent to detect and respond to almost any password-protected application.


Administration and Management

After the initial deployment, you can continue managing ESSO-LM modules deployment for updates and upgrades, using the Administrative Console or your own current deployment method.

ESSO-LM Configuration
Directory Servers & Database Systems | Using the Administrative Console, modify the SSOAdminOverride objects.
File Systems | Using your current File System administration/management tool or the Administrative Console, modify the overriding settings.
Local | Using a domain management tool, a deployment tool, RegEdit, and so on, modify the HKLM hive.
Application Configurations
Directory Servers & Database Systems | Using the Administrative Console, modify the SSOentlist and (optionally) SSOftulist objects.
File Systems | Using the Administrative Console modify the entlist and (optionally) ftulist files.
Local | Using the Administrative Console, modify the entlist.ini and (optionally) ftulist.ini files.
Settings
Change settings post-rollout

Using the Administrative Console, push overriding settings to the ESSO-LM synchronization repository (for example, the directory server, database, file system).

Using a domain management tool, a deployment tool, RegEdit, and so on, deploy registry changes.

User Data
Directory Servers | Using your current directory administration/management tool, move the user object and (if needed) alter or add an SSOLocator object for the user.
File Systems | Using your current network administration/management tool (or even Windows Explorer), move the user file directory tree and (if needed) change the user files' storage location.
Local | Using a domain management tool, a deployment tool, RegEdit, and so on, change the user files' storage location.
Managing User Credentials
Local Deleting User Credentials
Using a domain management tool, a deployment tool, Windows Explorer, and so on, delete the %AppData%\Passlogix file from the users %AppData%\SSO directory on all computers the user accesses.
Directory Servers

Deleting User Credentials
Using your current directory administration/management tool, delete the user object from the directory and delete user credentials by using Windows administrative access to delete the %AppData%\Passlogix file from the users %AppData%\SSO file directory tree on all computers the user accesses.

Moving a user object

Using your current directory administration/management tool, move the user object using the directory administrative tool and (if needed) alter or add an SSOLocator object for the user.
File Systems Deleting user credentials
Using your current network administration/management tool or Windows Explorer, delete the user files from the file system and delete user credentials by using Windows administrative access to delete the %UserName% AML.mdb file from the user's %AppData%\Passlogix file directory tree on all computers the user accesses.


Configuring Global Agent Settings

Configuring ESSO-LM

These topics describe how to configure ESSO-LM to support specific environments.

  • For Windows authentication
  • For directory servers
  • For databases
  • For file systems
  • For Citrix MetaFrame


for Windows Authentication

Configuring for Windows Authentication

ESSO-LM supports Windows Authentication as the Primary Logon Method (Authenticator), creating a true single sign-on user experience. The agent can use the Windows logon credentials as its authentication. In order for ESSO-LM to support this, the administrator needs to be aware of two issues:

  • The OS must have 128-bit encryption installed.
  • The administrator must enable user-level profiles.

For Microsoft Windows 2000/XP, user-level profile support is part of the base feature set when installed.

Confirming 128-bit Encryption

To check the encryption strength of the OS, launch Microsoft Internet Explorer, and select Help>About. Confirm that Cipher Strength is 128-bit.

If the OS is not 128-bit, download the update from Microsoft:

http://www.microsoft.com/windows/ie/ie6/downloads/recommended/128bit/default.mspx.


Directory Servers: Configuring the Agent

This topic describes the settings needed to configure ESSO-LM to use a directory server as a repository. The configuration is similar for all supported directory servers, with explanations of any differences.

  • See Directory Server Synchronization Support for more information about how ESSO-LM makes use of directory server resources.
  • See Overriding Settings for detailed descriptions of the associated registry entries.

Where the LDAP AUI and LDAP Directory Server extension are both installed, values must exist in both AUI\LDAP and Extensions\SyncManager\Syncs\%LDAP%.
  1. Point ESSO-LM to the server or servers.
  2. Do one of the following:
    • From Global Agent Settings in the left pane, select an existing set of registry entries.
    • Import a saved set of settings (File>Registry>Import).
    • Create a new set of registry settings (Insert>Global Agent Settings).
  3. In the left pane of the console, select and open the set of settings, select and open Synchronization (add the appropriate extension if needed), select and open the appropriate extension, then select and open Servers.
  4. In the right pane, select Servers, select the … button, enter the server names, or IP addresses, and click OK.
For Microsoft Active Directory Server (other than Application Mode):
  • If no Servers are entered for the Active Directory extension, and the user account is in an Active Directory domain, then ESSO-LM uses AD domain resources to discover the server. If one or more servers are provided in the Global Agent Settings, then ESSO-LM uses the Servers list to locate the server.
  • Unless otherwise configured, ESSO-LM queries the domain name server (DNS) for the name of the preferred domain controller assigned to the local subnet.
  • In Active Directory networks with multiple servers, be sure to enable replication in order to include the ESSO-LM schema extension and related objects. This assures that ESSO-LM will always find SSO information on every server it connects with.
  • If one or more servers are provided for Microsoft Active Directory Server, use server names, rather than IP addresses.

For Microsoft Active Directory Server Application Mode:

  • At least one server must be specified for ADAM services.
  • Use the port parameter (for example myserver.com:9890 ) to specify particular instances of ADAM running on a single server.
  • Applications templates must reside in a specific OU and not at the root of the ADAM instance.
  5. Point ESSO-LM to the User path.
  6. In the left pane, select the appropriate extension, then do one of the following:
    • For an LDAP extension, select Required.
    • For an Active Directory extension, select Advanced.
  7. In the right pane, select User Paths, then select the … button, enter the user path(s), and click OK.
  8. Enable or disable SSL.
  9. In the left pane, select the appropriate extension.
  10. In the right pane, select SSL options as follows:
  11. If using SSL, select SSL (for LDAP or Active Directory) and select Connect via SSL (defaults to port #636).
  • SSL is not enabled by default; the non-secure default port is #389.
  • To set non-standard ports, use the Servers setting (for LDAP or Active Directory).
  12. If using SSL, select When SSL Fails (for LDAP or Active Directory) appropriately.
For Novell eDirectory

There are two major caveats for Novell eDirectory and some other environments If the domain name for a user is in the form of

cn=%UserName%,ou=people,dc=Oracle,dc=com

instead of the form

namingattribute =%UserName%,ou=people,dc=Oracle,dc=com

where namingattribute can be any string, do the following:

  1. In the left pane, select the appropriate extension, then select Advanced.
  2. Select Naming Attribute string and set it to CN.
  3. Select Alternate User ID location and set it to uid=%user%,path where path is the rest of the path to the object; for example:

uid=johnd,ou=people,dc=Company,dc=com.


File Systems: Configuring the Agent

This topic describes the settings needed to initially configure the ESSO-LM Agent to synchronize application logons, global agent settings, and user credentials with a network file share.

The configuration settings described below can be distributed to the client workstations either as part of the general deployment of the Agent software (by modifying the MSI installer file), or after Agent deployment, by distributing a registry-entries (.REG) file that can be merged with the client workstation's registry.

  • See Deployment Options for topics about ESSO-LM Agent rollout.
  • See File System Synchronization Support for more information about how ESSO-LM makes use of file system resources.

  • See Overriding Settings for detailed descriptions of the associated registry entries.

    1. Point the ESSO-LM Agent to the server.

    2. Do one of the following:

      • Import a saved set of settings (choose Registry, then Import from the File menu).
      • Create a new set of registry settings (from the Insert menu,l choose Global Agent Settings).
      • Select an existing set of registry entries (by selecting it in the left pane under Global Agent Settings).
    3. In the left pane, select and open the set of registry settings, select and open Synchronization, add the appropriate extension (if needed), select and open the appropriate extension, then select Required.
    4. In the right pane, select Server, enter the server names or IP addresss and click OK.
    5. Export the settings to the Agent.
    6. Select a method for initial distributing the global agent settings to client workstations:
    7. Customize the MSI package that installs the ESSO-LM Agent to include these settings.
    8. Distribute a .REG file that you export from the Console. The REG file can be merged with the client workstation's registry locally by double-clicking the file icon.


Database Synchronization: Configuring the Agent

You can distribute the configuration settings described below to the client workstations either as part of the general deployment of the Agent software (by modifying the MSI installer file) or, after Agent deployment, by distributing a registry entries (.REG) file to merge with the client workstation's registry.

  • See Deployment Options for topics about ESSO-LM Agent rollout.
  • See Database Synchronization Support for more information about how ESSO-LM makes use of database server resources.
  • See Overriding Settings for detailed descriptions of the associated registry entries.
    1. Point ESSO-LM to the database server.
    2. Do one of the following:
      • Select an existing set of registry entries (by selecting it in the left pane under Global Agent Settings).
      • Import a saved set of settings (from the File menu, choose Registry, then Import).
      • Create a new set of registry settings (from the Insert menu, choose Global Agent Settings).
    3. In the left pane, select and open the set of registry settings, select and open Synchronization, add the appropriate extension (if needed), select and open the appropriate extension, then select and open Servers.
    4. In the right pane, select Servers, select the … button, enter the database server name(s) and click OK.
    5. Export the settings to the Agent by selecting a method for initial distribution to client workstations:
      • Customize the MSI package that installs the ESSO-LM Agent to include these settings.
      • Distribute a .REG file that you export from the Console. The REG file can be merged with the client workstation's registry locally by double-clicking the file icon.


Role/Group Support

Role/Group Support (Directory Server Only)

In directory-server synchronization installations, ESSO-LM provides support for role/group access control for individual configurations, including application logons, password-change policies, global agent settings, and passphrase question sets. When this feature is enabled, you can assign access-control lists, similar to those used in Windows security to the individual logons, policies, settings, and question sets.

Role/group support-enabled configurations are exported to a synchronizer container object just like the standard ESSO-LM configuration objects (EntList, FTUlist, and AdminOverride). When role/group support is enabled and these access-controlled objects are present in the container, they override the standard objects. Follow these steps to configure role/group support:

  1. Configure these global agent settings to enable role/group security support and update the Agent:
Synchronization

Enable role/group security support

Enables role/group support for application logons, password policies, global agent settings, and passphrase question sets.

Options:

  • Do not use role/group security (default)
  • Use role group security.
Synchronization > selected sync > Advanced

Configuration Objects Base Locations

(LDAP, Active Directory, ADAM)

Specifies where to begin the search for role/group-enabled configuration objects. The search is from the specified locations or locations downward, (away from the root). If there are no entries for this setting, the search is from the root.

  2. Specify the access rights for each configuration:

    Use the Security tab for each configuration (application logons, password policies, global agent settings, and passphrase question sets) to specify the users and groups that should have access to it.

  3. Export the configurations to a synchronizer container
  4. Connect to the synchronizer directory.
  5. In the right pane, right-click a container object and choose Configure SSO Support from the shortcut menu to start the wizard.
  6. Choose Administrative Console as the Data Source
  7. Choose Advanced Support and complete the Wizard procedure to export the configuration objects as individual, access-controlled objects.

For best performance and highest security, Oracle recommends the following practices:

  • Unless your organization explicitly requires role/group support, make certain that Enable role/group security support is set to "Do not use..."
  • For best security, make certain that there are no user-writeable areas anywhere down the directory tree from the location specified by Configuration Objects Base Locations (LDAP, Active Directory, ADAM).
  • For best performance, always specify at least one location for Configuration Objects Base Locations. This ensures that the entire server is not searched.
  • To minimize the search load and length, be sure to store as little unnecessary data as possible down the directory tree from the location specified by Configuration Objects Base Locations.


Distributing Predefined Application Logons

ESSO-LM recognizes and responds to a wide array of logon scenarios. Users can configure each logon in advance or as they encounter them. When a user configures a logon, the agent displays a list of predefined applications. Users select an application from this list or create a logon for an unlisted application.

Predefined applications simplify configuration for the user and increase the reliability of both recognizing and responding to logon and password-change requests.

Preconfigured application logons for many popular Windows applications are included with the Administrative Console in the form of templates that contain all or part of the logon's configuration. The applist.ini file (located in the installation directory in the Plugin\LogonMgrdirectory) includes predefined logons for network and web pop-up logon dialogs boxes and for many online service providers.

Adding Predefined Logons

  1. Create the application logons using console configuration features (see "Related Topics," below).
  2. Create and deploy an entlist as an INI file or equivalent synchronization object.
    • Use Export to INI file to create an entlist.ini file.
    • Use Configure SSO Support to create an e ntlist synchronization object.
  3. Do one of the following:
    • If you are using synchronization to deploy application logons, do not use the Location of entlist.ini file setting. The synchronizer automatically locates entlist.ini and ftulist.ini in the user's %AppData%\Passlogix directory.
    • If you are not using synchronization to deploy application logons, use the Location of entlist.ini file setting under End User Experience/Environment.

The administrator must create entlist.ini; the agent does not create it automatically.


Understanding the Application Configuration Files

ESSO-LM stores its application logon instructions in a file named aelist.ini that typically resides in the each user's %AppData%\Passlogix directory (i.e. C:\Documents and Settings\username\Application Data\Passlogix). The Agent creates aelist.ini by merging two component files:

  • entlist.ini, which you create using the console to provide your organization with customized logons for Windows, Web site, and mainframe/host applications. The Agent's synchronizer extension places entlist.ini in the %AppData%\Passlogix.
  • applist.ini, which is included in the Agent installation package and contains predefined logons for network and web pop-up logon dialogs and for many online service providers. The applist.ini file resides in the Agent's installation directory.

Preconfigured logons for Windows and Web application are provided in Console templates.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini) can only be created and edited using the console.

How the Agent Uses entlist.ini

The agent merges entlist.iniwith applist.ini to create aelist.ini in the %AppData%\Passlogix directory. The agent overwrites aelist.ini periodically, including at agent startup. The agent then uses aelist.ini to detect "known" applications.

If using a synchronizer extension (for example, Directory Server or File System), a remote object overrides any local entlist.ini file, and is then merged with applist.ini.

If there is no remote object or local entlist.ini file, the agent will utilize applist.ini without creating the aelist.ini file.

While the Agent is running, you can modify entlist.ini or the SSOentlist object. To force the agent to re-merge to create a new aelist.ini, select Refresh in Logon Manager.

See the following topics for more information about creating and distributing application logons:

  • Creating logons from templates:
  • Adding Windows Applications
  • Adding Web Applications
  • Adding Host/Mainframe Applications
  • Add Application dialog box
  • Distributing Logons:
  • Distributing Predefined Application Logons
  • Administration and Management
  • Overriding Settings Objects

How the Agent Uses aetlist.ini

The file that results from the merger of, aelist.ini, contains all the information necessary to identify and respond to logon and password change events for all configured applications. This information comprises:

  • Application-type settings such as Error Loop settings, for example, how many times the agent will retry a logon within the specified time period.
  • Application-specific configuration information, for example, application executable name or Web Site URL, password change behavior Password Policies, Error Loop settings, data file extension.
  • Scenario-specific configuration information for the logon and password change scenarios, for example, window dialog title strings, form names, and locations for credentials.
  • Dialog-specific matching settings (for example, that a string or control is or is not present).
  • Other settings (for example, name of a third or fourth field).

The merged file, aelist.ini, has a hierarchical structure, containing all the information necessary for the agent to uniquely identify and respond to logon and password change events for each application to configure. It organizes logons in sections and subsections as follows:

[*Other Apps] Section1=Application logon 1 Section2=Application logon 2 | This section references two administrator-defined Windows applications defined later in the file. See Adding Windows Applications for details.
[*Mainframe] Section1=Host logon 1 Section2=Host logon 2 & | This section references two host/mainframe applications defined later in the file. See Adding Mainframe applications for details
[*Shared Groups] Section1=Shared Group 1 Section2=Shared Group 2 & SectionN=Shared Group N & | This section references two groups used for credential sharing. See Creating credential sharing groups for details.
[*PasswordPolicies] & | This section enables Password Policies. See Setting Password Policies for details.

The application configurations in entlist.ini allow the agent to automatically recognize and respond to logon and password-change requests from applications specific to your organization.

When present as a local file or downloaded from a remote object, the Agent downloads an entlist object (if available) to an entlist.ini file, and combines your downloaded or local entlist.ini with those Oracle supplies in applist.ini to create aelist.ini, the complete list of predefined applications available to users. (If entlist.ini is not present, the agent utilizes applist.ini.)

Because Oracle provides updates to applist.ini, it is strongly recommended that you make no changes to applist.ini: future ESSO-LM releases may overwrite your applist.ini changes, and Oracle provides no guarantees that future releases will support changes you make to applist.ini.

Preconfigured Application Templates with ESSO-LM

The following table lists the preconfigured application logons that are included with the Administrative Console and any information that the administrator must supply before deploying the logons to the Agent.

Application Logon Form
Microsoft Word
  • Microsoft Word Logon
  • Microsoft Word 2000 Logon
  • Microsoft Word 2003 Logon
MS Dial-Up Networking
  • MS Dial-Up Networking Logon (admin supplies WindowTitle)
Netscape Mail
  • Netscape Mail Logon
  • Netscape Mail 7.1 Logon
PKZIP
  • PKZIP Logon
  • PKZIP v8 Logon
Siebel Sales
  • Siebel Sales Logon
  • Siebel Sales Change Password
Adobe Acrobat Reader
  • Adobe Acrobat Unlock
ICQ
  • ICQ Logon - Registration
  • ICQ Logon
Meeting Maker
  • MM 7.3 Logon
  • MM 5.5.2 Logon
  • MM 8.0 Logon
WinZip
  • WinZip Set Password Confirm
  • WinZip Set/Use Password
  • WinZip 9.0 Decrypt File(s) Password
Yahoo! Messenger
  • Yahoo! Messenger Logon
Oracle
  • Oracle Logon
  • Oracle 10g SQL*Plus Logon
MS SQL
  • MS SQL Logon
Novell GroupWise
  • Novell GroupWise Logon
  • Novell GroupWise 6.5 Logon
Microsoft FrontPage
  • Microsoft FrontPage Logon
Visual SourceSafe
  • VSS Logon
  • VSS Change Password
OpenNetwork Directory Smart
  • OpenNetwork Directory Smart Logon (admin supplies URL)
Oblix NetPoint
  • Oblix NetPoint Logon (admin supplies URL)
Citrix ICA Client/Program Neighborhood (2-field)
  • CICA2 Logon (admin supplies WindowTitle)
Citrix NFuse Classic (2-field)
  • CNFC2 Logon (admin supplies URL)
Act
  • Act Logon (admin supplies WindowTitle)
  • Act Set Password
QuickBooks Pro
  • QBP Change Password
  • QBP Logon
QuickBooks Pro (Password-Only)
  • QBPPO Change Password
  • QBPPO Logon
Lotus Organizer
  • Lotus Organizer Logon (admin supplies WindowTitle)
Citrix Program Neighborhood Agent (3-field)
  • CPN3 Logon
GoldMine
  • GoldMine Logon
  • GoldMine Clhange Password
Citrix NFuse Classic (3-field)
  • CNFC3 Logon (admin supplies URL)
Citrix Program Neighborhood Agent (2-field)
  • CPN2 Logon
Citrix ICA Client/Program Neighborhood (3-field)
  • CICA3 Logon (admin supplies WindowTitle)
AIM
  • AIM Logon
Eudora
  • Eudora Logon
  • Eudora Change
  • Eudora Confirm
Lotus Notes
  • Lotus Notes
Microsoft Outlook
  • Logon
  • Change Password
Microsoft Outlook 2003
  • Logon
  • Change Password
MSN Messenger
  • MSN Messenger Logon
Windows Logon
  • WL MPR Logon
  • WL MPR Change Password
  • WL WinLogon Logon
  • WL WinLogon Change Password
ICQ 4.0
  • ICQ 4.0 Logon (Password Only)


General Guidelines for Setting Up Applications

Setting up and configuring applications is easiest with the following conditions:

  • Have the target applications on the same workstation as the console.
  • Minimize the number of other applications running during configuration.
  • To facilitate creating application configurations and testing:
  • Configure your workstation not to use a synchronizer extension.
  • In the console, create the application configuration and then use Export Apps to Agent (on the Tools menu) to overwrite the local entlist.ini file.
  • Keep Logon Manager visible, and select Refresh whenever you finish exporting from the console.
  • Bring up the application logon dialog box to see if your new configuration works properly within the Agent.

When the application logon request causes the Agent to respond, tell the Agent to ignore it.


Adding Windows Applications

The easiest and most precise way to configure Windows applications is by using the Windows Form Wizard.

Before you begin Windows logon configuration, refer to the General Guidelines for configuring applications.

Special Issues and Settings

Some Windows applications interact in unusual ways or have special requirements. For these scenarios, the Administrative Console offers these additional configuration options.

Special Configuration Settings

On the Fields tab (for a new or selected logon form)
SendKeys

Use the SendKeys option for Windows applications that:

  • Cannot receive credentials from the Windows message queue or by other techniques the Agent normally uses to send credentials
  • Do not use standard Windows controls that have Control IDs
  • Dynamically generate controls or do not use Windows controls at all (for example, Flash applications).
On the Miscellaneous tab (for a new or selected logon form)
Allowable Class | Use the Allowable Class option to identify logon or password-change window classes that must be present in order to execute this logon. This is useful for applications that present logon- or password-change windows with non-standard class names.
Ignore this Window Class

Use the Ignore Window Class option for applications that:

  • Use hidden logon or password-change dialogs, or
  • Present duplicate dialogs.
Attach to window's Message Queue | Use the Attach to... option to keep the focus on the target logon window while sending credentials.
Preset Focus | Use the Preset Focus options to have the Agent set the focus on a field before entering data in it.
On the Miscellaneous tab (for a selected application)
Service Logon | Select the Service Logon option to let the Agent detect an application that runs as a Windows service (that is, in the System space, rather than the User space).
Third/Fourth Field Label | Use these options to specify the text labels the Agent should use to display these additional fields.
File extension for Icon | Use this option to provide a Windows file extension to associate with a logon; this lets the Agent map an icon to it.


Adding Web Applications

ESSO-LM detects and responds to logon and password-change requests for predefined Web applications. Much like Windows and host/mainframe applications, administrators define Web applications by including a section in entlist.ini.

The Agent recognizes specific strings of data at specified locations within the HTML code of a Web page. This data tells the agent how to detect the Web site's logon and password-change screens, where to enter the user credentials, and how to submit those credentials.

The easiest and most precise way to configure Web applications is by using the Web Form Wizard. Before you begin this procedure, refer to the General Guidelines for configuring applications.

Web applications can have the logon and password change forms on the same page, on different pages within the same URL, or at different URLs. Furthermore, logons can be in the same form at different URLs or on different forms at different URLs.

If you add a configuration for a site where the user's local store already includes a logon, your new configuration will override the user's. The user will need to re-enter credentials for this application.

The user can still view the old logon in Logon Manager.


Adding Host/Mainframe Applications

ESSO-LM provides single sign-on functionality to host/mainframe applications through host emulators that:

  • Implement HLLAPI (high-level language application programming interface), or
  • Have a built-in scripting language that can display a dialog.

The host emulator enables an end user to connect the Windows workstation to a mainframe, AS/400, OS/390, Unix, or other host-based session. ESSO-LM recognizes a terminal screen by looking for specific strings of data at specific screen locations.

In order for ESSO-LM to recognize host emulators, enable mainframe support by selecting MFEnable in the Host/Mainframe Apps dialog in the Administrative Console.

All host/mainframe applications must be predefined. The ESSO-LM end user has no means to define host/mainframe applications. The administrator must also configure the host emulators themselves in order for ESSO-LM to recognize them. Any host emulator can use application logons created by any other host emulator. See Configuring Host Emulators for information on configuring ESSO-LM-supported emulators.

Logon creation is easiest using a host emulator that allows you to select text and that displays the row and column coordinates of your selection.

For information on how to configure an emulator that does not support HLLAPI but does have a scripting language, contact Oracle.

For information on how to configure an emulator that does not support HLLAPI but does have a scripting language, contact Oracle.

For emulators that do not implement HLLAPI or have a scripting language, you can, in some cases, configure the host/mainframe application as a Windows application (to detect the form by its window title) and using SendKeys to supply user credentials. See Adding Windows Applications: Special Issues for more information.

Adding a host/mainframe application

The easiest, and most precise way to configure host/mainframe applications is by using the Host/Mainframe Form Wizard. Before you begin this procedure, refer to the General Guidelines for configuring applications.

Configuring a host/mainframe application manually

The following procedure describes the steps for manually configuring or modifying a host/mainframe logon. Refer to the specific dialogs and controls for more information. Refer to the General Guidelines for configuring applications before you begin this procedure.

  1. Start the application and configure the host emulator. See Configuring Host Emulators for more information.
  2. In the Administrative Console, do one of the following:

    • Create a new host/mainframe application logon.

      or

    • In the left pane, click Applications and select a host/mainframe application. Click the General tab in the right pane.
  3. In the General tab of the Host/Mainframe form-configuration dialog box:
    1. Select a logon form from the list and click Edit.
    2. Specify one or more Text Matching captions, so that this page can be identified uniquely from other pages. Specify the identifying Text string of the caption and its starting Row and Column numbers.
    3. Specify the Fields for credentials. Click Edit (under Fields) to display the SendKeys (Host/Mainframe) dialog box. Specify the starting row/column for each field and the keystrokes to send.
  4. If the terminal response time requires a pause between credential field entries, select the Options tab and enter the number of milliseconds to pause in Delay Field.
  5. Repeat the steps above for each additional logon screen.
  6. To add password change information, repeat the process with the Password Change tab and the password change dialog box in the target application.


Adding Java Applications

Adding Java Applications and Applets

You can configure Java application logons and Java applet logons (in Web pages) by using the Windows Form Wizard. The procedures for creating and deploying are generally identical for Java and Windows applications.

Before you begin Java logon configuration, refer to the General Guidelines for configuring applications.

In order for the Agent to detect and use Java application logons, the Java Runtime Environment (JRE) must be installed on the workstation prior to installing ESSO-LM. If JRE is not already present when ESSO-LM is installed, the Agent's Java Helper component is not available for installation.


Adding Telnet Applications

ESSO-LM supports Telnet sessions using HLLAPI (high-level language application programming interface) implemented by a mainframe/host emulator. For the most current list of supported emulators, see ESSO-LM Release Notes.

Configuring a logon for a Telnet application is essentially identical to adding host/mainframe applications generally, but with these exceptions:

  • Host applications generally display text captions and data fields in fixed positions, which lets ESSO-LM detect a screen as a logon form using text matching and absolute row/column coordinates. By contrast a Telnet application, including its logon screen, appears in a scrolling text window. The screen position of the text caption for ESSO-LMto match (and begin the logon) should be set as a row number relative to the cursor (negative for above, positive for below) and an absolute column number. See the example below.
  • If one or both of the caption's coordinates are unpredictable, you can use an asterisk (*) for the row setting to match text in any row (and a fixed column), for the column setting to match text in any column (and a row relative to the cursor), or for both settings to match text anywhere on screen.
  • When supplying credentials for a Telnet logon, ESSO-LM ignores the row and column coordinate settings for field-matching. However, the settings must be present in the logon configuration. Use 1 as the value for both row and column coordinates for all credential fields in a Telnet logon.
  • In order to ensure that the Telnet logon credentials are filled in properly, ESSO-LM is enabled with timing logic. The Delay Field setting (on the Options tab for configuring a host/mainframe logon form) indicates the time in milliseconds that the Agent should pause between each action.
See Configuring Host Emulators for additional information on HLLAPI configuration.

Adding a Telnet application logon

The easiest, and most precise way to configure Telnet applications is by using the Host/Mainframe Form Wizard. Before you begin this procedure, refer to the General Guidelines for configuring applications.

Configuring a Telnet application logon manually

The following procedure describes the steps for manually configuring or modifying a Telnet logon. Refer to the specific dialogs and controls for more information. Before you begin this procedure, refer to the General Guidelines for configuring applications.

  1. Start the application and configure the host emulator.
  2. In the Administrative Console, do one of the following:

    • Create a new host/mainframe application logon.

      or

    • In the left pane, click Applications and select a host/mainframe application.
  3. Click the General tab in the right pane.
  4. Select a logon form from the list and click Edit.
  5. In the General tab of the Host/Mainframe form-configuration dialog box:
    1. Specify one or more Text Matching captions, so that this page can be identified uniquely from other pages. Specify the identifying Text string of the caption and its starting Row and Column numbers.
      • The row numbers should be relative to the current cursor position and can be negative integers. See the example below.
      • The column number is an absolute position.
      • You can also use an asterisk (*) for the row or column as a wildcard.
    2. Specify the Fields for credentials. Under Fields, click Edit. In the SendKeys (Host/Mainframe) dialog box, select each field, and set the Row and Column for each field to 1. If needed, specify any additional keystrokes that should follow each field entry.
  6. If the terminal response-time requires a pause between credential field entries, select the Options tab and type the number of milliseconds to pause in Delay Field.
  7. Repeat the steps above for each additional logon form.
  8. To add Password Change information, repeat the process with the Password Change tab and the password change dialog boxes in the target application.

Text Matching example

Since the text in a Telnet application scrolls, the row positioning must be set relative to the cursor's row, which is always row 1. Therefore, the row coordinate for a caption ("Welcome to VAX/VMS_V6.1") that is two rows above the cursor is -2. The column setting of the start of the caption text is an absolute coordinate; in the example here, 9.

Screen text column
 | 123456789022345678903234567890123
Row# | 123456789012345678901234567890123
-4 |
-3 |
-2 | Welcome_to_VAX/VMS_V6.1_
-1 |
1 | Username: _
2 |
3 |
4 |

For ESSO-LM to identify this sample screen, you could set these text matching criteria (using the Text Matching dialog box):

Match 1
Text | Welcome to VAX/VMS V6.1
Row | -2
Column | 9
Match 2
Text | Username:
Row | 1
Column | 1


First-Time Use (Bulk-Add)

After the initial product installation, the First-Time Use Wizard requests various items of information to complete the setup process. If multiple authenticators are installed, the user is prompted to choose a Primary Logon Method. In addition, ESSO-LM can also prompt the user for application usernames/IDs and passwords to quickly populate the user's store.

In order to use Bulk-Add, you must enable First-Time Use.

The configuration settings for the First-Time Use Wizard are specified in the ftulist.ini file. End users can be prompted to provide credentials (username/ID, password, third field) for their existing logons. Combining first-time use configuration with predefined logons ensures that users reap the benefits of single sign-on immediately after installation. Alternatively, users can configure their individual logons as they encounter each application.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini can only be created and edited using the ESSO-LM Administrative Console.

Specifying Applications to Bulk-Add

Applications must be individually configured to be used in a bulk-add. See To enable a logon for Bulk-Add .
  1. Select Applications in the left pane, then select the Bulk-Add tab in the right pane.
  2. Click Add.
  3. From the Select Application dialog box, select the applications to add to this group. (Use Ctrl+click or Shift+click to select multiple entries.)
  4. Click OK.
  5. Enter or edit the Date Stamp in yyyymmdd format (for example "20030615" for June 15, 2003). If this date is later than the last date a given Agent completed Setup, then the Agent activates Setup Wizard to add the new logons.
To Enable a Logon for Bulk-Add
  1. Select Applications in the left pane, then select an application.
  2. Click the Bulk add tab in the right pane.
  3. Select Enable Bulk-Add capability for this application.
  4. If the user must re-enter one or more fields for confirmation, then select the appropriate Confirm settings.


Creating and Using Templates

Preconfigured application logons for many popular Windows applications are included with the console in the form of templates.

You can also convert the application logons that you create using the console into templates.

Templates provide two practical benefits for creating and managing pre-configured logons:

  • You can store, share, and reuse a group of specific logon settings as a "starter set" for creating new logons based on the template. Your templates appear as options in the Add Application dialog box.
  • If you make changes to a template's source logon, you can easily apply your changes to any logon based on that template, by using the Update Applications command on the Tools menu.

You create a template by:

  • Selecting an existing application logon in the Manage Templates dialog box from the Tools menu
  • Choosing the logon settings (for the application and for individual forms) that you want to be able to override later; use the Overriding Settings tab in the Edit Template dialog box (click Edit in the Manage Templates dialog box). For Web and Windows applications, you can also choose a setting that the template user must provide in order to complete the logon configuration (on the Supply Info tab).
  • Saving the current file to the Templates folder under the console's program directory (typically, this is C:\Program Files\Passlogix\SSO Administrative Console\Templates).

You use a template to create a logon by selecting it from the Applications drop-down list in the Add Application dialog box. You are prompted if additional information is needed to complete the configuration.

You can update application logons with any changes made in their originating templates. Open the console XML file containing the applications and select the Update Applications command from the Tools menu.


Installing ESSO-LM in a Citrix Environment

Configuring ESSO-LM in a Citrix Environment

Default installation of ESSO-LM in Citrix MetaFrame

The ESSO-LM default installation process automatically detects and installs the components necessary for ESSO-LM in a Citrix environment. The installation process enables ESSO-LM support for every application published on that Citrix server.

Installing ESSO-LM on Citrix MetaFrame

  1. Log on to the Terminal server as an administrator and close all applications.
  2. Click Start and then click Run.
  3. In the Run Dialog window, enter cmd and press Enter.
  4. In the Command Prompt window, enter change user/install and press Enter.
  5. Install ESSO-LM with the appropriate installation options for your environment.
  6. At the command prompt, enter change user/execute when installation is complete.

Controlling ESSO-LM for Specific Applications in Citrix

The following section explains how to change the from the default installation of ESSO-LM and enable it for only specific applications in a Citrix environment. There are two steps in this process. The first step is to remove global ESSO-LM support. The second is to specify which applications are going to be SSO-enabled through their published application configurations.

Removing Global ESSO-LM Support

  1. Click Start and then click Run.
  2. In the Run Dialog window, enter Regeditand press Enter.
  3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
  4. From the right pane, right-click the string value AppSetup and select Modify.
  5. Delete the value data inside this entry that refers to SSOLauncher. (C:\Program Files\Passlogix\v-GO SSO\wts\ssolauncher.exe /nossoshutdown)
  6. If you are using ESSO-LM’s Windows Authentication v1 add the “CheckForParentProcess” key into the Passlogix registry hive. This ensures authentication event handoff to ESSO-LM.

HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\AUI\WinAuth\

DWORD:

CheckForParentProcess

Value=0

Removing ssolauncher.exe from AppSetup configures ESSO-LM not to function with any applications on this Citrix server unless specified in your published applications configuration.

Specifying Which Applications Are SSO Enabled Through the Published Application Configuration (SSOLauncher)

Since ESSO-LM support is now globally disabled, you must specify which applications you wish to be published with ESSO-LM support by including the SSOLauncher.exe command in the published application properties.

  1. Open Citrix Management Console.
  2. Publish/Locate the application you would like to enable for ESSO-LM.
  3. Right-click on the published application and select Properties.
  4. On the Application Location tab, add to the front of the Command Line the following syntax:
    C:\Program Files\Passlogix\v-GO SSO\wts\SSOLauncher.exe/application

The command for SSOLauncher.exe is added to your published application’s command line, it does not replace it.

Here is an example of the Command Line syntax for the application ACT:

C:\Program Files\Passlogix\v-GO SSO\wts\SSOLauncher.exe” /application C:\Program Files\ACT\act.exe

This example is based on the assumption that ESSO-LM and ACT are both installed on the C:\ drive of the Citrix Server.

See SSOLauncher for MetaFrame XP Servers for more information.

Enabling MetaFrame Monitoring

To enable ESSO-LM to be monitored by Citrix MetaFrame, so that ESSO-LM will not keep otherwise-ended sessions alive, go to the following registry tree:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
  \Control\Citrix\Wfshell\TWI

If an entry named LogoffCheckSysModules exists, append to it: ssoshell.exe. For example, change app1.exe,app2.exe to app1.exe,app2.exe,ssoshell.exe.

If the entry does not exist, create LogoffCheckSysModules as type STRING and set to ssoshell.exe.


SSOLauncher

SSOLauncher for MetaFrame XP Servers

This utility lets you control the delivery of ESSO-LM with published applications in a Citrix MetaFrame XP environment.

To use the ssolauncher utility:

  1. Copy the ssolauncher utility in the WINNT\system32 folder. Otherwise you must include the full path to where ssolauncher resides.
  2. You can now manage the applications you want with which you want ESSO-LM to run by utilizing the ssolauncher utility. By accessing the Citrix Published Application Management console and applying the ssolauncher command through the Application Definition command line you can make ESSO-LM run on an application by application basis.
The ssolauncher command is applied in front of the command line.
Example

ssolauncher.exe /application "C:\Program Files\Internet Explorer\EXPLORER.EXE"

The following are the commands for ssolauncher:

Command | Use
/application | The full path of the application to execute. This is required.
/command | Used to supply command parameters to an application. This is optional.
/directory | Used to supply working to an application. This is optional.
/wait | The number of milliseconds to wait for an application to shut down. This is optional. If not specified ssolauncher will wait forever for the application to terminate.
/verbose | This supplies dialog boxes for error message if ssolauncher has any failures.
/nossoshutdown | Prevents shutting down sso when application completes.
/SSOCOMMAND LOGON | Used to initiate a command to the "Log On Using ESSO-LM" trigger, located in the ESSO-LM system tray icon.

Sample command line to launch AIM:

ssolauncher.exe /verbose /application "C:\Program Files\AIM95\aim.exe" /directory "C:\Program Files\AIM95"

The command should begin and end with quotation marks if it contains \ characters.


Configuring the Server

Configuring the Server for ESSO-LM

The topics below describe how to configure the server for ESSO-LM deployment and support for synchronization and event logging:

  • Directory server configuration for LDAP services, including:
  • IBM Tivoli Directory Server
  • Microsoft Active Directory and ADAM
  • Novell eDirectory
  • Oracle Directory Server
  • Sun Java System Directory Server
  • Open LDAP Directory Server
  • Database system configuration: for Microsoft SQL Server, IBM DB2, and Oracle database systems
  • File system configuration: for any UNC (Universal Naming Convention)-compliant network drive or device
  • Event logging: to configure a Microsoft Windows 2000 or XP server to receive ESSO-LM Event Log messages.


Directory Servers: Configuring the server

Directory Server: Configuring the Server

This topic describes how to extend directory servers to work with ESSO-LM. Although this process simplifies some directory-related tasks, it assumes that the administrator has knowledge of the planning and deployment of directory services. This guide only covers concepts specific to ESSO-LM deployments.

See Directory Server Synchronization Support for more information about how ESSO-LM makes use of directory server resources.

Configuring a directory server for ESSO-LM entails using the Administrative Console to extend the schema and set up objects in the directory structure.

When you connect to a directory server, you must provide administrator-privileged authentication information. This information includes the directory type, server name or IP address (IP address may not be valid for Microsoft Active Directory Server), port, SSL-use selection, user ID and password.

Your user ID should be in DN format; for example,

uid=yourname,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot

Directory operations must be performed from Microsoft Windows 2000XP.

For ADAM (Active Directory/Application Mode) repository:

The ADAM server instance must be installed and running before you begin the following procedure.

The naming context for the Application Directory Partition (step 2, below) must be an organization unit (ou). The example given in the ADAM Setup Wizard panel shows a cn(container name).
  1. Extend the directory schema.

It is considered a good practice to perform a backup of your directory before and after extending the schema. However, it is not necessary to disconnect users to extend the schema, or to reboot the server after the schema is extended.
  2. From the Repository menu, select Extend Schema.
  3. In the Connect to Repository dialog box, enter or select the required connection information, then click OK. The console binds to the repository, adds attributes and object classes, and confirms successful server configuration.
  4. Repeat for each additional server.

  5. Create the container object.

    A container object, typically named vgoconfig (class organizationUnit), holds overriding settings and a container object named People. The People container object (class organizationUnit) contains a container object for each user (class SSOUserData), and each of these user container objects holds user credentials and settings (class SSOSecret).

    Use the console to create container objects with the proper security, to create the People container object with the proper security, and to place overriding settings with the proper security in the People container object.
  6. In the left pane of the console, right-click Repository and select Connect to from the shortcut menu.
  7. Enter or select the required connection information, then click OK.
  8. In the right pane, navigate to the container object where you will create the People object and overriding settings.
  9. If necessary, create a new container object:
  • Right-click the parent container object, and select New Container from the shortcut menu.
  • Enter a name for the new container object and select it.
  • Right-click the container object (where the People container object and overriding settings will exist) and choose Configure SSO Support from the shortcut menu.
  • Choose the Data Source of the overrides and provide the information requested:
  • Administrative Console
  • Data File
  10. When you complete the configuration procedure, the newly-created People object, and entries for any overriding settings appear in the Repository pane. Right-click on any object and choose Refresh if necessary.
  11. Repeat this procedure for each additional container object.
  12. Create locator objects.
As described in Directory Structure, ESSO-LM looks for an SSOLocator object when it connects to the Directory Server, which points where the agent can store user credentials. An SSOLocatorClass object named Default is required somewhere in the tree. You can create specific SSOLocatorClass objects for specific users as needed.
  1. In the left pane of the Console, Right-click Repository and choose Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the container object where you will create the People object and overriding setting.
  4. If necessary, create a new container object:

  • Right-click the parent container object, and choose New Container from the shortcut menu.
  • Enter a name for the new container object and select it.

  1. In the right pane, navigate to the container in which you want to add the locator.
  2. Right-click the container and choose Add Locator Object from the shortcut menu.
  3. Specify the Locator Name (enter Default for all users unless there is one for a specific user)
  4. Navigate to the parent container object of the target People container object (or specify its path) and click OK. The newly-created SSOLocator object appears with the name you specified. Right-click any object and choose Refresh if necessary.
  5. Repeat for each additional SSOLocator object.


File Systems: Configuring the Server

This topic describes how to extend File Systems to work with ESSO-LM. Although this process simplifies some tasks, it assumes that the administrator has knowledge of the planning and deployment of file system shares. This guide only covers concepts specific to ESSO-LM deployments.

See File System Synchronization Support for more information about how ESSO-LM makes use of file system resources.

Configuring a File System share for ESSO-LM entails using the console to set up objects in the directory structure.

When you connect to a File System, you may need to provide Administrator-privileged authentication information. This information includes the synchronizer extension type, UNC path, user ID, and password.

Your user ID should be in domain name format, for example, yourdomain\yourname

Creating the container objectCreating the Container Object

A container object is typically a file system share in UNC format, for example

\\Server\Share

Or it can be a share with a path, for example:

\\Server\Share\Path\subPath

The container object holds overriding settings and a container object named People.

  • The People container object is a file folder that contains a container object for each user (rights: User=Full; Server\Administrators=Full),
  • Each of these user container objects holds a container object named SSOUserData.
  • Each SSOUserData container object holds user settings in an SSOSecretData object (a file) and container objects for each application credential.
  • Each of these container objects contains a user's credentials for one application (a file named SSOSecretData).

Use the console to create container objects with the proper security, to create the People container object with the proper security, and to place overriding settings with the proper security in the People container object.

  1. In the left pane of the console, right-click Repository and choose Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the container object where you will create the People object and overriding settings.
  4. If necessary, create a new container object:
    1. Right-click the parent container object, and choose New Container from the shortcut menu.
    2. Enter a name for the new container object and select it.
  5. Right-click the container object (where the People container object and overriding settings will exist) and choose Configure SSO Support from the shortcut menu.
  6. Choose the Data Source of the overrides and provide the information requested:
    • Administrative Console
    • Data File
  7. When you complete the configuration procedure, the newly-created People object and entries for any overriding settings appear in the Repository pane. Right-click on any object and choose Refresh if necessary.
  8. Repeat this procedure for each additional container object.


Database Synchronization: Configuring the Server

This topic describes how to configure a relational database server to work with ESSO-LM. It assumes that you have basic knowledge of relational database administration and operation. This guide only covers concepts specific to ESSO-LM deployments.

See Database Synchronization Support for more information about how ESSO-LM makes use of database resources.

Configuring ESSO-LM for database synchronization requires using the ESSO-LM Administrative Console to extend the database schema and to create the container objects.

  1. Extend the database schema.

Perform a backup of your database before and after extending the schema.
  1. Choose Extend Schema from the Repository menu.
  2. From the Connect to Repository dialog box, enter or select the required connection information, then click OK. You must have administrator-level authentication to connect the console to the database server. The console connects to the database, creates the necessary objects, and confirms successful configuration.

For SQL Server, when extending the schema, if the database does not exist, the extend schema function will create the database for you. For IBM DB2 Setup instructions, click here.
  2. Repeat for each additional server.
  3. Create the container objects.

A container object, typically named SSOConfig, holds a default set of overriding settings and a container object named People. The People container object contains a container object for each user, and each of these user container objects holds user credentials and settings.

Use the ESSO-LM Administrative Console to create container objects, to create the People container object, and to place overriding settings with the proper securityin the People container object.

  1. In the left pane of the console, right-click Repository and select Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the container object where you will create the People object and overriding settings.
  4. If necessary, create a new container object:
  5. Right-click the parent container object, and choose New Container from the shortcut menu.
  6. Enter a name for the new container object and select it.
  7. Right-click the container object (where the People container object and overriding settings will exist) and choose Configure SSO Support from the shortcut menu.
  8. Choose the Data Source of the overrides and provide the information requested:

    • Data File

    • Administrative Console
  9. When you complete the configuration procedure, the newly-created People object, and entries for any overriding settings, appear in the Repository pane. Right-click on any object and choose Refresh if necessary.
  10. Repeat this procedure for each additional container object.


Setting Password Policies

ESSO-LM allows administrators to set policies that control automatic password generation. Password policies simplify user logons while ensuring the organization's security.

Most applications have constraints for passwords how long they can or must be, whether you can use numbers or symbols, and so on. ESSO-LM password generation feature improves application logon security by automatically creating passwords made up of random characters according to predefined sets of constraints, stored as password policies. Each policy can apply to multiple applications, or subscribers.

Using predefined password policies, you can completely automate password changes and implement sophisticated security schemes, including complex passwords, frequent password changes, and application-specific passwords unknown to users.

If the policy you create makes a password difficult or impossible, ESSO-LM will try to create a password for up to five seconds and then notify the user that it was unable to generate a password. You can preview the passwords a particular policy generates using the Test Password Policy dialog box.


Creating Password Sharing Groups

Creating Credential Sharing Groups

Credential sharing groups let users apply a credential change made in one application to other specified applications automatically.

When ESSO-LM handles a credential change for any application that is a member of the sharing group, it automatically applies the credential change to all other group members. Any number or combination of Windows, mainframe/host, and Web applications can share a single credential. when using the Windows (Domain) or Directory Server ( LDAP) authenticator, selected applications can share a single credential with the authenticator as well.

For example, an enterprise might have a new Web interface to an old mainframe application. One way to share the credential between these two is to use a credential sharing group. Some applications share a common credential (for example, an Intranet application and an e-mail application). These applications should be in the same credential sharing group.

See Credential Sharing Groups for the procedures for creating and managing sharing groups.

The Windows authenticator password is in a predefined group named Domain.

The LDAP Directory Server authenticator is in a predefined group named LDAP.

Supporting Predefined Applications

The ESSO-LM Administrative Console does not currently support adding predefined applications (those included in the default configuration file applist.ini) to credential sharing groups. You must do this manually by creating identically-named sections in entlist.ini (the custom-application configuration file) that identifies the sharing group. The following example adds an Internet Explorer pop-up application to the credential sharing group OurServer.

Example:

[~Internet Explorer Pop-up XP]
Group=OurServer


Storing User Data

ESSO-LMstores user credentials locally in the ...\Application Data\Passlogix folder. Global agent settings are stored in the Local Machine registry key (HKLM); settings modified the user are stored in the Current User registry key (HKCU).

ESSO-LM can also perform a complete backup of credentials and settings to a file (.bkv). The backup can be performed manually by the user, or automatically by administrative configuration). For details on this feature, see File-Based Backup/Restore .

ESSO-LM can also synchronize individual user credentials with these remote sources, including file-systems, databases, and directory servers. These remote sources can provide the agent with application logons. first-time-use (setup) information and administrative overrides (global agent settings). For details on this feature, see Synchronization.

Storing Credentials in the User Object (Active Directory only)

On Active Directory installations, you can configure ESSO-LM to store user data under the user object, rather than in the standard vgoconfig container. To do this, take the following steps:

  1. Use the Enable Storing Credentials under User Object command (on the Repository menu) to update the directory schema to allow user-credential containers as children of user objects. This command also modifies the directory-root security settings to grant users the rights to create the credential containers.
  2. Do one of the following:
  3. Select the Store data under the user objects option (in the Add Locator Object dialog box) to create a vgolocator object ("default" for all users that use this locator, or for specific user by distinguished name) that points to the user objects.
  4. Use the Location for storing user credentials agent setting (in the Active Directory - Advanced settings) to configure the Agent to disregard the vgolocator object and always store credentials under the user object.


File-Based Backup/Restore

If the backup/restore module is installed, the console can perform a complete backup/restore of user credentials and settings to or from another location. The backup/restore can be performed manually (by the user) or automatically (by administrative configuration). Also, a selective backup/restore (writing the newer information over the older information) can be performed automatically (by administrative configuration).

If the Backup/Restore module is installed, the user can perform a manual backup, store to any location (even a floppy drive), and select any password (even a one-character password).

Automatic Backup

The agent can be configured to perform a full backup of user credentials and settings. This backup can be triggered from the command line (and thus from an "at," or timed, job) or by configuring certain agent events (for example, the Startup task, the Refresh task, and so on).

Command-Line Automatic Backup

To trigger a Command-Line Automatic Backup, run the Agent from the command line (even when the Agent is currently running) using the following syntax:

ssoshell.exe /mobility /backup [path] /silent &where&
[path] | The actual path to the directory where the backup file is pl`1aced. The default is the last directory where a command line backup file was stored, or to where the Default Backup path (under End-User Experience\Environment) points.
` | Do not show the Backup/Restore Wizard when performing the backup.

To perform a completely silent backup to a network share at \\FS\Backup\Private:

ssoshell.exe /mobility /backup "\FS1\Backup\Private" /silent

To backup to the last-used location or to where the Default Backup path (under End-User Experience\ Environment) points:

ssoshell.exe /mobility /backup /silent

Event-Driven Automatic Backup

To configure the Agent to perform an automatic backup upon certain agent events, determine the command line string needed to perform the desired backup. Then, set the appropriate task. For example, to perform a backup with every change in credentials, set a task to run When logons change (under End-User Experience\Advanced\Special Tasks) to the command line string.

Forced Restore

The Agent can be configured to perform a full restore of user credentials and settings, replacing any existing data. This restore can be triggered from the command line (and thus via a remote "run" command) or by configuring certain Agent events (for example, the startup task).

Command-Line Forced Restore

To trigger a Command-Line Automatic Backup, run the Agent from the command line (even when the Agent is running) using the following syntax:

ssoshell.exe /mobility /restore [path] /silent &where&
[path] | The path to the directory where the backup file exists. The default is the last directory where a command line backup file was stored, or where the Default Backup path (under End-User Experience\Environment) points.
/silent | Do not show the Backup/Restore Wizard when performing the backup.

To perform a completely silent restore from a network share at \\FS\Backup\Private:
ssoshell.exe /mobility /restore "\FS1\Backup\Private" /silent

To restore from the last-used location or to where the Default Backup path (under End-User Experience\ Environment) points:

ssoshell.exe /mobility /restore /silent

Event-Driven Forced Restore

To perform a Forced Restore upon certain Agent events, determine the command line string needed to perform the desired restore. Then, set the appropriate task. For example, to perform a restore at startup, set a task to run After Agent starts up (under End-User Experience\Advanced\Special Tasks) to the command line string.


Synchronization

ESSO-LM synchronizer extensions let you synchronize credentials between an end user's local store (on a workstation) and a store in a remote SSO repository (file system share, relational database or directory server). You can also use these extensions to deploy Administrative Overrides of local Agent settings, application logon configurations (overriding entlist.ini and to be merged with applist.ini), and bulk-add lists (overriding ftulist.ini). See Overriding Settings for more information.

Synchronizer extensions communicate with directory servers, database servers, file systems, and other storage devices. Each type of extension has its own configuration requirements. ESSO-LMsupports the following extensions:

  • Microsoft Active Directory Server, including Application Mode.
  • An LDAP-compliant directory server, including IBM Tivoli Directory Server, Novell eDirectory, Oracle Directory Server, Sun Java System Directory Server, and OpenLDAP Directory Server.
  • Relational databases, including Microsoft SQL Server. IBM DB2 and Oracle 9i/10g.
  • Network file systems.

The synchronizer extensions are capable of performing the following tasks:

  • Connecting to (or binding with) a destination device/resource/store
  • Retrieving any overriding settings (Administrative Overrides, application configuration information, and first-time use configuration information)
  • Synchronizing the local user store (credentials) with the remote store.

ESSO-LM supports using each extension multiple times, which allows you to support multiple configurations. For example, if the LDAP Directory Server and File System synchronizer extensions are installed, the agent will synchronize credentials with, and download overriding settings from, both an LDAP Directory Server and a File System.) See Multiple Synchronizer Extensions for more information about the procedures.


Directory Server Synchronization Support

The console supports any LDAP directory server, including:

  • IBM Tivoli Directory Server
  • Microsoft Active Directory (including Application Mode)
  • Novell eDirectory
  • Oracle Directory Server
  • Sun Java System Directory Server
  • Open LDAP Directory Server

ESSO-LM uses directory server resources for administrative configuration, mobility, and backup. Administrators can deploy configuration overrides to provide new registry, entlist.ini, and ftulist.ini (bulk-add) settings or to update existing settings. Users can store credentials (for backup) and move among multiple computers (for mobility). When ESSO-LMconnects to a directory server, it utilizes a specific directory structure to determine where the user's credentials and overriding settings reside.

Each Directory Server presents platform-specific configuration issues. These are addressed in the individual configuration topics.

Directory Structure

Within each directory, ESSO-LM utilizes the following object structure:

[ view diagram ]

When a user first connects to a directory server, the system is configured to locate a specific path on the directory tree. Using the process described below, the Agent is able to find the SSOConfig object, which contains overriding settings, and a People object, which contains the user's settings, preferences, and credentials.

Finding and Creating User Objects

This topic explains the methods that ESSO-LM uses to locate user objects and configuration information, and how to create these objects.

The Agent must locate the specific object in which to store and retrieve the user's credentials. After the first successful connection, the agent records the objects DN in the user's registry at:

HKCU\…\Extensions\SyncManager\%Extension%:Root

where %Extension% can be any name as specified in Sync Order (see Synchronization). However, for the first connection from a given workstation, if the user's object is moved, or if the user registry does not contain this information, the Agent must search for the user's object.

ESSO-LM uses three methods to search for the proper location to store user credentials on a directory server. Each method looks at the specified distinguished name; the latter two then each "walk the directory tree," toward the root, to look for a parent object with relevant information.

  • The first method is to look for the user object CN=%UserName%,OU=People) in a specified place.
  • The second method is to look for a user-specific pointer object (CN=%UserName%,OU=SSOLocator) to the right place; and if the object is not present, "walk the tree" until the Agent finds the object or checks the root.
  • The third method is to look for a default pointer (CN=default,OU=SSOLocator) to the right place; and if the object is not present, "walk the tree" until the Agent finds the pointer to the object or checks the root.

If none of these methods succeeds, the user cannot store credentials on the Directory Server (any existing local credentials will be useable).

The %UserName% variable is set automatically in Microsoft Active Directory from the users system username/ID. For LDAP Directory Servers, the %UserName% variable is set from the username/ID with which the user performs a bind to the Directory Server.

Method 1: ESSO-LM Looks for the User Object

ESSO-LM first looks for the user object, CN=%UserName%, inside an OU=People object, specified by the Root registry key (see above).

If that registry key is set to

OU=SSOConfig,OU=QA,OU=Eng,OU=Company,DC=com,

then the agent looks for

CN=%UserName%,OU=People,OU=SSOConfig,OU=QA,OU=Eng,OU=Company,DC=com.

If the Root registry key is not set, the Agent looks in

HKLM\…\Extensions\SyncManager\%Extension%

for User Paths (see Synchronization\LDAP\Required) or Naming Attribute string (see Synchronization\LDAP\Advanced), which points to where the Agent should look.

For example, if UserPath1 is set to

CN=users,DC=Company,DC=com

then the Agent looks for

CN=%UserName%,OU=People,OU=SSOConfig,OU=QA,OU=Eng,OU=Company,DC=com

Method 2: ESSO-LM Looks for a User Pointer

If the user object is not present, ESSO-LM next looks for an SSOLocator object in the same object as the SSOConfig object. Therefore, continuing the example above, the Agent looks for

CN=%UserName%,OU=SSOLocator,OU=QA,OU=Eng,DC=Company,DC=com

If the user pointer is not present, then the Agent "walks the tree," toward the root, looking first in

CN=%UserName%,OU=SSOLocator,OU=Eng,DC=Company,DC=com

and then

CN=%UserName%,OU=SSOLocator,DC=Company,DC=com

If an SSOLocator object exists with the users CN, it points to where the users credentials will be stored; the Agent records this information in the users Root registry key, and future logons look in that location.

Note that the pointer can indicate any location in the Directory Tree; for example, a pointer at

CN=%UserName%,OU=SSOLocator,OU=Eng,DC=Company,DC=com

can point to a user object at

CN=%UserName%,OU=People,OU=SSOConfig,OU=Sales,DC=Company,DC=com.

Method 3: ESSO-LM looks for a Default Pointer

If a user pointer object is not present, ESSO-LM next looks for a default object inside each SSOLocator object. Continuing the example above, the Agent looks for

CN=default,OU=SSOLocator,OU=QA,OU=Eng,DC=Company,DC=com

If an SSOLocator object exists with the CN=default object, it points to where the users credentials will be stored by default; the Agent records this information in the users Root registry key, and future logons look in that location. An example of a default object is OU=People,OU=SSOConfig,OU=Sales,DC=Company,DC=com.


File System Synchronization Support

The console supports file system synchronization with any network drive/device that can be addressed by UNC (Universal Naming Convention). File system synchronization can also be used to support a kiosk user scenario, where multiple users share a single workstation.

File System Structure

When a user first connects to the file system, the computer is configured to locate a specific path. The Agent is then directed to find the SSOConfig object, which contains overriding settings and a People object, which contains the user's settings, preferences, and credentials.


Database Synchronization Support

ESSO-LM Administrative Console supports synchronization of user credentials, application logons, and global agent settings between client workstations and a relational database server. Supported servers include Microsoft SQLServer 2000, IBM DB2, and Oracle 9i/10g.

In this type of synchronization, ESSO-LM configuration objects and user data containers are stored on the server as database records in ESSO-LM-specific tables:

  • SSO_ADMIN stores, as records, the configuration objects you create in the Console:
  • EntList (application logons), FTUList (Setup Wizard configurations)
  • AdminOverride (Global Agent Settings)

During synchronization, all workstation users read their logons and overrides from this table; only the administrator, using the Console) can write to it. These configuration object are depicted in the Console in the same hierarchal layout as for file system and directory server synchronizers.

  • SSO_USERS stores user credentials, preferences, and synchronization states as records. During synchronization, users read and write to their own record. Only the record for the user currently logged on can be accessed. In the console, the records for each user are depicted within the user container.

When ESSO-LM connects to the database server, it reads the configuration objects and overriding settings (from SSO_ADMIN) and synchronizes the user data (in SSO_USERS).

The procedure for configuring database synchronization is similar to that for other synchronization methods.

  1. Extend the database schema to create the two tables described above.
  2. Create the container objects: an SSOConfig object. This object contains overriding settings and a People object, which holds the user containers for each user's settings, preferences, and credentials.


Multiple Synchronizer Support

ESSO-LM supports synchronizing to multiple synchronizer extensions and multiple configurations of the same extension. In either scenario, the Agent attempts to complete synchronization with the first extension and then with each subsequent extension.

Overriding settings can exist on each extension. See Handling Multiple Sets of Overriding Settings for an explanation of how the Agent handles multiple extensions with overriding settings.

References to %AD%, %LDAP%, and %File% refer to the respective extensions, and %Extension% refers to any of those extensions.

Multiple Synchronizer Extensions

ESSO-LM supports using multiple synchronizer extensions simultaneously. For example, the Agent could first synchronize with a Microsoft Active Directory Server, then with a Sun Java System Directory Server, and then with the File System synchronizer. With ESSO-AM, the agent could then synchronize with a smart card.

To enable this:

  1. Install ESSO-LM with the desired synchronizer extensions.
  2. In the console, select an existing set of Global Agent Settings or create a new set.
  3. In the left pane, open the Global Agent Settings, right-click Synchronization and select Manage Synchronizers.
  4. In the Synchronizers dialog box, select Add, name this extension, select the extension type (for example, Active Directory, File System, or LDAP), then click OK.
  5. Repeat the previous step for additional synchronizer extensions, and reorder as desired.
  6. For each synchronizer: select it in the left pane and confirm in the right pane that Path is selected and the location specified is correct.

Oracle recommends that you set the DisplayName registry entry to help the user distinguish between the multiple extensions.

Multiple Configurations of the Same Synchronizer Extension

ESSO-LM supports using a given extension with multiple configurations. For example, one LDAP Directory Server configuration could be for a Sun Java System Directory Server and another LDAP Directory Server configuration could be for Novell eDirectory.

To enable this:

  1. Install ESSO-LM with the desired synchronizer extensions.
  2. In the console, select an existing set of Global Agent Settings or create a new set.
  3. In the left pane, open the Global Agent Settings, right-click Synchronization and select Manage Synchronizers.
  4. In the Synchronizers dialog box, select Add, name this extension, select the extension type LDAP, then click OK.
  5. Repeat the previous step for additional synchronizer extensions, and reorder as desired.
  6. For each synchronizer: select it in the left pane and confirm in the right pane that Path is selected and the location specified is correct.

Oracle recommends that you set the DisplayName registry entry to help the user distinguish between the multiple extensions.


Roaming Profile Synchronization

Roaming Profile Synchronization > Required

The console supports file system synchronization. The Roaming Profile Synchronizer extension supports roaming profiles. Use it in the deployments that meet the following conditions:

  • Users are set up to use roaming profiles on the server.
  • If the “Delete Local Cache” setting has not been enabled for synchronization.
  • If you are using V1 Authentication.

If the above conditions exist, set up the roaming profile environment as follows:

  1. Set ESSO-LM to operate in a multi-sync environment, where one of the sync extensions installed is the roaming sync extension. A multi-sync environment is one in which at least two sync extensions are installed. For example, if you are using AD sync extension, you must install AD sync extension and Roaming profile extension.
  2. The Roaming Profile Synchronizer extension must be the first synchronizer in the sync configuration order. To set this order, expand Global Agent Settings > Live and click on Synchronization. Locate the Sync Order field and click the "…" button. On the Synchronizers panel make sure ROAMSyncExt is first and the other Sync type being used is second, for example, ActiveDirectory.
  3. No changes need to be made in the AD sync settings, or any other sync being used with Roaming Profiles.
  4. In the Roaming Profiles panel, check the Extension location box and click the "…" button. Navigate to the location of the extension to select it.


Overriding Settings Objects

Configuration Objects

Synchronizer extensions can download overriding configurations for global agent settings (administrative overrides), application configuration information (EntList), and first-time use scenarios (FTUlist). Each of these objects has a local equivalent:

Settings Type | Local Equivalent | Directory Server/ Database Object Name | File System Object Name
Administrative Overrides | Registry entries under HKLM | SSOAdminOverride | AdminOverride
Application logon configuration information | The entlist.ini file | SSOentlist | entlist
First-time-use configuration information (including bulk-add information) | The ftulist.ini file | SSOftulist | ftulist

The latter two types of objects are similar in format and layout to their local equivalents, entlist.ini and ftulist.ini. The first type of object has the following syntax:

[HKLM\Software\Passlogix]

REQUIRED: RegistryPath\RegistryPath:KeyName=TYPE:Value

This format is exported by the console.

Example:

[HKLM\Software\Passlogix]

Shell:AutoBackupPath=STRING:\\FS\Home

Shell:ShowAccessBtn=DWORD:1

Extensions\AccessManager:ReauthOnReveal=DWORD:0

In directory server installations, this configuration information can be enabled with support for role group-based access.

Certain settings, such as server URLs, must not be overridden and are thus permanently excluded from administrative override objects. The table in Overriding Setings: Registry Entries denotes whether a setting is excluded from being overriden.

Working with Multiple Sets of Overriding Settings

The Agent attempts to retrieve each type of overriding settings from each extension until it finds an extension that has at least one of each; once an overriding setting is downloaded, the agent does not queried other extensions for that overriding setting.

Sample Scenarios

Example:
  • Order: Ext1,Ext2,Ext3,Ext4
  • Ext1 has Admin Overrides
  • Ext2 has Admin Overrides, an entlist.ini file, and an first-time use information file
  • Ext3 has no Admin Overrides
  • Ext4 has Admin Overrides, and an first-time use information file
Scenario A
  • Ext1 connects; downloads Admin Overrides; and synchronizes.
  • Ext2 connects; downloads application configuration information and first-time use configuration information; and synchronizes.
  • Ext3 connects and synchronizes.
  • Ext4 connects and synchronizes.
Scenario B
  • Ext1 fails.
  • Ext2 connects; downloads Admin Overrides, application configuration information, and first-time use configuration information; and synchronizes.
  • Ext3 connects and synchronizes.
  • Ext4 connects and synchronizes.
Scenario C
  • Ext1 fails.
  • Ext2 fails.
  • Ext3 connects and synchronizes.
  • Ext4 connects; downloads Admin Overrides and first-time use configuration information; and synchronizes.


Event Logging

The topics in this section describe the console's event logging feature and setup process. Event logging monitors a variety of user events including:

  • Agent startup/shutdown
  • Logon
  • Password changes
  • Credential addition, change, and deletion
  • Authenticator changes
  • Backup and restore
  • Credential synchronization
  • Settings changes
  • Help-system use

Through the console you control what events are logged, where and when they are logged, and whether to maintain a local copy of the log. The addition of extensions allows for various log destinations and formats.


Event Logging: Configuring the Agent

Event Logging: Agent Configuration

Event Logging is an optional feature of ESSO-LM. It does not install by default.

To install event logging, select Custom Install and enable the Event Manager and the event logging extensions you want to use from the Extensions selection. After installation, you must set up certain parameters for event logging and any installed extensions.

Global settings are set in HKLM\…\Extensions\EventManager.

Extension-specific settings are set in HKLM\…\Extensions\EventManager\%Extension%.

ESSO-LM ships with the Local (XML) File extension (Local Storage) and the Windows Event Logging extension (WindowsEvent).

Global Settings

As events occur, they are cached until a predefined amount of time passes. At this point, the events are filtered and sent to the appropriate extension. Upon successful transmission to each extension, the events are cleared from the cache.

Under Global Agent Settings > [selected set] > Event Manager
Filter | Specifies which event types and which specific events will be logged. Specify one global filter value for all extensions, or a different global filter value for each extension.
Retry | Specifies the interval (in minutes) the Agent should wait between successive attempts to log cached events to the event extensions. Default value for all extensions is 30 minutes.

Local File Extension

The local-access Event Manager extension is the Local File Extension. This extension creates an XML file %UserName%.eventlog.xml containing the filtered event data. The file is in the same directory (%AppData%\Passlogix) as the users AML file and is readable by any recent-release browser.

Under Global Agent Settings > [selected set] > Event Manager >LocalStorage
Filter | Specifies which events to log to the Local (XML) File Logging extension.
Retry | Specifies the interval (in minutes) between retries for the Local (XML) File Logging extension. Default is 30 minutes.

The following example shows the raw XML for an event log containing a single logon event:

Example:

<EVENTLOG>

<event>

<type>Info</type>

<category>Logon</category>

<timestamp>4/25/2002 5:46:06 PM</timestamp>

<appname>ACT</appname>

<username>SSOUser</username>

</event>

</EVENTLOG>

Windows Event Logging Extension

The Windows Event Logging extension relies on the Windows Event Logging built into Microsoft Windows 2000 and XP. To view the log, start Event Viewer (for example, run eventvwr.exe). ESSO-LM entries are in the Application Log. The server must be properly configured.

Under Global Agent Settings > [selected set] > Event Manager >WindowsEvent
Event Server

Server name for the Windows Event Logging extension (omit the "\\", for example, specify fileserver, not \\fileserver). If not provided, logging is performed on the local computer.

The server should have a trusted relationship with the user's account and the user's computer, depending on access rights and restrictions.
Filter | Specifies which events to log to the Windows Event Logging extension.
Retry | Interval (in minutes) between retries for the Windows Event Logging extension


Event Logging: Configuring the Server

Event Logging: Server Configuration

Configuring a Windows Event Server to Receive ESSO-LM Logging

To configure a Microsoft Windows 2000 or XP server to receive Event Log messages, either install the Agent to that server or copy SSOeventmessage.dll from an Agent installation to the server, preferably in the System32 directory. Create the four following registry keys under

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\v-GO Single Sign-On

EventMessageFile | STRING | Full path to the file SSOeventmessage.dll, including filename (recommended %WinDir%\System32\SSOeventmessage.dll)
TypesSupported | DWORD | 7
CategoryMessageFile | STRING | Full path to the file SSOeventmessage.dll, including filename (recommended %WinDir%\System32\SSOeventmessage.dll)
CategoryCount | DWORD | 4


Windows Event Log-Based Reporting

Large deployments of ESSO-LM will often see the need for frequent auditing of user actions and information describing each action (such as date, time, and the name of the user). ESSO-LM records this information through the Windows Event Log mechanism, enabling you to easily leverage your existing infrastructure to collect source data for system-wide audits.

Using the event log data recorded by ESSO-LM, you can:

  • Track the actions of ESSO-LM users, such as logons and password changes. This includes associated information such as the action type, AD account name, date, time, and the credentials used to perform the action, if applicable.
  • Track the credentials that were used to log on to an application over time by each user. This can help detect attempts of unauthorized access by users who share their credentials without permission.
  • Track the actions of ESSO-LM administrators. For example, if someone pushes a misconfigured template to the repository, you can find out when the update was performed on that particular ESSO-LM object and by whom.
  • Track application usage. You can use the event log data to analyze application usage by user, time, and date. Such information can aid you in gauging system loads, for example when setting up load balancing in large deployments.

Technical Prerequisites

The required event data is recorded on the machine hosting your Active Directory repository. In order to generate reports based on this data, you must:

  1. Enable the required level of log verbosity for your Active Directory instance by setting the following registry value:
    • Path: HKLM\SYSTEM\CurrentControlSet\Services\<AD_instance>\Diagnostics
    • Key: 8 Directory Access (DWORD)
    • Value: 0x00000005 (hex)
  2. Query the Win32_NTLogEvent handler and filter your queries by event type SSO EventMgr. This is the event type used by ESSO-LM when recording data in the Windows Event Log.


Deploying the Agent

Deploying ESSO-LM

The topics in this section describe the options for packaging, deploying, and managing ESSO-LM in a networked environment:

  • Microsoft Windows Installer (MSI) Package
  • Deployment Options
  • Administration and Management
  • Storing User Credentials and Settings
  • File-Based Backup/Restore


Microsoft Windows Installer (MSI) Package

ESSO-LM ships as an MSI package, a standard format used by installers from Microsoft and other vendors. Many other installers can read MSI files. For information on the contents of the ESSO-LM Setup MSI, see MSI Package Contents.

The Microsoft Windows Installer exists as a service (Windows Installer) on all Microsoft Windows 2000/XP computers (refer to Microsoft Knowledgebase article #q255905). You can customize the MSI package to meet special requirements, such as:

  • Providing custom applications and ESSO-LM agent configurations
  • Deactivating some options or components (for example, different authenticators) before the end users install the Agent themselves
  • Adding options or components to accommodate a complex environment, for example, one using biometric security devices or having an unusual network topology.

To meet these needs, there are these options:

  • Use a command-line installation.
  • Customize the installer package.
  • Include console-created logons and Global Agent Settings in the installer.
  • Deploy using a third-party deployment tool.


Deployment Options

This section describes using the default MSI package from the following perspectives:

  • Performing an installation with the shipped MSI package
  • Launching the MSI package from the command line
  • Remote installation
  • Editing the MSI package
  • Adding console-created logons and settings to the MSI package
  • Alternate tools and methods

Performing an Installation with the Shipped MSI Package

To perform an installation using the shipped MSI package, insert the ESSO-LM CD-ROM, or run the program setup from the CD-ROM or network share and follow the prompts. Because each environment is different and each organization has different needs, Oracle recommends you perform a custom install and select the desired components.

Installing from the Command Line

The MSI package can be installed from the command line. To do this, run the setup program with the appropriate parameters. The components of the command line are the executable name, InstallShield parameters (for example, /s for a silent install), and the ESSO-LM feature names:

ProductName.exe(where ProductName is the software being installed) [/s] /v"[/qn ] ADDLOCAL="FeatureName""

/s | InstallShield should be silent (optional)
/v"&hellip;" | InstallShield should pass the following parameters to the MSI package
/qn | The MSI package should install quietly (optional)
RUNVGO | Whether the agent should be launched after the install: YES or NO
MDAC | Whether to install MDAC: YES or NO
ADDLOCAL "FeatureNames" | FeatureNames is a comma-delimited list of the ESSO-LMfeatures to install, see MSI Package Contents for a list of the acceptable list values.
Quoting is critical. There must be quotes around the MSI features (the quote after /v and the second quote at the end of the line) and around each value within the MSI features (for example, "NO" or "Core").

Example:

Install (without seeing any visual signs) the core, the Windows authenticator, NO support for Microsoft Internet Explorer or hosts, and the Microsoft Active Directory synchronizer, and then start the agent, as follows:

ProductName.exe /s /v"/qn RUNVGO="YES"
ADDLOCAL="Core,Authenticators,SLA,LogonMgr,SetupMgr,SyncMgr,AD_Sync,English_Pack""

Installing the MSI Package Remotely

To install ESSO-LM to a computer remotely, verify that your system meets the following conditions:

  • Windows Installer must be present on the remote computer
  • The MSI package must be accessible to the remote computer
  • The person performing the remote installation must have administrator access rights to the remote computer.

Editing the MSI Package

Some organizations want to distribute MSI packages without Oracle-supplied optional components or with additional components (for example, alternative authenticators).

To customize an MSI package, use an MSI package editor. Some popular MSI package editors include:

  • InstallShield AdminStudio and InstallShield Update Service
  • Wise Package Studio
  • Microsoft Orca.

Adding Console-Created Application Logons and Global Agent Settings

You can also use the console to create a modified ESSO-LM installation package. The modified MSI package you create with this feature can include:

  • Selected application logons from an entlist.ini file or from the current console configuration.
  • Agent settings from an administrative overrides (.ini) file or from the current console configuration.

To do this use the Generate MSI command on the Tools menu.

Using Other Deployment Tools

ESSO-LM works with numerous deployment methods and tools, including (but not limited to):

  • Manual installation (for example, from a CD-ROM or network share)
  • Microsoft Windows Installer (MSI) service (local or remote installation)
  • Network remote installation (for example, copy files and install registry entries remotely to a desktop)
  • Microsoft SMS
  • IBM Tivoli
  • Attachmate NetWizard
  • Intel LANDesk
  • Novadigm Radia/EDM
  • Novell ZENworks
  • HP OpenView
  • Seagate Desktop Management Suite
  • McAfee ZAC Suite
  • Veritas WinINSTALL


Console Main Menu Commands

The table below describes the commands available on the console main menu and the corresponding keyboard and mouse shortcuts.

Menu | Command | Description | Shortcut
File | New | Start a new configuration | Ctrl+N
Open | Open | Ctrl+O
Merge

Merge current configuration (applications, password generation policies, credential sharing groups) with a configuration file.

If the merged file contains items with the same names as those in the current configuration, the Import/Merge Conflict dialog box opens. Select the items to import and click OK.
If the imported file contains a set of global agent settings with the same name as an existing set in the current configuration, the imported set is named Copy of existing settings.
Save | Save the current configuration to a file (XML). | Ctrl+S
Save As | Save a copy of the current configuration to a different file.
Import

Import configuration from an administrative override object (INI) file or a registration entries (REG) file as a new set of global agent settings

If the imported file contains items (applications, policies, groups) with the same names as those in the current configuration, the Import/Merge Conflict dialog box appears.

Right-click Applications and choose Import

or Ctrl+I

Choose Import from HKLM to import global agent settings from the local-machine registry to the console as a set named "Live."
Export Export selected applications and all password policies and groups to an entlist.ini file, which is a store of application logons.

Right-click Applications and select Export or Ctrl+E.
Menu Command Description Shortcut
Edit Delete

Delete the item selected in the left pane.

  • If you select a password policy or sharing group with subscribing applications, a delete-confirmation prompt opens. Click Yes to confirm or No to cancel.
  • There is no delete-confirmation prompt for applications, global agent settings, or for unsubscribed policies or groups.
 Del
Menu | Command | Description | Shortcut
Insert | Application | Add a new application configuration; displays the Add Application dialog box. | Right-click Applications and select New Windows App, New Web App, or New Host App.
Password Generation Policy

Add a new password generation policy; displays the Add Password Policy dialog box.

  • Enter Policy Name and click OK.
 Right-click Password Generation Policy and select New Policy.
Passphrase Questions

Add a new passphrase set; displays the Add Passphrase Set dailog box.

Enter a Passphrase Set Name and click OK.

 Right-click Passphrase Questions and select New Passphrase Set.
Credential Sharing Group

Add a new credential sharing group; displays the Add Sharing Group dialog box.

  • Enter Group Name and click OK.
  • Enter Policy Name and click OK.
 Right-click Credential Sharing Group and select New Group.
Global Agent Settings | Save the current configuration to a file (XML). | Right-click Global Agent Settings and select New Settings.
Sync Extension | Save a copy of the current configuration to a different file. | Right-click Synchronization and select Manage Synchronizers.
Menu | Command | Description | Shortcut
Repository | Extend Schema | Connect to synchronization repository and create a new synchronization schema (for LDAP and database sync support). Displays Connect to Repository dialog box. |
 | Use Short Names | Check or uncheck to toggle between displaying short and long names in repository. |
 | Show User Credential Containers | Check or uncheck to toggle between displaying and hiding ESSO-LM user credential containers in the Repository window tree view. |
 | Show Users (AD only) | (Active Directory only) Check or uncheck to toggle between displaying and hiding user objects in the Repository window tree view. |
Menu | Command | Description | Shortcut
Tools | Export Apps to Agent | Add the application logons in the current console session to the list of pre-configured logons for the locally-installed Agent. This option updates the local entlist.ini file, and optionally, the ftulist.ini (first time use) file. |
 | Write Global Agent Settings to HKLM | Export global agent Settings to local-machine registry; displays a confirmation message. |
 | Edit Passphrase Questions | Add or edit the passphrase questions that appear during First-Time Use; displays the Edit Passphrase Questions dialog box. |
 | Generate Customized MSI | Create an .msi file for distributing an Agent configuration as a Windows Installer package; displays the Generate MSI dialog box. |
 | Manage Templates | Create, modify, and remove templates for application logons; displays the Manage Templates dialog box. |
 | Update Applications | Update applications based on templates that have been modified since the application's creation; displays the Update Applications dialog box. |
 | Modify Configuration | View or edit the configuration (INI) files for the locally-installed ESSO-LM Agent. Choose Applist, or open anyMfrmList or FTUlist, EntList, other INI file by name. |


Applications

Displays application configuration information and provides access to logon settings.

Click Applications in the left pane to display these tabs in the right pane:

  • The Application List displaying currently configured logons.

  • The Bulk Add (multiple logon deployment) controls
  • Right-click Applications in the left pane to display a shortcut menu with these options:
New Windows App | Configure a new Windows application. Displays the Add Application dialog box.
New Web App | Configure a new Website application. Displays the Add Application dialog box.
New Host App | Configure a new mainframe application. Displays the Add Application dialog box.
Import | Open stored application configurations in a .REG or .INI file.
Export | Save one or more application configurations in an INI file.


Applications List tab

Applications List

Displays a list of applications with logons configured for use with ESSO-LM.

  • To add new applications click Add .
  • To modify a listed application's logon configuration, click an application, then click Edit .
  • To delete one or more logon configurations, click an application (use Ctrl+click or Shift+click to select multiple entries), then click Delete.


Add Application Dialog Box

Use the Add Application dialog to begin configuring a new application logon. You can define an application logon from scratch or you can use a stored template that provides pre-configured values for some or all logon settings.

To add an application:

  1. Type a Name for the new logon.
  2. Select an Application Type:
    • Windows
    • Web
    • Host/Mainframe
  3. Do one of the following:
    • Select a template from the Application drop down list and click Next to provide any additional information needed to complete the logon.
    • Leave the Application selection as New [type] Application and click Finish to create the logon from scratch.
  4. If this application requires authentication by RSA (SecurID/SoftID) token, select the RSA securID check box.
  5. Click Finish.

The Form Wizard for the selected Application Type launches. See Windows Form Wizard, Web Form Wizard or Host/Mainframe Form Wizard for more information.


Adding an Application from a Template

Add Application from Template

Use this wizard page to supply application logon configuration settings that are not provided by the application logon template. Settings that must be supplied to complete the logon are marked in the left pane with a red X.

  1. In the left pane of the dialog box, click a logon setting item that is marked by a red X. The corresponding dialog box for supplying the setting appears in the right pane.
  2. Enter or choose the requested setting. A green checkmark replaces the red X when the setting is completed.
  3. Click Finish to close the wizard and add the new application.


New Windows or Java application

New Windows/Java Application

Configuring a New Windows or Java Logon

  1. In the left pane, right-click Applications then select New Windows App from the shortcut menu. The Add Application dialog box appears with the Windows option selected.
  2. Type a Name for the new logon and click OK. The Windows Form Wizard (for configuring new logon forms) appears.

See Adding Windows Applications for more information.


Windows Form Wizard

Use the Windows Form Wizard to perform any of these tasks:

  • Configure new logons for Windows applications or for Java applets and applications.
  • Add new forms to existing logons
  • Create forms for automatic password changes.
  • Create forms for supporting a password confirmation field displayed in a separate window.
  • Create forms for automatic detection of password change success and failure.

The Windows Form Wizard lets you use the application itself to identify its forms, the individual fields, and the submit OK button.

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Windows Applications for specific information about configuring Windows application logons.

To configure a form:

  1. Start the target application and navigate to the target form. Arrange the console and target application windows so that you can see both at once.
  2. In the Form Wizard, select the type of form you want to configure. The available options are:
    • Logon. Configures a logon form.
    • Password change. Configures a password change form.
    • Password confirmation. Configures a new password confirmation form for applications that display their "Confirm password" field in a separate window.
    • Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Windows Form Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
    • Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Windows Form Wizard in which you will configure the necessary fields.
  3. In the Application Window list, select the window to configure. Note that a blinking outline indicates the application window you select.
  4. Confirm that you have selected the correct window, then click Next.
  5. In the Credential Fields page list, click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • Username/ID
    • Password (Logon forms only)
    • Old Password (password change forms only)
    • New password (password change forms only)
    • Confirm new password (password change and password confirmation forms only)
    • Submit button.
  6. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. Select a field to configure; for example, the logon window's user ID field. In the application's window, a blinking outline indicates the field corresponding to your current selection.

    2. Confirm that you have selected the correct field, then right-click the selected item and choose the field type (for example, UserID) from the shortcut menu. The corresponding icon appears to the left of the item. To deselect an item, right-click the item and choose None from the shortcut menu.

      Password change success forms do not inject credentials and thus do not require you to configure any fields. In such cases, proceed to step 8, as the Credential Fields page will not be displayed.

      The Class and Text columns provide cues to the fields. For example, text boxes appear as "Edit" Class; password fields usually have the Text value *** HIDDEN ***
  7. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  8. Confirm that you have configured the necessary fields and button, then click Next. A summary page appears, listing your configuration.
  9. Do one of the following:
    • Click Back to return to a previous page and make corrections.
    • Click Finish to complete the logon configuration and close the Form Wizard.


Application window

Application Window (Windows Form Wizard)

Use this Form Wizard page to select the application's logon or password/PIN change window.

See Windows Form Wizard for a detailed procedure for configuring Windows applications.

Controls

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Credential field

Credential Field (Windows Form Wizard)

Use this Form Wizard page to select the fields of the application's logon or password change window.

See Windows Form Wizard for details of the procedure for configuring Windows applications.

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID or Text, to sort the list. Right-click a field in the list to display a shortcut menu of field types and the submit control:

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • Confirm New Password
  • OK (submit control)

Refresh

Updates the field list.

Use "Send Keys" for this form, do not use Control IDs

Indicates that the Agent should transmit logon data to this form as a series of keystrokes, rather than by addressing individual fields by Control ID. See SendKeys for more information.

Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Detect Fields | Scans the field list and attempts to match them with field types. Note that although Detect Fields is usually accurate with typical applications, the fields should be checked for proper field types.
Refresh | Updates the field list.
Back | Go back to the previous Wizard page
Next | Go forward to the next Wizard page.


Summary

Displays the results of the Wizard. Do one of the following:

  • Click Finish to save your settings and close the Wizard.

    or

  • Click Back to return to a previous page and modify your settings.


Windows Form Wizard for RSA SecurID

Windows Form Wizard (for RSA SecurID Applications)

Use the Windows Form Wizard to perform any of these tasks:

  • Configure new logons for RSA SecurID Windows applications.
  • Add new forms to existing RSA SecurID logons
  • Create forms for automatic PIN changes.
  • Create forms for supporting a PIN confirmation field displayed in a separate window.
  • Create forms for automatic detection of PIN change success and failure.

The Windows Form Wizard lets you use the application itself to identify its forms, the individual fields, and the submit OK button.

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Windows Applications for specific information about configuring Windows application logons.

To configure a form:

  1. Start the target application and navigate to the target form. Arrange the Console and target application windows so that you can see both at once.
  2. In the Form Wizard, select the type of form you want to configure. The available options are:
    • SecurID Logon – configures a SecurIDlogon form.
    • PIN Change – configures a PIN change form.
    • Confirm PIN – configures a new PIN confirmation form for applications that display their "Confirm PIN" field in a separate window.
    • PIN Change Success – configures a form that serves as a match for the target application's PIN change success message. Since this form does not inject credentials, the Credentials page of the Windows Form Wizard is skipped. When the PIN change success message is detected, ESSO-LM will automatically save the new credentials.
  3. PIN Change Failure – configures a form that serves as a match for the target application's PIN change failure message and reinjects credentials when the PIN change failure message is detected. If you select this option, you will be presented with the Credentials page of the Windows Form Wizard in which you will configure the necessary fields.
  4. In the Application Window list, select the window to configure. Note that a blinking outline indicates the application window you select.
  5. Confirm that you have selected the correct window, then click Next.
  6. In the Credential fields page, for each credential field:
    1. Select a field to configure; for example, the logon window's user ID field. In the application's window, a blinking outline indicates the field corresponding to your current selection.

    2. Confirm that you have selected the correct field, then right-click the selected item and choose the logon field type (for example, UserID) from the shortcut menu. The corresponding icon appears to the left of the item. To deselect an item, right-click the item and choose None from the shortcut menu.

      New PIN Acceptance forms do not inject credentials and thus do not require you to configure any fields. In such cases, proceed to step 7, as the Credential Fields page will not be displayed.

      The Class and Text columns provide cues to the fields. For example, text boxes appear as "Edit" Class; PIN fields usually have the Text value *** HIDDEN ***

  7. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  8. Confirm that you have configured the necessary fields and button, then click Next. A summary page appears, listing your configuration.
  9. Do one of the following:
    • Click Back to return to a previous page and make corrections.
    • Click Finish to complete the logon configuration and close the Form Wizard.


General tab

General Tab (for Configuring a Windows Logon Form)

Use the General (Windows) tab to modify program and window information about a Windows application logon configuration.

  • Configure a logon manually by adding, editing or deleting entries in the AppPathKeys and Window Titles list, or
  • Use the Windows Form Wizard to define windows, titles and fields by pointing and clicking.

Controls

Name | Name of the application logon form.
AppPathKeys | The Windows registry key identifying an application associated with this logon to match against running processes. (Usually the application executable's name, such as Eudora.exe)
Window Titles | Text matched against logon window titles to identify logon requests. Click Choose to select a title from a currently-running application window.
Disabled

Select to disable this Windows template. This can be used with the sort order feature to disable certain web popups.

This feature is useful in a situation where an application has hundreds of windows titles defined using Regular Expressions or wild cards, but a few of those window titles should not be responded to. Rather than creating hundreds of templates to respond to, an administrator can define the window title to match (with regular expressions or wild cards), and exclude those that should not be matched by creating a disabled template for them.
Wizard | Start the Windows Form Wizard for configuring an application visually.

Configuring an Application Using the Windows Form Wizard

  • Click Wizard.

Configuring an Application Manually

  1. Enter the Name of the application.
  2. In the AppPathkey group, click Add.
  3. In the Add AppPath Key dialog box, enter a valid application key (usually the application executable's name, such as Eudora.exe). Click OK.
  4. In the Window Titles group click Add, then enter the Window title or click Choose to open the Select Window dialog box, where you can select a title from a currently-running application window.
  5. Click OK.


Select Window Title

Use the Select Window dialog to choose the title of an application's logon or password change window.

  • Select the logon or password change window and click OK.

Controls

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.


Fields tab

Fields Tab (for Configuring a Windows Logon Form)

Use the Fields (Windows) tab to define how the Agent interacts with the fields of the logon form. You can identify one of the following for the currently-selected application form:

  • Up to four logon fields (user ID, password, etc.), using Control IDs
  • A series of keystrokes (with optional timings) that fill-in and submit the logon form, using SendKeys.

Controls

Transfer method
(choose one) 		Control ID : Use standard Windows control IDs to identify and transmit credentials to a field. Click Add to add a field and enter its Control ID or Edit to modify existing field settings.

SendKeys : Configure fields by transmitting a keystroke series to the form. Click Edit to enter or change the series.

SendKeys using Journal Hook : Configure fields by transmitting a keystroke series to the form using Journal Hook. Click Edit to enter or change the series.
Fields

Fields with transfer methods configured for this logon form. You can:

  • Select a field and click Edit to modify Control ID or SendKeys settings.
  • Click Add to add a field (for Control ID only).


Fields Tab

ControlID

Use the Control ID dialog box to identify the fields and the submit button of a logon form in order to configure the ESSO-LM response.

Controls
Controls
Field

Select the credential data that the control represents, or identify the control as the Submit (OK) button.

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • OK (submit control)
Control ID | Enter the control ID of the selected field or button.
Skip field if control is disabled | Select this option to prevent the Agent from entering data if the selected field is set not to accept user entry.


SendKeys (for a Windows Application Logon)

Use the SendKeys dialog box to specify a series of keystrokes that ESSO-LM should transfer to the logon form.

Use the SendKeys option for Windows applications that:

  • Cannot receive credentials from the Windows message queue or by other techniques the Agent normally uses to send credentials.
  • Do not use standard Windows controls that have Control IDs.
  • Dynamically generate controls or do not use Windows controls at all (for example, Flash applications).

The New Actions list box in the right pane of the SendKeys dialog box provides the keystroke options for each action. Highlight the action to configure SendKeys for, and select or type the options you need on for each action. Click the Insert button to add the key or action to the series.

For East-Asian Language Applications: When adding information using SendKeys in an East Asian-language (Chinese, Japanese, Korean) application template, you must insert an Enter key press preceding the Tab key that advances to the next field. The Enter key signals the Input Method Editor that you have completed the field and allows the IME to differentiate the credentials fields.

Journal Hook SendKeys for East-Asian languages is not compatible with ESSO-LM.

Your selections appear in the Current Actions list in the left pane:

  • To change the order of the series, select an item and click the up or downarrows to move it.
  • To delete an item, select it, and click Delete.
  • To edit an item, select it, and click Edit. The Edit Action dialog opens. Edit the fields as necessary and click OK.

Controls

New Action Controls Description
Fields

Field Type

Select a credential item from the list to add to the series.

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • Old Password
  • New Password
  • Confirm New Password

Character to insert after field

Select a keystroke to insert automatically after the field is filled:

  • None (no keystroke)
  • Enter (to submit the form)
  • Tab (to advance the cursor)

Also see Special Keys, below.

Inject directly into control

Injects the credential directly into the control. Click the ... button to open the Choose Control ID dialog box.

When using SendKeys, the application is treated as a Windows application. The controls that appear in the Choose Control ID dialog box indicate whatever Windows controls ESSO-LM can find.

Insert

Add the current selection to the series.

Click

Click at a coordinate

Simulates a mouse click at the X, Y coordinate specified.

X: Choose the X coordinate for the mouse click.

Y: Choose the Y coordinate for the mouse click.

Relative to the: Select where the mouse click will be relative to:

  • Screen
  • Active Window

Mouse button: Select which mouse button will be clicked:

  • Left
  • Middle
  • Right

Click on a control

This option is similar to clicking at a specified coordinate, except that ESSO-LM figures out where the control is and simulates a click in the center of the control. Click the ... button to open the Choose Control ID dialog box.

When using SendKeys, the application is treated as a Windows application. The controls that appear in the Choose Control ID dialog box indicate whatever Windows controls ESSO-LM can find.

Insert

Add the click selection to the series.

Run Task

Command line to run

Enter a Command line to be executed. This feature allows you to run a program in the middle of entering keystrokes.

  • Window Handles can be appended to the command line to inform the script of the window handle currently being worked on:
    $(HWND)
  • Environment Variables can also be appended to the command line:
    $(USERDOMAIN)\$(USERNAME)

Click the ... button to open the Choose Control ID dialog box.

Virtual key codes cannot be used within the command line (the initial backquote character will terminate the command line).

Expected return code

Enter the expected return code. The rest of the Sendkeys script is discarded if this value is not returned.

Time out (sec.)

Enter the number of milliseconds to wait for the task to complete. The rest of the Sendkeys script is discarded if this timeout is reached. The maximum timeout period is 5 seconds.

Insert

Add the task to the series.

Delay

Length of delay (in seconds)

Type or select a delay between keystrokes.

Insert

Add the delay to the series.

Set Focus

Set focus to control

Sets the focus to the control. Click the ...button to open the Choose Control ID dialog box.

When using SendKeys, the application is treated as a Windows application. The controls that appear in the Choose Control ID dialog box indicate whatever Windows controls ESSO-LM can find.

Insert

Add the focus to the series.

Text

Enter text to insert

Type any literal text to add to the series.

Insert

Add the text to the series.

Special Keys

Category/Keys

Choose a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Page Down) from the right list.

Key Press

Insert the key as a single keystroke (default).

Key Down/Up

Insert the key as a pair of actions: key-press and key-release. This option lets you insert other keystrokes between these actions to indicate one or more keys held down as another is typed, as for a "hot key" combination that moves the focus to a specific text box.

For example, to insert the keystroke "Alt+P," select the Key Down/Up option, then select Modifier for the Category and Alt for the Key. and click Insert. This inserts two actions: [Down:Alt] and [Up:Alt].

Select the Text tab and enter P in the text box. In the left pane, select [Up:Alt] and click Insert. The "P" is inserted between the two Alt-key actions, producing "Alt-P."

Insert

Add the keystroke to the series.


Matching Dialog

Matching dialog box

Use this dialog box to create match criteria that the Agent uses to distinguish among similar target forms that use the same credential data. This lets the Agent apply a single set of user credentials appropriately to these multiple forms. To display this dialog box, from the Matching tab (for configuring a Windows logon form) click Add.

The easiest and most efficient way to create match criteria is through the Control Match Wizard. The Wizard lets you specify match criteria by selecting elements from the target form itself. You can also create and modify match criteria manually.

Creating Match Criteria Using the Wizard

  • Click Wizard and follow the onscreen instructions.

Creating or Modifying Match Criteria Manually

  1. Enter a Match name and select the Type of the target form.
  2. Add or edit the Window Titles that the target form displays, or select Use Titles from Main.
  3. Add or edit the Control Matching items: these are criteria based on the properties of form objects (such as a text caption, or a control class). Together these items uniquely identify the target form.
  4. Add or edit the Control IDs of the target form's credential fields.
  5. Click OK.
Controls
Match Name | Type or edit the name for the Match
Type

Select the type of form to match:

  • Logon
  • Change Password
  • Confirm (Password)
  • Ignore
Windows Titles | Click Use Titles from Main to copy the Windows Titles in the General tab for this logon or click Add to enter titles manually.
Control Matching | Click Add (or select a matching item and click Edit) to display the Control Matching dialog box.
Control ID | Click Add ( or select a control ID item and click Edit) to display the Control ID dialog box.
Wizard | Start the Control Match Wizard.


Add/Edit Window Title

Use this dialog box to add or modify the text string that the Agent uses to detect specific application windows (for example, for logon entry or password change) by their window title.

Specifying a Window Title for Matching

  1. Select one of the following (see Matching Expressions, below).
    • Exact match
    • Use wildcards (does not apply to ESSO-KM)
    • Use regular expression (does not apply to ESSO-KM)
  2. Type (or edit) the Window Title or a matching expression.
  3. Click OK.

Matching Expressions

For applications that have varying text in their URLs, you can use substrings or regular expressions to specify how to match the variable text.

Wildcards
  • ? (question mark) matches any single character.
  • * (asterisk) matches zero or more occurrences of any character.
This does not apply to ESSO-KM.
Regular Expressions

You can also use the set of regular expressions to specify a string pattern that the agent should recognize as a match.

This does not apply to ESSO-KM.

Matching Environment Variables

For applications that include the user's name in the URL (as derived from the DOMAINUSER environment variable in the workstation operating system), select Exact as the matching criterion, and use one of the following substitution tokens in the match string:

%DOMAINUSER% | User name exactly as derived from the environment variable
%UC%%DOMAINUSER% | User name converted to all upper case
%LC%%DOMAINUSER% | User name converted to all lower case
Example

This Window Titleentry matches a password-change window title that includes the username.

Password Expired - %UC%%DOMAINUSER%


Add Edit Control Matching

Control Matching

Use the Control Matching dialog box to specify a match criterion based on the properties of a target-form control (such as a text caption, or a control style).

Controls
Control ID | Type the numeric identifier of the control.
Match Condition | Select one property of the control, select a relation (Equals or Not Equal, Equals regular expression, Not equals regular expression), and type or select the condition that should (or should not) be met. The valid conditions for each property are:
 | Class | Edit or Static control
 | Style | A decimal numeric identifier for the aggregate of styles applied to the control.
 | Text | A literal string.

Click OK to save and exit the dialog box or Cancel to exit without changes.


Add Edit Control ID

Control ID dialog box (Windows Fields tab)

Use the Control ID dialog box to identify the fields and the Submit button of a logon form in order to configure the Agent's response.

Controls

Field

Select the credential data that the control represents, or identify the control as the Submit (OK) button.

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • OK (submit control)
Control ID Enter the control ID of the field or button.
Control Type

Select the control type:

  • Edit (text box)
  • Combo (drop-down list box)
  • List
In most cases, you can use the Windows Form Wizard to identify fields and control IDs.


Control Match Wizard

Use the Control Match Wizard to define match criteria by choosing from the windows and controls of the target application. The Agent uses match criteria to identify a target form, such as a password-change dialog, that is similar to the currently selected logon. The Agent then supplies data to the matched target form using the same credentials as the original logon. You can also use match criteria to specify target forms similar to the current logon that the Agent should ignore.

Using the Wizard to Create Match Criteria

  1. Start the target application and navigate to the target form. Arrange the Console and target application windows so that you can see both at once.
  2. Select a form Match Type, then follow the onscreen instructions or help topics.
    • Ignore
    • Logon
    • Password Change
    • Password Confirm
    • Password Change Success
    • Password Change Failure

See Matching tab for more information

To display the Control Match Wizard:

  1. From the Matching tab, select Add (for configuring a Windows logon form). The Matching dialog box appears.
  2. Click Wizard.


Ignore App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should ignore from the Window List.
  2. Click Next to display the Match Fields page.

Controls

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Ignore Match Fields

Use this Wizard page to choose a set of match fields, one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria.
  2. Click Next to display the Summary page.

Controls

Match Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of match criteria:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Goes back to the previous Wizard page.
Next | Goes forward to the next Wizard page.


Logon App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should recognize as a logon form from the Window List.
  2. Click Next to display the Match Fields page.
Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Logon Match Fields

Use this Wizard page to choose a set of match fields: one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria
  2. Click Next to display the Credentials page.

Controls

Match Fields

D isplays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Logon Credential

Use this Wizard page to identify the field in which the Agent should supply credential data.

  1. In the field list, right-click a field and select the credentials.
  2. Click Next to display the Summary page.

Controls

Credential Fields

D isplays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • UserID
  • Password
  • Third Field
  • Fourth Field
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Change App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should recognize as a password-change form from the Window List.
  2. Click Next to display the Match Fields page.
Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Change Match Fields

Use this Wizard page to choose a set of match fields: one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria
  2. Click Next to display the Credentials page.

Controls

Match Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Change Credential

Use this Wizard page to identify the field in which the Agent should supply credential data.

  1. In the field list, right-click a field and select the credentials.
  2. Click Next to display the Summary page.

Controls

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • UserID
  • Old Password/PIN
  • New Password/PIN
  • Confirm PasswordPIN
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Confirm App Window

Use this Wizard page to choose the application window that the Agent should recognize.

  1. Select the application window that the Agent should recognize as a password-confirmation form from the Window List.
  2. Click Next to display the Match Fields page.

Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.

Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Confirm Match Fields

Use this Wizard page to choose a set of match fields: one or more window objects that uniquely identify the application window that the Agent should recognize. You can identify a match field by its Class (the type of control, such as Edit or Static), its Style (the aggregate of its properties identified by a number), or its Text.

  1. In the field list, right-click a field and select the match criteria
  2. Click Next to display the Credentials page.

Controls

Match Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • Class
  • Style
  • Text
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Password Confirm Credential

Use this Wizard page to identify the field in which the Agent should supply credential data.

  1. In the field list, right-click a field and select the credentials.
  2. Click Next to display the Summary page.

Controls

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, Text or Style) to sort the list. Right-click a field in the list to display a shortcut menu of field types:

  • None (deselect field)
  • UserID
  • Old Password/PIN
  • New Password/PIN
  • Confirm PasswordPIN
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the list.
Back | Go back to the previous Wizard page.
Next | Go forward to the next Wizard page.


Miscellaneous tab (for a Windows logon)

Miscellaneous Tab (for Configuring a Windows Logon Form)

Use the Miscellaneous (Windows) tab to refine properties of the currently-selected application logon form for special configurations.

Controls

Allowable Class | Click Choose to identify the logon or password-change window class that must be present in order to execute this logon. This is useful for applications that present logon or password-change windows with non-standard class names. Displays the Select Window dialog box.
Regular Expression | Select whether the Allowable Class uses a regular expression.
Ignore this Window Class | Click Choose to select the logon or password-change window to ignore when executing a logon. This is useful for applications that use hidden logon or password-change dialog boxes or that present duplicate dialogs. Displays the Select Window dialog box.
Regular Expression | Select if the ignored Window Class uses a regular expression.
Attach to window's Message Queue | Select to hold on to the target window while sending credentials.
Preset Focus | Select to set the focus on a logon field before the Agent places data in the field.
System Logon | (Reserved)
Use WM_CHAR messages to fill controls | Some applications require that you enter passwords via a keyboard and not set text commands. Enabling this setting simulates keyboard entry in an alternate way by setting text within controls.
Sort Order | Specify the order in which ESSO-LM searches templates for window class titles containing regular expressions. By setting sort order, you increase the efficiency of your search without eliminating less precise matches. If you do not assign a sort order to a template, ESSO-LM checks templates in ascending order (lower values are checked first). Default is 1000.


New Web Application

Configuring a New Web Application Logon

  1. In the left pane, right-click Applications then select New Web App from the shortcut menu. The Add Application dialog box appears with the Web option selected.
  2. Type a Name for the new logon and click OK. The Web Form Wizard (for configuring new logon forms) appears.

See Adding Web Applications for more information.


Web Form Wizard

The Web Form Wizard lets you browse the Web application itself to capture the identifiers for its logon or password-change windows, the individual fields, and the submit OK button. To display the Web Form Wizard:

  1. Create a New Web application.
  2. In the New Web Application configuration dialog, click Wizard. The Web Form Wizard appears.
When using a workstation running at 800x600 resolution, buttons are missing from the bottom of the Web Form Wizard. The wizard is also extremely slow to start at this resolution. Oracle recommends that you set the resolution on your workstation to a higher resolution.

Configuring a Web Application

  1. In the dialog box that appears, select the type of application form you want to configure. The available options are:
  2. Logon. Configures a logon form.
  3. Password change. Configures a password change form.
  4. Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Web Form Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
  5. Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Web Form Wizard in which you will configure the necessary fields.
If you are editing an existing form, this dialog box will not appear.
  6. In the Web Form Wizard, enter the Web Address (URL) of the website and click Go. The top pane of the Wizard acts as a web browser window. You can resize the Wizard's window as needed.
  7. In the top pane, navigate to the Web site's logon form. When the Wizard detects one or more forms in a web page, it lists the forms and their elements (fields and buttons) in the bottom pane.
  8. Click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • Username/ID
    • Password
    • Old Password (password change forms only)
    • New Password (password change forms only)
    • Submit button.
  9. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. If you are editing an existing template, you may change the form type using the Form Type drop-down at the lower right. Keep in mind that if you do so, you will need to reconfigure the template (reassign fields, and so on). Only fields relevant to a given form type are displayed when that form type is selected.
    2. Identify and select a field from the list in the bottom pane. (The Element and Type descriptions provide cues.) In the top pane, a blinking outline indicates the corresponding field or button you have selected.
    3. Confirm that you have selected the correct field, then right-click the selected item and choose from the shortcut menu (for example, UserID). An icon appears to the left of the item. To deselect an item, right-click the item and select None from the shortcut menu.
  10. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  11. Repeat the two previous steps for each field required to logon. You can configure up to four fields in all.
  12. When you have completed your configuration click OK to save it and close the Web Form Wizard.


Web Form Wizard for RSA SecurID

Web Form Wizard (for RSA SecurID Applications)

Use the Web Form Wizard to perform any of these tasks:

  • Configure new logons for RSA SecurID Windows applications.
  • Add new forms to existing RSA SecurID logons
  • Create forms for automatic PIN changes.
  • Create forms for automatic detection of PIN change success and failure.

The Web Form Wizard lets you browse the Web application itself to capture the identifiers for its forms and windows, the individual fields, and the submit (OK) button. To display the Web Form Wizard:

  1. Create a New Web application. Be sure to select the RSA SecurID check box in the Add Application dialog.
  2. In the New Web Application configuration dialog, click Wizard. The Web Form Wizard appears.
When using a workstation running at 800x600 resolution, buttons are missing from the bottom of the Web Form Wizard. The wizard is also extremely slow to start at this resolution. Oracle recommends that you set the resolution on your workstation to a higher resolution.

Configuring a Web Application

  1. In the dialog box that appears, select the type of application form you want to configure. The available options are:
  2. SecurID Logon. Configures a SecurID logon form.
  3. PIN change. Configures a PIN change form.
  4. PIN change success. Configures a form that serves as a match for the target application's PIN change success message. Since this form does not inject credentials, the Credentials page of the Web Form Wizard is skipped. When the PIN change success message is detected, ESSO-LM will automatically save the new credentials.
  5. PIN change failure. Configures a form that serves as a match for the target application's PIN change failure message and reinjects credentials when the PIN change failure message is detected. If you select this option, you will be presented with the Credentials page of the Web Form Wizard in which you will configure the necessary fields.
If you are editing an existing form, this dialog box will not appear.
  6. In the Web Form Wizard, enter the Web Address (URL) of the Web site and click Go. The top pane of the Wizard acts as a web browser window. You can resize the Wizard's window as needed.
  7. In the top pane, navigate to the Web site's logon form. When the Wizard detects one or more forms in a Web page, it lists the forms and their elements (fields and buttons) in the bottom pane.
  8. Click the Detect Fields button. The Wizard attempts to detect and configure the credential fields and marks them accordingly:
    • SecurID Username
    • Passcode
    • Tokencode
    • Old PIN (PIN change and PIN change failure forms only)
    • New PIN (PIN change and PIN change failure forms only)
    • Submit button.
  9. Confirm that the Wizard has selected the correct fields. You can modify a selection, if necessary:
    1. If you are editing an existing template, you may change the form type using the Form Type drop-down at the lower right. Keep in mind that if you do so, you will need to reconfigure the template (reassign fields, and so on). Only fields relevant to a given form type are displayed when that form type is selected.
    2. Identify and select a field from the list in the bottom pane. (The Element and Type descriptions provide cues.) In the top pane, a blinking outline indicates the corresponding field or button you have selected.
    3. Confirm that you have selected the correct field, then right-click the selected item and choose from the shortcut menu (for example, SecurID Username). An icon appears to the left of the item. To deselect an item, right-click the item and select None from the shortcut menu.
  10. Repeat this process for each field required to complete the logon form. You can configure up to four fields in all.
  11. Repeat the two previous steps for each field required to logon. You can configure up to four fields in all.
  12. When you have completed your configuration click OK to save it and close the Web Form Wizard.


General tab

General Tab (for Configuring a Web Logon Form)

Use the General (Web) dialog box to modify program and window information for a Web application logon configuration.

  • You can configure a logon manually by adding, editing, or deleting entries in the URL and Fields list,

or

  • You can use the Web Form Wizard to define URLs, forms, and fields by pointing and clicking.

Controls

Name | Type the name of application.
URL | One or more URLs (or Uniform Resource Locator, commonly called a Web address) of the logon or password-change form to configure. Click Add (or select a matching item and click Edit) to display the URL dialog box.
Fields | One or more credential fields (including the submit button) and their identifying information. Click Add (or select a matching item and click Edit) to display the Web Fields dialog box.
Auto Submit | Select to have the agent automatically select OK for this application logon after providing credentials.
Dynamic Page | Check to indicate that the Web page for the template includes dynamic content.
Disabled | Select to have the agent ignore this application logon configuration; clear the checkbox to enable the logon configuration for this application.
Wizard | Start the Form Wizard for configuring an application visually.


Matching tab (for configuring a Web application)

Use the Web Matching tab to distinguish among logon, password-change, or password-confirmation forms (referred to here as target forms) within the same Web application, typically a multi-form portal page. The Agent uses the matching criteria you supply here to distinguish among similar forms.

This tab is typically used to refine the detection match criteria, that is, the set of HTML tags and values you use to identify a specific page. You can then create an offset match that uses a subset of the detection match to identify the desired logon or password-change form on the page.

To display this tab:

  • Create a new Web application logon.

or

  1. In the left pane, select Applications and select a Web application.
  2. Click the General tab in the right pane.
  3. Select a form from the list and click Edit.
  4. From the General tab in the Web form-configuration dialog box, select the Matching tab.

Creating or Modifying Detection-Matching Criteria

  1. In the Detection Match list, do one of the following:
    • Click Add to create a new matching criterion.
    • Select a match and click Edit to modify an existing match.
  2. From the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  3. If necessary, adjust the match criteria order.
    1. Select a match to move.
    2. Click the up or down arrows.
  4. Click OK.

Offset Matching

Offset matching should only be used with portal Web pages.

This type of matching is used with portal pages that have multiple windows that the user can rearrange, add, and remove. If the site you are matching on is not a portal, leave the offset matching section on this panel blank.

With regular match detection, the forms must always appear in the same order. With offset matching, you can rearrange the forms (which look like a window) and isolate a specific window from all the others. This only applies to portal pages because these pages are dynamic, and ordinal values are used to match instead of field names.

Use the Offset Start field to tell ESSO-LM which match result's forms to use for the form offsets. The offset start value should be the number of the offset matches. For example, if there are 3 offset matches, the offset start value should be 3.

Creating or Modifying Offset Matching Criteria

  1. In the Offset Match list, do one of the following as needed:
    • Click Copy from Detection to copy defined Detection Match criteria.
    • Click Add to create a new matching criterion.
    • Select a match and click Edit to modify an existing match.
  2. In the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  3. If necessary, adjust the match criteria order.
    1. Select a match to move.
    2. Click the up or down arrows.
    3. Select an Offset Start.
  4. Click OK.


Edit Match (for a Web Form)

Use this dialog box to create or modify matching criteria for the selected Web form.

Tag | Enter an HTML tag type; for example, <TD> for a table cell.
Match Tag Instance | Select to match a specific instance of the Tag and select the instance number; for example, 3 for the third table cell on the page.
Criteria

Select one criteria type:

  • Text. The plain-text (InnerText) content of the tag element (for example. Enter your password)
  • HTML. The rich-text (InnerHTML) content of the tag element (for example, <b>Enter your password</b>)
  • Property: An HTML attribute of the tag element (for example, id =password).
Value | Enter the text of the Criteria to match.
Match Whole Value | Select to enforce strict matching of Value (that is, any additional text in the tag element will cause the match to fail).
Operation

Select the relationship of this match to any others:

  • And. This match is one of multiple matches required to identify the form.
  • Or. This match alone identifies the form.
  • Not. This match excludes the form

The AND, OR, and NOT operators specify the conditions under which the Agent should respond to Web match combinations.

If you assign a match value of AND to a match criterion, that criterion must be present for the Agent to respond to a page. So, when several fields are assigned an AND operator, all those criteria must be present.

If you assign a match value of OR to several match criteria, the Agent responds if any one of the criteria is present.

The NOT operator is used as an excluder when performing a match. The Agent responds to any criteria that are assigned the AND and OR operators, unless the conditions of the NOT criteria are present. The Agent excludes the instances specified by the NOT operator.


Add/Edit URL

Use this prompt to specify the URL (or Uniform Resource Locator, commonly called a Web address) of the logon or password-change form to configure.

To specify a URL for matching

  1. Select one of the following (see Matching Expressions, below).
  2. Exact
  3. Wildcard (does not apply to ESSO-KM)
    • Regular Expression (does not apply to ESSO-KM)
  4. Type (or edit) the URL or a matching expression.
  5. Click OK.

Matching Expressions

For applications that have varying text in their URLs, you can use substrings or regular expressions to specify how to match the variable text.

Wildcards
  • ? (question mark) matches any single character.
  • * (asterisk) matches zero or more occurrences of any character.
This does not apply to ESSO-KM.
Regular Expressions

You can also use the set of regular expressions to specify a string pattern that the agent should recognize as a match.

This does not apply to ESSO-KM.

Matching Environment Variables

For applications that include the user's name in the URL (as derived from the DOMAINUSER environment variable in the workstation operating system), select Exact as the matching criterion, and use one of the following substitution tokens in the match string:

%DOMAINUSER% | User name exactly as derived from the environment variable
%UC%%DOMAINUSER% | User name converted to all upper case
%LC%%DOMAINUSER% | User name converted to all lower case
Example

This URLentry matches a password-change window title that includes the username:

Password Expired - %UC%%DOMAINUSER%


Add Edit Web Field

Web Field

Use this dialog box to specify a credential field or Submit button on a Web form.

Function

Select a credential type:

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • New Password
  • Confirm New Password
  • Submit
Frame | Type the target name of the browser frame in which the field appears (specified by the NAME attribute in a <frame> element in the target page's parent frameset )
Form | Type the name of the form in which the field appears (specified by the NAME attribute in the <form> element in the target page).
Field Name | Type the field name (the NAME attribute of the field's <input> element).
Field Type | Select the field type (corresponding to the type attribute of the field's <input>element) or a hyperlink anchor tag (<A HREF=...>) used as a Submit button.
Credential Type | <INPUT TYPE=...> Options
UserID | Text
Password | Password
Third Field | Select-One
Fourth Field | Select-Multiple
New Password
Confirm New Password
Submit | Submit
Image
Button
Anchor (<A HREF...> tag


Miscellaneous Tab for a Selected Web Application

Miscellaneous_Tab_Submit_Delay

Web pages occasionally include forms that require a short time to become enabled as the page loads. In such a case, ESSO-LM might submit credentials too soon. To avoid this occurrence, use the Submit Delay setting on the Miscellaneous tab to allow time for all forms to become enabled.

Submit Delay (milliseconds) Enter a time in milliseconds for the Agent to wait to submit credentials.


New Host/Mainframe Application

Use this dialog box to configure a new logon for a host/mainframe application.

See Adding Mainframe Applications for the full procedure.

Configuring a New Host/Mainframe Application

  1. Start the target application.
  2. In the left pane, right-click Applications then select New Host App from the shortcut menu.
  3. The Add Application dialog box appears with the Host/Mainframe option selected.
  4. In the Add Application dialog box, enter a Name for the new logon and click OK. The Host/Mainframe Form Wizard (for configuring new logon forms) appears.

See Adding Mainframe Applications for more information.


Host/Mainframe Form Wizard

Use the Host/Mainframe Form Wizard to perform any of these tasks:

  • Configure new logons for a host/mainframe emulator or Telnet (scrolling-screen) applications.
  • Add new forms to existing logons
  • Create forms for automatic password changes
  • Create forms for detecting password change success and failure

The Host/Mainframe Form Wizard lets you use the application itself to identify its logon/password-change windows and the individual username/ID, password, and other fields. The general steps for creating a logon are as follows:

  1. Start the target emulator or Telnet application.
  2. Select the Form Type and Screen Type.
  3. Copy the text of the application's logon/password-change screen and paste it to the Console.
  4. Indicate the text and position of onscreen captions that identifies the screen as a logon/password-change form.
  5. Indicate the position (or, for Telnet applications, the sequence) of the individual username/ID, password, and other fields.
  6. Review the configuration and make changes as needed, using the Back and Next buttons.
  7. To modify a host/mainframe logon's settings manually, use the General tab (for configuring a host/mainframe logon form).
  8. Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Host/Mainframe Applications for specific information about creating and configuring host/mainframe logons.

Configuring a Host/Mainframe Application

Start the target application in the host/mainframe emulator or Telnet.

  1. In the Console, do one of the following:
    • Create a new host/mainframe application logon.
    • Select an existing host mainframe application, then in the General tab, click Add.
  2. In the Host/Mainframe Wizard, select the form type. The available options are:
    • Logon. Configures a logon form.
    • Password change. Configures a password change form.
    • Password change success. Configures a form that serves as a match for the target application's password change success message. Since this form does not inject credentials, the Credentials page of the Host/Mainframe Wizard is skipped. When the password change success message is detected, ESSO-LM will automatically save the new credentials.
    • Password change failure. Configures a form that serves as a match for the target application's password change failure message and reinjects credentials when the password change failure message is detected. If you select this option, you will be presented with the Credentials page of the Host/Mainframe in which you will configure the necessary fields.
  3. In the Screen Type wizard page, do one of the following:
    • Choose Fixed Screen for applications running on a host/mainframe emulator that presents logon forms as static text pages.
    • Choose Scrolling Screen for applications running on Telnet or other scrolling-screen consoles that request logon information as a series of prompts.
  4. In the Paste Screen Text page that opens, in the target application, copy all of the onscreen text to the Windows Clipboard.
Some emulators provide a Copy command or button; others let you select Ctrl+C to copy. In Windows Telnet, select the text and select Enter
  5. In the Console's Paste Screen Text page, click Paste Text topaste the text into the wizard page, and click Next.

If the emulator screen does not use return or line-feed characters, adjust the Characters per Line to set proper text wrapping.
  6. In the Cursor Position page, click or use the arrow keys to place the text cursor in the exact position that it appears in the Telnet application's window.
  7. Click Next to display the next wizard page.
  8. In the Text to Match wizard page, select a block of text that identifies the screen as a logon or password-change form. Right-click the selection, and click Add as Text Match. Repeat this step for additional text blocks.
  9. When your selections are complete, click Next to display the next wizard page.
  10. In the Fields wizard page, do one of the following:
    • For a fixed-screen logon, place the text cursor at the starting position of a field. Right-click and select the field type (Username/ID, Password, Third Field, Fourth Field) from the shortcut menu. Repeat this step for each required field.
    • For a scrolling screen, place the text cursor at the prompt-entry position. Click Add, then select the first field type requested. Repeat this step for each required prompt.
  11. When your selections are complete, click Next to display the summary page.
  12. Review the configuration. To make changes, use the Back and Next buttons to display a page.
  13. When your configuration is complete, click Finish.


Host/Mainframe Form Wizard for RSA SecurID

Host/Mainframe Form Wizard

Use the Host/Mainframe Form Wizard to perform any of these tasks:

  • Configure new logons for a host/mainframe emulator or Telnet (scrolling-screen) applications.
  • Add new forms to existing logons
  • Create forms for automatic PIN changes
  • Create forms for detecting PIN change success and failure

The Host/Mainframe Form Wizard lets you use the application itself to identify its windows and fields. The general steps for creating a logon are as follows:

  1. Start the target emulator or Telnet application.
  2. Select the Form Type and Screen Type.
  3. Copy the text from the form displayed by the application and paste it to the Console.
  4. Indicate the text and position of onscreen captions that identifies the screen as a form of the selected type.
  5. Indicate the position (or, for Telnet applications, the sequence) of the individual username/ID, PIN, and other fields.
  6. Review the configuration and make changes as needed, using the Back and Next buttons.

To modify a host/mainframe logon's settings manually, use the General tab (for configuring a host/mainframe logon form).

Before you begin this procedure, refer to the General Guidelines for configuring applications. Also see Adding Host/Mainframe Applications for specific information about creating and configuring host/mainframe logons.

Configuring a Host/Mainframe Application

Start the target application in the host/mainframe emulator or Telnet.

  1. In the Console, do one of the following:
    • Create a new host/mainframe application logon. Be sure to select the RSA SecurID check box in the Add Application dialog.
    • Select an existing host mainframe application, then in the General tab, click Add.
  2. In the Host/Mainframe Wizard, select the form type. The available options are:
    • Logon. Configures a logon form.
    • PIN change – configures a PIN change form.
    • PIN change success – configures a form that serves as a match for the target application's PIN change success message. Since this form does not inject credentials, the Credentials page of the Host/Mainframe Wizard is skipped. When the PIN change success message is detected, ESSO-LM will automatically save the new credentials.
    • PIN change failure – configures a form that serves as a match for the target application's PIN change failure message and reinjects credentials when the PIN change failure message is detected. If you select this option, you will be presented with the Credentials page of the Host/Mainframe Wizard in which you will configure the necessary fields.
  3. In the Screen Type wizard page, do one of the following:
    • Choose Fixed Screen for applications running on a host/mainframe emulator that presents logon forms as static text pages.
    • Choose Scrolling Screen for applications running on Telnet or other scrolling-screen consoles that request logon information as a series of prompts.
  4. In the Paste Screen Text page that opens, in the target application, copy all of the onscreen text to the Windows Clipboard.
Some emulators provide a Copy command or button; others let you select Ctrl+C to copy. In Windows Telnet, select the text and select Enter.
  5. In the Console's Paste Screen Text page, click Paste Text topaste the text into the wizard page, and click Next.

If the emulator screen does not use return or line-feed characters, adjust the Characters per Line to set proper text wrapping.
  6. In the Cursor Position page, click or use the arrow keys to place the text cursor in the exact position that it appears in the Telnet application's window.
  7. Click Next to display the next wizard page.
  8. In the Text to Match wizard page, select a block of text that identifies the screen as a logon or password-change form. Right-click the selection, and click Add as Text Match. Repeat this step for additional text blocks.
  9. When your selections are complete, click Next to display the next wizard page.
  10. In the Fields wizard page, do one of the following:
    • For a fixed-screen logon, place the text cursor at the starting position of a field. Right-click and select the field type (Username/ID, Password, Third Field, Fourth Field) from the shortcut menu. Repeat this step for each required field.
    • For a scrolling screen, place the text cursor at the prompt-entry position. Click Add, then select the first field type requested. Repeat this step for each required prompt.
  11. When your selections are complete, click Next to display the summary page.
  12. Review the configuration. To make changes, use the Back and Next buttons to display a page.
  13. When your configuration is complete, click Finish.


General Tab (for Configuring a Host/Mainframe Logon Form)

Use this dialog box to modify information about a Host/Mainframe application logon form.

See Adding Telnet Applications for information about configuring logons for Telnet applications.
Controls
Form Name | The name of the application logon form. You can edit the name.
Text Matching | Displays the literal Text string that the Agent uses to identify this form, the screen coordinates (Row and Column numbers) of the first character of the string. Click Add to specify a new text identifier or Edit to modify an existing one.
Fields | Displays the series of keystrokes that ESSO-LM transfers to the host application's logon form. To add or modify a keystroke series, click Edit to display the SendKeys(Host/Mainframe) dialog box.
Wizard | Start the Host/Mainframe Form Wizardfor configuring an application visually.


Text Matching (on a Host/Mainframe Logon Form)

Use the Text Matching dialog box to specify the text and position of an onscreen caption that identifies the screen as a logon or password-change form.

You must also specify the location (row and column number) of the first character of the text. Use the cursor-position indicator in the status bar at the bottom of the session window to find the row and column numbers of the text.

For Telnet applications, use row coordinates relative to the cursor position. See Adding Telnet Applications for an example. You can also use an asterisk for wildcard matching of a row, column or both.

When you have completed your entries for a match, click OK.

Controls

Row | Type the row number (vertical screen coordinate) of the first character of the Text. For Telnet applications (with supported host emulators), this value is relative to the cursor position and can be negative (to indicate a row above the cursor) or an asterisk (*) to indicate any row onscreen).
Column | Type the column number (horizontal screen coordinate) of the first character of the Text. For Telnet applications (with supported host emulators), this setting can be an asterisk (*) to indicate any row onscreen.
Text | Type the string of text to match.


Edit Fields/Actions (Host Mainframe)

Edit Fields/Actions (for a Host Mainframe Application Logon)

Use theEdit Fields/Actions dialog box to specify a series of keystrokes for ESSO-LM to transfer to the host application's logon form.

The tabs in the right pane of the Edit Fields/Actionsdialog box provide the keystroke options. Select or enter the options you need on each tab. Click the Insert button to add the key or action to the series.

Your selections appear in the list in the left pane. To change the order of the series, select an item and click the up or down arrows to move it. To modify an item, select it, and click Edit to display the Fields dialog box. To delete an item, select it, and click Delete.

Controls

Fields tab

Select fields to insert

Select a credential item from the list to add to the series:

  • UserID
  • Password
  • Third Field
  • Fourth Field
  • New Password
  • Confirm New Password

Insert this character after field

Select a keystroke to insert automatically after the field is filled:

  • None (no keystroke)
  • Tab (to advance the cursor)
  • Enter (to submit the form)

Also see Special Keys, below.

Row/Column

Enter the row and column coordinates of the first character of the text-entry field.
If the column number is variable, (for example, most Unix systems include the affected username as part of the "New Password" and "Confirm Password" field labels when changing passwords), you can use a regular expression to wildcard the variable portion of the field label so that ESSO-LM always injects credentials in the correct spot.

Insert

Add the current selection to the series.
Text tab

Enter text to insert

Enter any literal text to add to the series.

Insert

Add the text to the series.
Delay tab tab

Length of delay (in seconds)

Enter or select a delay between keystrokes.

Insert

Add the delay to the series.
Special Keys tab

Category/Key

Select a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Page Down) from the right list.

Insert

Add the keystroke to the series.


Options Tab

Options Tab (for Configuring a Host/Mainframe Logon Form)

Use the Host/Mainframe Options tab to set emulator options for a host/mainframe logon.

To display this tab, do one of the following:

  1. Create a new host/mainframe application logon.

or

  1. In the left pane, click Applications and select a host/mainframe application.
  2. Click the General tab in the right pane.
  3. Select a logon form from the list and click Edit.
  4. In the General tab of the Host/Mainframe form-configuration dialog box, select the Options tab.

Controls

Delay Field (ms) Enter the delay in milliseconds for the Agent to pause between actions; for example, entering value into a field (default 0 ms).
Screen Type

Choose one of the following:

  • Fixed for static (non-scrolling) terminal emulation screen
  • Scrolling for scrolling terminal emulation screens; for example Telnet.
Column Position of Cursor Type the starting column number of the text cursor when logon or password change begins.
If this position varies (for example, most Unix systems include the affected username as part of the "New Password" and "Confirm Password" field labels when changing passwords), you can use a regular expression to wildcard the variable portion of the field label so that ESSO-LM always injects credentials in the correct spot.


Bulk-Add tab

See First Time Use (Bulk-Add) for more information.

Specifying Applications to Bulk-Add

You must configure applications individually to use in a bulk-add. See To enable a logon for Bulk-Add.
  1. Click Applications in the left pane, then click the Bulk-Add tab in the right pane.
  2. Click Add. The Select Application dialog box appears.
  3. Select the applications to add to this group. (Use Ctrl+click or Shift+click to select multiple entries.)
  4. Click OK.
  5. Type or edit the Version Stamp in yyyymmdd format (for example "20030615" for June 15, 2003). If this date is later than the last date a given Agent completed setup. then the Agent activates Setup Wizard to add the new logon(s).


Application (selected)

Selected Application

Represents a configured application. Use the tabs in the right pane to view or modify this logon's properties.

To select a logon for viewing or editing:

  1. Click Applications in the left pane, then click the Applications List tab in the right pane.
  2. Select an application from the list, then click Edit.

or

  1. In the left pane, click the plus sign (+) next to the Applications icon (or double-click Applications) to display the configured logons.
  2. Do one of the following:

    • Click a logon icon to select it. The General tab appears in the right pane.

      or

    • Right-click a logon icon to display a shortcut menu with these options:

New Form | Add a new form for the selected application logon. Displays the corresponding configuration dialog for the selected application type.
Delete | Delete the selected logon.
Make copy | Duplicate the selected logon.
Rename | Rename the selected logon.


General tab for (selected application)

General Tab (for a Selected Application)

Use the General tab to add or modify form or field configurations for the selected application.

Description | Enter an optional text comment to appear in the Description field of the Agent Logon Manager. For example, "Email."=
Reference

Enter an optional text comment to appear in the Reference field of the Agent Logon Manager. For example, the "Version 1.0."

This field is read-only on the client side.
Add | Add a new form for the selected application. The corresponding configuration dialog box for the selected application type appears.
Edit | Modify an existing logon form. Select a form from the Forms window, then click Edit. The corresponding configuration dialog for the selected application type appears.
Delete | Remove a form. Select a form from the Forms window, then click Delete. If only one form is listed, deleting it will remove the application entirely.
Add [Edit] Notes | Type or modify optional comments or documentation.
Deny response

Check this button to prevent the Agent from responding to this form.

Disabling any form in a template disables the entire template.


Bulk add tab (for selected application)

Bulk Add Tab (for a Selected Application)

Use this tab for special configurations of the currently-selected application. Also see Bulk-Add tab (general) for more information.

Enable Bulk-Add capability for this application | Select to enable this application to be included in a bulk-add.
Confirm UserID during Bulk-Add | Select to require the user to confirm username in order to perform a bulk-add.
Confirm Password during Bulk-Add | Select to require the user to confirm password in order to perform a bulk-add.
Confirm Third Field during Bulk-Add | Select to require the user to confirm a third field's information in order to perform a bulk-add.
Confirm Fourth Field during Bulk-Add | Select to require the user to confirm a fourth field's information in order to perform a bulk-add.


Authentication tab (for selected application)

Authentication Tab (for a Selected Application)

This tab only appears if you have ESSO-AM installed. ESSO-AM is an add-on module to ESSO-LM available separately from Oracle.

Use this tab to set the minimum authentication grade for the selected application.

The Primary Logon Method used must have an Authentication Grade equal to or higher than this value in order for ESSO-LM to log on to the selected application.

If the end-user's Primary Logon Method has an authentication grade lower than the minimum set for this application, when the user requests access to the application, ESSO-LM prompts the user to authenticate at a higher grade. The user will only gain access after successfully logging on at the required grade.

To set the authenticator grade for primary logon methods using the Authenticator Grade setting.

Minimum Authentication Grade Select or type the numeric value of the lowest Authentication Grade the end user's Primary Logon Method must have. The default is 1.


Error Loop tab (for selected application)

Error Loop Tab (for a Selected Logon)

Use the Error Loop tab (under a selected application) to control the appearance and behavior of the Logon Error (Error Loop) dialog box for individual applications.

  • To set Error Loop globally, for all applications, use the Error Loop global agent settings (see Error Loop (End-User Experience - Response)).
  • To set Error Loop by application type, use the Error Loopglobal agent settings for each type (Windows, Web, Host/Mainframe).

Controls

Logon Timeout (sec.)

[TimeOut]

Maximum time in seconds between successive logon attempts before Logon Error dialog appears. Default is 30.

If Logon Timeout is set to 0, a logon error (for example, entering the wrong credentials) will not display the Logon Error dialog box.

Max. Retries

[MaxRetry]

Maximum number of retries (after first try) allowed before the Logon Error dialog box appears. Default is 1.

Hide "Confirm Password"

[HideConfirmPW]

Whether to hide the password confirmation field in the Logon Error dialog box. Default is No.
(Global registry equivalents shown in brackets.)


Password Change Tab (for a Selected Application)

Use the Password Change tab to set or modify options that control how the Agent manages password changes.

The Agent distinguishes between logon and password change fields that appear on the same screen or on different tabs of a dialog box. In the instance of this type of screen, the Agent prompts the user, through the Action Chooser dialog box, to select a password change or logon. You can configure a period of time for which the user will not need to change passwords, and hence will not receive the Action Chooser.

Controls

Password Change Options
Wizard Behavior

Controls how the Agent responds when an application prompts the end user to change passwords. The options are:

  • Prompt User: Prompts the user with the Password Change Wizard.
  • Manual w/Auto Option: Prompts user to select a new password, but lets the Password Change Wizard offer to generate a password automatically.
  • Auto only: Generates a new password automatically, and does not allow the user to select the new password.
  • Auto w/Manual Option: Generates a new password automatically, but first allows the user to select a new password.
  • Quietly Generate and Submit Password: Generates and submits password without prompting the user.
  • Manual only: Prompts the user to select a new password; does not let the Password Change Wizard automatically generate a password.
Enable Password verify pop-up dialog | Check this box if you want to display the password change verification pop-up dialog box, which provides an additional confirmation that the password has been changed.
Lock focus to password change dialog

When enabled, locks desktop focus to the password change dialog, preventing interaction with the target application until the user completes or dismisses the dialog.

This setting changed in version 11.1.1.1.0 .

Prohibit cancelling a password change

When enabled, disables the “Cancel” button in the password change dialog, prohibiting the user from canceling the password change process.

This setting is new as of version 11.1.1.1.0 .

Password Generation Policy | Select a password generation policy. To subscribe multiple applications to a policy, see Policy Subscribers.
Credential Sharing Group | Select a credential sharing group. To assign multiple applications to a password group, see Credential Sharing Groups.
Bypass Logon Chooser

Controls whether the Logon Chooser is displayed when password change is initiated. When enabled, the password change dialog will be displayed immediately if the selected condition is met. The available conditions are listed below.

Options:

  • When the most recent logon was to the same application instance.
  • When the most recent logon for the same application occurred within x seconds.
If you select the second condition, you must specify the length of the timeout in seconds. Valid range is 1-999999 seconds.

This setting is new as of version 11.1.1.1.0 .

Password Expiration Options
Enable Password Expiration | Select this check box to require users to change passwords after a specified period.
Number of days until password expires | Enter or select the number of days for which a user's password is valid.
Run this command when the password expires | Type the full path and command (or click Browse to locate the executable file) that should be invoked when the user attempts to log on after the Number of days setting has elapsed. (Example C:\Program Files\PassChange\passchange.exe. )
Action Chooser Grace Period
Days Enter the length of the grace period (in days) for which the Agent will not display the Action Chooser dialog box.
Automatically proceed with password change

When enabled, the Action Chooser is bypassed when the grace period expires and password change initiates automatically.

This option is only available after the grace period has been specified.

This setting is new as of version 11.1.1.1.0 .


Events Tab (for a Selected Application)

Use this tab to add a logon event and configure the environment surrounding it.

Add Logon Event

Run this command when a logon for this application is added

This setting allows you to define a process (such as exe, web, script, etc.) to be run immediately after the Add Logon Wizard is completed for an application.

For example, this setting could be used to launch a password change application right after credentials are entered into the Agent, thus allowing the Agent to change the application password immediately.

Click the Browse button to locate a command to be entered.
Pre Logon Event
Run this command before a logon for this application is used

This setting allows you to define a pre-logon task that occurs prior to each logon instance, transmitting information from this process about the current logon attempt. The information in the resulting exit code cues Logon Manager whether to continue credential submission or abort the logon process.

For example, you might want to run a script to call an API, perform a task to ensure that an application is in the state required for logon, or check usernames against a list of permitted or prohibited applications.

Click the Browse button to locate a command to be entered.
Failure Return Code

The Agent will ignore a logon returning a number of errors equal to or higher than the number set in this field. A higher setting allows the application to return multiple error codes. The default for this setting is 1.
Time out

Specifies the time, in milliseconds, for the Agent to wait for the task to complete. This setting is incremental from 1.000 to 5.000 milliseconds (default). If the task has not completed within the specified time, the task terminates and logon does not occur.
It is recommended that you specify a full path to the application to run, and surround it with double quotes. For example, "C:\Program Files\My Tools\checktool.exe"


Miscellaneous Tab (for Selected Application)

Miscellaneous Tab (for a Selected Application)

Use this tab for special configurations of the currently-selected application.

Miscellaneous Settings

Allow Masked Fields to Be Revealed

Select to enable the Reveal button for for masked fileds in Wizards and property pages.

Force Reauthentication

Select to require the user to reauthenticate before providing credentials to this application.

Auto Submit

Select to have the agent automatically select OK for this application logon after providing credentials.

Service Logon

Select to let the agent detect an application that runs as a Windows service (that is, in the System space, rather than the User space).

Auto-Recognize

Select to have the agent recognize applications and Web sites and log users on automatically. If this setting is checked or unchecked, it overrides the global agent setting. If this setting is checked, the user can configure this setting from the Logon Manager. If this setting is unchecked, the user will not have access to this setting from the Logon Manager.

If this setting has a green box instead of a check, this means that the user can configure this setting from the Logon Manager.

Mask Third Field

 Select to mask the third field of an application logon. This affects the third field appearance on the following pages: New Logon property, Error Loop Dialog, Logon Properties, and FTU Entry. By default, this box is checked (third field is masked).

Mask Fourth Field

 Select to mask the fourth field of an application logon. This affects the fourth field appearance on the following pages: New Logon property, Error Loop Dialog, Logon Properties, and FTU Entry. By default, this box is checked (fourth field is masked).
Prohibit disabling the addition of new logons

Specifies whether the “Disable” button in the “New Logon” dialog is active for this application. When enabled, the “Disable” button is deactivated and the user is prohibited from adding new logons for this application when auto-prompted by the Agent. When disabled, clicking the “Disable” button adds this application is to the “Exclusions” list in the Agent settings dialog.

Options:

  • Yes
  • No (default)

This setting changed in version 11.1.1.1.0 .

Prohibit canceling the addition of new logons

Specifies whether the “Cancel” button in the “New Logon” dialog is active for this application. When enabled, the “Cancel” button is deactivated and the user is prohibited from cancelling a logon addition in progress for this application after being auto-prompted by the Agent. When disabled, clicking the “Cancel” button defers the logon addition until the next time this application is detected.

Options:

  • Yes
  • No (default)

File extension (for Icon)

Type a Windows file extension associated with a logon. Instructs the Agent to map an icon to the configuration.

ConfigName

Click Choose to select the windows and control that contains the text to use to create the new logon's initial configuration name (Windows applications only).

UserID Field Label

Type a text label to be used by the Agent for the username/ID field.

Password Field Label

Type a text label to be used by the Agent for the password field.

3rd Field Label

Type a text label to be used by the Agent when displaying a third logon field.

4th Field Label

Type a text label to be used by the Agent when displaying a fourth logon field.
SendKeys Settings
Delay Char Use this setting to add a delay, in milliseconds, between every press in SendKeys, slowing credential submission. This setting is useful for applications that require additional time to recognize credential input.
Logon Loop Grace Period

None

There is no grace period between logon prompts. The user is logged on automatically after initial logon. (Default)
Prompt If the logon grace period has not expired, the user receives a prompt asking if he wants to log back on to an application.
Silent

The Agent ignores the applcation for the duration of the grace period and does not inject credentials until the grace period expires.

Minutes

Set the length of the grace period in minutes.

Reset for each process

When enabled, the grace period is reset for each new process that is launched. This will cause ESSO-LM to log the user on to an application when the application is closed and restarted, even if the grace period has not expired.

When disabled, the grace period is not reset for each new process. ESSO-LM will not attempt to log the user on to an application that has been restarted until the grace period has expired. (When this is disabled and the grace period has not expired, the user will be prompted to log on again if the Prompt/Silent option is set to Prompt.)


Choose Control ID

Use the ConfigName wizard to select a logon window's text control to use as the initial name of the application logon. Use this feature to name a logon (when it is added to the Agent) with a variable text item (such as an account name) that appears in the logon window.

  1. Select the window that contains the text control you want to use, then click Next.
  2. Select the control that contains the text item to use as the logon's initial configuration name. Click Finish.

Controls (Application Window)

Window List | Displays the windows of current applications. Click on the column heads to sort the list.
Show hidden window | Specifies to include hidden windows in the Window list.
Next | Advances to the next Wizard page.

Controls (ConfigName Control)

Control List | Displays the controls of the currently-selected application window. Click on the headers (Class, ID,or Text) to sort the list.
Use ordinals instead of control IDs | Indicates that the Agent should transmit data to this form as a series of numbered control IDs assigned by ESSO-LM, rather than addressing individuals fields generated by native Control IDs.
Refresh | Updates the field list.
Back | Returns to the previous Wizard page.


Security Tab (for Role/Group Support)

Use this tab to set the access rights for the currently-selected configuration item. You can assign access rights to these items:

  • Application logons (including associated credential sharing groups)
  • Password generation policies
  • Global agent settings
  • Passphrase question sets.
For increased security on Active Directory domains, right-click the domain administrator's name and select DENY. This action will ensure that application templates are not automatically sent to domain administrators.

Controls

Directory | Select the target directory server.
Access information:
Name | Lists the groups or users who currently have access to this item.
ID | The user account name.
Access | Indicates whether the user or group has read/write or read-only access rights to the currently selected item. To change a user or group's access rights, right-click the user or group and select Read or Read/Write from the shortcut menu.
Actions:
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access tot he currently selected item.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.


Provisioning Tab for a Selected Application

Provisioning Tab (for Role/Group Support)

From this tab, permissions can be added and removed. You can also select the level of access rights (for example, add/modify/delete applications) for those permissions.

Controls

Directory | Select the target directory server.
Access information:
Name | Lists the groups or users who currently have access to this item.
ID | Lists the user account name.
Access | Indicates the permissions that have been granted to the user or group (Add, Modify or Delete Logon). To change a user or group's access rights, right-click the user or group and select Add Logon, Modify Logon or Delete Logon from the shortcut menu.
Actions
Copy permissions to | Use this button to easily apply the provisioning rights for the current application to multiple applications. Clicking this button displays a dialog listing all the applications. Selects the applications that you want these provisioning rights to be copied to. Use Ctrl+click or Shift+click to select multiple entries. Click OK.
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected item.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.

Add User or Group Dialog Box

The Select User or Group dialog box varies based on the directory server being used:

  • LDAP
  • Active Directory/ADAM

LDAP

Use this dialog to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls

Search Base | The base (highest-level) directory to begin searching for user/group accounts. All subdirectories of the base directory are searched. Type a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search. Use this dialog to browse to and select the base (highest-level) directory to search for user/group names. Click OK when finished.
Search | Begin searching the base directory for users and groups.
Users or Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.

Active Directory/ADAM

Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls

List Names From | Select an Active Directory domain or server.
Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add | Copies user(s) and group(s) selected in the Names list to the Add Names list. Use Ctrl+click or Shift+click to select multiple entries.
Members | When a group is selected the Names list, displays the Global Group Membership dialog box, which lists the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names | Display the names of the user(s) or group(s) for whom you have you have added so far. Click OK to add these names to the access list for the current configuration item. Note: You can type or edit user names in this list. However, entries are checked for invalid account names, and duplicate account selections are automatically removed when you click OK.


Generate MSI

Create a new .MSI file (a Windows Installer package), from an existing MSI package in order to add configured application logons and/or Agent configuration settings.

Generate MSI is typically used to modify the ESSO-LM installation package (\Full\setup.msi on the ESSO-LM distribution disk) to include logons or settings in the initial desktop installation of ESSO-LM. The MSI file you create can include:

  • Selected application logons from an entlist.ini file or from the current console configuration.
  • Agent settings from an administrative overrides (.ini) file or from the current console configuration.

Generating an MSI Package

  1. Select or type the names of the Base (input) and Output .msi files.
  2. Do either or both of the following:

    • Choose one or more configured Applications to include in the .msi package.

      or

    • Choose a set of Global Agent Settings to include in the .msi package.
  3. Click OK.
Files
Base (MSI)… | The base installer package to customize. Type the filename or click the … button to select the .msi file.
Output (MSI)… | The customized installer package that you will send to end users. Type a filename or click the … button to select an existing .msi file.
Configuration
Applications | Applications to be packaged. Click Choose to display Configure Applications dialog box.
Global Agent Settings | Set of Global Agent Settings to be packaged. Click Choose to display Configure Global Agent Settings dialog box.


Export to INI File

  1. Export selected applications and all password policies and groups to an entlist.ini file- a store of application logons.
  2. Do one of the following:

    • Select applications to export (use Ctrl+click or Shift+click to select multiple entries), then click OK.

      or

    • Click Export All to export all listed applications.
  3. If any applications you have selected are enabled for Bulk-Add, you can select Create First-Time-Use file to generate a bulk-add (ftulist.ini) file.
  4. Click OK. The Export EntList file dialog box appears.
  5. Locate and open the folder for the file, name the file, and click Save.
  6. If you chose to create a First-Time Use file, the Export First-Time Use dialog box appears. Locate and open the folder for the file (rename the file if desired), and click Save.


Export EntList File

Save an exported application configuration file (enlist.ini) to disk. The Export EntList file dialog displays when you export application logon information using the Export to INI file dialog box.

  1. Locate and open the folder for the file, name the file, and click Save.
  2. If you chose to create a First-Time Use file, the Export First-Time Use dialog box opens. Locate and open the folder for the file (rename the file if desired), and click Save.


Export First-Time Use

Save a first-time-use file (ftulist.ini) to disk. The Export First-Time Use dialog box opens when you create a First-Time Use file while exporting application logon information to an enlist.ini file.

  1. Locate and open the folder for the file (rename the file if desired).
  2. Click Save.


Import Merge Conflict

The Import/Merge Conflict dialog box appears if the merged file contains items with same names as those in current configuration.

  • Select the items to import and click OK.

    The items you select overwrite the current like-named items.


Manage Templates

Use this dialog box to create, modify, and remove templates for application logons. To display this dialog box, on the Tools menu, click Manage Templates.

When creating templates, take precautions to ensure that no complete template name exactly matches the first part of another template name. If the Agent finds two templates, one of whose names is a subset of the other, the Agent recognizes the template with the shorter name.

For example, if two templates are named ABC and ABD, this issue does not occur. But if one template is named ABC, and one is named ABC_D, the Agent recognizes only the ABC template, and ignores the ABC_D template, regardless of which application is opened.

Creating a New Template from an Application

  1. Click Add to create a new template from an application logon.
  2. From the Select Applications dialog box, select the application on which to base the template.
  3. Click OK. From the Edit Template dialog box, specify the settings that must be supplied by an administrator, and the template's overriding settings.

Modifying an Existing Template

  • Select an application from the list and click Edit. From the Edit Template dialog box, modify the settings that must be supplied by an administrator, and the template's overriding settings.

Deleting a Template

  • Select an application from the list and click Remove.


Override Settings Tab (Edit Template Dialog Box)

Use this tab to select the settings that the template updates in all logons that are based on it. You can choose global overrides that apply to all of the forms in the application logon configuration, and you can also select specific overrides for individual forms.

The left pane displays the hierarchy of the application and its component forms:

  • The global override settings for applications correspond to the general configuration settings for each application-type.
  • The form-specific settings correspond to the configuration controls for individual logons.

Both Setting types are listed in the right pane with a Category that corresponds to the application-configuration dialog box in which you make the setting. Refer to the dialog box or tab for information on each setting.

Applications | General Error Loop Password Change Miscellaneous
Windows forms | General Fields Matching Miscellaneous
Web forms | General Matching
Mainframe/Host forms | General Options

To display this tab:

  1. Choose Manage Templates from the Tools menu.
  2. Do one of the following:

  • Add a new template.

    or

  • Select an existing template and click Edit.

  3. In the Edit Templates dialog box, select the Overriding Settings tab.


Supply Info Tab (Edit Template Dialog Box)

Use this tab to specify what information an administrator must provide in order to complete an application logon based on this template. You can choose all items or choose individual items by selecting checkboxes.


Update Applications (from Template)

Use this dialog box to update application logons based on a template that has been modified since the logons were created. Only logons whose templates have been modified appear in the list. Select the applications to update (use Shift-click or Ctrl-click for multiple applications), then click Update.


Dynamic and Ordinal Control IDs

Certain applications change the control ID for each field with every application launch. ESSO-LM provides you with the option to assign ordinal ID numbers to replace these dynamic control IDs, thereby eliminating variations in control IDs with each application launch.

ESSO-LM assigns mandatory ordinal field IDs by default to .NET applications, which have no native support for control IDs.

Configuring ESSO-LM to assign ordinal control IDs

  1. Launch the ESSO-LM Administrative Console.
  2. Pause the ESSO-LM Agent.
  3. Launch an application to create a template.
  4. Launch the template wizard.

  5. Select Logon.

    The control ID for each field appears in the Credential Fields screen. For applications with dynamic control IDs, these ID numbers will vary with each launch. (This does not apply to .NET applications, which have no native control IDs.)

  6. Select Use ordinals instead of control IDs.
    • The Credential Fields Screen displays the fields, assigning control IDs by location order instead of using native (dynamic) control IDs.
    • For applications with native Control ID Support, if Use ordinals instead of control IDs is checked, the control ID detection is done by enumerating controls on the application window. The ID column will be filled with field ordinals and the display refreshes.
    • If you select not to use ordinal IDs, dynamic control IDs will display as the default (except for .NET applications, for which the ordinals are already displayed)
    • If you select Use ‘Send Keys’ for this form. Do not use Control ID, the Use ordinals instead of control IDs option is unavailable.
  7. Select a numeric field value to determine which field is assigned to the ID. The field will be surrounded by a flashing border. Right click the dropdown menu to select the field name (for instance, Username or Password).


Managing Sessions

Oracle Enterprise Single Sign-on Kiosk Manager

To create Actions and Session States:

  1. Click Create Action to create a new action.

    An action tells ESSO-KM to do something, such as run a program, call a .Net method, terminate a specific application, or terminate all but a specified list of applications.

  2. Click Create Session State to create a new session state.

    "Session States" are a list of events to associate with the actions, for example, a defined session state tells ESSO-KM that when a session ends, perform this list of actions. A session state defines what should occur within a logon session: When a logon session starts, what actions should be performed? When a logon session ends, what actions need to be performed?


Create Session Action List

Oracle Enterprise Single Sign-on Kiosk Manager > Add List dialog box

Use this dialog to create action lists. Select the List Type and enter a Name. Click OK when complete.

The three types of actions that can be created are lists are:

  • Terminate lists
    Terminate lists are a list of applications to be closed by ESSO-KM on session end.
  • Run lists
    Run lists are either a .Net API to call or a script of command lines to be executed by ESSO-KM
  • Special Actions lists
    Special Action lists specify how to handle application windows, such as the positioning of the application and the order that this application has actions performed on it.


Special Actions

Oracle Enterprise Single Sign-on Kiosk Manager > Special Actions

Use this panel to specify how to handle application windows, such as the positioning of the application and the order that this application has these actions performed on it.

If an application window does not appear in a special actions list, it will be hidden.

Controls

AppPathKeys

The Windows registry key identifying an application associated with this logon to match against running processes. (Usually the application executable's name, such as Notepad.exe)

Window Titles | Text matched against logon window titles to identify logon requests.
Reposition Application

This setting and those below it allow you to specify the position of the application.The state of this checkbox determines if the actions listed below it will be applied to the application window.

Options:

  • Maximize
  • Minimize
  • Restore
  • Move to. Enter the coordinates for the applications position.
  • Resize. Enter the width and height for the applications position.
Sort Order | This setting determines the order in which special actions are executed. This ensures that windows which are brought to the foreground can be in a specific order with a preferred window displayed on top when multiple windows are repositioned.
Bring to foreground | This setting ensures that the application window is always first in the application windows order.
Shared Application | Check this box to enable an application to be shared among user sessions. For example, if “Notepad.exe” is designated as a shared application, if user1 opens a document in notepad and then locks the session, notepad will be running when user2 starts a session. If user2 then closes notepad and locks their session, notepad will no longer be running when user1 logs back on.
Disabled | Select this checkbox to disable this list. Disabling a list allows you to retain the settings in a list without deleting the original list. This way you can still refer to the settings and use them with other lists.

Configuring an Application

  1. Under the AppPath Keys box, click Add. The Process Path Key dialog box displays.
  2. Enter a valid application key (usually the application executable's name, such as Notepad.exe). Click OK.
  3. The application has been added to the list of applications to close on session end. ESSO-KM will terminate these applications when a session ends.
  4. Use the Edit and Delete buttons to modify or remove applications from this list.
  5. In the Window Titles box, click Add. The Windows Title dialog box appears.
  6. Enter a valid windows title. Click OK.

Specifying a Window Title for Matching

  1. Enter (or edit) the exact Window Title.
  2. Click OK.


List of Sessions to Terminate

Oracle Enterprise Single Sign-on Kiosk Manager > Terminate List

Use this panel to create a list of applications to be closed by ESSO-KM on session end.

Controls

AppPathKeys

The Windows registry key identifying an application associated with this logon to match against running processes. (Usually the application executable's name, such as Notepad.exe)

Window Titles | Text matched against logon window titles to identify logon requests.
Process Termination Type

Select the methods of termination for applications to be closed on session end:

  • Keystroke Sequence
  • .Net SendKeys
  • SendKeys: Configure fields by transmitting a keystroke series to the form. Click Edit to enter or change the series.
  • SendKeys using Journal Hook: Configure fields by transmitting a keystroke series to the form using Journal Hook. Click Edit to enter or change the series.
  • Process closure requests
  • Process termination
When using keystroke sequences to terminate an application, a visual flicker occurs on the end users screen. This flicker is a function of using sendkeys to terminate an application.
Disabled | Select this checkbox to disable this list. Disabling a list allows you to retain the settings in a list without deleting the original list. This way you can still refer to the settings and use them with other lists.

Configuring an Application

  1. Under the AppPath Keys box, click Add. The Process Path Key dialog box displays.
  2. Enter a valid application key (usually the application executable's name, such as Notepad.exe). Click OK.
  3. The application has been added to the list of applications to close on session end. ESSO-KM will terminate these applications when a session ends.
  4. Use the Edit and Delete buttons to modify or remove applications from this list.
  5. In the Window Titles box, click Add. The Windows Title dialog box appears.
  6. Enter a valid windows title. Click OK.

Specifying a Window Title for Matching

  1. Enter (or edit) the exact Window Title.
  2. Click OK.


Session Manager State Actions tab

Oracle Enterprise Single Sign-on Kiosk Manager > Session States > Actions tab

The Actions tab contains a list of all the actions associated with this session state. This panel is empty for newly created session states. Once you associate actions with the session state, the actions appear in this panel.

Use this panel to create, associate, edit and delete actions.

To use the Actions tab:

  • To define a new action list, click Create. There are two types of action lists: Terminate lists and Run lists. A new action that you create from this panel is automatically added to this session state.
  • To associate a defined action with this session state, click Associate and select an action from the list.
  • To make changes to an action, highlight it and click Edit.
  • To delete an action from a session state, click Delete. This deletes the action only from the current session state, not the actions list.


Session Run List

Oracle Enterprise Single Sign-on Kiosk Manager > Run List

Use this panel to define either a .Net API to call or a script of command lines to be executed by ESSO-KM.

Commands

Select a .Net API or Script command to run:

.Net API | Assembly | Click the "…" to locate the .Net assembly to use. The assembly loads.
Class | Select a .Net class using the drop-down box. The .Net classes listed will be those that are available in the selected assembly.
Method

Select a method to call using the drop-down box. The .Net methods listed will be those that are available in the selected class. The method will be limited to the following signature and will not take any parameters or return any values:

void MethodName();

Unlike the script, processing will not continue until the method returns.

Click here to see a sample .Net API.

.NET API calls are synchronous (ESSO-KM will wait for the call to complete).
Script

Enter a command line script for ESSO-KM to execute. If this list contains multiple commands, each line starts without waiting for the previous task to terminate or checking the previous task’s return code.

Command line calls are asynchronous (run in parallel to other tasks including ESSO-KM).
Disabled | Select this checkbox to disable this list. Disabling a list allows you to retain the settings in a list without deleting the original list. This way you can still refer to the settings, and copy them to other lists, etc.


Session States Overview

Oracle Enterprise Single Sign-on Kiosk Manager > Session States

This panel contains the list of session states that have been created. Session states are a list of events to associate with the actions, for example, a defined session state tells ESSO-KM that when a session ends, perform this list of actions. A session state defines what should occur within a logon session; for instance, when a logon session begins or ends, what actions should be taken.

Use this panel to create, edit, copy and delete session states.

To add a session state:

  • Click Create to add a new session state.

    or

  • Highlight a session state.
  • Click Edit to select the events and authenticators that this session state should respond to. The Edit command also allows you to select which actions are to be associated with the events and authenticators selected for this state.

To copy a session state:

  • Click Copy to quickly make a copy of this session state. To change the name, right-click the session state in the left pane and click Rename. You can also perform a copy by right-clicking the session state in the left pane and clicking Copy.

To delete a session state:

  1. Click Delete to delete a session state. A confirmation message appears before the state is deleted.


Add Session State

Oracle Enterprise Single Sign-on Kiosk Manager > Add Session State

Use this dialog box to add and name a new session state. Type a Session State Name and click OK.


Events Tab

Oracle Enterprise Single Sign-on Kiosk Manager > Session States > Events Tab

The Events tab contains a list of all the possible events that ESSO-KM can respond to and the option to add custom events. Each listed event has a checkbox next to it that when checked indicates that the associated action lists should be executed when this event occurs. When a new session state is created, Session End is checked by default.

There are two ways to create events:

  • Create your own custom events by clicking the Add button. Use the Edit button to edit the custom event name and the Delete button to delete a custom event.

or

  • Select the pre-defined events for this session state. Available events are:
    • After Session Unlocked
      This event runs when the user unlocks their session after authentication has taken place. If an authentication is canceled, this event will not be triggered.
    • AM Device In
      This event is triggered when the SSO device monitor is enabled and a monitored authenticator is detected (e.g., a smart card is inserted or a biometrics device is in range).
    • AM Device Out
      This event is triggered when the SSO device monitor is enabled and a monitored authenticator is detected (e.g., a smart card is removed or a biometric goes out of range). This event will only be triggered when:
      • A session is open or locked
      • A "Device-In" event started the session
    • AM Grace Period
      This event is triggered if an authenticator which uses a grace period function is being used and a user returns to an open session within the grace period.
    • Authenticator Logon
      This event is triggered when an authenticator has accepted a logon. For example, the correct password for WinAuth or the correct PIN for smart card is entered.
    • Authenticator Timeout
      This event is triggered when ESSO-LM's internal timer has expired.
    • Before Session Unlocked
      This event is triggered when a user unlocks their session but before authentication takes place.
    • Cached Credential Session Start
      This event is triggered when a session is started and the user has cached credentials stored on the local computer.
    • Session End
      This event is triggered when the session ends and the timer expires, or when another user starts a session.
    • Session Locked
      This event is triggered when a user manually locks the session via the system tray.
    • Session Start
      This event is triggered when a user starts a new session.
    • Time Expired
      This event is triggered when the locked session timer has reached 00:00:00.
    • Transparent Screen Displayed
      This event is triggered when the transparent lock initiates and the screen is visible to the user in locked mode.
    • Transparent Screen Hidden
      This event is triggered when the transparent lock is ending.
    • User Change
      This event is triggered when a user logs into ESSO-KM. This event sets two properties on the .Net object if they exist (If the properties do not exist, nothing happens):
      • UserName. The sync user name.
      • DomainName. The sync domain name.

ESSO-AM events run when the authenticator sends a message to ESSO-KM indicating the event type.


Session Authenticator tab

Oracle Enterprise Single Sign-on Kiosk Manager >Session States > Authenticators tab

The Authenticators tab contains a list of all the authenticators that ESSO-LM supports as well as the option to add a custom authenticator. Each authenticator has a checkbox next to it that when checked indicates if the associated action lists should be executed when the selected events occur and the selected authenticator was used to authenticate the user.

When a new session state is created, all authenticators are checked by default.

There are two ways to select authenticators:

  • Create your own custom authenticator by clicking the Add button. Use the Edit button to edit the custom event authenticator and the Delete button to delete a custom authenticator.
  • Select the pre-defined authenticator for this session state. Available authenticator are:
    • Authentication Manager
    • Entrust
    • LDAP
    • LDAP v2
    • Proximity Card
    • Read-Only Smart Card
    • SecurID
    • Smart Card
    • Windows Logon
    • Windows Logon v2


Session State Security

Oracle Enterprise Single Sign-on Kiosk Manager > Session States > Security Tab

Use the Security tab to set the access rights for this session state. You can assign access rights to these items:

  • Application logons (including associated credential sharing groups)
  • Password generation policies
  • Global agent settings
  • Passphrase question sets
The security tab will only show up if Role/Group Security is enabled.

Controls

Directory | Select the target directory server.
Access information
Name | Lists the groups or users who currently have access to this session state.
ID | The user account name.
Access | Indicates whether the user or group has read/write or read-only access rights to the currently selected session state. To change a user or group's access rights, right-click the user or group and select Read or Read/Write from the shortcut menu.
Actions
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected session state.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.


Provisioning Overview

Oracle Enterprise Single Sign-on Provisioning Gateway

Oracle Enterprise Single Sign-on Provisioning Gateway (PM) provides the ability for an administrator to automatically provision ESSO-LM with a user's ID and password by using a provisioning system. An administrator is able to add, modify and delete IDs and passwords for particular applications within the provisioning system and have the changes reflected in ESSO-LM. From the provisioning system, all usernames and passwords inside of ESSO-LM can also be deleted so that a user’s access to all protected applications is eliminated.

The following ESSO-PG settings are configured through the console:

  • Provisioning tab (for role/group support)
  • Provisioning App tab (for role/group support)
ESSO-PG is an add-on module to ESSO-LM available separately from Oracle.

For more detailed information on ESSO-PG, refer to the ESSO-PG product documentation.

Accessing the ESSO-PG Administrative Console

  • Open a Web browser and enter this URL (replacing serverhost with the server where ESSO-PG was installed):
    https://serverhost/ESSO-PG console/overview.aspx


Passphrase Sets

You can create groups of questions to present to the user upon password reset request. Create, configure, modify, and delete, these groups, called Passphrase Sets, using the Passphrase Questions screens.

Use this option for Windows Authenticator v2 and LDAP Authenticator v2 only.

Use this option in ESSO-AM for Smart Card authenticator (SCAuth).


Add a Passphrase Set

To add a passphrase set:

  1. Do one of the following:

    • In the left pane, right-click Passphrase Questions and select New Passphrase from the shortcut menu.

      or

    • Right-click in the right pane and select New Passphrase from the shortcut menu.

      or

    • Click the Add button at the bottom of the right pane.

      or

    • From the INSERT menu, select Passphrase.
  2. In the Add Passphrase Set dialog box, type a passphrase set name and click OK.
  3. Use the Questions tab in the right pane to add questions to the current passphrase set.


Delete a Passphrase Set

Deleting a Passphrase Set

To delete a passphrase set, do one of the following:

  1. In the left pane, select Passphrase Questions.
  2. From the list of passphrase sets in the right pane, select a set and click the Delete button.

or

  • Select a set, right-click, and select Delete from the shortcut menu.

or

  1. Double-click (or click the "+" sign next to) Passphrase Questions in the left pane.
  2. From the expanded Passphrase Questions menu, right-click an existing passphrase set, and select Delete from the shortcut menu.


Modify a Passphrase Set

To modify a passphrase set:

  1. Double-click a passphrase set under the Passphrase Questions menu. The questions in that set display in the Questions tab in the right pane.
    • To add a question to the set, click the Add button and type your question into the Add a Question dialog box. Then click OK.
    • To edit a question in the set, select it and click the Edit button. Make changes to the question in the Add a Question dialog box. Then click OK.
    • To delete a question in the set, select it and click the Remove button. ESSO-LM asks you to confirm the deletion. Click OK.


Setting a Default Passphrase Set

Use this option to designate a Passphrase set as the default. The default set contains passphrase questions that users answer during First-Time Use (FTU). The FTU wizard is invoked when:

  • You start the Agent for the first time after installation

or

  • When the administrator deploys a ftulist object (for example, the ftulist.ini file).

On first-time use, ESSO-LM users select a passphrase question and supply an answer. This stored passphrase answer can be used to reset ESSO-LM authentication if the user later changes the primary logon password. The next time single-sign-on re-authentication is required, the user enters the new password, and ESSO-LM displays the passphrase question to confirm the user's identity.

The Agent uses only one passphrase set. You must decide which set of questions you want the user to answer and designate that set as the default passphrase set. The set you designate as the default is the only one written to the ftulist.

If you import an ftulist to the Administrative Console and change the passphrase set before you re-export the ftulist to the repository, the passhprase set is not included in the export if you do not reset it as the default.

To assign a default passphrase set, do one of the following:

  • In the right pane, right-click on the set name, then select Set As Default from the shortcut menu.

or

  • In the left pane, right-click on the set name, then select Set As Default on the shortcut menu.
    The passphrase set name will appear in bold type in both the right and left panes, indicating that it is the default set.


Passphrase Questions Tab

Questions Tab

Use the Questions tab to manage questions and settings in the selected passphrase set. To display this tab, from the left pane, select Passphrase Questions and select the Default Set displayed in bold.

To add questions to a passphrase set:

  1. Select a language from the drop-down menu.
  2. Click Add or select Passphrase from the Insert menu.
  3. In the Add Question dialog box, enter a question.
  4. Select or enter a minimum length for the reply.
  5. Click OK.

Controls

Language | Select language for passphrase questions.
Default Question | Lists current default passphrase question, which is checked by default. When a new passphrase question is added the default passphrase is unchecked. When checked, the default passphrase is disabled for the current passphrase set. When unchecked the default passphrase is enabled for the current passphrase set.
Enabled Question | Lists current passphrase questions. Checked items are the enabled passphrases for the current set. To disable a passphrase click the checkbox to clear it. To modify a passphrase question, double-click it, or select it and click Edit.
Add | Add a new passphrase question. Displays the Add Question dialog box
Remove | Delete the selected passphrase question. Displays a confirmation prompt.
Edit | Modify the selected passphrase question. Displays the Edit Question dialog box.
Set This Passphrase Set as Default | Sets the current set as the default. The default passphrase set name in the left pane displays in bold.
Remove or Disable? | Once a passphrase question has been created, deployed, and put into use by end-users, it should not be deleted. Users who have selected a passphrase question that has been deleted will not be able to change their passwords without losing access to their ESSO-LM credentials. Instead, to remove an in-use passphrase question (and keep it from being displayed during first-time use), disable the question by clearing its checkbox in the list in the Questions tab.


Password Generation Policies

Displays the currently available password generation policies and provides access to policy settings. Click Password Generation Policy in the left pane to display the current password policies in the right pane.

See Setting Password Policies for more information.

To add a new password policy:

  1. Do one of the following:

    • Click Add in right pane

      or

    • In the left pane, right-click Password Generation Policy then click New Policy on the shortcut menu.
  2. Enter a Policy Name and click OK. The Policy Subscribers tab appears in the right pane, where you can add applications that will use the new policy

To modify a listed password policy's configuration:

  • Click a policy, then click Edit. The Policy Subscribers tab appears in the right pane.

To delete one or more password policies:

  • Select a policy (use Ctrl+click or Shift+click to select multiple entries), then click Remove.


Add Password Policy

Use this dialog box to add and name a new password generation policy.

  • Enter a Policy Name and click OK.


Password Policy (selected)

Selected Password Policy

Represents a configured password generation policy. You can use the tabs in the right pane to view or modify this policy's properties and add or remove applications that use this policy.

See Setting Password Policies for more information.

Selecting a Password Policy for Viewing or Editing

  1. Click Password Generation Policies in the left pane
  2. Select a policy from the list in the right pane, then click Edit. The Policy Subscribers tab appears in the right pane.

or

  1. In the left pane, click the plus sign (+) next to the Password Generation Policies icon (or double-click Password Generation Policies) to display the configured policies.
  2. Do one of the following:
    • Click a policy icon to select it. The Policy Subscribers tab appears in the right pane.
    • Click a policy icon to select it. The Policy Subscribers tab appears in the right pane.
Delete | Delete the selected policy.
Make copy | Duplicate the selected policy.
Rename | Rename the selected policy.


Password Policy Subscribers tab

Policy Subscribers

Use the Policy Subscribers tab to add or manage the applications that use the selected password generation policy.

See Setting Password Policies for more information.

To add applications to a policy:

  1. Click Add. The Select Application dialog box appears.
  2. Select the applications that will use this policy. (Use Ctrl+click or Shift+click to select multiple entries.)
  3. Click OK.

To remove applications from a policy, select a policy (use Ctrl+click or Shift+click to select multiple entries) and click Remove.

Click Add Notes to enter notes.


Password Constraints

Password Constraints Tab

Use the Password Constraints tab to set or modify the allowed type, number, position, and repetition of characters in passwords. These constraints apply to new passwords that ESSO-LM automatically generates for applications that subscribe to the selected policy.

To view a set of test passwords based on the passwords constraints for this policy, click the Test Policy button.

See Setting Password Policies for more information.

To set password constraints:

  1. Do one of the following:
  • Select a password policy

or

  • Create a new password policy.
  2. Click the Password Constraints tab in the right pane.
  3. Select constraint options from the displayed controls.

Password Constraint Options

Length Constraint
Minimum Length | Minimum number of characters a password most contain: 1-128, default: 8
Maximum Length | Maximum number of characters a password can contain: 1-128, default: 8
Repeat Constraint
Maximum repeated non-consecutive characters | Maximum number of times a given character can be repeated in a password (in any position): 0-127, default: 7
Maximum repeated consecutive characters | Number of times a given character can be repeated consecutively (adjacent to itself): 0-127, default: 7
Alphabetic Characters
Allow Uppercase Characters | Check to allow uppercase characters to be included in a password, and enter or select the minimum quantity to permit.
Allow Lowercase Characters | Check to allow lowercase characters to be included in a password, and enter or select the minimum quantity to permit.
Numeric Characters
Allow Numeric Characters | Check to allow numeric characters to be included in a password, and enter or select the minimum and maximum quantity to permit.
Can Start Password | Check to allow password to begin with numeric characters. Default: numeric characters are allowed to begin a password.
Can End Password | Check to allow password to end with numeric characters. Default: numeric characters are allowed to end a password.
Special Characters
Allow Special Characters | Check Allow Special Characters to allow special characters (non-alphabetical, non-numeric). and enter or select the minimum and maximum quantity to permit. Default: special characters are not allowed.
Can Start Password | Select to allow password to begin with a special character. Default: special characters are not allowed to begin a password.
Can End Password | Select to allow password to end with special a character. Default: special characters are not allowed to end a password.
Other Characters
Check to allow other characters to be included in a password.
Excluded Characters
Enter the specific characters to exclude from a password.
Previous Password Constraints
Password must not be the same as previous password | Select to prevent reusing the previous password.
Limit the amount of characters that are the same as the previous password | Select to limit repetition of characters from the previous password.
Number of characters that can be the same from the previous password

If some number of characters from the previous password is permissible, select the maximum number of characters to allow.

ESSO-LM recognizes multiple occurrences of a character as the same character and will therefore permit more than one occurrence of that character in the new password.

So, if the previous password contained three "A"s, and you specify that one character from the previous password can repeat, ESSO-LM will allow more than one instance of "A" in the new password.
Test Policy
Displays the Test Password Policy dialog box, which lets you generate and view a set of test passwords based on the current policy settings.

This setting is changed in version 11.1.1.1.0 .


Credential Sharing Groups

Displays the currently available credential sharing groups and provides access to group settings.

See Creating credential sharing groups for more information.

Creating Credential Sharing Groups

  1. Select Credential Sharing Groups in the left pane to display current password groups in the right pane.
  2. Do one of the following:
  3. Click Add in the right pane.
  4. In the left pane, right-click Credential Sharing Groups, then select New Group on the shortcut menu.
  5. In the Add Sharing Group dialog box, enter a Group Name and click OK.
  6. Click Add in the right pane to add applications to the group. See To add applications to a password group for more information.

Selecting a Sharing Group for Viewing or Editing

  1. Select Credential Sharing Groups in the left pane.

    • Select a group from the list in the right pane, then click Edit.

      or

    • In the left pane, click the plus sign (+) next to the Credential Sharing Groups icon (or double-click Credential Sharing Groups) to display the configured groups.
  2. Do one of the following:

    • Select a group icon. The list of applications for this group appears in the right pane.

      or

    • Right-click a group icon to display a shortcut menu with these options:

      • Delete. Delete the selected group.
      • Rename. Rename the selected group.

Deleting a Sharing Group

  • Select a group (use Ctrl+click or Shift+click to select multiple entries), then click Remove.

You cannot delete the default groups, Domain or LDAP.


Edit Shared Fields

Use the Edit Shared Fields dialog box to specify which fields you want to include in a Credential Sharing Group. Check the box adjacent to the field you want to include, or uncheck the adjacent box to exclude a field.

Username | Check to include the username in the Credential Sharing Group. Uncheck to exclude the username from the Credential Sharing Group.
Password | Check to include the password in the Credential Sharing Group. Uncheck to exclude the password from the Credential Sharing Group.
Third Field | Check to include the third field in the Credential Sharing Group. Uncheck to exclude the third field from the Credential Sharing Group.
Fourth Field | Check to include the fourth field in the Credential Sharing Group. Uncheck to exclude the fourth field from the Credential Sharing Group.


Domain

Domain Sharing Group

The Domain sharing group is the predefined credential sharing group for the Windows authenticator.

See To add applications to a sharing group for more information on using this panel.

To select the Domain credential sharing group:

  1. Select Credential Sharing Groups in the left pane

  2. Select Domain from the list in the right pane, then click Edit.

    or

  1. In the left pane, click the plus sign (+) next to the Credential Sharing Groups icon (or double-click Credential Sharing Groups) to display the configured groups.
  2. Click Domain.


LDAP Password

LDAP Sharing Group

The LDAP sharing group is the predefined credential sharing group for the Directory Service authenticator. See To add applications to a sharing group for more information on using this panel.

To select the LDAP credential sharing group:

  1. Click Credential Sharing Groups in the left pane.

  2. Select LDAP from the list in the right pane, then click Edit.

    or

  1. In the left pane, click the plus sign (+) next to the Credential Sharing Groups icon (or double-click Credential Sharing Groups) to display the configured groups.
  2. Click LDAP.


Selected Credential Sharing Group

Represents a configured credential sharing group. Use the list in the right pane to add or remove applications from the selected group. Click Add Notes to type notes.

See Creating credential sharing groups for more information.

To add applications to a sharing group

  1. Click Add. The Select Application dialog box appears.
  2. Select the applications to include in the selected group. (Use Ctrl+click or Shift+click to select multiple entries.)
  3. Click OK.

To edit applications in a sharing group

  1. Click Edit Sharing Fields in the top right. The Edit Sharing Group dialog box appears.
  2. Select the credentials to be shared for the selected group. The following credentials are available to be shared:
    • Username
    • Password(automatically checked upon group creation)
    • Third Field
    • Fourth Field
  3. Click OK.
  4. The Shared Fields are displayed on the top left.
Tips:
  • If all checkboxes are unchecked, you will be asked if you want to delete this sharing group.
  • Checkboxes should not be disabled if the applications that belong to this sharing group do not contain the field. This allows new applications that share this field to be added later without requiring you to go back and check these.

To remove applications from a sharing group

  1. Select an application to remove from the selected group. (Use Ctrl+click or Shift+click to select multiple entries.)
  2. Click Remove.


Create Global Agent Settings

Global Agent Settings

The Global Agent Settings contain agent configuration information and provide access to stored sets of Global Agent Settings.

  1. Click Global Agent Settings in the left pane to display a list of sets of Global Agent Settings in the right pane.
  2. Right-click Global Agent Settings in the left pane to display a shortcut menu with these options:

New Settings | Create a new set of Global Agent Settings. Displays the Add Set of Settings dialog box.
Import | Import a set of Global Agent Settings from an external source:
 | From File | Import a set of settings from an administrative override object (INI) file or a registration-entries (REG) file. Navigate to the file and click Open.
 | From Live HKLM | Import the current Agent configuration from the local-machine registry (HKLM) as a set of settings named Live.

If the imported settings have the same name as an existing set in the current configuration, the imported set is named "Copy of existing settings.

If this version of the console is installed on a foreign OS (any OS other than English), do not use the New Settings option. Rather, use the Import option. If the New Settings option is used, the path for synchronization extension points to an invalid path, which results in a synchronization failure.


Add Set of Settings

Use this dialog box to add and name a new set of Global Agent Settings.

  • Enter the Set of Settings Name and click OK.

To display this dialog box:

  • Right-click Global Agent Settings and choose New Settings from the shortcut menu.

    or

  • Choose Global Agent Settings from the Insert menu.


Selected Set of Global Agent Settings

Represents a stored set of Global Agent Settings: defaults, switches, and other configuration information that modify the behavior of ESSO-LM on the desktop. Double-click items in the list in the right pane to view or modify the individual settings. Click Add Notes to type notes about this set of settings.

Viewing a Set of Global Agent Settings

  1. Do one of the following:

  • Click Global Agent Settings in the left pane, then double-click a set of settings from the right pane.

    or

  • In the left pane, click the plus sign (+) next to the Global Agent Settings icon (or double-click Global Agent Settings) to display the sets of settings.
  3. Do one of the following:

  • Select a Global Agent Settings icon. The list of individual settings appears in the right pane.

    or

  • Right-click a Global Agent Settings icon to display a shortcut menu with these options:

Export | Save the selected set of settings to a registry file or administrative override object.
Write to Live HKLM | Export the current Agent configuration to the local-machine registry (HKLM).
Delete | Delete the selected set of settings.
Make copy | Duplicate the selected set of settings.
Rename | Rename the selected set of settings.


End-User Experience

The End-User Experience settings control the Agent as a Windows application, including its interactions with the end-user and with other programs.

Show the Tray Icon

This setting determines whether to show the ESSO-LM Tray Icon in the system tray.

Options:

  • Do not show
  • Show (default)

Title Bar Button

This setting determines whether to show the ESSO-LM Title Bar Button on all window/dialog title bars.

Options:

  • Do not show (default)
  • Show

Title Bar Button- Always show for:

Enter the list of applications (by executable filename, such as notepad.exe) for which the title bar icon should always be displayed. This setting will override the Title Bar Button setting above.

Click the ... button to enter the application names. Separate application names with a carriage return.

Title Bar Button Menu

This setting determines whether to show the ESSO-LMTitle Bar Button menu.

Options:

  • Do not show
  • Show (if the Title Bar Button setting is enabled [default])

Title Bar Button tooltip

Tooltip text to display when the mouse hovers over the Title Bar Button. Default is "ESSO-LM."

Tray Icon Tooltip

Text to provide in the Tray Icon label. Recommended use: labeling each Citrix MetaFrame Server session. Default is "ESSO-LM."

Tray Icon Tooltip: Show System Name

Show computer name after the Tray Icon name. A string consisting of space-dash-space is inserted before the computer name if either TrayIconName is not set, or if set and not empty/null.

Options:

  • Do not show (default)
  • Show

Tray Icon: Use which icon

This setting determines whether to show the standard ESSO-LM icon or the alternate server icon in the system tray.

Options:

  • Standard (default)
  • Server

Use strict window detection

Enable this setting to control strict window detection. If this setting is enabled, ESSO-LM will not respond to hidden and minimized windows.

Options:

  • No (default)
  • Yes

This entry is not required.


End-User Experience\Environment

Environment (End-User Experience)

The End-User Experience Environment settings control important directory paths used by the Agent and its language support.

Default Backup path

Default backup path for silent backup. If this is not specified here (and is not specified within the command line), then the default is the user's application data directory, %AppData%\Passlogix.

Language

Language to be used in the Agent. Default is English.

Other values may be acceptable based on localized versions.

Options:

  • Brazilian Portuguese
  • Czech
  • Dutch
  • English
  • Finnish
  • French
  • German
  • Italian
  • Japanese
  • Korean
  • Polish
  • Simplified Chinese
  • Spanish

Location of entlist.ini file

Fully-qualified path and filename of the entlist.ini file. This setting should be set only if synchronization is not used to deploy pre-configured application logons created with the console. See Configuring Application Logons for more information.

SubLanguage

Settings for the language set by Language.

Other values may be acceptable based on localized versions.

The display font should support the desired characters in the specified language. Default is ENG.

Options:

  • ENG Default support
  • DBL Extended support


End-User Experience\Password Change\Required

Required (End-User Experience - Password Change)

The Required Password Change setting allows the sharing of credentials among logons. See Creating Credential Sharing Groups for more information.

Credential Sharing Groups

Enables sharing between credentials in a group.

Default is Disabled.


End-User Experience\Password Change\Change Policies

Change Policies (End-User Experience - Password Change)

The Password Change Policies settings controls the sets of characters that are used to define password-change polices and the administrator-defined policy that is to be used as a default password-change policy.

Characters: Lowercase | List of characters allowed as lowercase alphabet characters in password policies. (default: abcdefghijklmnopqrstuvwxyz)
Characters: Numeric | List of characters allowed as numeric characters in password policies. (default: 1234567890)
Characters: Special | List of non-alphanumeric (special) characters allowed for passwords (default: !@#$^&*()_-+=[]\|,?).
Characters: Uppercase | List of characters allowed as uppercase alphabet characters in password policies. (default: ABCDEFGHIJKLMNOPQRSTUVWXYZ)
Default Policy | Name of section in entlist.ini that contains the default password policy. (If no policy is specified in entlist.ini, ESSO-LM defaults to the policy in applist.ini.)


End-User Experience\Password Change\Common

Common (End-User Experience - Password Change)

The Common Password Change setting controls the user interface of the Agent's Password Change Wizard.

Default Change Password Wizard behavior

Sets the behavior of the Password Change Wizard when a user encounters a password-change request.

Options:

  • Prompt: Prompts user with the Password Change Wizard (default).
  • Manual, offer auto: Prompts user to select a new password, but also allows the Password Change Wizard to offer to generate the password automatically.
  • Auto, offer manual: Generates the new password automatically, but also allows the user to select the new password.
  • Manual only: Prompts user to select a new password; does not allow Password Change Wizard to automatically generate the password.
Default pop-up dialog text

Specify the text you want to display after the user changes a password.

To change the default text, select the checkbox and highlight the current text, then type in new text. To restore default text, deselect the checkbox.

The default text reads: "After closing this message, verify that the application accepted the password. Select OK if it was accepted, if rejected please try again."


End-User Experience\Password Change\Advanced

Advanced (End-User Experience - Password Change)

The Advanced Password Change settings control special-case functions for credential sharing and automatic password generation.

Allow user to exclude logons from sharing groups

Allows the ESSO-LM user to exclude an application logon from the administrator-assigned credential sharing group.

Options:

  • Do not allow (default)
  • Allow
Change passwords automatically

Specifies the level of control given to the user during the password change process.

Options:

  • No – full control; ESSO-LM will not automatically change passwords. User must initiate password change
  • Yes, with user confirmation – partial control; ESSO-LM will automatically initiate password change and prompt the user to either accept the auto-generated password, request to generate another, or enter one manually.
  • Yes, without user confirmation – no control; ESSO-LM will automatically initiate password change, generate a password, and submit it to the application without permitting user interaction.
Notify Primary Logon Method

Applies credential sharing to the current authenticator when credentials in its credential sharing group change.

Options:

  • Do not notify the Authenticator (default)
  • Notify the Authenticator

Credential sharing is currently supported only for Windows Authenticator version 2 and LDAP Authenticator version 2.

Because the end user is not notified of the new password, you should not use automatic password generation to change the passwords of applications in the sharing group.


End-User Experience\Response

Response (End-User Experience)

The general Response settings control the behavior of the Agent when the end user provides credentials for new logons and when detecting applications requiring logons. These settings also control whether end users can create logons for applications not created by the administrator.

Automatically logon to applications

Automatically provides credentials to applications.

Options:

  • Do not automatically provide credentials.
  • Automatically provide credentials (default).
Selecting "Automatically provide credentials" disables the user's ability to turn off the Auto-Recognize setting in the Agent's Response settings tab.
Display "Add another logon" checkbox

Enables or disables display of the Add another logon checkbox in the Add Wizard.

Options:

  • Disable (default)
  • Enable

Enable Auto-Prompt

Specifies whether to automatically prompt the user to add a logon when a new application is detected.

Options:

  • Yes. The New Logon dialog box displays when an application without stored credentials launches. (Default)
  • No. Applications without stored credentials launch without the New Logon dialog box displaying.

Limit user to predefined applications

Allows user to add credentials for applications that are not predefined.

Options:

  • Predefined apps only. Do not allow the user to add credentials for unknown applications.
  • Unlimited. Allow the user to add credentials for unknown applications (default).

Logon to waiting applications upon agent startup

Enables the Agent, at startup, to submit credentials to a Windows or Java application that has already presented its logon form.

The agent always submits credentials to Web applications and to host/mainframe application logons that use polling to elicit logon entry. These applications are not affected by this setting.

Options:

  • Do not logon (default)
  • Logon at startup
Prohibit canceling the addition of new logons

Specifies whether the user has the option to click the Cancel button or close the New Logon dialog box to defer entering credentials. This permits current access to an application and re-prompts the user to enter credentials at the next appropriate instance.

Options:

  • No. Allows the user to defer application logons. (default)
  • Yes. Prohibits the user from deferring application logons.

Prohibit disabling the addition of new logons

Specifies whether the Disable button is available in the New Logon dialog box, allowing the user to reject adding credentials for applications permanently. Disabling an application adds it to the Exclusions list in Agent settings.

Options:

  • Yes. Prohibits the user from excluding applications.
  • No. Allows the user to exclude applications. (default)

SendKeys Event Interval

Specifies the minimum time to allow between SendKeys key events. This is especially useful for Eastern languages where keystrokes are sometimes lost.

Options:

  • Best Speed (0 ms)
  • Typical For Eastern Languages (60 ms)
  • Use For Slow System (80 ms)
  • Use For Very Slow System (120 ms)

ESSO-LM does not support credential submission using Journal Hook SendKeys.

Utilize the just-added Logon

Specifies whether to log on to an application after configuring it (adding its credentials).

Options:

  • Do not log on to an application after adding its credentials.
  • Log on to an application after adding its credentials (default).


End-User Experience\Response\Error Loop

Error Loop (End-User Experience - Response)

The Error Loop settings control the Agent's default behavior when it supplies incorrect credentials. A logon error usually occurs when a user enters the wrong password when creating a logon, or changes the application password from another computer. When a logon error occurs, the Agent displays the Logon Error dialog box to prompt the user to enter and store the proper credentials.

Use the Error Loop controls to set the error loop for specific application types:

Windows

Web

Host/Mainframe

To set the error loop for a specific application, select Applications>Error Loop.
Maximum retries before prompting | Specifies maximum number of retries (after first try) allowed before Logon Error dialog box appears. Default is 1. This setting applies for each set of credentials.
Maximum time for retries before prompting | Specifies maximum time in seconds between successive logon attempts before Logon Error dialog box appears. Default is 30. This setting applies for each set of credentials.
Require password confirmation when modifying password | Specifies whether to display the Confirm Password field in the Logon Error dialog box. Default is to Require password confirmation.


End-User Experience\Response\Host/Mainframe Apps

Host/Mainframe Applications (End-User Experience - Response)

The Host/Mainframe Response settings control the behavior of the Agent with host/mainframe applications.

16-bit screen capture attempts

Number of times to attempt the 16-bit screen capture. If an attempt is unsuccessful after the allotted number of tries, the 32-bit method is reverted to. (default: 5)

Credential Request Delay Interval

Interval (in milliseconds) between prompts to the user to create a logon for a mainframe session.

When a user logs on to a mainframe session that matches a configured application for which a stored password does not exist, ESSO-LM prompts the user with the following question: "There are no matching Logons for this mainframe session. Would you like to create one now?" If the user selects No, the next time the user presses any key on the mainframe screen, ESSO-LM prompts the user again. This delay setting is the amount of time ESSO-LM should wait before displaying the question again (default: 60000).

Host/Mainframe support

Enable host/mainframe support. See Adding Mainframe applications for more information

Options:

  • Host/mainframe support disabled.
  • Host/mainframe support enabled (default).

Polling Interval

Interval (in milliseconds) between instances when the Agent checks the host emulator for changes. Lower values use more CPU time; higher values increase the time between when a screen opens and when the Agent provides credentials (default: 700).


End-User Experience\Response\\JavaApps

Java Applications (End-User Experience - Response)

The Java Apps Response settings control the behavior of the Agent with Java applications.

Delay after Java runtime startup | Amount of time (in milliseconds) the JHO should wait before listening to window events at Java startup. Adding a delay can resolve timing conflicts during Java runtime initialization. Default is 0.
Delay between retries | Amount of time (in milliseconds) the JHO should wait between retries. Default is 500.
Excluded Java versions | Java versions to exclude, listed as regular expressions. Enter one expression per line. This setting is new as of version 11.1.1.1.0 .
Maximum times to retry credential injection | Number of times to retry credential injection. Default is 0.
Time allowed for Java applets to load | Maximum time (in seconds) that the Agent waits for a Java applet to be fully loaded in the browser. Default is 6.


End-User Experience\Response\Web Apps

Web Applications (End-User Experience - Response)

The Web Applications Response settings control the behavior of the Agent with Web applications.

Because some Web applications contain content that changes with each visit, you can configure a Web template to rescan dynamic Web pages, detect changes, and respond appropriately.

Activate Tab

Enable/disable activating the tab that identifies the logon fields.
Allowed Dynamic Web Pages | Specify the dynamic Web pages that the Agent should allow. Click the … button to enter regular expressions that match these URLs.
Allowed Web Pages

Specify the Web pages that the Agent should allow. Click the … button to enter regular expressions that match the URLs.

Use this feature only when you limit the user to predefined applications or Web applications.

Applications to ignore

Comma delimited list of applications that the BHO should skip when searching for logons.

Border Appearance

Sets the default border color, size, and style for Web credential fields (default setting: red 6px solid). See Border Appearance for more information.

Limit user to predefined Web apps

Indicates whether to allow the user to add credentials for Web applications that are not predefined by the administrator (unknown applications).

Options:

  • Predefined apps only: Responds only to Web applications specified by the administrator. Does not allow the user to add credentials for unknown Web applications.
  • Unlimited: Responds to any Web application. (default)
  • Manually add undefined: Allows the user to add credentials for Web applications not specified by the administrator.
  • This setting works with Limit user to predefined applications on the End-User Experience > Response page. These settings work together as follows:
    • Limit user to predefined applications is set to Limit:
      The user is limited to pre-defined windows and Web applications no matter what the value of this setting.
    • Limit user to predefined applications is set to Do not Limit and this setting is set to Limit:
      The user is limited to pre-defined Web applications. The user is able to add unknown Windows applications on the fly.

    Respond to IE Modal Dialogs

    Enable this setting to have the Agent respond to a web page that displays as a modal dialog or HTML application.

    Registry Location: Extensions\AccessManager\BHO:RespondToIEModalDialogs

    Scroll Into View

    Enable/disable scrolling the browser window to bring the logon fields into view.

    Show Border

    Displays a highlighted border around the credential fields of a Web form during logon.

    Options:

    • Disable the border around fields.
    • Enable the border around fields (default).

    URL Matching Precision

    Number of levels of the URL to use as the matching criteria.

    Options:

    (for the Web URL http://mail.company.com)

    • Match to *company.com (default)
    • Match to *mail.company.com
    Web Pages to Ignore | Comma-delimited list of Web sites that the Agent should ignore. Click the … to enter regular expressions that match these URLs.


End-User Experience\Response\Windows Apps

Windows Applications (End-User Experience - Response)

The Windows Applications Response settings control the behavior of the Agent with Windows applications.

Ignored Window Classes for Applications

The list of window class names that the Agent does not recognize as applications. This setting allows you to direct ESSO-LM to ignore a specific window class globally.

Limit user to predefined Windows apps

Indicates whether to allow the user to add credentials for Windows applications that are not predefined by the administrator (unknown applications).

Options:

  • Predefined apps only. Do not allow the user to add credentials for unknown Windows applications.
  • Unlimited. Allow the user to add credentials for unknown Windows applications (default).

This setting works in conjunction with "Limit user to predefined applications" in "End-User Experience > Response." These settings work together as follows:

  • "End-User Experience > Response> Limit user to predefined applications" is set to "Predefined apps only":
    The user is limited to pre-defined windows and Windows applications regardless of the value of this setting.
  • "End-User Experience > Response> Limit user to predefined applications" is set to "Unlimited" and this setting is set to "Predefined apps only":
    The user is limited to predefined Windows applications. The user is able to add unknown Web applications on the fly.

Retry for a Window Title Match

For slow-appearing dialog boxes or applications, this value indicates how many times (in half-second intervals) the Agent retries for a window title match. If the window title changes after this time, the change will be ignored. Default is 6.

Supported Window Classes for Applications

The list of window class names that the Agent recognizes as applications. This setting is provided to improve performance by restricting the Agent to this list. To enable support for dynamic window classes, delete the default settings to set this value to null. Default is #32770;Dialog; ThunderRT5FormDC; ThunderRT6FormDC.

Supported Window Classes for Services

The list of window class names that the Agent recognizes as Windows services. This setting is provided to improve performance by restricting the Agent to this list. To enable support for dynamic window classes, delete the default settings to set this value to null. Default is #32770;Dialog; ThunderRT5FormDC; ThunderRT6FormDC.


End-User Experience\Setup Wizard

Setup Wizard (End-User Experience)

The Setup Wizardsettings control the behavior of the Setup Wizard, which launches at first-time use. See First Time Use for more information.

Enable/disable First-Time-Use (FTU) wizard

Controls whether the Setup Wizard launches when first-time-use is invoked.

Options:

  • Do not hide (default)
  • Hide

If more than one authenticator (primary logon method) is installed, then the first authenticator in the list is automatically selected as the end user's primary logon method.

You must have the FTU wizard enabled in order to use the Bulk-Add feature.

Selected Primary Logon

Enables the selected logon method as the primary logon method and hides all other installed logon methods. The default is no selection (i.e., end-users select their own primary logon method).

To hide the primary logon method selection menu, use the Enable/Disable First-Time-Use (FTU) Wizard setting. If the primary logon method selection page is hidden, and this setting is blank, then the first installed logon method in the list is automatically selected.

Skip "selection" page if only one Primary Logon Method installed

Hide the Select Primary Logon Method step in the Setup Wizard if only one authenticator (primary logon method) is installed.

Options:

  • Do not hide/skip the Select step of the Setup Wizard (default).
  • Hide/skip the Select step of the Setup Wizard.


End-User Experience\Advanced

Advanced (End-User Experience)

The Advanced End-User Experience settings control the appearance of the Agent when performing a logon and of the information presented in the Logon Manager and Logon Chooser dialog boxes.

Logon Animation's duration

Duration (in milliseconds) the animated spinner appears (pausing response). A value of 0 (the default) disables the spinner.

Logon Chooser Columns

Click "…" to display the Edit Columns dialog box to choose the appearance and order of columns in the Agent's Logon Chooser dialog box. Default is Username/ID, Application Name, Description.

  • Username/ID
  • Application Name
  • Description

My Accounts columns for "Details" view

Click "…" to display the Edit Columns dialog box to choose the appearance and order of columns in the Agent's Logon Manager.

  • Application Name
  • URL/Module
  • Username/ID
  • Password
  • Modified
  • Last Used
  • Description
  • Reference
  • Group
  • Third Field
  • Fourth Field

The default is all columns, except Third Field and Fourth Field, in the preceding order.

My Accounts Refresh button

Displays the Logon Manager Refresh button.

Options:

  • Disable the Refresh button.
  • Enable the Refresh button (default).

User can shut down ESSO-LM from the System Tray Icon Menu

With this setting enabled (the default), the end user can shut down the Agent by selecting Shutdown ESSO-LM from the System Tray Icon menu. When disabled, this menu item is unavailable.

Options:

  • Do not allow shutdown from menu.
  • Allow shutdown from menu (default).


End-User Experience\Advanced\Performance

Performance (End-User Experience Advanced )

The Advanced Performance settings fine-tune how and when the Agent stores user credentials and other data. The first and third settings apply only if "Store user data on disk in encrypted file" is set to "Do not store," which affords optimal Agent performance; This setting defaults to Store user data in disk file for compatibility with previous versions of ESSO-LM.

Increase user data storage priority

Sets processing priority for storing changes to user data (for example, credentials). Set to Increase processing priority only if the workstation's CPU typically runs at 100% usage.

Options:

  • Increase processing priority
  • Do not increase processing priority (default).

Maxiumum time before forced SSO process shutdown (ms)

Sets time interval to wait (in milliseconds) before forcing SSO processes (satellites) to shut down.

This is useful in situations where ESSO-LM takes a long time to shut down, and shutdown time is critical.

This setting can be adjusted from the default of 5000 milliseconds (5 seconds) down to a minimum of 500 milliseconds (0.5 seconds).

Set delay for first update (after startup) to stored user data (ms)

Sets an interval (in milliseconds) to wait after ESSO-LM starts up before writing changes in user data (for example, credentials) to the internal database. Default is 5000ms).

Set delay for storing user data (ms)

Sets an interval to wait (in milliseconds) before writing changes in user data (for example, credentials) to the internal database. Default is 500ms.

Store user data on disk in encrypted file

Stores a copy of user data (for example, credentials) locally in an encrypted database file in each user's Application Data folder.

Options:

  • Store user data in a disk file (default)
  • Do not store user data in disk file


Special Tasks (End-User Experience Advanced)

The Special Tasks settings control the tasks (lists of commands) that should executed when specific Agent actions occur. For each set of tasks, select the checkbox and click "…" to open the Edit List dialog box. Enter one command on each line; end each line by pressing Enter. Do not use any other delimiter characters. They run one at a time, sequentially.

ESSO-LM will not respond until all of the tasks complete.

After Agent starts up | Commands that will run every time the background task starts (the taskbar tray icon).
Before Agent starts | Commands that will run before any Agent process starts. The Agent will not continue if any of these tasks fails (as indicated by the resultant registry value located at License:PreCheck).
When logons are deleted | Commands that will run every time a user deletes an application configuration.
When logons change (add, delete, copy, modify) | Commands that will run every time a user modifies credentials and configurations.


Reporting Extension

Reporting

Use this setting to specify the path of the Reporting extension.

Extension Location Path\filename of the Reporting Database Extension that points to the ReportingExt.dll .


Event Logging\SysLog

Syslog (Event Logging)

The Syslog settings control how the Agent records program events.

Cache Retry Interval

Specifies the interval (in minutes) between retries for the Syslog extension. The default is 30 minutes.

Extension Location

Specifies the path to the Syslog Extension. The default path is C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\SyslogExt.dll.

Of logged events, limit Syslog extension to:

Event Logging filter delineating which events (of those logged by the root Filter setting) to log to the Syslog extension. Click the "…" button to see a list of events to log.

Send messages to which host?

Specifies the hostname to send messages to. Either a hostname or dotted IP v4-address can be used. Use 0.0.0.0 to disable sending to syslog-daemon, or use 255.255.255.255 to send to any daemon that= is set up to receive broadcast messages. It must be on your local network as broadcast does not reach beyond a router. The default is localhost.

Send messages to which port?

Specifies the destination port for syslog messages using a number. The default port is 1468.

Send messages via TCP or UDP?

Specify whether to send messages via TCP or UDP protocol. Note that the UDP protocol is connectionless, so it is impossible to tell whether the Syslog Deamon is reachable at the specified hostname and port or not.

If the UseTCP parameter is set to "Use UDP," the Syslog Extension returns S_OK both on success and on failure. If it is necessary to make the Syslog Extension return the correct state, enable TCP in the Syslog Daemon and set this parameter to "Use TCP."

Options:

  • TCP (use 1) [default]
  • UDP (use 0)


Event Logging\Database

Database (Event Logging)

Use the Database Event Logging menu to specify the server instance and table name where you want to send log data, as well as the fields to write to the database.

In addition to the fields, users must specify the server instance and table name. These are previously defined in the Database Setting and should not be required for Database Fields. If the database and table name are not specified for each field, events will not be written to the database.

The XML File Event Logging settings let you specify which events should be logged locally. You can also change the default path to the local logging extension, and you can modify the retry interval of the logging cache.

Cache Retry Interval | Interval (in minutes) between retries for Local (XML) File Logging; the default is30 minutes
Default Server | If no other server is specified, the server to which the database log will be written. (OLE DB connection string)
Default Table | If no other table is specified, the table to which the database log will be written.
Extension location | The path/filename to the Local (XML) File Logging extension, XMLEvent.dll. (Default path: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\XMLEvent.dll
Events to log | Event Logging filter delineating which events (of those logged by the root Filter setting) to log to the Database extension. Click the "…" button to see a list of events to log.
Servers | Click the "…" button to open a window in which to enter Database servers. Enter one server name per line, using the OLE DB format "Provider=sqloledb; Data Source=myServerName; Initial Catalog=myDatabaseName; User Id=myUsername; Password=myPassword".

You must specify the database instance and table name in the Database Fields in order for events to be written to the database.


GlobalAS_Event Logging_Database Event Fields

Event Fields

Use the Event Fields screen to assign data to the field in which you want it to appear.

If you do not specify a database instance or table name, the data will be written to the default database and table that you specified in the Database screen.

AppName | Check the box and assign a field number to which to write the AppName.
Category | Check the box and assign a field number to which to write the Category.
Field1 | Check the box and specify the data field to appear in Field 1.
Field10 | Check the box and specify the data field to appear in Field 10.
Field2 | Check the box and specify the data field to appear in Field 2.
Field3 | Check the box and specify the data field to appear in Field 3.
Field4 | Check the box and specify the data field to appear in Field 4.
Field5 | Check the box and specify the data field to appear in Field 5.
Field6 | Check the box and specify the data field to appear in Field 6.
Field7 | Check the box and specify the data field to appear in Field 7.
Field8 | Check the box and specify the data field to appear in Field 8
Field9 | Check the box and specify the data field to appear in Field 9.
Time Stamp | Check the box and assign a field number to which to write the Time Stamp.
Type | Check the box and assign a field number to which to write the Type.


Event Logging\Windows Event Viewer

Windows Event Viewer (Event Logging)

The Windows Event Viewer settings enable event logging to be performed on a remote server.

Windows Event Logging Server

Server name for the Windows Event Logging extension (do not provide leading "\\" characters). If not provided, logging is performed on the local computer.

The server should have a trusted relationship with the user's account and the user's computer, depending on access rights and restrictions.


Event Logging\Windows Event Viewer\Advanced

Advanced (Event Logging - Windows Event Viewer)

The Advanced Windows Event Viewer settings let you specify which events should be logged. You can also change the default path to the Windows Event logging extension and Windows event message components, and you can modify the retry interval of the logging cache.

Cache Retry Interval | Interval (in minutes) between retries for Windows Event Logging; the default is 30 minutes.
Extension location | Path/filename to the Windows Event Logging extension, WindowsEvent.dll. (Default path: C:\Program Files\Passlogix\v-GO SSO \Plugin\EventMgr\WindowsEvent.dll)
Of logged events, limit for Windows server to | Displays the Event Logging Filter to specify which events to log to the Windows Event Server. Click "…" to display a checklist of events.


Event Logging\XML File

XML File (Event Logging)

The XML File Event Logging settings let you specify which events should be logged locally. You can also change the default path to the local logging extension, and you can modify the retry interval of the logging cache.

Cache Retry Interval | Interval (in minutes) between retries for Local (XML) File Logging. Default is 30 minutes.
Extension location | The path/filename to the Local (XML) File Logging extension, XMLEvent.dll. (Default path: C:\Program Files\Passlogix\v-GO SSO \Plugin\EventMgr\XMLEvent.dll)
Of logged events, limit for XML file to | Displays the Event Logging Filter to specify which events to log to the Local (XML) File Logging extension. Click "…" to display a checklist of events.


Event Logging\Advanced

Advanced (Event Logging)

The Advanced Event Logging settings let you change the default paths to the logging extension and event message components. You can also modify the retry interval and size of the logging cache.

Cache Limit | Maximum number of event log entries to be cached. Default is 200 entries.
Cache Retry Interval | Interval (in minutes) between retries for all Event Logging extensions. Default is 30 minutes.
Event Server Message Library location | Path/filename to the event message library, SSOeventmessage.dll, used for viewing events in Windows Event Viewer. (Default path: C:\Program Files\Passlogix\v-GO SSO \Plugin\EventMgr\SSOeventmessage.dll
Extension location | The path/filename to the event logging extension, eventmgr.dll. (Default path : C:\Program Files\Passlogix\v-GO SSO \Plugin\EventMgr\eventmgr.dll)
Shutdown Delay | The maximum amount time (in milliseconds) to wait for the Shutdown event to be written to the Event Log. A default of 0 will wait until the write has completed.
Shutdown Immediately | When set, will not wait for the Shutdown event to be written to the Event Log. When reset (default), will wait for the Shutdown event to be written to the Event Log.


Primary Logon Methods\MultiAuth|Enrollment

Enrollment (Primary Logon Methods\ Authentication Manager)

The Authentication Manager Enrollment settings specify the primary logon methods (authenticators) that can be used by the Multi-Authenticator primary logon.

The settings on this page will determine whether a user will be required to set up a specific logon method during the First Time Use Wizard, if Authentication Manager is chosen as the primary logon method.

For each primary logon method, select one of the following:

  • Optional. ESSO-LM will have the option to configure this logon or to skip it. If user defers the logon request, ESSO-LM will not ask again.
  • Incremental. ESSO-LM will have the option to configure this logon or to skip it. If user defers the logon request, ESSO-LM will ask for credentials each time the application starts.
  • Required. User will be required to configure this logon. If this logon is not configured, user will not be able to complete enrollment.
  • Disabled. The logon method will not be presented to the user during the FTU Wizard.
Entrust | Select whether a user will be required to set up Entrust as a primary logon method.
LDAP | Select whether a user will be required to set up LDAP as a primary logon method.
LDAP v2 | Select whether a user will be required to set up LDAP v2 as a primary logon method.
Proximity Card | Select whether a user will be required to set up Proximity Card as a primary logon method.
Read-Only Smart Card | Select whether a user will be required to set up Read-Only Smart Card as a primary logon method.
RSA SecurID | Select whether a user will be required to set up RSA SecurID as a primary logon method.
Smart Card | Select whether a user will be required to set up Smart Card as a primary logon method.
Windows | Select whether a user will be required to set up Windows as a primary logon method.
Windows v2 | Select whether a user will be required to set up Windows v2 as a primary logon method.


Primary Logon Methods\MultiAuth|Grade

Grade (Primary Logon Methods\Authentication Manager )

The Authentication Manager Grade settings specify an authentication grade for each primary logon method.

Authentication Grades are numeric values:

  • An authentication grade will automatically default to grade level 1 if authentication grading is turned on and no grade level is specified.
  • The higher the grade level specified, the stronger the authentication level that is being requested.
  • The grading scale can be arbitrarily configured. For example, an expected normal scenario would be a scale of 1-3, but you have the flexibility to make this 1-5 or 1-n, as required. Any grade less than 1 will be converted to 1.

The Multi-Authenticator logon supports the authentication grades by mapping the grades to the authentication methods used, if Authentication Manager is chosen as the primary logon method.

If a user tries to access credentials with a grade level that is too low, he will be asked to authenticate at a higher grade and only gain access if successful.

Lockouts occur as per normal ESSO-LM authentication lockout policy. Since graded authentication uses the core SSO authentication process, this will happen naturally.

Set a number grade value (>=1) for each logon method.

Entrust | This setting assigns an authentication grade to Entrust. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
LDAP | This setting assigns an authentication grade to LDAP. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
LDAP v2 | This setting assigns an authentication grade to LDAP v2. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
Proximity Card | This setting assigns an authentication grade to Proximity Card. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
Read-Only Smart Card | This setting assigns an authentication grade to Read-Only Smart Card. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
RSA SecurID | This setting assigns an authentication grade to RSA SecurID. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
Smart Card | This setting assigns an authentication grade to Smart Card. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
Windows | This setting assigns an authentication grade to Windows. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).
Windows v2 | This setting assigns an authentication grade to Windows v2. This value is used for Multi-Authenticator primary logon. Set a number grade value (>=1).


Primary Logon Methods\MultiAuth|Order

Order (Primary Logon Methods\Authentication Manager )

The Authentication Manager Order settings specify the sequence that the installed logon methods will be presented to the end user during reauthentication scenarios, if Authentication Manager is chosen as the primary logon method.

For each primary logon method, select or type a number to indicate the logon method's position in the FTU/logon order.

Allowed number of logon methods | This setting allows you to set the maximum number of logon methods that will be presented to a user. Once this number of logon methods have been presented (and skipped by) the user, a "Choose Logon" dialog is displayed. Defaults to 1. This setting is only used for the Multi-Authenticator primary logon.
Entrust | This setting sets the ordered position for Entrust. This will be the order that Entrust will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 4.
LDAP | This setting sets the ordered position for LDAP. This will be the order that LDAP will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 3.
LDAP v2 | This setting sets the ordered position for LDAP v2. This will be the order that LDAP v2 will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 3.
Proximity Card | This setting sets the ordered position for Proximity Card. This will be the order that Proximity Card will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 6.
Read-Only Smart Card | This setting sets the ordered position for Read-Only Smart Card. This will be the order that Read-Only Smart Card will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 1.
RSA SecurID | This setting sets the ordered position for RSA SecurID. This will be the order that RSA SecurID will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 6.
Smart Card | This setting sets the ordered position for Smart Card. This will be the order that Smart Card will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 1.
Windows | This setting sets the ordered position for Windows. This will be the order that Windows will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 2.
Windows v2 | This setting sets the ordered position for Windows v2. This will be the order that Windows v2 will be presented to the end user during reauthentication scenarios. This setting is only used for Multi-Authenticator logons. Defaults to 2.


Primary Logon Methods\LDAP\Required

Required (Primary Logon Methods - LDAP - Required)

The Required LDAP Primary Logon Methodssettings are the primary controls for enabling standard LDAP authentication. These settings must be used in order for the Agent to use LDAP as a primary logon method.

Directory Type The specific type of directory server. If the directory server is not listed, select "Generic LDAP Directory."

Servers

Servers to try, in the format computer[:port] (one server per line), where computer is the server name or IP, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: 127.0.0.1 127.0.0.1:456 somewhereelse.com:8080 anotherplace.com

At least one server must be specified for this extension to work.

If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback.

SSL

Select to connect via SSL.

Options:

  • Connect without SSL (insecure) (default port #389).
  • Connect via SSL (default port #636) (default setting).

User Paths

Fully qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree.

A value for either Naming Attribute string or at least one value for User Paths must be specified for this extension to work.

If using User Paths, do not use Alternate User ID location.


Primary Logon Methods\LDAP\Advanced

Advanced (Primary Logon Methods - LDAP - Advanced)

The Advanced LDAP Primary Logon Methodssettings control special-case options for enabling standard LDAP authentication.

Active Directory: Domain name support enabled

Enables Active Directory domain-name support. End users can specify the domain name (for example, domainname\username) at primary logon. Alternatively, the administrator can specify a default domain name (see Active Directory: Set domain name) to let end users log on by username alone. If no domain is specified, then the local workstation's domain is used.

Options:

  • Do not use AD domain names (default)
  • Use AD domain names

Active Directory: Set domain name

The Active Directory domain name to use for primary logon if no domain is specified for the username/ID credential (for example, domainname\username). This setting is used only if Active Directory: Domain name support enabled is set to "Use AD domain names." If domain-name support is enabled and this setting is blank (and the end user does not specify a domain), then local workstation's domain is used.

Alternate User ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set this location to:

empid=%user,ou=people,dc=computer

instead of to:

uid=user,ou=people,dc=computer

For Novell eDirectory, the Alternate User ID location should be:

uid=%user,path to the object%

If you use the Naming Attribute string, you must use User Paths and not Alternate User ID location.

BIND Timeout

The time (in milliseconds) to time out of LDAP BIND call (default depends on the operating system).

Change Password Window SubTitle Name

Use this setting to customize the LDAP v1 Change Password Window subtitle name for this authenticator.

This entry is not required.
Change Password Window Title Name

Use this setting to customize the LDAP v1 Change Password Window title name for this authenticator.

This entry is not required.
Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click the "…" and browse to the image file.

The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

This setting is new as of version 11.1.1.1.0 .

Enable Directory Search for users Enables or disables directory search for the user account. When the user account is not found in the given path, the extension will search for it from that location down the directory tree. The search is performed whether using "User Paths" or the "Alternate User ID location."

Naming Attribute string

String to prepend to User Paths.

This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer&n bsp;

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string). If needed, set to cn.

For Novell eDirectory, Alternate User ID location should be: uid=%user,path to the object%

If you use the Naming Attribute string, you must use User Paths and not Alternate User ID location.

Share credentials with other Primary Logon Methods

This setting provides a way to eliminate the double authentication that takes place when using authenticators that have the same credentials.

This setting links authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, refer to the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Share credentials with synchronizers

This setting provides a way to eliminate double authentication when an authenticator and one or more synchronizers use the same credentials.

Enter a comma separated list of synchronizers to share the credentials with, for example ADEXT, LDAPEXT.

To locate other synchronizer names, please see the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Show user path

When enabled, the User path field is displayed when the user is prompted to authenticate.

Options:

  • Yes (default)
  • No

This setting is new as of version 11.1.1.1.0 .

SSL Fallback

Fallback to an insecure connection when an SSL connection fails.

Options:

  • Do not connect if the SSL connection fails (default).
  • Connect without SSL (insecure) if the SSL connection fails.

If you select SSLFallback and any of the servers listed in Servers includes a port specification, the fallback port must also be specified as an additional Servers entry.

Example:

If the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as:

  • Server1=mycomputer.com:1272 ;My secure SSL Port
  • Server2=mycomputer.com:389;My fallback port

Window Title Name

Use this setting to customize the Window title name for this authenticator.

This entry is not required.


Primary Logon Methods\LDAP v2\Required

Required (Primary Logon Methods - LDAP version 2- Required)

The Required LDAP v2 Primary Logon Methodssettings are the primary controls for enabling LDAP version 2 authentication. These settings must be used in order for the Agent to use LDAP v. 2 as a primary logon method.

Servers

Servers to try, in the format computer[:port] (one server per line), where computer is the server name or IP, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: 127.0.0.1 127.0.0.1:456 somewhereelse.com:8080 anotherplace.com Note: At least one server must be specified for this extension to work.

If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback.

SSL

Select to connect via SSL.

Options:

  • Connect without SSL (insecure) (default port #389).
  • Connect via SSL (default port #636) (default setting).

User Paths

Fully-qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree. Note: A value for either Naming Attribute string or at least one value for User Paths must be specified for this extension to work.

If using User Paths, do not use Alternate User ID location.


Primary Logon Methods\LDAP2\Advanced

Advanced (Primary Logon Methods - LDAP version 2 - Advanced)

The Advanced LDAP Primary Logon Methodssettings control special-case options for enabling LDAP version 2 authentication.

Alternate User ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set this location to

empid=%user,ou=people,dc=computer

instead of to

uid=user,ou=people,dc=computer

For Novell eDirectory, Alternate User ID location should be:

uid=%user, path to the object%.

If you use Alternate User ID location, do not use Naming Attribute string or User Paths.

BIND Timeout

The time (in milliseconds) to time out of LDAP BIND call (default depends on the operating system).

Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click the "…" and browse to the image file.

The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

This setting is new as of version 11.1.1.1.0 .

Include in "LDAP" credential sharing group

Share credential changes from the LDAP authenticator to credentials in the LDAP Credential Sharing Group. This setting requires that credential sharing be enabled; see the Sharing Groups setting.

Options:

  • Do not share credential changes from the LDAPauth authenticator to credentials in the Group LDAP.
  • Share credential changes from the LDAPauth authenticator to credentials in the Group LDAP (default).

Naming Attribute string

String to prepend to UserPaths. This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer&n bsp;

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string). If needed, set to cn.

For Novell eDirectory, Alternate User ID location should be: uid=%user,path to the object%

If you use the Naming Attribute string, you must use User Paths and not Alternate User ID location.

Passphrase

Enables the passphrase challenge for additional security. Users must provide a passphrase answer during First Time Use; this is the default setting.

Options:

  • Disable
  • Enable (default)

Share credentials with other Primary Logon Methods

This setting provides a way to eliminate the double authentication that takes place when using authenticators that have the same credentials.

This setting links authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, please see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Share credentials with synchronizers

This setting provides a way to eliminate double authentication when an authenticator and one or more synchronizers use the same credentials.

Enter a comma separated list of synchronizers to share the credentials with, for example ADEXT, LDAPEXT.

To locate other synchronizer names, please see the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Show user path

When set to Yes, the User path field is displayed when the user is prompted to authenticate.

Options:

  • Yes (default)
  • No

This setting is new as of version 11.1.1.1.0 .

SSL Fallback

Fallback to an insecure connection when an SSL connection fails.

Options:

  • Do not connect if the SSL connection fails (default).
  • Connect without SSL (insecure) if the SSL connection fails.

If you select SSLFallback and any of the servers listed in Servers includes a port specification, the fallback port must also be specified as an additional Servers entry.

Example:

If the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as:

  • Server1=mycomputer.com:1272 ;My secure SSL Port
  • Server2=mycomputer.com:389 ;My fallback port

Windows Title Name

Use this setting to customize the Window title name for this authenticator.

This entry is not required.


Primary Logon Methods\Proximity Card

Primary Logon Methods - Proximity Card

The proximity card settings are used for configuring proximity card settings.

Alphanumeric PIN Requirements

The alphanumeric requirements of the user-defined PIN.

Options:

  • Numbers only
  • Letters only
  • Numbers and letters (default)

Card Family

The proximity card family type.

Options:

  • HID ISO/DUO PROX (default)
  • iClass
  • Indala/EM

Maximum PIN Length

The maximum length of the user defined PIN. The default is 8.

Maximum PIN Retries

The number of correct PIN attempts before the authentication fails. The default is 3.

Minimum PIN Length

The minimum length of the user defined PIN. The default is 4.

Reader Name

The name of the proximity card reader to use.

Options:

  • Omnikey CardMan 5125
  • Omnikey CardMan 5121
  • Omnikey CardMan 5321
  • RFIdeas (all readers)

Second Factor Authentication

Whether to use the Active Directory Password or a user defined PIN for the second factor in authentication.

Options:

  • AD Password (default)
  • User Defined PIN


Primary Logon Methods\ROSC\Advanced

Advanced (Primary Logon Methods - Read-Only Smart Card)

The Read-Only Smart Card Primary Logon Methods settings control special-case options for read-only smart card authentication.

Lock ESSO-KM session on removal

Configure whether ESSO-KM will lock a session when the session owner removes the smart card from the smart card reader. By default, this value is set to lock. If set not to lock, the ESSO-KM session will remain open when the smart card is removed. This setting is useful in a scenario where employees must have their smart cards displayed at all times, and therefore cannot leave them in a reader.

Options:

  • 0 Do not lock
  • 1 Lock (Default)

Reg Node: AUI\ROSCauth:LockSMOnRemoval

Passphrase

Allow the Reset passphrase to be used. The passphrase can be supplied either by the user (entering the passphrase in a dialog box) or by the newest non-default encryption certificate on the card itself.

Options:

  • 0 Disable
  • 1 Enable (using a dialog box) (Default)
  • 2 Enable (using the card's certificate)

Reg Node: AUI\ROSCauth:ResetEnable

Reset Certificate Object Identifier

Configure the object identifier that identifies the certificate used for the certificate-based passphrase feature. The authenticator searches the "Enhanced Key Usage" attribute of each certificate on the smart card for this Object Identifier.

The Passphrase option must be set to: "Enable (using the card's certificate)" This entry is not required.

Reg Node: AUI\ROSCAuth:ResetCertOID

Store Synchronization

Configure whether to store the user's synchronization repository credentials using Secure Data Storage.

Secure Data Storage must be enabled and configured.

Options:

  • Do not store credentials (default)
  • Store credentials

Reg Node: AUI\ROSCauth:StoreSyncCreds


Primary Logon Methods\Secure Data Storage

Primary Logon Methods - Secure Data Storage

These settings are used for configuring the secure data storage settings.

Data Storage Location Fully-qualified path to the location in the repository where the data will be stored.
Enable Data Storage

Configures whether to securely store users synchronization credentials within the repository.

Options:

  • Disable (default)
  • Enable


Primary Logon Methods\Smart Card\Advanced

Advanced (Primary Logon Methods - Smart Card)

The Smart Card Primary Logon Methodssettings control special-case options for smart card authentication.

Lock ESSO-KM session on removal

This setting configures whether ESSO-KM will lock a session when the session owner removes the smart card from the smart card reader. By default, this value is set to lock. If set to not lock, the ESSO-KM session will remain open when the smart card is removed. This setting is useful in a scenario where employees must have their smart cards displayed at all times, and therefore cannot leave it in a reader.

Options:

  • Lock (default)
  • Do not lock

Reg Node: AUI\SCauth:LockSMOnRemoval

Passphrase

Enables the passphrase challenge for additional security. The passphrase can be supplied either by the user entering the passphrase in a dialog box (the default setting), or by the newest non-default encryption certificate on the card itself.

The default setting requires users to provide a passphrase answer during First Time Use.

Options:

  • Disable
  • Enable using a dialog box (default)
  • Enable using the card's certificate

Reg Node: AUI\SCauth:ResetEnable

Reset Certificate Object Identifier

Configure the object identifier that identifies the certificate used for the certificate-based passphrase feature. The authenticator searches the "Enhanced Key Usage" attribute of each certificate on the smart card for this Object Identifier.

The Passphrase option must be set to: "Enable (using the card's certificate)." This entry is not required.

Reg Node: AUI\SCAuth:ResetCertOID

Smartcard Library

Configures whether to use the Cryptographic Service Provider (CSP) or the PKCS #11 library to perform cryptographic operations on the Smartcard The default is to use the CSP.

Reg Node: AUI\SCAuth:SmartCardAPI

Store Synchronization Credentials

Configure whether to store the user's synchronization repository credentials on the Smart Card.

Store credentials when using Smart Card authorization in conjunction with ESSO-KM and/or if using the Read-Only Smart Card authenticator.

Performance improves when credentials are not stored on the smart card because the read/write operation adds time to the authentication process.

Options:

  • 0 Disable (default)
  • 1 Enable

Reg Node: AUI\SCauth:StoreSyncCreds

Use the default certificate for authentication

Use the default logon certificate (provided by the administrator) on the card for authentication. If not enabled (the default), use (and create if necessary) the public/private keys in the SSO container on the card.

Options:

  • Use SSO-generated keys (default)
  • Use the default logon certificate

Reg Node: AUI\SCauth:UseCertOnCard

Whether to store the PIN

Whether to store the smart card PIN (and thus the Agent may prompt for the PIN), or to let the smart card drivers deal with requesting the PIN.

Options:

  • Do not store PIN (default)
  • Store PIN

Reg Node: AUI\SCauth:AuthOptions

Windows Subtitle Name

Use this setting to customize the Window subtitle name for this authenticator.

This entry is not required.

Reg Node: AUI\SCAuth:WindowSubTitle

Windows Title Name

Use this setting to customize the Window title name for this authenticator.

This entry is not required.

Reg Node: AUI\SCAuth:WindowTitle


Primary Logon Methods\Windows

Windows (Primary Logon Methods)

The Windows Primary Logon Methodssettings controls standard Windows authentication.

When user's Windows password changes...

Require the user to enter the old Windows password when a new one is in use. This setting is disabled by default.

Options:

  • Do not require the old Windows password (default).
  • Require the old Windows password


Primary Logon Methods\Windows\Advanced

Advanced (Primary Logon Methods - Windows)

Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click the "…" and browse to the image file.

The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

This setting is new as of version 11.1.1.1.0 .

Share credentials with other Primary Logon Methods

This setting provides a way to eliminate the double authentication that takes place when using authenticators that have the same credentials.

This setting links authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Share credentials with synchronizers

This setting provides a way to eliminate double authentication when an authenticator and one or more synchronizers use the same credentials.

Enter a comma separated list of synchronizers to share the credentials with, for example ADEXT, LDAPEXT.

To locate other synchronizer names, see the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Window Subtitle Name

Use this setting to customize the Window subtitle name for this authenticator.

This entry is not required.
Window Title Name

Use this setting to customize the Window title name for this authenticator.

This entry is not required.


Primary Logon Methods\Windows v2

Windows v2 (Primary Logon Methods)

The Windows v2 Primary Logon Methods settings are the primary controls for the Windows Authenticator version 2.

Include in "Domain" Credential Sharing Group

Share credential changes between the MS Windows authenticator and credentials in the Domain credential sharing group. This setting requires that credential sharing be enabled; see the Sharing Groups in Required Password Change settings.

Options:

  • Credential sharing between this authenticator and group Domain is disabled.
  • Credential sharing between this authenticator and group Domain is enabled (default).
Reauthentication dialog

Select which method to use when ESSO-LM requires the end-user to reauthenticate.

Options:

  • Use ESSO-LM dialog: Reauthenticate using the Agent's own dialog; ESSO-LM functionality is suspended until authentication is successful (default).
  • Use GINA: Reauthenticate using Windows GINA authenticator dialog; the workstation is locked until authentication is successful.
Use Windows Data Protection

Set to On to eliminate the requirement for a passphrase while still allowing the user to change his password.

This is only viable in DPAPI-capable (such as full AD) infrastructures.


Primary Logon Methods\Windows v2\Advanced

Advanced (Primary Logon Methods - Windows version 2 )

The Advanced Windows v2 Primary Logon Methods settings control special-case options for the Windows Authenticator version 2.

Custom image for authentication prompt

Enter the fully-qualified path, including the file name, to the image, or click the "…" and browse to the image file.

The dimensions set for this image are 300 pixels wide by 100 pixels tall. You cannot change these dimensions. If the image is smaller it will be centered in this area; if it is larger, it will be cropped equally on all sides.

This setting is new as of version 11.1.1.1.0 .

Passphrase

Enables the passphrase challenge for additional security. Users must provide a passphrase answer during First Time Use; this is the default setting.

Options:

  • Disable
  • Enable (default)
Passphrase: Checkbox Message

Use this setting to customize the user agreement style dialog checkbox.

This checkbox must be checked before the dialog can be dismissed. The OK button is disabled until this checkbox is checked.

(Default: I have read and understand the provisions listed above.)
Passphrase: Message

Use this setting to display a user agreement style dialog box where users must check a checkbox to continue. This is typically used to suggest the importance of the passphrase that they enter.

This message might contain multiple lines, 180 character maximum. The character sequence "\n" will be replaced with carriage return and new line characters. If this setting is not set, the dialog box is skipped.
Passphrase: Message Dialog Title | Use this setting to customize the user agreement style dialog title.
Passphrase: Minimum Length | Default required length of a passphrase. This setting can be overridden by setting the required length for a specific question. Default is 8.
Passphrase: Reset with old password

Enabling this setting adds the ability to allow a user to re-use a previous password as their passphrase in Windows Auth v2.

Options:

  • Disable (default)
  • Enable (allows the previous password to be used in the passphrase process)
Passphrase: User can change passphrase

Enabling this setting adds the ability to allow a user to change the answer to a verification question in Windows Auth v2.

Options:

  • Yes (default)
  • No
Share credentials with other Primary Logon Methods

This setting provides a way to eliminate the double authentication that takes place when using authenticators that have the same credentials.

This setting links authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, please see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).

Share credentials with synchronizers

This setting provides a way to eliminate double authentication when an authenticator and one or more synchronizers use the same credentials.

Enter a comma separated list of synchronizers to share the credentials with, for example ADEXT, LDAPEXT.

To locate other synchronizer names, please see the name listed in the registry for that synchronizer (located under HKLM\Software\Passlogix\Extensions\SyncManager).
Skip reset re-enrollment when using old password to reset

Determines whether the ESSO-LM passphrase prompt can be skipped by users. Enabling this feature ensures that after a user enters their previous Windows password, ESSO-LM will not prompt them to enter a new passphrase. By default, this is disabled.

Enabling this feature runs the risk of a complete lockout to ESSO-LM. This can happen if a user no longer remembers their passphrase, and subsequently forgets their Windows password. In this scenario, a user would be completely locked out of ESSO-LM.

Options:

  • Disable (default)
  • Enable
Window SubTitle Name

Use this setting to customize the Window subtitle name for this authenticator.

This entry is not required.
Window Title Name

Use this setting to customize the Window title name for this authenticator.

This entry is not required.


Reporting

The Reporting tool allows you to generate reports on user activities. Refer to the ESSO-LM Reporting documentation for complete information on using this tool.

Batch Size | Defines the group size of events to be sent to the database Stored Procedure at one time. Default is 100. For example, if you have 1000 events in the Reporting Service cache and the Batch Size = 100, you will have 10 database Stored Procedure calls.
Cache Limit | Number of reporting events to be cached. Once this number is reached, the oldest events are discarded. Default is 1000. For example, if the batch size is 100, and an end users system cannot connect to the reporting service, it will keep logging events. Once it gets to 1000, the oldest events will be discarded.
Retry Interval | Defines timeout in minutes between sequential operations of the Reporting Service Cache offloading events to the database. Default is 30. An interval is necessary to reduce database connection load.


Reporting Database

Configure settings for the Reporting database on this tab.

Connection String | Database connection string in the OLE DB format: "Provider=sqloledb; Data Source=myServerName; Initial Catalog=myDatabaseName; User Id=myUsername; Password=myPassword".
Extension Location | Path\filename of the Reporting Database Extension that points to the ReportingDBExt.dll .
Stored Procedure | The name of the stored procedure in the database. When encoded events are sent to the database, the stored procedure is called to decode the XML file and store the events in the database.


Security\Common

Common (Security)

The Common Security setting controls the frequency by which end users must re-enter their primary logon passwords.

Reauthentication timer

Time between reauthentication requests (in milliseconds).

If set to 4,294,967,295 (0xFFFFFFFF), the time will never expire and the user will never need to reauthenticate, except in forced authentication scenarios.

Default value for client-side installation is 900000 (15 minutes)

Default value for client-side installation is 900000 (15 minutes).

Default value n a Terminal Services environment is 4,294,967,295 (disabled).


Security\Advanced

Advanced (Security)

The Advanced Security settings control end-users' access to view their application logon passwords and the preferred encryption provider and strength.

Allow user to reveal masked fields

Allow user to reveal passwords in Wizards and on property pages.

Options:

  • Allow (default)
  • Do not allow
Default encryption algorithm

Select an encryption algorithm and strength:

Options:

  • Cobra 128-bit
  • Cobra 128-bit (also)
  • Blowfish 448-bit
  • Triple-DES 168-bit
  • AES 256-bit
  • Triple-DES (MS CAPI) (All OSs) (default)
  • Triple-DES (MS CAPI) (XP/2003 only)
  • RC-4 (MS CAPI) (All OSs)
  • RC-4 (MS CAPI) (XP/2003 only)
  • AES (MS CAPI) (XP/2003 only)

Setting PreferredCSP with an option that is supported only on Windows XP/2003 disables a ESSO-LM Agent running on another operating system.
Obfuscate length of masked fields

Specifies whether to display encrypted fields with a string of blank characters different from the length of the obfuscated data.

Options:

  • Yes. Hides length of masked fields. (default)
  • No. Displays the actual length of masked fields.

This setting has changed as of version 11.1.1.1.0 .

Require reauthentication before updating account credentials

When enabled, forces the user to provide ESSO-LM credentials before updating any stored application credentials, even if the reauthentication timer has not yet expired.

This setting is new as of version 11.1.1.1.0 .

Require reauthentication to reveal masked fields

Require reauthentication if the user selects Reveal or Reveal All in Logon Manager and in dialogs.

Options:

  • Do not require reauthentication
  • Require reauthentication (default)


Session Overview

Oracle Enterprise Single Sign-on Kiosk Manager

The Kiosk Manager settings let you control the operation of the ESSO-KM.

Allow administrator to close ESSO-KM

*This setting is new as of version 10.1.4.1.0 .

This setting determines whether an administrator has the ability to close ESSO-KM on a kiosk.

If enabled, the administrator is then prompted to enter their credentials. Only an administrator’s credentials will succeed in closing the agent.

Options:

  • No
  • Yes (default)
Close suspended session after how many seconds

Enter the amount of time (in seconds) of inactivity after which ESSO-KM should close a session. Default is 600.
Close sync/auth dialog after how many seconds

Enter the amount of time (in seconds) of inactivity after which ESSO-KM should close a sync dialog or authentication dialog. Default is 600.
Desktop Status Window

*This setting is new as of version 10.1.4.1.0 .

This status window displays during a ESSO-KM session. It displays the current session owner's name and contains a Lock Session button which conveniently allows users to lock a session with one click from the desktop.

Options:

  • Hidden (default)
  • Display
Event Log Machine Name

Enter the name of the local machine where ESSO-KM events should be logged.

Event Log Name

Enter the name of the Windows event log where ESSO-KM events should be logged.

Lock session on screen saver timeout

This setting determines whether ESSO-KM should lock a session when the screen saver timeout occurs.

Options:

  • No (default)
  • Yes

If this value is set to Yes or does not exist (default value), ESSO-KM will lock the session after the screen saver timeout occurs.

If this value is set to No, ESSO-KM will not lock the session if device detection is used to control the session.
Maximum number of sessions

Specifies the maximum number of sessions allowed at one time.

A setting of zero will be interpreted as one session.

There is no maximum number for this setting.
Number of times to process termination

Enter the number of times that ESSO-KM should process the termination of an application. This setting instructs the termination process to loop a certain number of times (or until it is done), which ever comes first. This allows ESSO-KM to react to an application if it displays multiple screens during the termination process. Default is 1.

Prepopulate at
Startup

Specifies whether to run a prepopulate step at startup. If an authenticator requires this step and ESSO-AM is not installed, this setting enables ESSO-KM to perform the required prepopulation, eliminating the need for the sync manager to reauthenticate.

Select either to run pre-populate when starting a session, a device-in event is received and ESSO-AM is installed; always run prepopulate when starting a session; or never run prepopulate. Default is to run prepopulate when a device-in event is received and ESSO-AM is installed.
Restart computer

This setting determines whether the restart computer option is enabled in the ESSO-KM Desktop Manager. You can also choose to have only an administrator have privileges to restart the computer by selecting Administrator must supply password.

Even if this setting is enabled, the option may still be disabled if the Kiosk account does not have sufficient privileges.

Options:

  • Disable (default)
  • Enable
  • Administrator must supply password
Shutdown computer

This setting determines whether the shutdown computer option is enabled in the ESSO-KM Desktop Manager. You can also choose to have only an administrator have privileges to shut down the computer by selecting Administrator must supply password.

Even if this setting is enabled, the option may still be disabled if the Kiosk account does not have sufficient privileges.

Options:

  • Disable (default)
  • Enable
  • Administrator must supply password
Status Window X coordinate

*This setting is new as of version 10.1.4.1.0 .

The X coordinate for the status window. This is the horizontal location of the status window on the desktop.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.

Status Window Y coordinate

*This setting is new as of version 10.1.4.1.0.

The Y coordinate for the status window. This is the vertical location of the status window on the desktop.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.
Track Memory Consumption

*This setting is new as of version 10.1.4.1.0 .

This setting determines the level of memory usage at which ESSO-KM should automatically close sessions. When system memory use has reached the percentage as set by this value, ESSO-KMautomatically closes the oldest user sessions.

Minimum = 0 (disabled)

Maximum = 100

Default is 90.
Transparent Display After Cancel

*This setting is new as of version 10.1.4.1.0 .

This setting determines whether the display after cancel feature should be enabled.

If disabled, ESSO-KM will revert to the inactivity timer to determine when to display the desktop.

If enabled, when an authentication or synchronization dialog is canceled, the desktop will be viewable instantly.

The Transparent Lock setting below must be turned on in order for this feature to work.

Options:

  • Disable (default)
  • Enable
Transparent Lock

*This setting is new as of version 10.1.4.1.0 .

This setting determines whether the transparent screen lock feature should be enabled. Transparent screen lock provides the ability to lock the desktop inputs (keyboard and mouse) in view mode, so for example, a monitoring application can be viewed without starting a session.

Locks keyboard and mouse input

When there are multiple sessions running, the last active session is displayed when transparent screen lock engages.

Options:

  • Disabled (default)
  • Show desktop with active session. Transparent screen lock will be enabled as long as there is an active session running.
  • Show desktop. If this option is chosen, the transparent screen lock will be enabled with or without an active session.

If the setting is set to 'Show desktop with active session', the transparent screen lock will only be enabled if there is an active session.
Transparent Lock Time

*This setting is new as of version 10.1.4.1.0 .

This setting determines the number of seconds to wait for mouse and keyboard inactivity before showing the desktop (default=5).

The Transparent Lock setting above must be turned on in order for this feature to work.
Transparent Only Recognize Ctrl-Alt-Delete

*This setting is new as of version 10.1.4.1.0 .

This setting determines whether clicking Ctrl+Alt+Delete be the only method to turn off the transparent screen lock and display the Desktop Manager.

If disabled, any keyboard or mouse activity results in displaying the Desktop Manager.

If enabled, all keyboard and mouse activity will be ignored. Only Ctrl-Alt-Del and authenticators that support "device-in" will be recognized to display the Desktop Manager.

Options:

  • Disable (default)
  • Enable


Cached Credentials

Cached Credentials (Oracle Enterprise Single Sign-on Kiosk Manager)

The Cached Credentials settings lets you control how the ESSO-KM stores and uses credentials it stores.

Expiration Date | This setting determines the number of days for which cached credentials should be kept. Zero indicates that this feature is disabled. Default is 30.
Storage Path | The default folder to store the cached credentials. Default is an empty string. If this value is empty, the default folder will be C:\Documents and Settings\Kiosk User\Local Settings\Passlogix\CachedCredentials\ESSO-KM User.
Use cached credentials | This setting determines whether cached credentials should be used. If enabled, users logging into ESSO-KM are presented with a list of cached users to choose from. If disabled, the list is not displayed and users enter their user name into the text entry user field. The default is to enable cached credentials. This improves ESSO-KM performance.


Advanced Session Settings

Advanced (Oracle Enterprise Single Sign-on Kiosk Manager)

The Oracle Enterprise Single Sign-on Kiosk Manager advanced settings let you control the confirmation messages presented by ESSO-KM.

Show confirmation message when restarting kiosk | This setting determines whether a user should be prompted with a confirmation message after choosing to restart the kiosk.
Show confirmation message when shutting down kiosk | This setting determines whether a user should be prompted with a confirmation message after choosing to shut down the kiosk.


Background Image

Background Image (Oracle Enterprise Single Sign-on Kiosk Manager \ Desktop)

Use this panel to upload a background image on the ESSO-KM Desktop Manager.

Image height (in pixels) | The height of the image (in pixles). Default is 300.
Image Placement

The placement of the logo image.

Options:

  • Normal. Image is placed in upper left corner of coordinates and clipped if larger than specified height and width.
  • Autosize. Image is placed in upper left corner of coordinates.
  • Center. Image is centered within coordinates and clipped if larger than specified height and width.
  • Stretch. Image is stretched or shrunk to fit within specified coordinates.
  • Maximize. Image is stretched to full screen size.
Image width (in pixels) | The width of the image (in pixles). Default is 300.
Image X coordinate (in pixels)

The X coordinate for the image.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.
Image Y coordinate (in pixels)

The Y coordinate for the image.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.
Location of the image file | Full- qualified path and filename to the image file. Click the ... button to locate the file.


Text Message

Text Message (Oracle Enterprise Single Sign-on Kiosk Manager \ Desktop)

Use this panel to upload a message around the ESSO-KM Desktop Manager, for example, a HIPAA compliance reminder. This message will be displayed when the Desktop Manager is active.

Some relevant sizes:

Desktop Manager Logon Window Size

Width = 476 Pixels

Height = 404 Pixels

Desktop Manager Logon Window Origin

XOrigin = (ScreenWidth – 476)/2

YOrigin = (ScreenHeight – 404)/2

Desktop Manager Logon Window Extent (Lower right corner)

XExtent= XOrigin+476-1

YExtent= YOrigin+404-1

Example on an 800x600 display:

Desktop Manager Logon Window is:

Width: 476 Pixels x Height: 404 Pixels.

On an 800x600 display, this appears at coordinates 161, 97.

Refer to the ESSO-KM Administration Guide for more information.
Text Message | Message text to provide on the ESSO-KM Desktop Manager. This message will be displayed when the Desktop Manager is active.
Text Message Autosize

*This setting is new as of version 10.1.4.1.0 .

Select whether the text message should be auto-sized. This setting automatically sets the size of the control based on the size of the message.

Options:

  • Yes
  • No

Text Message Color Background

*This setting is new as of version 10.1.4.1.0 .

Click the ellipses ... button to select the background color for the text message.
Text Message Color Foreground

*This setting is new as of version 10.1.4.1.0.

Click the ellipses ... button to select the foreground color for the text message.
Text Message Font Name

*This setting is new as of version 10.1.4.1.0.

The font that the text message will display in. Select a font from the drop-down list.

Text Message Font Size

*This setting is new as of version 10.1.4.1.0.

The font size the text message will display in.

Text Message Font Style

*This setting is new as of version 10.1.4.1.0.

The font style the text message will display in.

Options:

  • Regular
  • Bold
  • Italic
Text Message height (in pixels) | The height of the message of the day (in pixels). Default is 300.
Text Message width (in pixels) | The width of the message of the day (in pixels). Default is 300.
Text Message X coordinate (in pixels)

The X coordinate for the text message.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.
Text Message Y coordinate (in pixels)

The Y coordinate for the text message.

Negative values are represented by large positive numbers in the registry. For example: -1 = 4294967295 and -2 = 4294967294.


Agent Synchronization Settings

The Synchronization settings are the general options for credential synchronization for all synchronizer extensions. Use these settings to control the following functions and features:

Performance Options
  • Sync Order
  • Aggressive Synchronization
  • Optimized Synchronization
  • Interval for automatic re-sync
  • Re-sync when network or connection status changes
  • Wait for synchronization at startup
  • Roaming Profile Syncronization Support
User Mobility Options
  • Delete local cache
  • Deleted-credential cleanup
  • Disconnected operation
Security and Management Options
  • Enable role/group security support
Aggressive Synchronization

Determines whether to allow aggressive synchronization, in which the Agent performs synchronization whenever a user performs any action that requires the most current credentials or settings available (for example, when an application requests credentials).

Aggressive Synchronizationhas a significant impact on the performance of both the client and server computers.

Options:

  • Do not allow Aggressive Sync (default).
  • Allow Aggressive Sync.
Delete local cache

Delete the user's data folder and registry keys upon shutdown of the Agent.

Options:

  • Do not delete the user's data (default).
  • Delete the user's data.
Deleted-credential cleanup | Days before a credential is actually deleted after being marked for deletion (Default is 30 days).
Disconnected Operation

Determines whether ESSO-LM executes first-time-use setup when it is unable to connect to any synchronizer extension and no local cache is present. This check occurs when run with the /background parameter (for example, at startup).

Options:

  • Do not continue running.
  • Allow disconnected operation (default).
Enable role/group security support

Enables role/group support for application logons, password policies, global agent settings, and passphrase question sets.

Options:

  • Do not use role/group security (default)
  • Use role group security.
Interval for automatic re-sync | Interval (in minutes) between automatic re-synchronization. This interval applies whether or not a user-generated sync event occurs. A value of 0 (the default) disables this setting.
Optimized Synchronization

Enables ESSO-LM to use an optimized method (using a checksum routine) to detect changed credentials or settings, rather than by retrieving the credentials and settings themselves.

Options:

  • Disable optimized synchronization (retrieve credentials and settings to detect changes)
  • Enable optimized synchronization (use a checksum routine to detect changes; default)
Re-sync when network or connection status changes

Enables or disables monitoring for changes in the network connection status. When enabled, the Agent performs re-synchronization when a status change occurs (for example, re-connecting to the network).

Options:

  • Ignore network status changes
  • Watch for and re-sync on network status changes (default)
Sync Order

Sets the order of synchronization extensions to use. If no value is specified then all extensions will be used (in an unpredictable order).

Examples:

LDAPExt,ADExt FileSync Remote,AD,FileSync Local,SmartCard MySmartCard,ADExt,ADExtRemote
Wait for synchronization at startup

Determines whether to wait for synchronization at startup, which ensures that the user's data is current.

There is a minor performance impact on the client workstation.

Options:

  • Wait for sync
  • Do not wait for sync (default)


Synchronization\AD\Required

Required (Synchronization - Active Directory)

You must specify the Required Active Directory Synchronization settings for all Active Directory synchronizer extensions.

Extension location

Path\filename of the Active Directory synchronizer extension.

(Default: C:\Program Files\Passlogix\Plugin\SyncMgr\ADEXT\adsync)
SSL

Connect via SSL.

Options:

  • Connect without SSL (insecure), default to port #389 (default).
  • Connect via SSL, default to port #636.


Synchronization\AD\Advanced

Advanced (Synchronization - Active Directory)

The Advanced Active Directory Synchronization settings control special-case options for all Active Directory synchronizer extensions.

Change Password Window Subtitle Name

Use this setting to customize the Active Directory Change Password Window subtitle name for this synchronizer.

This entry is not required

Change Password Window Title Name

Use this setting to customize the Active Directory Change Password Window title name for this synchronizer.

This entry is not required.

Configuration Objects Base Locations

Specify where to begin the search for role/group-enabled configuration objects. The search is from the specified location(s) downward. If no entries, the search is from the base location.

Credentials to use

Which credentials to use when authenticating to the Active Directory Server.

Options:

  • Use local computer credentials only
  • Use Active Directory server account only (recommended that User Paths be set)
  • Try local computer credentials; if it fails, use Active Directory server account (default).

Descriptive name

Logon dialog box title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required

Location for storing user credentials

Enables storage of user-credential containers under their respective directory User objects when no locator object is used. When disabled (the default), credentials are stored as specified by the locator object.

This setting requires updating the directory schema and modifying the directory-root security settings. To do this, use the Enable Storing Credentials under User Object command on the Repository menu.

Options:

  • Store user credentials as specified by locator object (default)
  • Store user credentials under respective directory user objects

Logon attempts

Number of times to present the retry dialog to the user (Default is 3).

Prepend Domain when naming objects

Enable/disable prepending of the user's domain to the username in naming the user's container. Example: For the domain company and user jamesk, the container is named jamesk with this flag disabled and company.jamesk with this flag enabled.

If you enable Prepend Domain, do not enable Enable Storing Credentials under User Object (in the Repository menu). If you do enable credential storage in User Objects, this option must be disabled (the default setting). If both options are enabled, no synchronization will occur.

Prompt when disconnected

Allow the user to work offline without prompting/notification if a synchronization event fails.

Options:

  • Prompt/notify the user (default).
  • Do not prompt.

Search for locator and override objects

Controls how the Agent searches for locator and override objects.

Options:

  • Search all servers for locator/override.
  • Limit locator/override search to the server root (default).

Servers

Specify the servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Type one server name on each line; end each line by pressing Enter. Do not use any other delimiter characters.

Valid formats are determined by your network's DNS configuration

computername]port[:

or

[]port][:tld[domainname.]host.

Examples:

sales

sales:389

ourdomain.net

sales.ourdomain.net

sales.ourdomain.net:389

If no Servers are entered for the Active Directory extension, and the user account is in an Active Directory domain, ESSO-LM uses AD domain resources to discover the server. If one or more Servers are provided, ESSO-LM uses the Servers list to locate the server.

Unless otherwise configured, ESSO-LM queries the domain name server (DNS) for the name of the preferred domain controller assigned to the local subnet.

In Active Directory networks with multiple servers, be sure to enable replication in order to include the SSO schema extension and related objects This assures that ESSO-LM will always find SSO information on every server it connects with.Active Directory requires use of computer names (not IP addresses).

If specifying a port value, see SSLFallback.

Share credentials with other Primary Logon Methods

This setting provides a way to eliminate the double authentication that takes place when using synchronizers and authenticators that have the same credentials.

This setting links synchronizer and authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.

To locate other authenticator names, please see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).

User Paths

Fully qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree. Note: This entry is not required for this extension.

When SSL fails

Fallback to an insecure connection when an SSL connection fails.

If SSLFallback=1 and any of Servers includes a port specification, you must specify the fallback port as an additional Servers entry. For example, if the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, for example: mycomputer.com:1272 ;My secure SSL Port

mycomputer.com:389 ;My fallback port.

Options:

  • Do not connect if the SSL connection fails.
  • Connect without SSL (insecure) if the SSL connection fails.


Synchronization\ADAM\Required

Required (Synchronization - ADAM)

You must specify the Required ADAM Synchronization settings for all ADAM synchronizer extensions.

Extension location

Path\filename of the Active Directory synchronizer extension.

(default: C:\Program Files\Passlogix\v-GO SSO
\Plugin\SyncMgr\ADAMext\ADAMsyncExt.dll)

Servers

Specify the servers (and ports) and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Type one server name on each line; end each line by pressing Enter. Do not use any other delimiter characters.

Valid formats are determined by your network's DNS configuration. Use the port parameter to specify a particular instance of ADAM on a target server.

computername]port[:

or

[]port][:tld[domainname.]host.

Examples:

sales
sales:389
ourdomain.net
sales.ourdomain.net
sales.ourdomain.net:389

At least one server must be specified for the extension to work.

ADAM requires use of computer names (not IP addresses).


Synchronization\ADAM\Advanced

Advanced (Synchronization - ADAM)

The Advanced ADAM Synchronization settings control special-case options for all ADAM synchronizer extensions.

Change Password Window SubTitle Name

Use this setting to customize the ADAM Change Password Window subtitle name for this synchronizer.

This entry is not required
Change Password Window Title Name

Use this setting to customize the ADAM Change Password Window title name for this synchronizer.

This entry is not required
Configuration Objects Base Locations Specify where to begin the search for role/group-enabled configuration objects. The search is from the specified location(s) downward. If no entries, the search is from the base location.
Credentials to use

Which credentials to use when authenticating to the ADAM server.

Options:

  • Connect to ADAM with current user name
  • Use ADAM server account only
  • Try local computer credentials; if it fails, use ADAM server account (default)
Descriptive Name

Logon dialog box title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required
Prepend Domain when naming objects

Enables prepending of the user's domain to the username in naming the user's container. Example: For the domain company and user jamesk, the container is named jamesk with this flag disabled and company.jamesk with this flag enabled.

Options:

  • Disable (default)
  • Enable
Prompt when disconnected

Allow the user to work offline without prompting/notification if a synchronization event fails.

Options:

  • Prompt/notify the user (default).
  • Do not prompt.
Share credentials with Primary Logon Methods

This setting provides a way to eliminate the double authentication that takes place when using synchronizers and authenticators that have the same credentials.

This setting links synchronizer and authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example WinAuth, MSAuth.
User domain name to use

Domain name to use in the container name (e.g., "DomainName.UserName") when Prepend Domain when naming objects is enabled. The user can specify another domain the in the logon dialog.

Example:

If User domain is "MyDomain" (with Prepend Domain enabled) and the user logs on as jamesk, the container name used is MyDomain.jamesk If the user logs on as AltDomain\jamesk the container name used is AltDomain.jamesk.


Synchronization\DB\Required

Required (Synchronization - Database)

The Required Database Synchronization settings must be set for all database synchronizer extensions.

Extension location

Path\filename of the database synchronizer extension.

(Default: C:\Program Files\Passlogix\v -GO SSO

 \Plugin\SyncMgr\DBEXT\DBExt.dll)
Servers

Specify the database servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Enter the full connection address (computerName.dbServerName) for one database server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

You must specify at least one server for the extension to work.

For Oracle:

  • To connect to an Oracle database, use the following connection string:
  • Provider=OraOLEDB.Oracle;Data Source=%MachineName%;Extended Properties='OSAuthent=1' where the "Data Source" value will be different for each configuration.
  • To connect to the Oracle database, the Oracle 10g client must be installed on the same machine as the Administrative Console.

For SQL Server:

To connect to a SQL Server that is hosting multiple instances, use the following connection string (with no manual line break):

Provider=SQLOLEDB; Data Source="ServerName\Instance"; Initial Catalog="DatabaseName";

Trusted_Connection=Yes


Synchronization\DB\Advanced

Advanced (Synchronization - DBEXT/ORA)

The Advanced Database/Oracle Synchronization settings control special-case options for all database/Oracle synchronizer extensions.

Append Domain when naming objects

Enables appending of the user's domain to the username in naming the user's container. Example: For the domain company and user jamesk, the container is named jamesk with this flag disabled and jamesk.company with this flag enabled. (default: 0)

Options:

  • Disable
  • Enable


Required

Required(Synchronization - File System)

You must specify the Required File System Synchronization settings for all file system synchronizer extensions.

Extension location

Path\filename of the File System synchronizer extension.

(Default: C:\Program Files \Passlogix\v-GO SSO
\Plugin\SyncMgr\FileSyncExt\filesync.dll )

Server

This is a list of UNC paths to try for synchronization. You must specify at least one server for this extension to work.

Examples:

\\FS1\Users
\FS2\Extras
D:\Backup

The File System extension requires use of proper UNC paths.

As of ESSO-LM4.0, only one path is supported.


Advanced

Advanced (Synchronization - File System)

The Advanced File System Synchronization settings control special-case options for all file-system synchronizer extensions.

Descriptive name

Logon dialog title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.
Logon attempts Number of times to present the Retry dialog box to the user (Default is 3).
Prepend Domain when naming user folders

Enable/disable prepending of the user's domain to the username in naming the user's container. Example: For the domain company and user jamesk, the container is named jamesk with this flag disabled and Oracle.jamesk with this flag enabled.

Prompt when disconnected

Allow the user to work offline without prompt or notification if a synchronization event fails.

Options:

  • Prompt/notify the user (default).
  • Do not prompt.


Synchronization\IBM\Required

Required (Synchronization - IBM)

You must specify the Required IBM Synchronization settings for all IBM synchronizer extensions.

Directory Type

The specific type of directory server. If the directory server is not listed, select Unspecified LDAP Directory (the default) for backwards-compatibility in upgrade scenarios; otherwise select Generic LDAP Directory.

Options:

  • Unspecified LDAP Directory (LDAP default)
  • Novell eDirectory
  • Generic LDAP Directory
  • Sun Java System Directory
  • IBM Tivoli Directory Server (IBM default)
  • Oracle Directory Server
Extension location

Path\filename of the LDAP Directory Server synchronizer extension.

(Default path: C:\Program Files\Passlogix\v-GO SSO \
\Plugin\SyncMgr\LDAPEXT\ldapsync.dll)
Servers

Specify the servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Enter one server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

The format is

computer],port[:

where

computer is the server name or IP, and

port is assumed to be default (636 for SSL, 389 for no SSL) if not specified.

Example:

127.0.0.1
127.0.0.1:456
somewhereelse.com:8080
anotherplace.com

You must specify at least one server for the extension to work.

If you specify a port, see SSLFallback.
SSL

Select to connect via SSL.

Options:

  • Connect without SSL (insecure; default port #389) (default setting).
  • Connect via SSL (default port #636) .
User Paths

Fully qualified path where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree.

You must specify a value for either Naming Attribute string or at least one value for User Paths for this extension to work.

If using User Paths, do not use Alternate User ID location.


Synchronization\IBM\Advanced

Advanced (Synchronization - IBM)

The Advanced LDAP/IBM Synchronization settings control special-case options for all IBM synchronizer extensions.

Alternate User ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set this location to:

empid=%user,ou=people,dc=computer

instead of to

uid=user,ou=people,dc=computer

For Novell eDirectory, Alternate User ID location should be:

uid=%user,path to the object%.

If you use Alternate User ID location, do not use Naming Attribute string or User Paths.
BIND Timeout

The time (in milliseconds) to time out of LDAP BIND call (default depends on the operating system).

Configuration Objects Base Locations

Where to begin the search for role/group-enabled configuration objects. The search is from the specified location(s) downward. If there are no entries for this setting, the search is from the base location.

Descriptive name

Logon dialog title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.
DSAME disabled-account support

Recognize disabled accounts on Sun Java System Directory Server, formerly known as iPlanet Directory Server Access Management Edition (DSAME).

Options:

  • The server is not a Sun Java System Directory Server (default).
  • The server is a Sun Java System Directory Server.
Logon attempts

Number of times to present the retry dialog to the user (default: 3).

Naming Attribute string

String to prepend to User Paths. This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer&n bsp;

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string). If needed, set to cn.

This value usually needs to be set to cn for Novell eDirectory.

If you use Naming Attribute string, you must use User Paths and not use Alternate User ID location.
Prompt when disconnected

Allow the user to work offline without prompting/notification if a synchronization event fails.

Options:

  • Prompt/notify the user (default).
  • Do not prompt
When SSL fails

Fallback to an insecure connection when an SSL connection fails.

Options:

  • Do not connect if the SSL connection fails (default).
  • Connect without SSL (insecure) if the SSL connection fails.

If you select SSLFallback and any of the servers listed in Servers includes a port specification, the fallback port must also be specified as an additional Servers entry.

Example:

If the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as:

Server1=mycomputer.com:1272 ;My secure SSL Port

Server2=mycomputer.com:389 ;My fallback port


Synchronization\LDAP\Required

Required (Synchronization - LDAP)

The Required LDAP/IBM Synchronization settings must be set for all LDAP synchronizer extensions.

Directory Type

The specific type of directory server. If the directory server is not listed, select Unspecified LDAP Directory (the default) for backwards compatibility in upgrade scenarios; otherwise select Generic LDAP Directory.

Options:

  • Unspecified LDAP Directory (LDAP default)
  • Novell eDirectory
  • Generic LDAP Directory
  • Sun Java System Directory
  • IBM Tivoli Directory Server (IBM default)
  • Oracle Directory Server
Extension location

Path\filename of the LDAP/IBM Directory Server synchronizer extension.

(Default path: C:\Program Files \Passlogix\v-GO SSO \
\Plugin\SyncMgr\LDAPEXT\ldapsync.dll )
Servers

Specify the servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Enter one server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

The format is

computer],port[:

where

computer is the server name or IP, and

port is assumed to be default (636 for SSL, 389 for no SSL) if not specified.

Example:

127.0.0.1
127.0.0.1:456
somewhereelse.com:8080
anotherplace.com

You must specify at least one server for the extension to work.

If you specify a port, see SSLFallback.
SSL

Select to connect via SSL.

Options:

  • Connect without SSL (insecure; default port #389) (default setting).
  • Connect via SSL (default port #636) .
User Paths

Fully qualified path of where the user account is located when LDAP Directory Search is not enabled. There can be unlimited paths to search. The extension searches these in order, looking for the user account. When using LDAP Directory Search, if the user account is not found in the given userpath the extension will search down the directory tree from that path.

You must specify a value for either Naming Attribute string or at least one value for User Paths for this extension to work.

If using User Paths, do not use Alternate User ID location.


Synchronization\LDAP\Advanced

Advanced (Synchronization - LDAP)

The Advanced LDAP/IBM Synchronization settings control special-case options for all LDAP synchronizer extensions.

You can bind to a directory before or after searching for a specific user account. If you choose to search for a user account before binding, ESSO-LM begins searching at the user path you specify and continues down the tree until it locates the user account and binds to that directory, or it exhausts all paths. If ESSO-LM does not find the user account you specify, the user receives a message that the system has been configured incorrectly and to contact the administrator.

Typically, ESSO-LM uses anonymous binding for LDAP directories, but it also allows you to create a "browse-only" account to search for a user in scenarios where anonymous binding is disabled. In such cases, the account name is not the user's name and therefore is not readily identifiable (for instance, an employee ID or social security number). The browse-only account facilitates user searches when the alternate user ID option is enabled, identifying the user who belongs to the alternate user ID. Use the Alternate User ID location, BIND User Name, and BIND User Password settings to configure the browse-only account.

Admin Group DN | Distinguished Name for the Administrative group. This value is placed in the ACI. For example: cn=configuration administrators,ou=groups,ou=topologymanagement,o=netscaperoot
Alternate User ID location

Indicates where to locate a user object when the user validates against an attribute other than the username.

Example:

If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set this location to:

empid=%user,ou=people,dc=computer

instead of to

uid=user,ou=people,dc=computer

For Novell eDirectory, the Alternate User ID location should be:
uid=%user,path to the object%

If you use the Naming Attribute string, you must use User Paths and not Alternate User ID location.
BIND Timeout | The time (in milliseconds) to time out of the LDAP BIND call (default depends on the operating system).
BIND User DN

Specifies LDAP "browse only" account user DN. This must be in the format "uid=%username%,ou=people,dc=%CompanyName%" (for example, uid=jsmith,ou=people,dc=yourcompany,dc=com.)

LDAP Directory Search functionality requires anonymous binding to be enabled on the directory. If anonymous binding is not enabled you must use this account to perform the directory search. The search is performed whether using "User Paths" or the "Alternate User ID location."
BIND User Password

Specifies LDAP "browse only" account user password.

LDAP Directory Search functionality requires anonymous binding to be enabled on the directory. If anonymous binding is not enabled you must use this account to perform the directory search. The search is performed whether using "User Paths" or the "Alternate User ID location."
Configuration Objects Base Locations

Where to begin the search for role- or group-enabled configuration objects. The search starts at the specified locations and proceeds downward through the tree. If there are no entries for this setting, the search takes place in the base location.

Descriptive name

Logon dialog title, to help differentiate between multiple synchronizer extensions having the same name.

This entry is not required.
DSAME disabled-account support

Recognize disabled accounts on Sun Java System Directory Server, formerly known as iPlanet Directory Server Access Management Edition (DSAME).

Options:

  • The server is not a Sun Java System Directory Server (default).
  • The server is a Sun Java System Directory Server.
Enable Directory Search for users | Enables or disables directory search for the user account. When the user account is not found in the given path, the extension will search for it from that location down the directory tree. The search is performed whether using "User Paths" or the "Alternate User ID location."
Logon attempts

Number of times to present the sync dialog to the user. The default value is 3, meaning the sync dialog will be displayed a maximum of 3 times if incorrect credentials are submitted.

Naming Attribute string

String to prepend to User Paths. This is required when the domain name for a user is in the form:

cn=%UserName%,ou=people,dc=computer&n bsp;

instead of the form:

namingattribute=%UserName%,ou=people,dc=computer

(where namingattribute can be any string). If needed, set to cn.

This value usually needs to be set to cn for Novell eDirectory.

If you use Naming Attribute string, you must use User Paths and not use Alternate User ID location.
Prompt when disconnected

Allow the user to work offline without prompting or notification if a synchronization event fails.

Options:

  • Prompt/notify the user (default).
  • Do not prompt
Security Version

This setting in used in conjunction with the Admin Group DN setting to allow the update of the security rights on the people container used by ESSO-LM to store LDAP user credentials for deployed environments.

To do this:

  1. Provide the new Admin Group DN to be used for the new security. This is the Distinguished Name of the security group.
  2. Set the Security Version to one higher than its current value.
  3. Deploy the settings.

The next time ESSO-LM performs a sync, it updates the security to the new Admin Group DN and sets its current internal Security Version to the one configured. This forces the security update to run only once.

This setting is not meant to be used as a normal upgrade path for the security change. It is recommended that you use in place mechanisms that exist for the various servers.
Share credentials with Primary Logon Method

This setting provides a way to eliminate the double authentication that takes place when using synchronizers and authenticators that have the same credentials.

This setting links synchronizer and authenticator credentials together so if the credentials are the same they will be reused without requiring the user to reenter them.

Enter a comma-separated list of authenticators to share the credentials with, for example “WinAuth, MSAuth.”

To locate other authenticator names, please see the name listed in the registry for that authenticator (located under HKLM\Software\Passlogix\AUI).
Show user path

When set to Yes, the User path field is displayed when the user is prompted to authenticate.

Options:

  • Yes (default)
  • No

This setting is new as of version 11.1.1.1.0 .

When SSL fails Fallback to an insecure connection when an SSL connection fails.

Options:

  • Do not connect if the SSL connection fails (default).
  • Connect without SSL (insecure) if the SSL connection fails.

If you select SSLFallback and any of the servers listed in Servers includes a port specification, the fallback port must also be specified as an additional Servers entry.

Example:

If the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as:

Server1=mycomputer.com:1272 ;My secure SSL Port

Server2=mycomputer.com:389 ;My fallback port


Synchronization\Ora\Required

Required (Synchronization - ORA)

You must specify the Required Oracle Synchronization settings for all Oracle synchronizer extensions.

Extension location

Path\filename of the database synchronizer extension.

(Default: C:\Program Files\Passlogix\v-GO SSO
 \Plugin\SyncMgr\DBEXT\DBExt.dll)
Servers

Specify the database servers and the order to attempt connection for synchronization. Select the checkbox and click "…" to open the Edit List dialog box. Enter the full connection address (computerName.dbServerName) for one database server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

At least one server must be specified for the extension to work.

To connect to an Oracle database, use the following connection string:

Provider=OraOLEDB.Oracle;Data Source=%MachineName%;Extended Properties='OSAuthent=1'

where the "Data Source" value will be different for each configuration.

To connect to the Oracle database, the Oracle 10g client must be installed on the same machine as the Administrative Console.


Synchronization\Ora\Advanced

Advanced (Synchronization - DBEXT/ORA)

The Advanced Database/Oracle Synchronization settings control special-case options for all database/Oracle synchronizer extensions.

Append Domain when naming objects

Enables appending of the user's domain to the username in naming the user's container. Example: For the domain company and user jamesk, the container is named jamesk with this flag disabled and jamesk.company with this flag enabled. (default: 0)

Options:

  • Disable
  • Enable


Repository

Displays and provides connection to a synchronization repository.

  • Click Repository in the left pane to display the current SSO synchronization repository.

Or, if no connection is active:

  • Right-click Repository in the left pane and choose Connect to… from the shortcut menu.

Repository Actions and Options

Right-click an object in the Repository window in the right pane to display a shortcut menu of commands and options.

With a Container Selected

Publish SSO Objects Here | Opens the “Publish to Repository” dialog box, which allows you to publish configuration objects, such as application templates and Agent setting overrides to the repository. This setting is new as of version 11.1.1.1.0.
Bring Multiple Objects to Console | Displays a list that allows you to select multiple configuration objects that you wish to import into the current Console settings. This setting is new as of version 11.1.1.1.0.
Add Locator Object | Create locator objects (directory servers only).
Create People Container | Creates the ou=People container used for application credential storage on directory systems other than Microsoft Active Directory. This setting is new as of version 11.1.1.1.0 .
New Container | Create a new container within the selected container.
Delete | Remove a container and all objects within.
Refresh | Update the Directory window.

With an Override Object Selected

Configure

Create Administrative Override objects from Console settings or a data file.

View

Quickly view the selected object, with an option to save it to an INI file.

Bring to Console

Import the object to the current Console settings.

  • If the imported file contains items (applications, policies, groups) with same names as those in current configuration, the Import/Merge Conflict dialog box appears.
  • If the imported file contains a set Global Agent Settings with the same name as an existing set in the current configuration, the imported set is named "Copy of existing settings."

Save as File

Save the object to a local INI file.

Delete

Remove the object from the repository.


Add Container

New Container

Use this prompt to name a new container object at the selected node in the current repository.

To name a new container:

  • Type a container name, then click OK.

See Repository for more information.


Bring Multiple Objects to Console

Select Objects to Bring to Console

This dialog box displays, in a flat list, all objects residing in the selected container and all of its child containers, and allows you to select multiple objects for import to the current Administrative Console settings.

To select multiple objects from the list and bring them to the Administrative Console:

  • Ctrl+click each desired object.

    or

  1. Shift+click the first and last objects in the desired range.
  2. Click OK.


Browse for Repository

This dialog box allows you to navigate to a specific target repository container within the currently connected directory server’s hierarchy. It also allows you to connect to a different server, if necessary.

To select the target repository container:

  1. (Optional) If the directory server to which the Administrative Console is currently connected is not the desired target server, click Change Server, fill in the connection information, and click OK to connect to the desired server.
  2. In the directory tree, navigate to and select the target container.
  3. Click OK.

This setting has changed as of version 11.1.1.1.0 .


Configure SSO Support from Data File

Configuring ESSO-LM Support from a Data File

Use this wizard page to export an Agent configuration to a selected synchronizer container using one or more data files as the source. You can export:

  • One or more application logons
  • A (first-time use (bulk-add) object
  • A set Global Agent Settings (from an .ini or .reg file)

Exporting Administrative Overrides from Data Files

  1. Enter the file names (or select Browse to select a data file) as the source for each administrative override object you want to export: You can export:

    • First-Time Use (from an ftulist.ini file)

    • Administrative overrides (from a valid INI or REG file).
    • Applications (from an entlist.ini file)
  2. Click Next. The wizard displays a summary of the override configuration.
  3. Click Finish to complete the export.


Connect to Repository

Connecting to the Repository

Connects the ESSO-LM Administrative Console to a synchronization repository.

Connecting to a Synchronization Repository

  1. Right-click Repository and select Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.

Connection Controls

SyncPath or Server Name

  • If you selected a directory service for Repository Type, enter or select a server name ().

    or

  • If you selected a database for Repository Type, enter or select an instance name (for Oracle), or the server and instance names separated by a backslash (for SQL Server).

    or

  • If you selected File Service for Repository Type, enter or select the path to the synchronization folder.

Select Edit List to remove directories/servers from the drop-down list.

For SQL Server, if the database server is the only instance on the computer you're connecting to, then type just the computer name. If there is more than one database server instance on the target computer, then enter the full connection address (computerName\dbServerName).

You must specify a file system server as a UNC path, not as a drive-letter and directory path. For example: \\ServerName\ShareName not D:\ShareName

Repository Type

Select File System Sync, a directory service, or a database server from the drop-down list.

If you select OpenLDAP Directory Server, andan Extend Schema Status error appears, extend the schema manually.

Port | (Directory server only) Enter the port number .
Database | (Database server only) The name of the database to connect to; enter the name of an existing database (default vGOSSO).
Use secure channel (SSL) | Select to enable secure socket layer (directory server only).
User ID | Enter your username.
Password | Enter your password.


Edit Repository List

Select Objects to Bring to Console

This dialog box displays the list of most recently used target repositories and allows you to delete unwanted entries from the list.

To delete an unwanted entry from the list:

  1. Select the entry in the list.
  2. Click Delete.
  3. Repeat steps 1-2 for any other unwanted list entries.
  4. When you have finished, click OK.

This setting is new as of version 11.1.1.1.0 .


Edit Server List

Delete this text and replace it with your own content.


OpenLDAP Manual Schema Extension

In the Connect to Repository dialog box, if OpenLDAP Directory Server is selected as the Repository Type and an Extend Schema Status error appears, the schema will have to be manually extended.

The Error message appears as follows:

============= ERROR =============
Automated schema extention is not supported by this server. Use the file located at "C:\Program Files\Passlogix\v-GO SSO Administrative Console\DirectorySchema\vgo\OLDAP\sso.schema" to extend the schema manually.
Extend Schema ABORTED!

If you receive this error, follow these steps to extend the schema manually:

  1. Copy the sso.schema file to the OpenLDAP server. The sso.schema file can be located in the following location:
    C:\Program Files\Passlogix\v-GO SSO Administrative Console\DirectorySchema\vgo\OLDAP\sso.schema
  2. Place the sso.schema file in the following directory (or other schema directory for OpenLDAP configuration):
    /usr/local/etc/openldap/schema
  3. The OpenLDAP configuration file must be modified to include the new schema file. Open the file, and add the following line:
    include <path>/sso.schema
    where <path> is the path specified in the previous step.

On UNIX machines, this file is called slapd.conf.


Publish to Repository

This dialog box allows you to publish configuration objects of your choice to the selected target container, either in a directory-style hierarchy (default), or as a flat configuration file.

To select and publish the desired objects to the repository:

  1. In the Available configuration objects list, navigate to and select the desired objects.
Only categories for which objects have been configured will appear in this list. For example, if no password generation policies exist, the corresponding category will not appear in this list.
  2. Click >> to move the selected objects to the Selected objects to be published list. (To remove an object from this list and not publish it, select the object and click <<.)
  3. (Optional) If you did not invoke the Publish SSO Objects Here command by right-clicking on the target container, select the desired container from the Target repository drop-down list.

If the target container path does not appear in the list, click Browse to find and select the desired container.

To remove unwanted entries from this list, select the Edit list option from the list.
  4. (Optional) If your environment calls for storing configuration objects in flat-format, select the check box Store selected items in configuration files, rather than as individual objects.
Selecting this option will overwrite all items stored in existing configuration files, if present in the target container.
  5. (Optional) If you want to create the first-time-use object (FTUList), select the corresponding check box.
This option only becomes active if you choose to store your configuration objects in flat format in step 4.
  6. Click Publish. The Console publishes the selected objects to the target repository.
Do not attempt to dismiss the dialog or close the Console until the publishing process completes. The dialog will disappear automatically when the objects have been published.

To quickly publish an object or a group of objects, select it in the left-hand tree, right-click it, and select Publish (single objects and groups) or Publish To (single objects only) from the context-menu.

This will invoke the Publish to Repository dialog and automatically add the object(s) to the list of objects to be published. Keep in mind that:

  • If you select the Publish option, the Publish to Repository dialog appears.
  • If you select the Publish To option and select a repository, the selected object is automatically published to that repository and the Publish to Repository dialog is not displayed. (If you are not currently connected to the selected repository, you will be prompted to authenticate to the directory server.)

This feature has changed as of version 11.1.1.1.0 .


Selective Backup Command Line Synchronization

Selective Backup/Restore

The agent can be configured to compare the local store of user credentials with a remote backup file and write the newer set over the older set. This selective backup/restore, or "synchronize", can be triggered from the command line (and thus from an "at", or timed, job) or by configuring certain agent events (for example, the Startup task, the Refresh task, and so on).

Individual sets of credentials are not compared; for this more-granular level of synchronization, see Synchronization.

Command-Line Synchronization

To trigger a Command-Line Synchronization, run the Agent from the command line (even when the Agent is currently running) using the following syntax:

ssoshell.exe /mobility /sync [path] /silent

Where:

[path] | The actual path to the directory where the backup file may exist. (Default: the last directory a command line backup file was stored, or where Shell:AutoBackupPath points.)
/silent | Do not show the Backup/Restore Wizard when performing the backup/restore.

To perform a completely-silent synchronize with a network share at \\FS\Backup\Private:

ssoshell.exe /mobility /sync "\FS1\Backup\Private" /silent

To synchronize to the last-used location or to where Shell:AutoBackupPath points:

ssoshell.exe /mobility /sync /silent


Configure SSO Support

Configuring ESSO-LM Support

Use the Configure SSO Support wizard to deploy administrative overrides and application configurations to end users using file-system, database, or directory service synchronizers. The objects you can export include:

  • One or more application logons
  • A first-time use (bulk-add) object
  • A set of Global Agent Settings.

The Configure SSO Support wizard helps you export the overrides, from current console settings or from one or more data files, to a selected synchronizer container object.

See Synchronization for more information.

Exporting Administrative Overrides to a Synchronizer Container

  1. Connect to the ESSO-LM synchronizer repository.
  2. In the right pane, right-click a container object and select Configure SSO Support from the shortcut menu to start the wizard.
  3. Choose the Data Source of the administrative overrides and provide the information requested:
    • Administrative Console
    • Data File


Configure SSO Support from Console

Configuring ESSO-LM Support (from Console)

Use this wizard page to export an Agent configuration to a selected synchronizer container using the current console settings as the source. You can export:

  • One or more application logons
  • A (first-time use (bulk-add) object
  • A set of Global Agent Settings.

Exporting Administrative Overrides from the Console

  1. Do one of the following:

    • Select Send All Applications

      or

    1. Select Send Some Applications, then:

    2. Click Select Apps.

      or

    1. From the Select Applications dialog box, select the applications to send, and click OK.
    2. Choose Send No Apps
  2. Optionally, select Create First-Time-Use (FTUList) object.
  3. Optionally, choose a set of Global Agent Settings from the Admin Overrides drop-down list box.
  4. Select Next. The wizard displays a summary of the Override configuration.
  5. Select Finish to complete the export.

Displaying the Wizard Page

  1. Connect to the ESSO-LM repository.
  2. In the right pane, right-click a container object and select Configure SSO Support from the shortcut menu to start the wizard.
  3. Select Administrative Console.


Add Locator Object

Use the Add Locator Object dialog box to create a locator, a directory object that points the Agent to the container in which user credentials are (or can be) stored. You can create a default locator for all end users or a locator for a specific end user.

See Directory Servers: Create Locator Objects for more information.

Controls

Locator Name | Enter default to create a locator for all users. To create a locator for a specific end user, type the user's distinguished name.
Forwarding Location | Navigate to the container where user credentials are stored. and click OK.
Store data under the user objects (AD only)

(Active Directory only) Select this checkbox to store the user's credentials (or all users if Locator Name is "default") in the container under the respective user object, rather than in a specific Forwarding Location.

This setting requires updating the directory schema and modifying the directory-root security settings. To do this, use the Enable Storing Credentials under User Object command on the Repository menu.

You can use this setting to specify individual users whose credentials are to be stored under their respective User objects. All other user credentials will be stored as specified by the default locator.

To store all users' credentials under their respective user objects without using a locator object, use the Location for storing user credentials setting (under Synchronization\Selected Active Directory sync\Advanced).


View Configuration Object

View Object

Use this dialog box to view the contents of the selected configuration object. To save the object to an INI (text) file, click Save To. See Repository for more information.

You can edit the displayed configuration information, but your changes can only be saved to an INI file, not to the object itself.


Add-on modules

ESSO-LM Add-On Modules

Oracle offers several add-on modules to customize ESSO-LM functionality for individual environments. Settings that are specific to these add-on modules exist within the ESSO-LM Administrative Console. These settings only function with their corresponding modules.

Oracle Enterprise Single Sign-on Authentication Manager | Oracle Enterprise Single Sign-on Authentication Manager (ESSO-AM) provides strong authentication support and multiple authenticator support. An administrator can define grades for levels to restrict access to applications based upon the authenticator used.
Oracle Enterprise Single Sign-on Provisioning Gateway | Oracle Enterprise Single Sign-on Provisioning Gateway (ESSO-PG) provides an administrator with the ability to provision ESSO-LM with a user’s usernames and passwords automatically, using a provisioning system. An administrator is able to add, modify and delete usernames and passwords for particular applications within the provisioning system and have the changes reflected in ESSO-LM.
Oracle Enterprise Single Sign-on Kiosk Manager | Oracle Enterprise Single Sign-on Kiosk Manager(ESSO-KM) manages user sessions in a Kiosk environment.
ESSO Shared Accounts Manager | ESSO Shared Accounts Manager (ESSO-SAM) provides system and application access for administrators, temporary workers, and others who share account IDs.


Authentication Manager

Oracle Enterprise Single Sign-on Authentication Manager

Oracle Enterprise Single Sign-on Authentication Manager (ESSO-AM) enables organizations to seamlessly bridge strong authentication to all of their applications, including smart cards, biometric devices, and Entrust authenticators. Users employ different authenticators at different times; the authenticator in use controls application access.

ESSO-AM is an add-on module to ESSO-LM available separately from Oracle.

ESSO-AM adds three capabilities to ESSO-LM:

  • Strong authentication support from a variety of strong authenticators, including smartcards and biometric devices for all authentication events: initial authentication, re-authentication, and forced authentication.
  • Multiple Authenticator support, enabling:
  • Multiple logon methods for authenticating an end-user
  • Support for graded authentication
  • Alternative logon methods allowing end-users the ability to mix and match multiple logon methods on-the-fly.
  • Definition of grades, or levels to authentication methods and applications. This provides the ability to control which (ESSO-AM functions users can execute based upon the type of authenticator presented.

Multiple Authenticator Support

Multiple authentication supports the use of multiple logon methods to authenticate an end-user. This feature provides an authenticator that is capable of supporting graded authentication as well as alternative authentication methods.

ESSO-AM's Multiple Authenticator:

  • Accepts authentication using different authenticators.
  • Supports Graded Authentication.
  • Allows multiple authenticators to be used interchangeably during a user session, between the initial logon and the logout.
  • Allows multiple authenticators to be used interchangeably between sessions.
  • Provides administrators the ability to:
  • Allow or disallow the use of multiple authenticators
  • Specify the default primary authenticator
  • Specify which authenticators are mandatory for enrollment
  • Restrict access to applications based upon the strength of the authenticator used
  • Allow or disallow the use of multiple authenticators interchangeably during a single session
  • Allow or disallow the use of multiple authenticators interchangeably between sessions.


Graded Authentication

Graded Authentication lets you define grades or levels to authentication in ESSO-AM. Graded authentication controls what functions of ESSO-AM users can execute based upon the type of authenticator presented. Levels, or grades, can be applied and used to ensure the correct level of authentication has been performed for specific events or activities.

Configuring Application-Level Authentication Grades

Configuring Applications

Authentication grades are numeric values. An authentication grade will automatically default to grade level 1 if authentication grading is turned on and no grade level is specified. The higher the grade level specified, the stronger the authentication level that is being requested.

You can arbitrarily configure the grading scale. For example, an expected normal scenario would be a scale of 1-3, but you have the flexibility to make this 1-5 or 1-n, as you require. To be consistent, any grade less than 1 will be converted to 1.

ESSO-AM supports the authentication grades by mapping the grades to the authentication methods used. By default, most authenticators require a specific authenticator to manage grade levels, as they do not support this on their own.

If a user tries to access credentials with a grade level that is too low, that user will be asked to authenticate at a higher grade and only gain access if successful.

Lockouts occur as per normal authentication lockout policy. Since graded authentication uses the core SSO authentication process, this will happen naturally.

A potential security problem exists with graded authentication and multiple primary logon methods. If multiple authenticators are set up with different grades, a user with a lower grade authenticator has the ability to change the primary logon method from multiple authentication to single authentication, thereby gaining access to logons that require higher grades.

This potential issue can be avoided through settings in the console.

Right-click the Global Agent Settings icon to display a shortcut menu, point to Import and click From Live HKLM.

Once the list has been imported, expand Live, then expand End User Experience, and then click Setup Wizard. Set the Selected Primary Logon (Registry Location: AUI:Selected) setting to Authentication Manager. As long as this is selected, the user cannot change the primary logon method.

ESSO-AM Graded Authentication

  • Supports an unbounded number of authentication grades or levels.
  • Supports setting required authentication grades on a per application basis.
  • Supports setting-required authentication grades on SSO processes that require re-authentication.
  • Supports administration setup for the authentication level for every application.
  • Supports administration setup for the authenticator grade.
  • Supports logging of graded authentication events.
  • Provides administrators the ability to:
  • Enable graded authentication support to be turned on or off.
  • Configure graded authentication on a per-application basis.

ESSO-AM and Graded Authentication

  • ESSO-AM controls application logons, which can be initiated by the user, based upon the authenticator used by the end user on the most recent authentication request. The most recent authentication request may be the initial logon, the last re-authentication, or the forced authentication requested by ESSO-AM.
  • ESSO-AM has an authentication grading scheme to which different authenticators are mapped and, separately, to which application logons are mapped. ESSO-AM only allows users to log on to an application when the grade of the authenticator used equals or exceeds that of the application logon.
  • When a user does not respond to an authentication request with an authenticator of sufficiently high grade, ESSO-AM prompts the use to either re-authenticate with an authenticator of sufficiently high grade or cancel the requested logon.
  • If a user repeatedly attempts to initiate a logon or function with an authenticator of insufficient grade, ESSO-AM locks out the user, logs an event in the Event Manager, and notifies the user and administrator.
  • If a user does not have ESSO-AM installed, but his application logons have been configured to require strong authentication, the user will not have access to those applications (for example, strong authentication is deployed in the enterprise, but not to that user).
  • Logon Manager only displays the application logons that are currently available, based upon the authenticator used in the most recent authentication request.
  • The following ESSO-AM functions can be configured to be accessible or inaccessible based upon the grade of authenticator used in the most recent authentication request:
  • System Tray: Logon Manager
  • Logon Manager: Delete, Properties, and Reveal All functions
  • Logon Manager | Properties Page: Reveal Password function
  • If the Reveal All function is accessible based upon a grade of authentication used, it only reveals passwords for those applications whose grade is equal to or lower than the grade used to authenticate for that function.


Session Management Overview

Kiosk Manager

Oracle Enterprise Single Sign-on Kiosk Manager (ESSO-KM) manages user sessions in a Kiosk environment. The following ESSO-KM settings are configured through the ESSO-LM Administrative Console:

  • Actions
  • Session States
  • General operation settings
  • Confirmation messages
  • ESSO-KM Desktop Manager UI customization
  • ESSO-KM Desktop Manager Text Message
ESSO-KM is an add-on module to ESSO-LM available separately from Oracle. For more detailed information on ESSO-KM, please refer to the ESSO-KM product documentation.


SM SendKeys Format

Oracle Enterprise Single Sign-on Kiosk Manager - SendKeys Format

When using keystroke sequences to terminate an application, a visual flicker occurs on the end users screen. This flicker is a function of using SendKeys to terminate an application.

Each key is represented by one or more characters. To specify a single keyboard character, use the character itself. For example, to represent the letter A, pass in the string "A" to the method. To represent more than one character, append each additional character to the one preceding it. To represent the letters A, B, and C, specify the parameter as "ABC."

The plus sign (+), caret (^), percent sign (%), tilde (~), and parentheses () have special meanings to SendKeys. To specify one of these characters, enclose it within braces ({}). For example, to specify the plus sign, use "{+}". To specify brace characters, use "{{}" and "{}}". Brackets ([ ]) have no special meaning to SendKeys, but you must enclose them in braces. In other applications, brackets do have a special meaning that might be significant when dynamic data exchange (DDE) occurs.

To specify characters that aren't displayed when you press a key, such as ENTER or TAB, and keys that represent actions rather than characters, use the codes in the following table.

Key | Code
BACKSPACE | {BACKSPACE}, {BS}, or {BKSP}
BREAK | {BREAK}
CAPS LOCK | {CAPSLOCK}
DEL or DELETE | {DELETE} or {DEL}
DOWN ARROW | {DOWN}
END | {END}
ENTER | {ENTER}or ~
ESC | {ESC}
HELP | {HELP}
HOME | {HOME}
INS or INSERT | {INSERT} or {INS}
LEFT ARROW | {LEFT}
NUM LOCK | {NUMLOCK}
PAGE DOWN | {PGDN}
PAGE UP | {PGUP}
PRINT SCREEN | {PRTSC} (reserved for future use)
RIGHT ARROW | {RIGHT}
SCROLL LOCK | {SCROLLLOCK}
TAB | {TAB}
UP ARROW | {UP}
F1 | {F1}
F2 | {F2}
F3 | {F3}
F4 | {F4}
F5 | {F5}
F6 | {F6}
F7 | {F7}
F8 | {F8}
F9 | {F9}
F10 | {F10}
F11 | {F11}
F12 | {F12}
F13 | {F13}
F14 | {F14}
F15 | {F15}
F16 | {F16}
Keypad add | {ADD}
Keypad subtract | {SUBTRACT}
Keypad multiply | {MULTIPLY}
Keypad divide | {DIVIDE}

To specify keys combined with any combination of the SHIFT, CTRL, and ALT keys, precede the key code with one or more of the following codes.

Key Code

SHIFT +

CTRL ^

ALT %

To specify that any combination of SHIFT, CTRL, and ALT should be held down while several other keys are pressed, enclose the code for those keys in parentheses. For example, to specify to hold down SHIFT while E and C are pressed, use "+(EC)." To specify to hold down SHIFT while E is pressed, followed by C without SHIFT, use "+EC."

To specify repeating keys, use the form {key number}. You must put a space between key and number. For example, {LEFT 42} means press the LEFT ARROW key 42 times; {h 10} means press H 10 times.

In addition to the above SendKeys, there is also a wait command. The wait command is in the format {WAIT number} where "number" is the number of milliseconds delay. The wait can be anywhere in the string (that is, beginning, middle, end} and can be used as many times as needed.

For example, if you want to send Ctrl+Shift+F7, then wait for 5 seconds, and then send Alt+F4, the format should be as follows:

^+{F7}{WAIT 5000}%{F4}

© 2001-2002 Microsoft Corporation. All rights reserved.


Provisioning Management

Managing Provisioning

Use this node to manage provisioning rights for users. There are two tabs to set the rights:

  • Default Rights
  • Delete SSO User Right

Default Rights

Use this tab to define the provisioning rights for each new application created. This feature sets standard rights for each application created. Once each application is created, change the rights as needed.

Controls
Directory | Select the target directory server.
Access information:
Name | Lists the groups or users who currently have access to this item.
ID | Lists the user account name.
Access | Indicates the permissions that have been granted to the user or group (Add, Modify or Delete Logon). To change a user or group's access rights, right-click the user or group and select Add Logon, Modify Logon or Delete Logon from the shortcut menu.
Actions
Copy permissions to | Use this button to easily apply the provisioning rights for the current application to multiple applications. Clicking this button displays a dialog listing all the applications. Selects the applications that you want these provisioning rights to be copied to. Use Ctrl+click or Shift+click to select multiple entries. Click OK.
Add | Displays the Add User or Group dialog box (for LDAP or Active Directory) to select the users or groups who should have access to the currently selected item.
Remove | Removes selected user(s) or group(s) from the list. Select a user or group to remove; use Ctrl+click or Shift+click to select multiple entries.

Add User or Group Dialog Box

The Select User or Group dialog box varies based on the directory server being used:

  • LDAP
  • Active Directory/ADAM

LDAP

Use this dialog to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls
Search Base | The base (highest-level) directory to begin searching for user/group accounts. All subdirectories of the base directory are searched. Type a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search. Use this dialog to browse to and select the base (highest-level) directory to search for user/group names. Click OK when finished.
Search | Begin searching the base directory for users and groups.
Users or Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.

Active Directory/ADAM

Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (Add Logon, Modify Logon, or Delete Logon).

Controls
List Names From | Select an Active Directory domain or server.
Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add | Copies user(s) and group(s) selected in the Names list to the Add Names list. Use Ctrl+click or Shift+click to select multiple entries.
Members | When a group is selected the Names list, displays the Global Group Membership dialog box, which lists the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names | Display the names of the user(s) or group(s) for whom you have you have added so far. Click OK to add these names to the access list for the current configuration item. Note: You can type or edit user names in this list. However, entries are checked for invalid account names, and duplicate account selections are automatically removed when you click OK.

Delete SSO User Right

Use this tab to define the users to grant the Delete SSO User functionality to in the ESSO-PG Administrative Console. The controls function the same as on the Default Rights tab.


Table of Contents

ESSO-LM Administrative Console Reference Topics

Global Agent Settings

Setting Registry Settings and Admin Overrides

Overriding Settings

Configuring Host Emulators

Telnet Support

Attachmate EXTRA!

BlueZone Web-to-Host

BOSaNOVA

Ericom PowerTerm

G&R Glink

Hummingbird HostExplorer

IBM Client Access

IBM Client Access Express

IBM Host On-Demand

In Microsoft Internet Explorer

In Host On-Demand

IBM Personal Communications

Jolly Giant QWS3270 PLUS

NetManage Rumba

Net Soft NS Elite

Newhart Systems BLUES 2000

Novell LAN Workplace

PuTTY

Scanpak Aviva for Desktops

Seagull Bluezone

WRQ Reflection

Zephyr PC to Host

Zephyr Web to Host

Configuring SAP

Command-Line Options

Configuring the Windows Event Logging Server

Windows Event Logging extension

Directory Server Schema Definition

vGOSecret

vGOUserData Object

vGOConfig Object

vGOLocatorClass

entlist.ini Keys

Root Keys

Application Type Section Keys

Windows Application Keys

Windows Application Keys for SectionN subsection

Windows Application Keys for MatchN subsection

Host/Mainframe Application Keys

Host Application Keys for PageN subsection

Web Application Keys

Web Application Keys for SectionN subsection

Password Policy Keys

Error Loop

ftulist.ini Keys

Root Keys

Password Windows Section Keys

My Logons Section Keys

Bulk Add Logon Section Keys

MSI Package Contents

Pre-configured Applications and Templates

Troubleshooting

Installation

Authenticators

Synchronizer Extensions

Uninstall

Agent Performance

Application Response

Authentication

Initial Authentication

Reauthentication

Application Configuration

All Applications

Windows Applications

Web Applications

Host Applications

Credential Sharing Groups

Synchronizer Extensions

Directory Extensions

File System Server

Event Logging


Application Compatibility Considerations

While Oracle officially tests and supports only the applications for which we provide templates, we have an exceptionally high success rate enabling the vast majority of business and productivity applications for Windows, the Web, Java applications and mainframe/AS400 emulators. Our support team will assist you in configuring any application template unless or until we determine that the application as it exists is incompatible with ESSO-LM.

The following table identifies characteristics of applications for which ESSO-LM is known to have support issues:

High Risk | Medium Risk
Application characteristics that generally hinder successful application template configuration | Application characteristics that often result in incomplete SSO functionality or require an action on the part of the end-user to complete the sign-on or password change
  • XWindows
  • Flash applications
  • Outdated Java (earlier than 1.3.1)
  • Non-HLLAPI emulators
  • Emulator applications that already use HLLAPI, when used in conjunction with emulators that allow only one application to connect to HLLAPI
  • DOS GUI applications and DOS applications not run in CMD
  • Web Applications that:
  • Require SendKeys
  • Require a delay.
  • ESSO-LM does not inject credentials until it sees that the page has fully loaded. With some websites, the page appears to be fully loaded from the perspective of the browser, but fields are not yet ready for credential injection.
  • Applications that require matching to fix an issue (for example, logon looping, ignore, password change, etc.), but unique criteria is not available for matching.
  • Applications hosted on Terminal Server or Citrix, if ESSO-LM cannot be installed on the Terminal Server or Citrix box.
  • Applications where the OK Button is missing and ENTER is not accepted. ESSO-LM cannot process the submission and the user must manually submit the credentials or SendKeys must be used.
  • Applications where the logon or password change fields are on a dialogue box tab. SendKeys can be used for Windows applications.
  • Applications where logon or password change requires an action (for example, a checkbox). SendKeys can be used for Windows applications.
  • Password Change: Applications where other user profile information fields are present along with the password change fields. ESSO-LM processes the password change and bypasses the other fields.
  • Applications where the window title of the target application changes after creation but before the logon screen is active.
  • Applications where logon fields are on a page with other logon or credential entry fields. ESSO-LM cannot distinguish between multiple logons if they are on the same screen.
  • Applications where the Submit button is in an image tag with a fully-qualified path and ENTER is not accepted. If the image path changes, ESSO-LM will not insert and submit the credentials properly.
  • Password Change:
  • Applications where ESSO-LM logs the user on and bypasses the password change on the logon screen (run as a service, change title bar, etc.)
  • Applications where the application password policy does not match the SSO capabilities, and the user is responsible for password selection (for example, if the application has a password history or dictionary requirement)
  • SendKeys for Windows applications (Web applications are high risk and Mainframe applications lose the password change).
  • Logon looping: The application shows exactly the same logon screen after logoff, requiring a workaround.
  • Firefox Pop-Up Windows. ESSO-LM can only detect these windows if “Limit users to predefined applications” is set to “Do not limit.”
  • In versions prior to ESSO-LM 6.0 Rollup F:
  • Applications with Dynamic Window Classes that also need Service Logons functionality (run as a service, change title bar, etc.)
  • Dynamic Control IDs
  • Duplicate Control IDs on Target Credentia


Pre-Configured Applications and Templates

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

Preconfigured logons for Windows and Web application are provided in Console templates. Configurations for common network/web pop-up logons and for online service logons are stored in the configuration file applist.ini, which is located in the installation directory.

Predefined application logons that had been stored in applist.ini on the client in previous ESSO-LM versions are now stored as templates in the ESSO-LM Administrative Console. See Compatibility with Previous Product Versions for more information.

The following applications are included in ESSO-LM, either as Templates with the ESSO-LM Administrative Console, or in applist.ini.

Applications With Console Templates

The following applications are configured to work, but need to be added to user configurations. Some of these require customization to meet your environment (e.g., specifying internal URLs or application Window Titles).

Application Logon Forms
Microsoft Word
  • Microsoft Word Logon
MS Dial-Up Networking
  • MS Dial-Up Networking Logon (admin supplies WindowTitle)
Netscape Mail
  • Netscape Mail Logon
PKZIP
  • PKZIP Logon
Siebel Sales
  • Siebel Sales Logon
  • Siebel Sales Change Password
Adobe Acrobat Reader
  • Adobe Acrobat Unlock
ICQ
  • ICQ Logon - Registration
  • ICQ Logon
Meeting Maker
  • MM Logon
WinZip
  • WinZip Set Password Confirm
  • WinZip Set/Use Password
  • WinZip Decrypt File(s) Password
Yahoo! Messenger
  • Yahoo! Messenger Logon
Oracle
  • Oracle Logon
  • Oracle 10g SQL*Plus Logon
MS SQL
  • MS SQL Logon
Novell GroupWise
  • Novell GroupWise Logon
Microsoft FrontPage
  • Microsoft FrontPage Logon
Visual SourceSafe
  • VSS Logon
  • VSS Change Password
OpenNetwork Directory Smart
  • OpenNetwork Directory Smart Logon (admin supplies URL)
Oblix NetPoint
  • Oblix NetPoint Logon (admin supplies URL)
Citrix ICA Client/Program Neighborhood (2-field)
  • CICA2 Logon (admin supplies WindowTitle)
Citrix NFuse Classic (2-field)
  • CNFC2 Logon (admin supplies URL)
Act
  • Act Logon (admin supplies WindowTitle)
  • Act Set Password
QuickBooks Pro
  • QBP Change Password
  • QBP Logon
QuickBooks Pro (Password-Only)
  • QBPPO Change Password
  • QBPPO Logon
Lotus Organizer
  • Lotus Organizer Logon (admin supplies WindowTitle)
Citrix Program Neighborhood Agent (3-field)
  • CPN3 Logon
GoldMine
  • GoldMine Logon
  • GoldMine Clhange Password
Citrix NFuse Classic (3-field)
  • CNFC3 Logon (admin supplies URL)
Citrix Program Neighborhood Agent (2-field)
  • CPN2 Logon
Citrix ICA Client/Program Neighborhood (3-field)
  • CICA3 Logon (admin supplies WindowTitle)
AIM
  • AIM Logon
Eudora
  • Eudora Logon
  • Eudora Change
  • Eudora Confirm
Lotus Notes
  • Lotus Notes
Microsoft Outlook
  • Logon
  • Change Password
Microsoft Outlook
  • Logon
  • Change Password
MSN Messenger
  • MSN Messenger Logon
Windows Logon
  • WL MPR Logon
  • WL MPR Change Password
  • WL WinLogon Logon
  • WL WinLogon Change Password
ICQ
  • ICQ Logon (Password Only)

Preconfigured Logons in applist.ini

Online Services

  • AOL
  • Compuserve
  • Earthlink
  • MSN
  • Prodigy
  • ATT WorldNet
  • Internet Explorer logons


Backing Up and Restoring

It is possible to back up or restore your information either from the command line or from a file. See Command Line Options or File-Based Backup/Restore for more information on these procedures.


Character Key Codes

Character Codes

Codes for VTabKeyN (Windows)

Code | Meaning
`DELAY=N` | N is the number of milliseconds to delay
`VKEY=N` | N is the virtual key code to send

Example sending a Tab, End, Space, a 1.5 second delay, Logon username , Space, the username/ID, Home, a 0.35 second delay, Tab, and then the password:

VTabKey1=`VKEY=9``VKEY=35` `DELAY=1500`Logon username`VKEY=32`

VTabKey2=`VKEY=36``DELAY=350``VKEY=9`

Codes for VirtualKeyCode and VKEY (Windows)

These codes are used in the application configuration file (entlist.ini) to send specific keystrokes to Windows logon or password change form fields. They are listed here for reference only. Use the SendKeys (Windows) dialog box to specify keystrokes for a Windows application. See Adding Windows Applications for more information.

Key | Code | Key | Code | Key | Code | Key | Code
Break | 3 | 5 | 53 | V | 86 | F5 | 116
Backspace | 8 | 6 | 54 | W | 87 | F6 | 117
Tab | 9 | 7 | 55 | X | 88 | F7 | 118
Clear | 12 | 8 | 56 | Y | 89 | F8 | 119
Enter | 13 | 9 | 57 | Z | 90 | F9 | 120
Shift | 16 | A | 65 | Left Windows | 91 | F10 | 121
Ctrl | 17 | B | 66 | Right Windows | 92 | F11 | 122
Alt | 18 | C | 67 | NumPad 0 | 96 | F12 | 123
Caps Lock | 20 | D | 68 | NumPad 1 | 97 | F13 | 124
Esc | 27 | E | 69 | NumPad 2 | 98 | F14 | 125
Spacebar | 32 | F | 70 | NumPad 3 | 99 | F15 | 126
Page Up | 33 | G | 71 | NumPad 4 | 100 | F16 | 127
Page Down | 34 | H | 72 | NumPad 5 | 101 | F17 | 128
End | 35 | I | 73 | NumPad 6 | 102 | F18 | 129
Home | 36 | J | 74 | NumPad 7 | 103 | F19 | 130
Left | 37 | K | 75 | NumPad 8 | 104 | F20 | 131
Up | 38 | L | 76 | NumPad 9 | 105 | F21 | 132
Right | 39 | M | 77 | Asterisk (*) | 106 | F22 | 133
Down | 40 | N | 78 | Plus (+) | 107 | F23 | 134
Print Scrn | 44 | O | 79 | Minus (-) | 109 | F24 | 135
Help | 47 | P | 80 | Period (.) | 110 | Num Lock | 144
0 | 48 | Q | 81 | Slash (/) | 111 | Scroll Lock | 145
1 | 49 | R | 82 | F1 | 112 | Left Shift | 160
2 | 50 | S | 83 | F2 | 113 | Right Shift | 161
3 | 51 | T | 84 | F3 | 114 | Left Ctrl | 162
4 | 52 | U | 85 | F4 | 115 | Right Ctrl | 163

Codes for PreKey and TabKey (Host/HLLAPI)

These codes are used in the application configuration file (entlist.ini) to send specific keystrokes to HLLAPI-enabled Mainframe/Host logon or password change form fields. They are listed here for reference only. Use the SendKeys (Host/Mainframe) dialog box to specify keystrokes for a host application. See Adding Host/Mainframe Applications for more information.

Char/Cmd | Code | Char/Cmd | Code | Char/Cmd | Code
Alt Cursor | @$ | Local Print | @P | PF12/F12 | @c
Backspace | @< | Reset | @R | PF13/F13 | @d
@ | @@ | Shift | @S | PF14/F14 | @e
Alt | @A | Dup | @S@x | PF15/F15 | @f
Field - | @A@- | Field Mark | @S@y | PF16/F16 | @g
Field + | @A@+ | Tab (Right Tab) | @T | PF17/F17 | @h
Field Exit | @A@E | Cursor Up | @U | PF18/F18 | @i
Alt Cursor | @$ | Cursor Down | @V | PF19/F19 | @j
Erase Input | @A@F | Cursor Left | @L | PF20/F20 | @k
Sys Request | @A@H | Cursor Right | @Z | PF21/F21 | @l
Insert Toggle | @A@I | Page Up | @u | PF22/F22 | @m
Cursor Select | @A@J | Page Down | @v | PF23/F23 | @n
Attention | @A@Q | End | @q | PF24/F24 | @o
Print Screen | @A@T | Home | @0 | PA1 | @x
Hexadecimal | @A@X | PF1/F1 | @1 | PA2 | @y
Cmd/Func Key | @A@Y | PF2/F2 | @2 | PA3 | @z
Print (PC) | @A@t | PF3/F3 | @3 | PA4 | @+
Back/Left Tab | @B | PF4/F4 | @4 | PA5 | @%
Clear | @C | PF5/F5 | @5 | PA6 | @&
Delete | @D | PF6/F6 | @6 | PA7 | @'
Enter | @E | PF7/F7 | @7 | PA8 | @(
Erase EOF | @F | PF8/F8 | @8 | PA9 | @)
Help | @H | PF9/F9 | @9 | PA10 | @*
Insert | @I | PF10/F10 | @a |  |
New Line | @N | PF11/F11 | @b |  |


Directory Server Schema Definition

The following are Directory Server Container and Class Objects, their rights, and their attributes.

vGOSecret

Stores all user secrets. This includes an object that stores all deleted objects and their logon credentials. This is added to the SSOUserData object as an auxiliary class. All users can read this object, but only the owner can write to this object, and only the owner or administrator can delete this object.

Rights: The rights are inherited from the vGOUserData object.

Attribute Name | Syntax | Flag
vGOSecretData | Case Ignore String | Singled Valued, Synchronize
vGOSharedSecretDN | Not Used
Other optional attributes | ou, dn, cn, o

vGOUserData Object

A container allowing users to store their individual/personal secured credentials.

Rights: Users have write access to these attributes for their own user objects. The administrator has full rights but will not be able to read the secrets due to encryption.

Attribute Name | Syntax | Flag
vGOSecretData | Case Ignore String | Singled Valued, Synchronize
vGORoleDN | Not Used
Other optional attributes | ou, dn, cn, o

vGOConfig Object

Used to hold all configuration information that the Agent needs. This includes the application-supported list, mainframe/host application supported list, first-time use setup instructions, Password Policies, and admin overrides. All of these settings control Agent behavior.

Rights: All users have read-only rights to the attributes within this object. The administrator has full rights.

Attribute Name | Syntax | Flag
vGOConfigType | Case Ignore String | Singled Valued, Synchronize
vGOConfigData | Case Ignore String | Singled Valued, Synchronize
vGORoleDN | Not Used
Other optional attributes | ou, dn, cn, o

vGOLocatorClass

This is used to specify where to store user credentials.

Rights: All users have read/compare/search access to these attributes for all of this class of object. The administrator has full rights.

Attribute Name | Syntax | Flag
vGOLocatorAttribute | Case Ignore String | Single Valued
Other optional attributes | dn, cn, o


Configuring Host Emulators

Configuring Host Emulators to Enable HLLAPI Short Session Names

ESSO-LM provides single sign-on functionality for the following host/terminal emulators using built-in HLLAPI (high-level language application programming interface) support. The topics listed here outline how to enable HLLAPI support in each emulator.

  • Telnet Support
  • Attachmate Extra! / myExtra! / Xtra! X-Treme
  • BlueZone Web-to-Host
  • BOSaNOVA
  • Ericom PowerTerm
  • G&R Glink
  • Hummingbird HostExplorer
  • IBM Client Access
  • IBM Client Access Express
  • IBM Host on-Demand
  • IBM Personal Communications
  • Jolly Giant QWS3270 PLUS
  • NetManage Rumba
  • Net Soft's NS/Elite
  • Newhart Systems BLUES 2000
  • Novell LAN Workplace
  • PuTTY
  • Scanpak Aviva for Desktops
  • Seagull Bluezone
  • WRQ Reflection
  • Zephyr PC to Host
  • Zephyr Web to Host
For emulators that do not implement HLLAPI support, you can configure a host/mainframe application as a Windows application (to detect the form by its window title) and using SendKeys (to supply user credentials). See Adding Windows Applications: Special Issues for more information.


Attachmate EXTRA!

Attachmate EXTRA!/ myExtra!

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up each session of Attachmate EXTRA! to work with ESSO-LM:

In the emulator:
  1. Open the session.
  2. Select Global Preferences from the Options menu.
  3. Select Advanced, select the Short name (for example, A), select Browse, select the session document, and click OK.

This setting needs to be saved with each session configuration file.

Background processes sometimes remain running after a mainframe or host session has ended. This may disrupt the Auto-Logon process and prevent the session from restarting.


BlueZone Web-to-Host Emulator

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To install and configure BlueZone Web-to-Host emulator:

  1. Launch the BlueZone Web-to-Host setup.
  2. In the Setup Type section, select Install BlueZone Web-to-Host and click Next.
  3. Read the end-user license agreement carefully. If you agree to the terms, select the button next to Yes, I agree with the terms of this software license, and click Next.
  4. Select a location to install the software. The installer defaults to your C: drive's Program Files directory.
  5. Direct the installer to the location of the Seagull Activation File (SAF), or leave it blank if you do not have an SAF yet.
  6. Select whether the installer should create a program group to use, and whether it should create a desktop shortcut for the BlueZone Web-to-Host Wizard, and click Next.
  7. In the Sites dialog box, select a language for the site from the dropdown menu.
  8. Do one of the folllowing:
    • Click Create and enter a path and folder name.
    • Click Import and navigate to the site you want to import.
    • Click Copy and navigate to the site you want to copy.
    • Click Upgrade and navigate to the site you want to upgrade.
    • If you want to delete an existing site, select it and click Delete .
  9. In the Launch Folders dialog box, select an existing launch folder, or click Create to create a new one. Click Next.
  10. In the New BlueZone Launch Folder dialog box, enter the folder name, and select from the folder options whether to distribute as a standard web-to-host or as a served desktop. Click OK.
  11. When you return to the Launch Folders dialog box, which now displays your new launch folder, click Next.
  12. In the Sessions dialog box, click Create.
  13. In the New BlueZone Session dialog box, select Mainframe Display from the dropdown menu and click OK.
  14. Enter a name for the session and specify whether to use an existing profile. Select an existing profile if appropriate. Select whether to allow local saves. Click OK.
  15. In the Define New Connection dialog box, enter your connection information and click OK.
  16. Review the information in the Session Properties window. Edit any information that you want to change. Click OK when you are done.
  17. Select Session in the BlueZone Mainframe Display and click Connect.

Support for this emulator is new as of version 11.1.1.1.0 .


BOSaNOVA

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports BOSaNOVA emulator. No steps are necessary to set up BOSaNOVA to work with ESSO-LM.

There is an open issue with the BOSaNOVA emulator when used with ESSO-LM. When closing the emulation, the following warning message appears: "There are active applications connected to the emulation via the HLLAPI/DDE interface. Closing the emulation now may cause unpredictable results. Are you sure?"

If you click Yes, ESSO-LM stops responding to the BOSaNOVA emulator and you must restart it. Note that the restart may take a few additional seconds. Another workaround for this issue is to shut down ESSO-LM before closing the emulation, close the emulation, and then restart ESSO-LM.


Reference\Ericom_PowerTerm

Ericom PowerTerm

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

Setting Up Ericom PowerTerm to Work with ESSO-LM

In the emulator:

  1. Select Terminal from the Setup menu.
  2. Select the General tab.
  3. Under HLLAPI Names, set Short to a unique value.
  4. Click OK.
In order to enable ESSO-LM support for PowerTerm InterConnect, Plus, and Lite editions, the complete and exact path to the emulator must be specified in the Agent's host/mainframe-configuration file, MfrmList.ini. The default path in the mainframe configuration is C:\Program Files\Ericom Software\PowerTerm.

If one of these editions of the PowerTerm emulator is installed in any other directory or on any other drive, you must modify this default path in MfrmList.ini. This file can only be edited using th console.

  1. On the Tools menu, point to Modify Configuration, then click MfrmList.
  2. In the INI editor, select Ericom PowerTerm Lite/Plus/InterConnect from the Section dropdown list.
  3. For ValueName= edit the path to the emulator as needed.
  4. Click Save (click OK to restart the Agent if prompted), then Close.


G&R Glink

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up G&R Glink to work with ESSO-LM:

  1. Configure short names in the glHLLAPI.ini file, which is found in the GLWin\WHLLAPI directory within the G&R Glink installation path. This file must be copied to the user's %WinDir% directory to take effect. Oracle recommends that the default values be left as they are, except for those values that refer to the short names, which take the form of:

A]
Name=HLLAPI long name
Config=config file name

where 'A' represents the short name.


Hummingbird Host Explorer

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up Hummingbird HostExplorer to work with ESSO-LM:

In the emulator:
  1. Select API Settings from the Options menu.
  2. Under HLLAPI Options, select Update screen after PS update.
  3. Under EHLLAPI Compatibility, select Attachmate
  4. Click OK.


IBM Client Access

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports IBM Client Access. No steps are necessary to set up IBM Client Access to work with ESSO-LM.


IBM Client Access Express

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports IBM Client Access Express. No steps are necessary to set up IBM Client Access Express to work with ESSO-LM.


IBM Host On-Demand

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM support for IBM Host On-Demand is tested with Microsoft Windows, Microsoft Internet Explorer or Mozilla Firefox, and the updated JVM (Java Virtual Machine). If Microsoft Internet Explorer is installed, the JVM should not have to be updated.

One issue with these methods is that clients might not be able to save configured sessions, and entering the auto-start name each time a session is used is quite tedious. Alternatively, administrators can replicate the existing sessions that are available to the client, and HLLAPI-enable these sessions as explained below. Clients can then be offered both standard and HLLAPI-enabled sessions.

To set up IBM Host On-Demand to work with ESSO-LM:

In Microsoft Internet Explorer or Mozilla Firefox

  1. Launch the browser.
  2. Go to IBM FixCentral and download the Host On-Demand EHLLAPI Bridge Download for the particular version of IBM Host On-Demand.
  3. Unzip the downloaded file to the ESSO-LM installation directory.
  4. Install Ehllapibridge.exe.
  5. Select Internet Options from the Tools menu.
  6. Select the Advanced tab.
  7. Under Microsoft VM, select Java console enabled (requires restart).
  8. Click Apply, then OK. If necessary, exit the browser.
  9. Restart the computer.

In Host On-Demand

  1. Configure each individual session to run the HLLAPI enabler through the Host On-Demand applet.
  2. Select Properties from the menu.
  3. Select the Advanced tab.
  4. Select Applet from the Auto-Start drop-down list box.
  5. Enter com.ibm.eNetwork.hllbridge.HLLAPIEnabler in the Name text box.
  6. Enter ENABLE_PCSAPI=YES in the Parameter (Optional) text box.
  7. Select Yes in the Auto-start HLLAPI Enabler check-box.
  8. Alternatively, run this applet after the session starts by selecting Assist, then Run applet.


IBM Personal Communications

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up IBM Personal Communications to work with ESSO-LM:

  1. From the Edit menu in the emulator, point to Preferences and select API Settings.
  2. Select the DDE/EHLLAPI checkbox.
  3. Click OK.


Jolly Giant QWS3270 PLUS

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Jolly Giant QWS3270 PLUS emulator. No steps are necessary to set up Jolly Giant QWS3270 PLUS to work with ESSO-LM.


NetManage Rumba

NetManager Rumba

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.
Setting Up NetManage in the Emulator
  1. Select API from the Options menu.
  2. Select the Identification tab.
  3. Set the Session Short Name.
  4. Click OK.

NetManage Rumba appears to have an incomplete implementation of HLLAPI. NetManage Rumba connects and sees the Presentation Space (emulator screen), but it does not appear to support connections for more than one session. ESSO-LM can only provide single sign-on support to the last session started.


Net Soft's NS/Elite

Net Soft NS/Elite

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Net Soft NS/Elite. No steps are necessary to setup NS/Elite to work with ESSO-LM.


Newhart Systems BLUES 2000

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Newhart Systems BLUES 2000S emulator. No steps are necessary to set up Newhart Systems BLUES 2000S to work with ESSO-LM.


Novell LAN Workplace

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

In order to enable ESSO-LM support for Novell LAN Workplace Pro, the complete and exact path to the emulator must be specified in the Agent's host/mainframe-configuration file, MfrmList.ini. The default path in the mainframe configuration is c:\Program Files\Novell\LAN Workplace\Terminals\Bin.

If the Novell LAN Workplace emulator is installed in any other directory or on any other drive, you must modify this default path in MfrmList.ini. This file can only be edited using theESSO-LM Administrative Console.

  1. On the Tools menu, point to Modify Configuration, then click MfrmList.
  2. In the INI editor, select Novell LAN Workplace Pro 5.2 from the Section dropdown list.
  3. For ValueName= edit the path to the emulator as needed.
  4. Click Save (click OK to restart the Agent if prompted), then Close.


PuTTY

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

Creating Application Templates for the PuTTY Terminal Emulator

Due to the way PuTTY and support for PuTTY in ESSO-LM have been designed, you must keep the following information in mind when creating templates for applications accessed via PuTTY.

Use PuTTY’s Copy All to Clipboard feature when creating a PuTTY-based template.

PuTTY Treats Fixed-Screen Applications as Scrolling-Screen

Because PuTTY treats all applications as scrolling-screen, you must create scrolling-screen templates even if the application in question is fixed-screen.

PuTTY Does Not Support Detection or Setting of Cursor Position

Because PuTTY cannot detect nor set the cursor position, you must do the following when creating templates:

  • Fixed-screen applications. Configure the template to manually position the cursor into the target row and column by sending appropriate keyboard characters such as tabs and spaces.
  • Scrolling-screen applications. Configure the template with the assumption that the cursor is always positioned after the last character on the last line of the screen, plus a separating space.

Screen Updates in PuTTY Are Not Immediate

Because PuTTY does not update its screen display immediately due to host echo (text entered is first sent to the server then returned back to the terminal and displayed), it is necessary to add delays when switching fields and/or submitting the credentials, depending on the latency of the echo. If you need to delay the “Submit” action, you must disable the “Auto Submit” feature.


Scanpak Aviva for Desktops

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Scanpak Aviva for Desktops (formerly Eicon Aviva). To set up Scanpak Aviva for Desktops to work with ESSO-LM:

In the emulator:

  1. Select Settings, then Properties from the menu.
  2. Select Automation.
  3. Ensure the Choose first available short name checkbox is selected.

Only the session and destination parameters must be configured.


WRQ Reflection

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up WRQ Reflection to work with ESSO-LM:

In the Emulator:

  1. Select Setup, then Terminal from the menu.
  2. Set the HLLAPI names for Short and Long. (Short must be unique, Long can be anything the program permits.)
  3. Click OK.


Zephyr PC to Host

Zephyr PC to HostZephyr to PC Host

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

To set up Passport to work with ESSO-LM:

In the emulator:

  1. Select Communication, then Setup from the menu.
  2. Select HLLAPI (If Automatically Select is checked there is not additional steps necessary. If Manually Specify is checked, you must select either a Short Name or Long Name.


Zephyr Web to Host

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Passport Web to Host. No steps are necessary to setup Web to Host to work with ESSO-LM.


SAP Configuration

ESSO-LM supports SAP applications. In order for ESSO-LM to work with SAP applications, scripting must be turned on. (Note that in your environment, scripting may be turned off by default.) The following configuration changes must be made to all SAP desktops that will run ESSO-LM. If these configuration changes are not made, end users will receive an SAP error unless ESSO-LM is shut down. To set up SAP to work with ESSO-LM

To set up SAP to work with ESSO-LM:

Configuring the Client

  • Open the SAP Client and log on (SAPGUI Front End).
  • On the SAP Easy Access screen, open the Options dialog box. (Click Alt F12 or select Customizing of local layout from the Standard Toolbar on any SAP screen).
  • Select the Scripting tab.
  • Under User Settings, make sure that Enable Scripting is checked and that Notify when a script attaches to a running GUI is not checked.
  • Click Apply.

Configuring the Server

  • Open the SAP Application Server.
  • Start transaction RZ11.
  • On the Maintain Profile Parameters screen, in the Param. Name, enter sapgui/user_scripting and click Display.
  • On the Display Profile Parameter Attributes screen, select Change Value from the Application Toolbar.
  • On the Change Parameter Value screen, enter TRUE in the New Value field.
  • Click Save (lower left hand corner).

Editing the Registry

  • Open the Registry.
  • Drill down to HKCU\software\SAP\SAPGUI Front\SAP Frontend Server\Security:WarnOnAttach.
  • Set the WarnOnAttach value to 0.
  • Push out this change to all desktops that will use SAP applications with ESSO-LM.

The SAP Helper must be present for this process. Run the ESSO-LM Agent Installer, select Custom Setup, expand the Extensions tree and drill down to Logon Manager. Select SAP Helper and choose This Feature will be installed on the local hard drive. Select Next and follow the onscreen instructions to complete the installation.


Command-Line Options

You can invoke ESSO-LM from the command line to perform certain tasks.

Items in [brackets] are optional in this section only.

Task | Use/Description
Backup | ssoshell.exe /mobility /backup [path] /silent [confirm]
 | Example: [path] | The actual path to the directory where the backup file is placed. (Default: the last directory in which a command line backup file was stored, or where Shell:AutoBackupPath points.)
 | Example: silent | Do not show the Backup/Restore Wizard when performing the backup.
 | Example: [confirm] | Show all dialog boxes. When doing a silent backup where the confirm switch is not present, the user does not see the Yes/No dialog box and the Agent defaults to Yes. (Example of a confirm dialog: "Overwrite backup file?
Logon Manager | ssoshell.exe
 | Example | Show Logon Manager
No FTU | ssoshell.exe /background /noftu
 | Description | Prevents the agent from starting twice when logging on to the computer. Enable in the Userinit registry key, which is located in HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon.
 | Description | Prevents the agent from starting twice when logging on to the computer. Enable in the Userinit registry key, which is located in HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon.
 | Description | Using /noftu ensures that the agent does not run for users who do not have it in their Windows Startup folder. This allows the administrator to roll out ESSO-LM to only specific (not all) users of a particular computer.
 | Description | This command applies only to Microsoft Windows 2000/XP.
Options | ssoshell.exe /options
 | Example | Show the Settings property page.
Restore | ssoshell.exe /mobility /restore [path] /silent [confirm]
 | Example:[path] | The actual path to the directory where the backup file exists. (Default: the last directory to which a command line backup file was stored, or where Shell:AutoBackupPath points.)
 | Example: silent | Do not show the Backup/Restore Wizard when performing the backup.
 | Example: [confirm] | Show all dialog boxes. When doing a silent backup and the confirm switch is not present, the user will not see the Yes/No dialog box and the Agent will default to Yes. (Example of a confirm dialog: "Backup file has been restored")
 | Example: Notes | The restore password submitted by default is the Windows password. The restore command is executed with a startup task (see Shell\Tasks:StartupTaskN).
Setup | ssoshell.exe /setupmgr
 | Example | Show the Setup Wizard.
Shutdown | ssoshell.exe /shutdown
Startup | ssoshell.exe /background
Synchronize | ssoshell.exe /syncmgr /sync | Execute synchronization with the first synchronizer in the Sync Order list (see Synchronization in Global Agent Settings); displays a logon to connect to the first-listed synchronizer.


ssoSCDetect (smartcard monitor utility)

Smartcard Monitor Utility (ssoSCDetect.exe )

The utility program ssoSCDetect monitors a workstation's smartcard reader, making it possible to use the workstation as a multiple-user "kiosk" that can access and synchronize the remote SSO credential store of any user authenticated by a smartcard.

When a user inserts a card into the reader, the ssoSCDetect utility starts the Agent and prompts for the user's primary logon credentials. It then synchronizes the user's credentials with the remote repository. When the user logs out of the workstation (for example, by removing the card from the reader), ssoSCDetect shuts down the Agent.

To run the utility, copy the executable file ssoSCDetect.exe from the Utilities directory of the ESSO-LM CD to the installation directory (%ProgramFiles%/Passlogix/v-GO SSO) then launch the program.

Recommended Global Agent Settings for SSO Kiosk Operation

For best performance and security, the following global agent settings should be applied to the ESSO-LM Agent running on a workstation configured as a kiosk:

User Paths (Active Directory only) For best performance, specify one or more fully-qualified paths to begin searching for user accounts. See the Advanced options, under Synchronization\Active Directory.


Configuring the Windows Event Logging Server

Windows Event Logging Extension

To configure a Microsoft Windows 2000 or XP server to receive Event Log messages:

  • Install the Agent on that server.

    or

  1. Copy SSOeventmessage.dll from an Agent installation to the server, preferably in the System32 directory.
  2. Create the following registry keys under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\v-GO SSO:
Name | EventMessageFile
Type | STRING
Value | Full path to the file SSOeventmessage.dll, including filename (recommended: %WinDir%\System32\SSOeventmessage.dll)
Name | TypesSupported
Type | DWORD
Value | 7
Name | CategoryMessageFile
Type | STRING
Value | Full path to the file SSOeventmessage.dll, including filename (recommended: %WinDir%\System32\SSOeventmessage.dll)
Name | CategoryCount
Type | DWORD
Value | 4


DB2 Setup

IBM DB2 Setup

To extend the central repository schema for ESSO-LM and prepare IBM DB2 as the central repository, follow the steps in this section.

IBM DB2 Setup Requirements:

  • You must install the IBM DB2 Client on the local machine.
  • The DB2 client must have OLE DB (Object Linking and Embedding Database) support installed and configured. This support provides a set of interfaces that allow applications to uniformly access data stored in different data sources. To install OLE DB support, run the DB2 setup wizard and navigate to Client support > Interfaces > OLE DB Support. See your DB2 documentation for more information.
  • The currently logged-in user (to Windows) that is extending the schema, must have the appropriate rights to the database in order to connect to the repository and extend the schema. The DB2 User Account must have “Database Administrator Authority” rights.
  • A DB2 administrator must create a database named “vGOSSO.”
  • Refer to the IBM DB2 instructions for detailed information on any of these instructions.

Extending the database schema

  1. Open the Administrative Console.
  2. From the Repository menu, select Extend Schema.
  3. From the Connect to Repository menu, enter or select the required IBM DB2 connection information:
  4. Server name: Enter the server name.
  5. Repository Type: Select DB2 Database.
  6. Port: The port number only needs to be entered if it is not the default port (normally 50000). If the port is the default, this field can be left blank.

  7. Click OK.
You must have Administrator-level authentication to connect the console to the database server. The console connects to the database, creates the necessary objects, and confirms successful configuration.

The ‘Extend Schema’ function uses the following SQL commands to extend the schema:

CREATE SCHEMA vGOSSO;

CREATE TABLE vGOSSO.SSO_ADMIN (ConfigType VARCHAR(128) NOT NULL, Data CLOB, PRIMARY KEY(ConfigType));

CREATE TABLE vGOSSO.SSO_USERS (UserID VARCHAR(128) NOT NULL, ObjectID VARCHAR(255) NOT NULL, Data CLOB, PRIMARY KEY (UserID, ObjectID));
  8. After schema extension, grant “full” rights to SSO_USERS table and its indexes and “read-only” rights to SSO_ADMIN table and its indexes in the DB2 database.

Configuring SSO Support

  1. In the left pane of the console, right-click Repository and select Connect to from the shortcut menu.
  2. Enter or select the required connection information, then click OK.
  3. In the right pane, navigate to the root (server name).
  4. Right-click on the root and choose Configure SSO Support from the shortcut menu. The People container object will already exist under the root.
  5. Choose the Data Source of the Administrative Overrides and provide the information requested:
  6. Administrative Console. Use this wizard page to export an Agent configuration to a selected synchronizer container using the current console settings as the source.
  7. Data File. Use this wizard page to export an Agent configuration to a selected synchronizer container using one or more data files as the source.
  8. When you complete the configuration procedure, entries for any overriding settings appear in the Repository pane. Right-click on any object and choose Refresh if necessary.

Required Settings for connecting to IBM DB2 Database

You must set the Required Database Synchronization settings for all database synchronizer extensions.

To add the synchronizer and configure it for IBM DB2:

  1. Open the console and select a set of global agent settings.
  2. Expand Synchronization > DBExt > Required.
  3. Enter the following information:
    • Extension location: Make sure this is checked. It is the Path\filename of the IBM DB2 database synchronizer extension.
      Default: C:\Program Files\LocalDirectory\v-GO SSO\Plugin\SyncMgr\ DBEXT\DBExt.dll)
    • Servers: Specify the connection string for the database server in the order to attempt connection for synchronization. Select the checkbox and click ... to open the Edit List dialog box. Type the full connection string for one database server on each line; end each line by pressing Enter. Do not use any other delimiter characters.

You must specify at least one connection string for the extension to work.

To connect to an IBM DB2 database, use the following connection string:
Provider=IBMDADB2;Data Source=vGOSSO;CurrentSchema=vGOSSO;Location=<DB2ServerName>[:port];Extended Properties="trusted_connection=yes";Where <DB2ServerName> is the name of the server and [:port] is the optional port.
  4. Expand Synchronization > DBExt > Advanced. The Advanced Database Synchronization settings control special-case options for all database synchronizer extensions. This setting is not required.

Append Domain when naming objects: Enables appending of the user's domain to the username in naming the user's container. Example: For the domain "company" and user "user1", the container is named "user1" with this flag disabled and "user1.company" with this flag enabled. Default is set to Disable. Select Enable to activate this feature.


Error Loop Quick Reference

This section serves as a quick-reference to the basic Error Loop settings.

Configure these settings in the Administrative Console. The table is provided only for reference.

The settings are inherited downward from global to application type to application. More-specific settings override more-general (application overrides application type, which overrides global).

For security settings (for example, MaskPW), the most-secure setting is used, regardless of whether it is set globally, for an application type, or for an application.

Place the application-type settings in the entlist.ini [*Root] section.

Example

[*Root]

AppsTimeout=8

WebMaxRetry=3

Place the Application settings in the specific application's entlist.ini section.

Example

[Payroll]

WindowTitle1=Payroll

MaxRetry=3

Timeout=30

IDCtrl=203

...

Global (Registry) | Application Type ([*Root])
Parameter Purpose | Extensions\ AccessManager\ Dlg | Windows | Web | Host/Mainframe | Application | Default
Max # of retries (after first try) beforeError Loopdialog box appears | MaxRetry | AppsMaxRetry | WebMaxRetry | MainframeMaxRetry | MaxRetry | 1
Max time between successive logon attempts beforeError Loop dialog box appears | Timeout | AppsTimeout | WebTimeout | MainframeTimeout | Timeout | 30
Setting to indicate whether to hide the password confirmation field in theError Loop dialog box | HideConfirmPW | AppsHideConfirmPW | WebHideConfirmPW | MainframeHideConfirmPW | HideConfirmPW | 0 (do not hide)


MSI Package Contents

This section documents the basic contents of each package feature. The Display Name and Description are as in the Custom display of the Installer. For the exact feature details, review the package.

Any child package requires all parent packages. For example, LDAP_Sync requires SyncMgr.

Required features are in bold. In addition, at least one authenticator must be installed, though it need not be one of the Oracle-shipped authenticators. All other features are optional. However, Oracle recommends installation of the Internet Explorer component.

Display Name | Description | Feature Name
Application | Required files and settings | Core
Logon Methods | SSO authentication support | Authenticators
Windows Logon | The Microsoft Windows Authenticator | SLA
Windows Logon v2 | The Microsoft Windows Authenticator version 2 | MSauth
GINA | Oracle GINA (required with Windows Authenticator v2) | SSOGina
LDAP | The LDAP Authenticator | LDAP
LDAP v2 | The LDAP Authenticator version 2 | LDAPauth
Authentication Manager | Multiple authentication support | MultiAuth
Extensions | ESSO-LM Plug-ins | Extensions
Backup/Restore Manager | Plug-in for backup/restore of ESSO-LM credentials and settings | BackupMgr
Logon Manager | Plug-in for logon/credential request events | LogonMgr
Internet Explorer Helper | Internet Explorer credential request integration | InternetExplorer
Mozilla Browser Helper | Mozilla Firefox credential request integration | MozillaHelper
Mainframe Emulator Helper | Mainframe session credential request emulator integration | MainframeEmulators
Console Window Support | Support for Console windows (command prompt) within ESSO-LM's mainframe plug-in |
Legacy Emulator Support | Support for 16-bit legacy HLLAPI-based emulators |
Java Helper | Java virtual machine session credential request integration | JavaHelper
SAP Helper | SAP application credential request integration | SAPHelper
Setup Manager | Plug-in for initial ESSO-LM experience setup | SetupMgr
Synchronization Manager | Plug-in for synchronization of credentials and settings to/from additional data sources | SyncMgr
Active Directory Synchronizer | Active Directory synchronization support | AD_Sync
LDAP Synchronizer | LDAP directory synchronization support | LDAP_Sync
ADAM Synchronizer | Active Directory/Application Mode synchronization support | ADAM_sync
File System Synchronizer | File System synchronization support | File_Sync
Database Synchronizer | SQL relational database synchronization support | DB_Sync
Roaming Profile Sync | Roaming Profile synchronization support |
Event Manager | Plug in for Event Manager | EventMgr
XML | Plug in for the Local File Extension | LocalFileExt
Windows Event Extension | Plug in for the Windows Event Extension | WindowsEventExt


ftulist.ini Keys

ftulist.ini determines special actions the Agent will take the first time a user starts it. The file can exist as a local file or as a directory server or database object. If it is deployed using synchronization, ftulist.ini is placed in the %AppData/Passlogix% directory.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini) can only be created and edited using the Administrative Console. The information in the topics listed below is provided only for reference.

The tables in the following topics list the keys and acceptable values for each section of ftulist.ini:

  • Root Keys for ftulist.ini
  • Password Windows Section Keys
  • My Logons Section Keys
  • Bulk Add Logon Section Keys


Root Keys for ftulist.ini

Root Keys

These settings are used strictly within the [FTU] section and are required.

Example

[FTU]

Ver=20020523

Step1=Password Windows

Step2=My Logons

First-Time Use Keys | Description | Acceptable values
Ver = %s | Required. String of the date of the last ftulist.ini file. If the value of this key is higher (newer) than the decimal value in the user's registry (in HKCU\&\Extensions\SetupManager:Completed), then the user will see the bulk add list the next time the user starts up the agent. Example: 20020523 | %s = string representing the decimal equivalent of a date in yyyymmdd (year-month-date) format, as in 20020523 for May 23, 2002.
Step1 = %s | Required, do not alter. Calls the section that launches Primary Logon Method. This module forces the user to select an authenticator. | %s = "Password Windows"
Step2 = %s | Required, do not alter. Calls the section that launches Access Manager. This module enables bulk adding of credentials. | %s = "My Logons"


Password Windows Section Keys

These settings are required and used strictly within the Password Windows section.

Example

[Password Windows]

ExtensionName=<core>

Action1=Password Window

First-Time Use Keys | Description | Acceptable values
ExtensionName = %s | Required, do not alter. Internal name of the extension module. | %s = "<core>"
Action1 = %s | Required, do not alter. Launches primary logon method. This module forces the user to select an authenticator. | %s = "Password Window"


My Logons Section Keys

These settings are required and used strictly within the [My Logons] section.

Example

[My Logons]

ExtensionName=AccessManager

Section1=Corporate Win App

Section2=Intranet

&

First-Time Use Keys | Description | Acceptable values
ExtensionName = %s | Required, do not alter. Internal name of the extension module. | %s = "AccessManager"
Section%d = %s | Required, do not alter. Specifies logons to include in the bulk add wizard. | %d = consecutive integers %s = application logon section name; link to relevant logon class section


Bulk Add Logon Section Keys

These settings are required and used in each bulk-add logon section.

Example

[My Logons]

ExtensionName=AccessManager

Section1=Corporate Win App

Section2=Intranet

[Intranet]

ConfigKey=*Other Webs

ConfigName=Corporate Intranet

FTU_NeedID=0

FTU_NeedOther=0

FTU_NeedPwd=1

FTU_CONFIRMID=0

FTU_CONFIRMOTHER=0

FTU_CONFIRMPASSWORD=1

URL=Corp Intranet

First-Time Use Keys | Description | Acceptable Values
ConfigKey = %s | Link to logon configuration in entlist.ini | %s = application logon section name in entlist.ini or applist.ini. Use [*Mainframe] for host/mainframe logons, [*Other Webs] for Web logons, [*Online Services] for Online service logons, and [*Other Apps] for other Windows application logons.
ConfigName = %s | The name to use in the First-Time Use Wizard to describe the logon. | %s = application logon name
Description = %s | The name to use in Logon Manager to describe the logon. | %s = application logon name
FTU_CONFIRMID = %b | Flag indicating if the First-Time Use Wizard will require the user to confirm username/ID (optional). | %b = 0, user will not have to confirm username/ID (default) %b = 1, user will have to confirm username/ID
FTU_CONFIRMOTHER = %b | Flag indicating if the First-Time Use Wizard will require the user to confirm a third field, if one exists (optional). | %b = 0, user will not have to confirm third field (default) %b = 1, user will have to confirm third field
FTU_CONFIRMPASSWORD = %b | Flag indicating if the First-Time Use Wizard will require the user to confirm password (optional). | %b = 0, user will not have to confirm password (default) %b = 1, user will have to confirm password
FTU_NeedID = %b | Flag to indicate whether the application requires a username/ID. | %b = 0, application does not require a username/ID %b = 1, logon requires a username/ID (default)
FTU_NeedOther = %b | Flag to indicate whether the application requires a third field (optional). | %b = 0, application does not require a third field (default) %b = 1, application requires a third field
FTU_NeedPwd = %b | Flag to indicate whether the application requires a password. | %b = 0, application does not require a password %b = 1, logon requires a password (default)
URL = %s | Section name in entlist.ini for a Web or Host application, or URL for a Web site that is not predefined in entlist.ini. | %s = Web/Host section name or Web URL


entlist.ini Keys

Keys for entlist.ini

The administrator designates the directory where the entlist.ini file resides. In most instances, this should be a subdirectory under the ESSO-LM program directory.

All ESSO-LM configuration files (including entlist.ini and ftulist.ini) can only be created and edited using the Administrative Console. The information in the topics listed below is provided only for reference.

This is also the format for synchronizer objects that override local entlist.ini files.

A directory-based object causes the agent to ignore any local entlist.ini file. The remote object (if it exists) overwrites a local entlist.ini file when downloaded.

Then, entlist.ini is merged with applist.ini to create a new file (aelist.ini) in the %AppData%\Passlogix directory. The aelist.ini file is overwritten periodically, including when ESSO-LM launches, when it re-merges applist.ini and entlist.ini. The agent then uses aelist.ini to detect known applications.

The tables in the following topics list the keys and acceptable values for each section of entlist.ini.

  • Root Keys for entlist.ini
  • Windows Application Keys
  • Web Application Keys
  • Host/Mainframe Application Keys
  • Password Policy Keys


Root Keys for entlist.ini

Root Keys

These settings are used strictly within the [*Root] section.

Example

[*Root]

Section1=*Other Apps

Section2=*Other Webs

Section3=*Mainframe

AppsMaxRetry=1

WebMaxRetry=3

HostMaxRetry=2

WebTimeout=90

&

Global Application Keys Description Acceptable values

[*Root]

Root section, from which application types (logon classes) are derived.

N/A

AppsHideConfirmPW = %b

Indicates whether to hide the password confirmation field in the Logon Error dialog for all Windows applications.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

AppsMaxRetry = %d

Indicates the number of logon retries for all Windows applications the agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

AppsTimeout = %d

Indicates the maximum time between successive logon attempts that will trigger Error Loop detection for all Windows applications.

%d = amount of time in seconds (default: 30)

MainframeHideConfirmPW = %b

Indicates whether to hide the password confirmation field in the Logon Error dialog box for all Host applications.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

MainframeMaxRetry = %d

Indicates the number of logon retries for all Host applications the agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

MainframeTimeout = %d

Indicates the maximum time between successive logon attempts that will trigger Error Loop detection for all Host applications.

%d = amount of time in seconds (default: 30)

Section%d = %s

Declaration of supported subsections.

Because *Other Webs, *Online Services, and *Other Apps are defined in applist.ini, they need not be defined in [*Root] in entlist.ini.

%d = consecutive integers
%s = *Other Apps | (Windows applications)
%s = *Mainframe | (Host/Mainframe applications)
%s = *Other Webs | (Predefined Web applications)
%s = *Online Services

WebHideConfirmPW = %b

Indicates whether to hide the password confirmation field in the Logon Error dialog for all Web applications.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

WebMaxRetry = %d

Indicates the number of logon retries for all Web applications the agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

WebTimeout = %d

Indicates the maximum time between successive logon attempts that will trigger Error Loop detection for all Web applications.

%d = amount of time in seconds (default: 30)

Application Type Section Keys

These settings are used for the Windows, Web, and Host application sections that delineate the list of predefined applications.

Example

[*Other Apps]

Section1=Corporate WinApp

&

[*Other Webs]

Section1=Corporate Intranet

&

[*Mainframe]

Section1=Corporate Mainframe

Global Application Keys Description Acceptable Values

[%s]

Section heading that identifies an application category section.

%s = [*Other Apps] | (Windows applications)
%s = [*Mainframe] | (Host/Mainframe applications)
%s = [*Other Webs] | (Predefined Web applications)

Section%d = %s

Declaration of application sections.

%d = consecutive integers

%s = section name


Windows Application Keys

These settings are used within applications delineated in the [*Other Apps] section.

Example

[*Other Apps]

Section1=Corporate WinApp

&

[Corporate WinApp]

(the keys below)

Windows Application Keys Description Acceptable Values

AllowReveal = %b

Flag that enables or disables the Reveal button for password in Wizards and property pages.

%b = 0; disabled

%b = 1; enabled (default)

AppPathKey%d = %s

Windows registry key identifying the application associated with a logon to match against running processes. Used in combination with the WindowTitle for exact matching of logon requests. %d is replaced with a number, starting at 1, so that multiple registry keys can be associated with a single logon.

%d = consecutive integers

%s = application name string used in Windows registry
(typically corresponds to executable name)

AutoOK = %b

Flag instructs the agent to automatically select OK for this application logon after insertion of logon data.

%b = 0; disabled

%b = 1; enabled (default)

ChangeTitle%d = %s

Text matched against password change window titles to identify password change requests. %d is replaced with a number, starting at 1, so that multiple windows can be identified for a single password change request.

There must be a duplicate WindowTitle entry for each ChangeTitle entry.

%d = consecutive integers

%s = window title string

ChgCtrl0 = %d

Control ID used to identify the username/ID field in a password-change request window.

%d = -1; change request does not require a username/ID

%d = 1; change request requires a username/ID, but it will be sent to the application using Send Keys. If this value is 1, all other Control IDs (IDCtrl, PassKeyCtrl, OtherCtrl1, OtherCtrl2, OKCtrl, ChgCtrl1, ChgCtrl2, and ChgCtrl3) must also be 1 or -1.

%d = 2 - 99,999; control ID value

ChgCtrl1 = %d

Control ID used to identify the old password field in a password change request window.

%d = -1; change request does not require an old password

%d = 1; change request requires a password, but it will be sent to the application using Send Keys. If this value is 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; control ID value

ChgCtrl2 = %d

Control ID used to identify the new password field in a password change request window.

%d = -1; change request does not require a new password.

%d = 1; change request requires a password, but it will be sent to the application using Send Keys. If this value is 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; control ID value

ChgCtrl3 = %d

Control ID used to identify the password confirmation field in a password change request window.

%d = -1; change request does not require a "confirm new password" entry.

%d = 1; change request requires a "confirm new password" entry, but it will be sent to the application using SendKeys. If this value is 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; control ID value

ConfigName = %d

Control ID identifying the control that contains the text used to create the initial configuration name when the user adds this logon.

%d = 1 - 99,999; control ID value

CPWFlag = %d

Determines the behavior of the Password Change Wizard, for specific applications, when a user encounters a password-change request. This key is specified in the application's root section, not in a password-change subsection.

This setting can also be set globally, for all applications, via the Registry. See for instructions.

%d = 1; Prompts user with Password Change Wizard (default).

%d = 2; Prompts user to manually enter a new password, but also provides the option of having the agent automatically generate the password.

%d = 4; Generates the new password automatically, but also provides the option of manually creating the new password.

%d = 10; Prompts user to manually enter a new password, without providing the option of having the agent automatically generate the password.

%d = 12; Generates the new password automatically, without providing the option of manually creating the new password.

CtrlOrder = %s1, %s2, %s3&

Determines the order in which fields are sent when UseSendKeys is enabled. For example, specifying CtrlOrder = OtherCtrl1, IDCtrl, PassKeyCtrl tells the agent that the tab order in the dialog box should be OtherCtrl1, then IDCtrl, followed by PassKeyCtrl.

For logons, the default order is IDCtrl, PassKeyCtrl, OtherCtrl1, OtherCtrl2.

Tony/Drew: What is CtrlOrder default for password change scenario?

For password changes, the default order is ChgCtrl0, ChgCtrl1, ChgCtrl2, ChgCtrl3.

This setting applies only when UseSendKeys is enabled and works only with Windows applications.

%s1 = The first field sent

%s2 = The second field sent

%s3 = The third field sent

etc.

Description = %s

Text describing this application, also stored in the Description field in Logon Manager.

%s = any string

ExtMap = %s

Windows file extension associated with a logon. Allows the agent to map an icon to the configuration.

%s = three-character string for file extension

ForceReauth = %b

Force the user to reauthenticate before providing credentials to this application.

Applies to all subsections; the user would have to reauthenticate multiple times in a multiple-section password change scenario.

%b = 0; do not require reauthentication (default)

%b = 1; require reauthentication

Group = %s

Group section name that this application is a part of. Used when configuring for credential sharing groups. Special values include:

LDAP: Application uses LDAP Directory Server authenticator password.

Domain: Application uses the Windows authenticator password.

Must set Windows Registry entry PWSEnable=1 to enable Groups

%s = the section name of the application group that the application belongs to.

HideConfirmPW = %b

Determines whether to hide the password confirmation field in the Logon Error dialog box.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

IDCtrl = %d

Identifies the username/ID control field and/or the mechanism to provide the username/ID data to the appropriate username/ID control.

%d = 0; the user must use the Agent's "teaching tool" mechanism during application setup (default)

%d = -1; application does not require a username/ID

%d = 1; application requires a username/ID, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs (PassKeyCtrl, OtherCtrl1, OtherCtrl2, OKCtrl, ChgCtrl0, ChgCtrl1, ChgCtrl2, and ChgCtrl3) must also be 1 or -1.

%d = 2 - 99,999; username/ID control ID value

IDCtrlType = %d

Identifies the control type of the username/ID control field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

IgnoreClassName = %s

Identifies the class name of the logon or password-change window that should be ignored when submitting credentials. Used in cases where an application contains a second, hidden logon or password-change window.

%s = class name string

InteractionMode = %b

Prevents the agent from attaching to the application's window's message queue.

%b = 0; disabled (default)

%b = 1; enabled

Match%d = %s

Maps to a matching section for the application. Use this method if the same application has multiple logon and password change screens. This is most useful when one set of user credentials is for multiple screens within an application. By using this method, the matching sections could be set up for logons, password change (pick and manual), and ignores.

%d = consecutive integers

%s = application logon name (logon definition sections)

MaxRetry = %d

Determines the number of logon retries the agent makes before displaying the Logon Error dialog box.

%d = the number of retries (default: 1)

ModuleName%d = %s

Application module name associated with a logon to match against running processes. Used in conjunction with WindowTitle key to identify a specific application logon or password-change request. %d is replaced with a number, starting at 1, so that multiple application modules can be associated with a single logon.

%d = consecutive integers

%s = application name string
(typically corresponds to executable name)

OKCtrl = %d

Identifies the control ID of the OK button for this application.

%d = 1; use the agent's internal logic (default)

%d = 2 - 99,999; OK button control ID

%d = -1; requires the user to manually select OK

OtherCtrl1 = %d

Identifies the control ID of a third logon field and/or the mechanism to provide the additional field data to the appropriate control.

%d = -1; application does not require a third field

%d = 1; application requires a third field, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; third field control ID value; can be any value if Send Keys is used

OtherCtrl1Type = %d

Identifies the control type of a third logon field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

OtherCtrl2 = %d

Identifies the control ID of a fourth logon field and/or the mechanism to provide the additional field data to the appropriate control.

%d = -1; application does not require a fourth field

%d = 1; application requires a fourth field, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; fourth field control ID value; can be any value if Send Keys is used

OtherCtrl2Type = %d

Identifies the control type of a fourth logon field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

OtherLabel1 = %s

The text label used by the agent when displaying a third logon field.

%s = the text the agent will display

OtherLabel2 = %s

The text label used by the agent when displaying a fourth logon field.

%s = the text the agent will display

ParentKey1 = %s

Maps a subsection to its parent section.

%s = parent application/section name

PassKeyCtrl = %d

Identifies the password control field and/or the mechanism to provide the password data to the appropriate password control.

%d = 0; the user must use the agent's "teaching tool" mechanism during application setup

%d = -1; application does not require a password

%d = 1; application requires a password, but it will be sent to the application using Send Keys. If this value is set to 1, all other Control IDs must also be 1 or -1.

%d = 2 - 99,999; password control ID value; can be any value if Send Keys is used

PassKeyCtrlType = %d

Identifies the control type of the password control field.

%d = 0; edit control (default)

%d = 1; combobox control

%d = 2; listbox control

PassPolicy = %s

Identifies which password policy section to associate with this application logon configuration.

%s = Policy Section Name

PresetFocusAll = %b

Specifies whether to set the focus to a logon field before the agent actually places data in that field.

%b = 0; disabled (default)

%b = 1; enabled

QuietGenerator = %b

When set, this flag instructs the agent to handle password change requests automatically and not inform the user that a password change request has been handled.

%b = 0; do not use quiet generator, use standard password change process with user intervention (default)

%b = 1; use quiet generator

Section%d = %s

Declaration of application subsections.

%d = consecutive integers

%s = subsection name

SystemLogon = %b

RESERVED. Flag identifying if a logon section is a system logon section.

%b = 0; not a system logon section (default)

%b = 1; system logon section

Timeout = %d

Determines the maximum time period between successive logon attempts that will trigger Error Loop detection.

%d = amount of time in seconds (default: 30)

UseSendKeys = %b

Send fields via keystrokes to the application.

If UseSendKeys is selected, then IDCtrl, PassKeyCtrl, OtherCtrl1, OtherCtrl2, and (if present) ChgCtrl0, ChgCtrl1, ChgCtrl2, and ChgCtrl3 variables must all be set to 1, if needed.

%b = 0; do not use Send Keys; use control IDs (default)

%b = 1; use Send Keys

VTabKey%d0 = %d1

Specifies the character/delay sequence to send before/after each credential field.

Fields are sent in the order specified by CtrlOrder.

UseSendKeys must also be enabled.

To send nothing for the specified value, specify a value of `` (two back-quotes in a row).

%d0 = 1; sequence to send before the first credential field

%d0 = 2; sequence to send after the first field, before the second

- so on; %d is not bound.

%d1 = Code sequence to send (see) (default: standard tab key)

VTabKeyPWC%d0 = %d1

Specifies the character/delay sequence to send before/after each credential field.

Fields are sent in the order specified by CtrlOrder.

UseSendKeys must also be enabled.

To send nothing for the specified value, specify a value of `` (two back-quotes).

%d0 = 1; sequence to send before the first credential field

%d0 = 2; sequence to send after the first field, before the second

- so on; %d is not bound.

%d1 = Code sequence to send (see) (default: standard tab key)

WindowTitle%d = %s

Text matched against logon window titles to identify logon requests. %d is replaced with a number, starting at 1, so that multiple windows can be identified for a single logon.

%d = consecutive integers

%s = window title string

Windows Application Keys for SectionN Subsection

These settings are used within subsections delineated by SectionN.

Example

[Corporate WinApp]

Section1=~Corporate WinApp Logon

Section2=~Corporate WinApp Password Change

&

[~Corporate WinApp Logon]

(the keys below)

Windows Application Keys | Description | Acceptable values
AppPathKey%d = %s | (See in parent section, above) | (See in parent section, above)
ChangeTitle%d = %s | (See in parent section, above) | (See in parent section, above)
ChgCtrl0 = %d | (See in parent section, above) | (See in parent section, above)
ChgCtrl1 = %d | (See in parent section, above) | (See in parent section, above)
ChgCtrl2 = %d | (See in parent section, above) | (See in parent section, above)
ChgCtrl3 = %d | (See in parent section, above) | (See in parent section, above)
CtrlOrder = %s1, %s2, %s3& | (See in parent section, above) | (See in parent section, above)
IDCtrl = %d | (See in parent section, above) | (See in parent section, above)
IDCtrlType = %d | (See in parent section, above) | (See in parent section, above)
IgnoreClassName = %s | (See in parent section, above) | (See in parent section, above)
InteractionMode = %b | (See in parent section, above) | (See in parent section, above)
Match%d = %s | (See in parent section, above) | (See in parent section, above)
ModuleName%d = %s | (See in parent section, above) | (See in parent section, above)
OKCtrl = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl1 = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl1Type = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl2 = %d | (See in parent section, above) | (See in parent section, above)
OtherCtrl2Type = %d | (See in parent section, above) | (See in parent section, above)
ParentKey1 = %s | (See in parent section, above) | (See in parent section, above)
PassKeyCtrl = %d | (See in parent section, above) | (See in parent section, above)
PassKeyCtrlType = %d | (See in parent section, above) | (See in parent section, above)
VTabKey%d0 = %d1 | (See in parent section, above) | (See in parent section, above)
VTabKeyPWC%d0 = %d1 | (See in parent section, above) | (See in parent section, above)
UseSendKeys = %b | (See in parent section, above) | (See in parent section, above)
WindowTitle%d = %s | (See in parent section, above) | (See in parent section, above)

Windows Application Keys for MatchN Subsection

These settings are used within subsections delineated by MatchN.

Example

[Corporate WinApp

Section1=~Whatever subsection

Match1=~Corporate WinApp Logon Match

Match2=~Corporate WinApp Ignore Match

&

[~Corporate WinApp Ignore Match]

(the keys below)

Match Section Keys Description Acceptable values

ChangeTitle%d = %s

(See in parent section, above)

(See in parent section, above)

ChgCtrl0 = %d

(See in parent section, above)

(See in parent section, above)

ChgCtrl1 = %d

(See in parent section, above)

(See in parent section, above)

ChgCtrl2 = %d

(See in parent section, above)

(See in parent section, above)

ChgCtrl3 = %d

(See in parent section, above)

(See in parent section, above)

Field%d0 = %d1,%s1,%s2,%s3

The match criteria for the fields. %d1 is replaced with a number, starting at 1, so that multiple matching criteria could be set up for one screen. %d2 is replaced with the control ID of the matching criteria. %s1 is replaced with the control type. %s2 is replaced with the comparison operator. %s3 is replaced with the compare value.

%d0 = consecutive integers

%d1 = control ID of the matching criteria

%s1 = the control type could be the following, with the appropriate value in %s3:

text | actual text from the control
style | numeric value for the style of the control
class | the class of the control, usually Edit or Static
Edit | edit or combobox controls
Static | static controls (for example, text labels).

%s2 = the comparison operator could be the following:

EQ | equals
NE | not equal

%s3 = compared value

IDCtrl = %d

(See in parent section, above)

(See in parent section, above)

OKCtrl = %d

(See in parent section, above)

(See in parent section, above)

OtherCtrl1 = %d

(See in parent section, above)

(See in parent section, above)

OtherCtrl2 = %d

(See in parent section, above)

(See in parent section, above)

ParentKey1 = %s

(See in parent section, above)

(See in parent section, above)

PassKeyCtrl = %d

(See in parent section, above)

(See in parent section, above)

Type = %s

The type of event.

%s = string for the type:

Logon | logon events
Change | password change events
Confirm | confirm the new password
Ignore | bypass all events for the application

WindowTitle%d = %s

(See in parent section, above)

(See in parent section, above)


Host/Mainframe Application Keys

These settings are used within applications delineated in the [*Mainframe] section.

For all keys below that have row/column values, the row/column value starts at 1 (that is, top-left is 1,1).

For Telnet the value must be 1,1.
Example

[*Mainframe]

Section1=Corporate Mainframe

&

[Corporate Mainframe]

(the keys below)

Host Application Keys Description Acceptable values

AllowReveal = %b

Flag that enables or disables the Reveal button for password in Wizards and property pages.

%b = 0; disabled

%b = 1; enabled (default)

AltTabKey = %d

Flag to indicate how to send credentials to the host emulator. Normally, credentials are sent through a direct HLLAPI call but this setting specifies using another method. If this is set to 1, then Enter is pressed in between two fields. This is usually used for password change screens that separate the new password and confirmation password into two screens.

%d=1 is usually used for password-change scenarios that separate the new-password field and confirm-password into two screens.

%d = 0; Use HLLAPI to submit credentials directly to the credential fields (default).

%d = 1; Replace the Tab key with the Enter key between two fields.

%d = 2; Use HLLAPI SendKeys and enable support for CtrlOrder, PreKey, and TabKeyN. This is useful for logon scenarios with non-standard credential delimiters.

AutoOK = %b

Flag instructs the agent to automatically send Enter for this application logon after insertion of logon data.

%b = 0; disabled

%b = 1; enabled (default)

CPWFlag = %d

Determines the behavior of the Password Change Wizard, for specific applications, when a user encounters a password-change request. This key is specified in the application's root section, not in a password-change subsection.

This setting can also be set globally, for all applications, via the Registry. See for instructions.

%d = 1; Prompts user with Password Change Wizard (default).

%d = 2; Prompts user to manually enter a new password, but also provides the option of having the agent automatically generate the password.

%d = 4; Generates the new password automatically, but also provides the option of manually creating the new password.

%d = 10; Prompts user to manually enter a new password, without providing the option of having the agent automatically generate the password.

%d = 12; Generates the new password automatically, without providing the option of manually creating the new password.

CtrlOrder = %s1,%s2,%s3,%s4,%s5

Determines the order in which fields are sent when AltTabKey=2.

For example, specifying CtrlOrder=OtherField1,IDField,PassField tells the agent that the order in the dialog box should be OtherField1, then IDField, followed by PassField.

%s1 = The first field sent (default: IDField)

%s2 = The second field sent (default: PassField)

%s3 = The third field sent (default: OtherField1)

%s4 = The fourth field sent (default: NewPWField)

%s5 = The fifth field sent (default: NewPWField2)

%s5 = The sixth field sent (default: OtherField2)

DelayField = %d

Numeric value in milliseconds for the agent to delay between actions (entering value into a field).

%d = integer value in milliseconds

Description = %s

Text describing this application, also stored in the Description field in Logon Manager.

%s = any string

Field%d0 = %d1, %d2, %s

Strings to match against text fields as displayed on the screen for identifying a host/mainframe logon. %d0 is replaced with a number, starting at 1, so that multiple text strings can be used to uniquely identify a logon. For Telnet applications, the values must be 1,1.

%d0 = consecutive integers

%d1 = row of first text string character

%d2 = column of first text string character

%s = text string

ForceReauth = %b

Force the user to reauthenticate before providing credentials to this application.

Applies to all subsections; the user would have to reauthenticate multiple times in a multiple-section password change scenario.

%b = 0; do not require reauthentication (default)

%b = 1; require reauthentication

Group = %s

Group section name that this application is a part of. Used when configuring for credential sharing groups. Special values include:

LDAP: Application uses LDAP Directory Server authenticator password.

Domain: Application uses the Windows authenticator password.

Refer to for detailed instructions.

Must set Windows Registry entry PWSEnable=1 to enable Groups.

%s = the section name of the application group that the application belongs to.

HideConfirmPW = %b

Determines whether to hide the password confirmation field in the Logon Error dialog.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

IDField = %d1, %d2

Location of first input character of username/ID field as displayed on a host/mainframe logon screen. For Telnet applications, this value is ignored and is optional. Set to 1,0 if the field is not present.

%d1 = row of first text string character

%d2 = column of first text string character

MaxRetry = %d

Determines the number of logon retries the agent makes before displaying the Logon Error dialog.

%d = the number of retries (default: 1)

NewPWField = %d1,%d2

This is the key-value pair that identifies the location of the new password field.

%d1 = row of first text string character

%d2 = column of first text string character

NewPWField2 = %d1,%d2

This is the key-value pair that identifies the location of the new password confirmation field. This is optional. This is not necessary if only one new password field is required.

%d1 = row of first text string character

%d2 = column of first text string character

OtherField1 = %d1, %d2

Location of first input character of third logon field as displayed on a host/mainframe logon screen. For Telnet applications, this value is ignored and is optional.

%d1 = row of first text string character

%d2 = column of first text string character

OtherField2 = %d1, %d2

Location of first input character of fourth logon field as displayed on a host/mainframe logon screen. For Telnet applications, this value is ignored and is optional.

%d1 = row of first text string character

%d2 = column of first text string character

OtherLabel1 = %s

The label presented within the agent for the third logon field.

%s = text string

OtherLabel2 = %s

The label presented within the agent for the fourth logon field.

%s = text string

Page%d = %s

Pointer to subsections used for multiple pages for one host/mainframe application. One application logon may have multiple pages.

%d = consecutive integers

%s = name of the subsection

ParentKey1 = %s

Maps a subsection to its parent section.

%s = parent application/section name

PassField = %d1, %d2

Location of first input character of password field as displayed on a host/mainframe logon screen. For Telnet applications, the values must be 1,1. Set to 1,0 if the field is not present.

%d1 = row of first text string character

%d2 = column of first text string character

PassPolicy = %s

Identifies which password policy section to associate with this application logon configuration.

%s = Policy Section Name

PreKey = %d

A string of characters and mnemonics defining what should be sent prior to any credential submission.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

QuietGenerator = %b

When set, this flag instructs the agent to handle password change requests automatically and not inform the user that a password change request has been handled.

%b = 0; do not use quiet generator, use standard password change process with user intervention (default)

%b = 1; use quiet generator

TabKey1 = %d

A string of characters and mnemonics defining what should be sent after IDField is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey2 = %d

A string of characters and mnemonics defining what should be sent after PassField is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey3 = %d

A string of characters and mnemonics defining what should be sent after OtherField1 is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey4 = %d

A string of characters and mnemonics defining what should be sent after NewPWField is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey5 = %d

A string of characters and mnemonics defining what should be sent after NewPWField2 is submitted.

Any combination of characters and/or ASCII mnemonics. Maximum length is 25 characters.

TabKey6 = %d

A string of characters and mnemonics defining what should be sent after OtherField2 is submitted.

Any combination of characters and/or ASCII mnemonics Maximum length is 25 characters.

Timeout = %d

Determines the maximum time period between successive logon attempts that will trigger error loop detection.

%d = amount of time in seconds (default: 30)

Host Applications: Keys for PageN Subsection

These settings are used within subsections delineated by PageN.

Example

[Corporate Mainframe]

Page1=~Corporate Mainframe Logon

Page2=~Corporate Mainframe Password Change

[~Corporate Mainframe Logon]

(the keys below)

Host Application Keys | Description | Acceptable values
AllowReveal = %b | (See in parent section, above) | (See in parent section, above)
AltTabKey = %d | (See in parent section, above) | (See in parent section, above)
AutoOK = %b | (See in parent section, above) | (See in parent section, above)
CPWFlag = %d | (See in parent section, above) | (See in parent section, above)
CtrlOrder = %s1,%s2,%s3,%s4,%s5 | (See in parent section, above) | (See in parent section, above)
DelayField = %d | (See in parent section, above) | (See in parent section, above)
Description = %s | (See in parent section, above) | (See in parent section, above)
Field%d0 = %d1, %d2, %s | (See in parent section, above) | (See in parent section, above)
ForceReauth = %b | (See in parent section, above) | (See in parent section, above)
Group = %s | (See in parent section, above) | (See in parent section, above)
HideConfirmPW = %b | (See in parent section, above) | (See in parent section, above)
IDField = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
MaskPW = %b | (See in parent section, above) | (See in parent section, above)
MaxRetry = %d | (See in parent section, above) | (See in parent section, above)
NewPWField = %d1,%d2 | (See in parent section, above) | (See in parent section, above)
NewPWField2 = %d1,%d2 | (See in parent section, above) | (See in parent section, above)
OtherField1 = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
OtherField2 = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
OtherLabel1 = %s | (See in parent section, above) | (See in parent section, above)
OtherLabel2 = %s | (See in parent section, above) | (See in parent section, above)
Page%d = %s | (See in parent section, above) | (See in parent section, above)
ParentKey1 = %s | (See in parent section, above) | (See in parent section, above)
PassField = %d1, %d2 | (See in parent section, above) | (See in parent section, above)
PassPolicy = %s | (See in parent section, above) | (See in parent section, above)
PreKey = %d | (See in parent section, above) | (See in parent section, above)
QuietGenerator = %b | (See in parent section, above) | (See in parent section, above)
TabKey1 = %d | (See in parent section, above) | (See in parent section, above)
TabKey2 = %d | (See in parent section, above) | (See in parent section, above)
TabKey3 = %d | (See in parent section, above) | (See in parent section, above)
TabKey4 = %d | (See in parent section, above) | (See in parent section, above)
TabKey5 = %d | (See in parent section, above) | (See in parent section, above)
Timeout = %d | (See in parent section, above) | (See in parent section, above)


Web Application Keys

These settings are used within applications delineated in the [*Other Webs] section.

Example

[*Mainframe]

Section1=Corporate Mainframe

&

[Corporate Mainframe]

(the keys below)

Web Application Keys Description Acceptable values

AllowReveal = %b

Flag that enables or disables the Reveal button for password in Wizards and property pages.

%b = 0; disabled

%b = 1; enabled (default)

AutoOK = %b

Flag instructs the agent to automatically send Enter for this application logon after insertion of logon data.

%b = 0; disabled

%b = 1; enabled (default)

CPWFlag = %d

Determines the behavior of the Password Change Wizard, for specific applications, when a user encounters a password-change request. This key is specified in the application's root section, not in a password-change subsection.

This setting can also be set globally, for all applications, using the Registry.

%d = 1; Prompts user with Password Change Wizard (default).

%d = 2; Prompts user to manually enter a new password, but also provides the option of having the agent automatically generate the password.

%d = 4; Generates the new password automatically, but also provides the option of manually creating the new password.

%d = 10; Prompts user to manually enter a new password, without providing the option of having the agent automatically generate the password.

%d = 12; Generates the new password automatically, without providing the option of manually creating the new password.

Description = %s

Text describing this application, also stored in the Description field in Logon Manager.

%s = any string

ForceReauth = %b

Force the user to reauthenticate before providing credentials to this application.

Applies to all subsections; the user would have to reauthenticate multiple times in a multiple-section password change scenario.

%b = 0; do not require reauthentication (default)

%b = 1; require reauthentication

Group = %s

Group section name that this application is a part of. Used when configuring for credential sharing groups. Special values include:

LDAP: Application uses LDAP Directory Server authenticator password.

Domain: Application uses the Windows authenticator password.

Refer to for detailed instructions.

Must set Windows Registry entry PWSEnable=1 to enable Groups.

%s = the section name of the application group that the application belongs to.

HideConfirmPW = %b

Determines whether to hide the password confirmation field in the Logon Error dialog.

%b = 0; do not hide confirmation field (default)

%b = 1; hide confirmation field

IDField = %s1,%s2,%s3,%s4

Identification of the field for entering a username/ID.

If a frame/form/field name consists solely of digits, the enumerated value must be used.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

MaxRetry = %d

Determines the number of logon retries the agent makes before displaying the Logon Error dialog.

%d = the number of retries (default: 1)

NewPWField = %s1,%s2,%s3,%s4

Identification of the field for entering a new password.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

NewPWField2 = %s1,%s2,%s3,%s4

Identification of the field for confirming a new password.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

OtherField1 = %s1,%s2,%s3,%s4

Identification of the third logon field.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

OtherField2 = %s1,%s2,%s3,%s4

Identification of the fourth logon field.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

OtherLabel1 = %s

The label presented within the agent for a third logon field.

%s = text string

OtherLabel2 = %s

The label presented within the agent for a fourth logon field.

%s = text string

ParentKey1 = %s

Maps a subsection to its parent section.

%s = parent application/section name

PassField = %s1,%s2,%s3,%s4

Identification of the field for entering the password.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number

%s4 = Field type (text/password)

PassPolicy = %s

Identifies which password policy section to associate with this application logon configuration.

%s = Policy Section Name

QuietGenerator = %b

When set, this flag instructs the agent to handle password change requests automatically and not inform the user that a password change request has been handled.

%b = 0; do not use quiet generator, use standard password change process with user intervention (default)

%b = 1; use quiet generator

Section%d = %s

Declaration of application subsections.

%d = consecutive integers

%s = subsection name

StrictURLCheck = %b

Determines whether to require an exact (case-insensitive) URL match or to use substring matching.

%b = 0; use substring matching (default)

%b = 1; use precise matching

SubmitField = %s1,%s2,%s3,%s4

Identification of the Submit button (or equivalent).

The value format is frame name/number, form name/number, field name/number/URL, and Field type. If the field type is image, the field name must be the entire/exact URL.

This entry is optional. If not specified, the agent uses its own internal search logic to locate and press this button.

%s1 = Frame name/number

%s2 = Form name/number

%s3 = Field name/number/URL

%s4 = Field type (submit/image)

Timeout = %d

Determines the maximum time period between successive logon attempts that will trigger Error Loop detection.

%d = amount of time in seconds (default: 30)

URL%d = %s

The address(es) of a Web site's logon page(s).

Note: If the web address consists of spaces or special characters, use the URL quoting method (RFC 2396) to define the web address. This means substituting %20 for each space in the URL and substituting similar "%"-escaped ASCII hexadecimal values for all characters other than the following: : / , . = ? @

%d = consecutive integers starting with 1

%s = Web URL

Web Application Keys for SectionN Subsection

These settings are used within subsections delineated by SectionN.

Example

[Corporate WebApp]

Section1=~Corporate Intranet Logon #1

Section2=~Corporate Intranet Logon #2

&

[~Corporate Intranet Logon #1]

(the keys below)

Web Application Keys | Description | Acceptable values
IDField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
NewPWField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
NewPWField2 = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
OtherField1 = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
OtherField2 = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
ParentKey1 = %s | (See in parent section, above) | (See in parent section, above)
PassField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
SubmitField = %s1,%s2,%s3,%s4 | (See in parent section, above) | (See in parent section, above)
URL%d = %s | (See in parent section, above) | (See in parent section, above)


Password Policy Keys

These settings are used within subsections delineated by SectionN in the [*PasswordPolicies] section.

Example

[*PasswordPolicies

Section1=A policy

Section2=PIN

Section3=Windows

&

[A policy]

(the keys below)

Password Policy Keys | Description | Acceptable values
ALPHA = %s | Flag instructing the agent to use alphabetic characters when generating a password. | %s = U; use upper case alphabetic characters only %s = L; use lower case alphabetic characters only %s = UL; use upper and lower characters (default) %s = (nothing); use no alphabetic characters
NAME = %s | Descriptive name of this password policy. | %s = any string
NUMCONSMAX = %d | Number of times a given character can be repeated consecutively (adjacent to itself). | %d =0 - 127 (default: 8)
NUMERIC = %b | Flag instructing the agent to use numeric characters when generating a password. | %b = 0; do not use numeric characters (default) %b = 1; use numeric characters
NUMFLAGFIRST = %b | Flag indicating if a numeric character can start a password. | %b = 0; numeric character cannot start (default) %b = 1; numeric character can start
NUMFLAGLAST = %b | Flag indicating if a numeric character can end a password. | %b = 0; numeric character cannot end (default) %b = 1; numeric character can end
NUMRPTMAX = %d | Number of times a character can be repeated in a password. | %d =0 - 127 (default: 8)
NUMSIZE = %d | Maximum number of numeric characters. | %d =0 - 128 (default: 0)
NUMSIZEMIN = %d | Minimum number of numeric characters. | %d =0 - 128 (default: 0)
SBYE = %s | List of special characters to exclude when generating this password. | %s = any string of special characters, to exclude, such as: !@#$ The Windows registry key pair that holds the list of special characters normally used, but which can be excluded, is AccessManager:SpecialChars.
SCHARFLAGFIRST = %b | Flag specifying if a special character can start a password. | %b = 0; special character cannot start (default) %b = 1; special character can end
SCHARFLAGLAST = %b | Flag specifying if a special character can end a password. | %b = 0; special character cannot end (default) %b = 1; special character can start
SCHARS = %b | Flag instructing the agent to use special characters when generating a password. | %b = 0; do not use special characters (default) %b = 1; use special characters
SCHARSIZE = %d | Maximum number of special characters. | %d =0 - 128 (default: 0)
SCHARSIZEMIN = %d | Minimum number of special characters. | %d =0 - 128 (default: 0)
SIZE = %d | Maximum total length of a password. | %d = 1 255 (default: 8)
SIZEMIN = %d | Minimum total length of a password. | %d = 1 255 (default: 8)


Global Agent Settings

Various functions and behaviors of ESSO-LM can be centrally defined by using the Settings dialog, setting Windows registry settings on the local workstation, and specifying administrative overrides via a Synchronizer extension.

Configure these settings in the console. The table is provided only for reference.

Registry settings can be set by the Agent, by the Administrative Console, with the RegEdit Windows utility, and via a centrally managed software distribution mechanism. Registry settings are located in the following Windows Registry locations:

  • HKLM\…\ for computer-specific settings
  • HKCU\…\ for user-specific settings

Administrative override objects from Synchronizer extensions specify settings that override HKLM\…\ Windows Registry settings, which in turn overrides the HKCU\…\ Windows Registry settings.

 | Example:
Synchronizer extension object | Extensions\AccessManager:MFEnable=DWORD:0
overrides |
Computer-specific Registry Location (HKLM\…\) | HKLM\…\Extensions\AccessManager:MFEnable
overrides |
User-specific Registry Location (HKCU\…\) or User setting in Settings dialog in ESSO-LM Mainframe Enable | HKCU\…\Extensions\AccessManager:MFEnable

Setting Registry Settings and Administrative Overrides

The Administrative Console can be used to configure HKLM\&\ values and deploy them to synchronizer extensions.

  1. In the Administrative Console, create a new set of settings (right click Global Agent Settings and choose New Settings), load a saved set of settings (right click Agent Settings and select Import), or select an existing set of settings (by selecting it in the left pane).

  2. In the left pane, select and open the set of settings, and select and open the desired registry key.

    Registry entries beginning with Extensions\ are displayed in the Administrative Console without the leading Extensions\.
  3. In the right pane, select the desired registry value, select the checkbox, and enter the desired value.
  4. Export to the desired format (Admin Override or HKLM Registry format):
  5. Select the set of settings in the left pane
  6. Choose Export from the File menu and choose an export format.

To deploy an administrative overrides file to a synchronizer extension, see the following topics:

  • Directory Server Support
  • Database Synchronization Support
  • File Server Support.

To use an HKLM Registry format file, either launch it (for example, double-click on the file from Explorer), import it (for example, from RegEdit), or deploy it using your deployment tool.


Overriding Settings: Registry Values

The table below lists each registry location followed (where applicable) by:

  • The Display Path (the node in the Console's left pane navigator) and Display Name (the setting in the right pane property sheet).
  • The actual registry path and value name and a description of the setting, defaults, and options (the actual value and its definition).
  • Whether the setting is overridable (i.e., can be included in an administrative override object or file).
  • The Registry Type (DWORD, String, or Binary) and Data Type.
Display Path | DisplayName | Description Text | Overridable | Options | Default | RegType | DataType
End-User Experience | Show the Tray Icon | Shell:ShowTrayIcon Whether to show the Tray Icon. | Yes | 0 Do not show 1 Show | default: 1 | dword |
End-User Experience | Title Bar Button | Shell:ShowAccessBtn Whether to show the Title Bar Button on window/dialog title bars. | Yes | 0 Do not show 1 Show | default: 0 | dword |
End-User Experience | Title Bar Button Menu | Shell:ShowAccessBtnMenu Whether to show the menu from the Title Bar Button. | Yes | 0 Do not show 1 Show | default: 1 | dword |
End-User Experience | Tray Icon tooltip | Shell:TrayIconName Text to provide in the Tray Icon Label. (Recommended use: Labeling each Citrix Metaframe/Terminal Services/Remote server/session.) | Yes |  | default: Oracle Enterprise Single Sign-on Logon Manager | string | string
End-User Experience | Tray Icon tooltip: Show System Name | Shell:TrayIconDisplaySysName Whether to show computer name after the Tray Icon Name. A string consisting of space-dash-space is inserted before the computer name if either TrayIconName is not set, or if set and not empty/null. | Yes | 0 Do not show 1 Show | default: 0 | dword |
End-User Experience\Advanced | Logon Animation's duration | Shell:AutoLogonAnimationTime Time (in milliseconds) the animated spinner appears (pausing response). Note: A value of 0 disables the spinner.. | Yes |  | default: 0 | dword | int
End-User Experience\Advanced | Logon Chooser Columns | Extensions\AccessManager\LogonChooser:Columns Order of columns displayed in Logon Chooser. | Yes | 1 Username/ID 2 Application Name 3 Description | default: 1,2,3 | string |
End-User Experience\Advanced | Logon Manager "Details" Columns | Extensions\AccessManager\LogonManager:Columns Columns to display and order to use in Logon Manager in the "Details" view. | Yes | 1 Application Name 2 URL/Module 3 Username/ID 4 Password 5 Modified 6 Last Used 7 Description 8 Group 9 Third Field 10Fourth Field | default: 1,2,3,4,5,6,7,8 | string |
End-User Experience\Advanced | Logon Manager Refresh button | Extensions\AccessManager:AllowRefresh Enable/disable the Logon Manager Refresh button. | Yes | 0 Disable 1 Enable | default: 1 | dword |
End-User Experience\Advanced | User can shut down ESSO-LM from the System Tray Icon Menu | Shell:AllowShutdown When enabled (default), end user can shut down the Agent by selecting "Shutdown ESSO-LM" from the System Tray Icon Menu. When disabled, this menu item is unavailable (grayed out). | Yes | 0 Do not allow shutdown from menu 1 Allow shutdown from menu | default: 1 | dword |
End-User Experience\Advanced\Performance | Increase user data storage priority | Extensions\StorageManager\InMemShr:ThreadPriority Increase processing priority for storing changes to user data (e.g., credentials). Set to Increase only if the workstation's CPU typically runs at 100% usage. | Yes | 1 Increase processing priority 0 Do not increase processing priority | default: 0 | dword |
End-User Experience\Advanced\Performance | Set delay for first update (after startup) to stored user data (ms) | Extensions\StorageManager\InMemShr:IntitialThreadDelay Set an interval (in milliseconds) to wait after ESSO-LM starts up before writing changes in user data (e.g., credentials) to the internal database. | Yes |  | default: 5000 | dword | int
End-User Experience\Advanced\Performance | Set delay for storing user data (ms) | Extensions\StorageManager\InMemShr:ThreadDelay Set an interval to wait (in milliseconds) before writing changes in user data (e.g., credentials) to the internal database. | Yes |  | default: 500 | dword | int
End-User Experience\Advanced\Performance | Store user data on disk in encrypted file | Extensions\StorageManager\InMemShr:LocalStorage Store a copy of user data (e.g., credentials) locally in an encrypted database file in each user's ApplicationData folder | Yes | 1 Store user data in a disk file 0 Do not store user data in disk file | default: 1 | dword |
End-User Experience\Advanced\Special Tasks | After Agent starts up | Shell\Tasks:StartupTaskN Command(s) that will run every time the background task starts (the Tray Icon appears). | Yes |  | default: none | string |
End-User Experience\Advanced\Special Tasks | Before Agent starts | Shell\Tasks:PreTaskN Command(s) that will run before any agent process starts. Note: The agent will not continue if any of these tasks fail (as indicated by the resultant registry value located at License:PreCheck). | Yes |  | default: none | string |
End-User Experience\Advanced\Special Tasks | When logons are deleted | Shell\Tasks:DeletionTaskN Command(s) that will run every time a user deletes an application configuration. | Yes |  | default: none | string |
End-User Experience\Advanced\Special Tasks | When logons change (add, delete, copy, modify) | Shell\Tasks:RefreshTaskN Command(s) that will run every time credentials and user configurations are modified. | Yes |  | default: none | string |
End-User Experience\Environment | Default Backup path | Shell:AutoBackupPath Default backup path for silent backup. If this is not present and not specified within the command line, then the user's application data directory (%AppData%\SSO) is used. | Yes |  | default: none | string | filename
End-User Experience\Environment | Language | [Root]:Language Language to be used. Note: Other values may be acceptable based on localized versions Note: The display font should support the desired characters in the specified language. | Yes | ENG English | default: ENG | string |
End-User Experience\Environment | Location of entlist.ini file | Extensions\AccessManager:EntList Fully qualified path and filename to the entlist.ini file. | Yes |  | default: none | string | filename
End-User Experience\Environment | SubLanguage | [Root]:SubLanguage Language settings for the language set by Language. Note: Other values may be acceptable based on localized versions Note: The display font should support the desired characters in the specified language. | Yes | ENG Default support DBL Extended support | default: ENG | string |
End-User Experience\Password Change\Advanced | Allow user to exclude logons from password groups | Extensions\AccessManager:AllowExcludePWSG Allows end user to exclude application logons from an assigned credential sharing group. | Yes | 0 Do not allow 1 Allow | default: 0 | dword |
End-User Experience\Password Change\Advanced | Notify Primary Logon Method | AUI:ShareToAuth Support Credential Sharing back to the current Authenticator when a credential in its share group is changed. Note: Currently supported only for Windows Authenticator v2 and LDAP Authenticator v2. Note: Since the user will not be made aware of the new password, it is not advised to use automatic password generation for password changes for applications in the share group. | Yes | 0 Do not notify the Authenticator 1 Notify the Authenticator | default: 0 | dword |
End-User Experience\Password Change\Advanced | Quietly Change Passwords | Extensions\AccessManager:QuietGenerator Whether to inform the user about a password change. | Yes | 0 Inform the user 1 Do not inform the user | default: 0 | dword |
End-User Experience\Password Change\Change Policies | Characters: Lowercase | Extensions\AccessManager:LowerAlphaChars List of characters allowed as "Lowercase Alphabet" characters in password policies. | Yes |  | default: abcdefghijklmnopqrstuvwxyz | string | UniqueChars
End-User Experience\Password Change\Change Policies | Characters: Numeric | Extensions\AccessManager:NumericChars List characters allowed as "Numeric" characters in password policies. | Yes |  | default: 1234567890 | string | UniqueChars
End-User Experience\Password Change\Change Policies | Characters: Special | Extensions\AccessManager:SpecialChars List of characters allowed as "Special" characters in password policies. | Yes |  | default: !@#$^&*_-+=[]\|,? | string | UniqueChars
End-User Experience\Password Change\Change Policies | Characters: Uppercase | Extensions\AccessManager:UpperAlphaChars List of characters allowed as "Uppercase Alphabet" characters in password policies. | Yes |  | default: ABCDEFGHIJKLMNOPQRSTUVWXYZ | string | UniqueChars
End-User Experience\Password Change\Change Policies | Default Policy | Extensions\AccessManager:DefaultPolicy Name of section in entlist.ini that contains the default password policy. (If no policy is specified in entlist.ini, the default policy in applist.ini is used.) | Yes |  | default: none | string | PasswordPolicy
End-User Experience\Password Change\Common | Default Change Password Wizard behavior | Extensions\AccessManager:CPWFlag Determines the behavior of the Password Change Wizard when a user encounters a password-change request. | Yes | 1 Prompt 2 Manual, offer auto 4 Auto, offer manual 10Manual only 12Auto only | default: 1 | dword |
End-User Experience\Password Change\Required | Password Groups | Extensions\AccessManager:PWSEnable Enable/disable Credential Sharing between credentials in a group. (If this setting is not enabled, Credential Sharing Groups are not used.) Note: If using the Domain group and Windows Authenticator v2 is to be included in the group, then do not disable AUI\Windows Authenticator v2:PWSEnable. Note: If using the LDAP group and LDAP Authenticator v2 is to be included in the group, then do not disable AUI\LDAP Authenticator v2:PWSEnable. | Yes | 0 Disabled 1 Enabled | default: 0 | dword |
End-User Experience\Response | Automatically logon to applications | Shell:UseActiveLogin Whether to automatically provide credentials to applications. | Yes | 0 Do not automatically provide credentials 1 Automatically provide credentials | default: 1 | dword |
End-User Experience\Response | Display "Add another logon" checkbox | Extensions\AccessManager:ShowAddAdditionalLogon Enable/disable display of the "Add another logon" checkbox in the Add Wizard. | Yes | 0 Disable 1 Enable | default: 0 | dword |
End-User Experience\Response | Limit user to predefined applications | Extensions\AccessManager:AllowUnknown Whether to allow the user to add credentials for applications that are not predefined. | Yes | 0 Limit 1 Do not limit | default: 1 | dword |
End-User Experience\Response | Logon to waiting applications upon agent startup | Shell:LogonOnStartup Enable the agent, at startup, to submit credentials to a Windows or Java application that has already presented its logon form. Note: Web and host/mainframe application logons are not affected by this setting. | Yes | 0 Do not logon 1 Logon at startup | default: 0 | dword |
End-User Experience\Response | Prompt user to add new logons | Shell:UseAutoSense Whether to prompt the user to ask if the user wants to add a logon when a new application is detected. | Yes | 0 Do not prompt 1 Prompt | default: 1 | dword |
End-User Experience\Response | Time allowed for Java applets to load | Extensions\AccessManage:MaxAppletLoadTime Maximum time (in seconds) that the Agent waits for a Java applet to be fully loaded in the browser. | Yes |  | default: 6 | dword | int
End-User Experience\Response | Utilize the just-added Logon | Extensions\AccessManager:LogonAfterConfig Whether to logon to an application after configuring it (adding its credentials). Note: Overridden by application configuration-specific setting. | Yes | 0 Do not logon 1 Logon | default: 1 | dword |
End-User Experience\Response\Error Loop | Maximum retries before prompting | Extensions\AccessManager\Dlg:MaxRetry Number of logon retries before displaying the Error Loop dialog. Note: Overridden by application-type and application configuration-specific settings. Note: This is for each set of credentials. | Yes |  | default: 1 | dword | int
End-User Experience\Response\Error Loop | Maximum time for retries before prompting | Extensions\AccessManager\Dlg:Timeout Maximum seconds for all successive logon attempts before the Error Loop dialog appears. Note: Overridden by application-type and application configuration-specific settings. Note: This is for each set of credentials. | Yes |  | default: 30 | dword | int
End-User Experience\Response\Error Loop | Require password confirmation when modifying password | Extensions\AccessManager\Dlg:HideConfirmPW Indicate whether to display the Confirm Password field in the Logon Error dialog; the default is to Require password confirmation. Note: Overridden by application-type and application configuration-specific settings. | Yes | 0 Require 1 Do not require | default: 0 | dword |
End-User Experience\Response\Host/Mainframe Apps | Host/Mainframe support | Extensions\AccessManager:MFEnable Enable/disable host/mainframe support. | Yes | 0 Disable 1 Enable | default: 1 | dword |
End-User Experience\Response\Host/Mainframe Apps | Polling Interval | Extensions\AccessManager\MHO:CycleInterval Interval (in milliseconds) between when the agent check the host emulator for changes. Lower values can use more CPU time, higher values can increase the time between when a screen appears and when the agent provides credentials. | Yes |  | default: 700 | dword | int
End-User Experience\Response\Host/Mainframe Apps\Error Loop | Maximum retries before prompting | Extensions\AccessManager\Dlg:MainframeMaxRetry Controls the number of logon retries for host/mainframe logons. | Yes |  | default: 1 | dword | int
End-User Experience\Response\Host/Mainframe Apps\Error Loop | Maximum time for retries before prompting | Extensions\AccessManager\Dlg:MainframeTimeout Controls the timeout for mainframe. The default is 30 seconds | Yes |  | default: 30 | dword | int
End-User Experience\Response\Host/Mainframe Apps\Error Loop | Require password confirmation when modifying password | Extensions\AccessManager\Dlg:MainframeHideConfirmPW Indicate whether to display the Confirm Password field in the Logon Error dialog for host/mainframe logons; the default is to Require password confirmation. | Yes | 0 Require 1 Do not require | default: 0 | dword |
End-User Experience\Response\Web Apps | Border Appearance | Extensions\AccessManager\BHO:FeedbackColor Default border color/size/style. | Yes |  | default: red 6px solid | string | string
End-User Experience\Response\Web Apps | Show Border | Extensions\AccessManager\BHO:ShowBorder Enable/disable the border around fields. | Yes | 0 Disable 1 Enable | default: 1 | dword |
End-User Experience\Response\Web Apps | URL Matching Precision | Extensions\AccessManager:DNLevelsToMatch Number of levels of the URL that is used as the matching criteria. Note: Values below 2 are treated as 2. For the Web URL http://mail.Passlogix.com: 2=match to *Passlogix.com 3=match to *mail.Passlogix.com | Yes |  | default: 2 | dword | int
End-User Experience\Response\Web Apps\Error Loop | Maximum retries before prompting | Extensions\AccessManager\Dlg:WebMaxRetry Controls the retry for web. The default value is 1 | Yes |  | default: 1 | dword | int
End-User Experience\Response\Web Apps\Error Loop | Maximum time for retries before prompting | Extensions\AccessManager\Dlg:WebTimeout Controls the timeout for web. The default is 30 seconds | Yes |  | default: 30 | dword | int
End-User Experience\Response\Web Apps\Error Loop | Require password confirmation when modifying password | Extensions\AccessManager\Dlg:WebHideConfirmPW Indicate whether to display the Confirm Password field in the Logon Error dialog for Web logons; the default is to Require password confirmation. | Yes | 0 Require 1 Do not require | default: 0 | dword |
End-User Experience\Response\Windows Apps | Supported Window Classes for Applications | Extensions\AccessManager:AppClasses Default Window Class Names recognized as applications. | Yes |  | default: #32770;Dialog;ThunderRT5FormDC; ThunderRT6FormDC | string | string
End-User Experience\Response\Windows Apps | Supported Window Classes for Services | Extensions\AccessManager:ServiceClasses Default Window Class Names recognized as services. | Yes |  | default: #32770;Dialog;ThunderRT5FormDC; ThunderRT6FormDC | string | string
End-User Experience\Response\Windows Apps | Wait for a Window Title | Extensions\AccessManager:EmptyTitleRetryCount For slow-appearing dialogs/applications, this value is how long (in half-seconds) the Agent will wait for a window title to appear. If the window title does not appear in this time, the dialog will be ignored. A higher value uses more CPU cycles. | Yes |  | default: 6 | dword | int
End-User Experience\Response\Windows Apps\Error Loop | Maximum retries before prompting | Extensions\AccessManager\Dlg:AppsMaxRetry Controls the retry for apps The default value is 1 | Yes |  | default: 1 | dword | int
End-User Experience\Response\Windows Apps\Error Loop | Maximum time for retries before prompting | Extensions\AccessManager\Dlg:AppsTimeout Controls the timeout for apps. The default is 30 seconds | Yes |  | default: 30 | dword | int
End-User Experience\Response\Windows Apps\Error Loop | Require password confirmation when modifying password | Extensions\AccessManager\Dlg:AppsHideConfirmPW Indicate whether to display the Confirm Password field in the Logon Error dialog for Windows logons; the default is to Require password confirmation. | Yes | 0 Require 1 Do not require | default: 0 | dword |
End-User Experience\Setup Wizard | Enable/disable First-Time-Use (FTU) wizard. | Extensions\SetUpManager:HideWizard Controls whether the Setup Wizard is displayed when first-time-use is invoked. Note: If more than one authenticator (primary logon method) is installed, then the first authenticator in the list is automatically selected as the end user's primary logon method. | Yes | 0 Do not hide 1 Hide | default: 0 | dword |
End-User Experience\Setup Wizard | Selected Primary Logon | AUI:Selected Enables the selected logon method as the primary logon method and hides all other installed logon methods. The default is no selection (i.e., end-users select their own primary logon method). Note: To hide the primary logon method selection menu, use the "Enable/Disable First-Time-Use (FTU) Wizard" setting. If the primary logon method selection page is hidden, and this setting is blank, then the first installed logon method in the list is automatically selected. | Yes | None MSauth Windows v2 WinAuth Windows LDAP LDAP LDAPauth LDAP v2 MultiAuth Authentication Manager | default: none | string |
End-User Experience\Setup Wizard | Skip "selection" page if only one Primary Logon Method installed | AUI:HideSingleSelection Hide the "Select Primary Logon Method" step in the Setup Wizard if only one Primary Logon Method is installed. | Yes | 0 Do not hide/skip the Select step of the Setup Wizard. 1 Hide/skip the Select step of the Setup Wizard. | default: 0 | dword |
Event Logging | Select events to log: | Extensions\EventManager:Filter Event Logging filter delineating which events to log. | Yes | 4 Credential Edit 8 Credential Delete 10 Credential Copy 20 Credential Add 100 Provisioning 200 Startup/Shutdown 400 Help 800 Settings Change 1000 Reauthentication 20000 Logon Field: System Username 40000 Logon Field: System Domain 80000 Logon Field: Third Field 100000 Logon Field: Username 200000 Logon Field: Fourth Field 800000 Application Password Change 1000000 Primary Logon Method Change 4000000 Backup/Restore 40000000 Event Types: Info | default: 0 | dword |
Event Logging\Advanced | Cache Limit | Extensions\EventManager:CacheLimit Maximum number of event log entries to be cached before old events are discarded. | Yes |  | default: 200 | dword | int
Event Logging\Advanced | Cache Retry Interval | Extensions\EventManager:Retry Interval (in minutes) between retries for all Event Logging extensions. | Yes |  | default: 30 | dword | int
Event Logging\Advanced | Event Server Message Library location | Extensions\EventManager:EventMessagePath Path/filename to the Event Message library (SSOeventmessage.dll), used for viewing events in Windows Event Viewer. | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\SSOeventmessage.dll | string | filename
Event Logging\Advanced | Extension location | Extensions\EventManager:Path Path/filename to the Event Logging extension (eventmgr.dll). | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\eventmgr.dll | string | filename
Event Logging\Windows Event Viewer | Windows Event Logging Server | Extensions\EventManager\WindowsEvent:EventServer Server name for the Windows Event Logging extension (do not provide leading "\\" characters). If missing, logged to local computer. The server should have a trusted relationship with the user's account and the user's computer, depending on access rights and restrictions. | No |  | default: none | string | string
Event Logging\Windows Event Viewer\Advanced | Cache Retry Interval | Extensions\EventManager\WindowsEvent:Retry Interval (in minutes) between retries for the Windows Event Logging extension. | Yes |  | default: 30 | dword | int
Event Logging\Windows Event Viewer\Advanced | Extension location | Extensions\EventManager\Logs:WindowsEvent Path/filename to the Windows Event Logging extension (WindowsEvent.dll). | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\WindowsEvent.dll | string | filename
Event Logging\Windows Event Viewer\Advanced | Of logged events, limit for Windows server to: | Extensions\EventManager\WindowsEvent:Filter Event logging filter delineating which events (of those logged by the root Filter setting) to log to the Windows Event Logging extension. | Yes | 4 Credential Edit 8 Credential Delete 10 Credential Copy 20 Credential Add 100 Provisioning 200 Startup/Shutdown 400 Help 800 Settings Change 1000 Reauthentication 20000 Logon Field: System Username 40000 Logon Field: System Domain 80000 Logon Field: Third Field 100000 Logon Field: Username 200000 Logon Field: Fourth Field 800000 Application Password Change 1000000 Primary Logon Method Change 4000000 Backup/Restore 40000000 Event Types: Info | default: 0 | dword |
Event Logging\XML File | Cache Retry Interval | Extensions\EventManager\LocalStorage:Retry Interval (in minutes) between retries for the Local (XML) File Logging extension. | Yes |  | default: 30 | dword | int
Event Logging\XML File | Extension location | Extensions\EventManager\Logs:LocalStorage Path/filename to the Local (XML) File Logging extension (XMLEvent.dll). | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\XMLEvent.dll | string | filename
Event Logging\XML File | Of logged events, limit for XML file to: | Extensions\EventManager\LocalStorage:Filter Event Logging filter delineating which events (of those logged by the root Filter setting) to log to the Local (XML) File Logging extension. | Yes | 4 Credential Edit 8 Credential Delete 10 Credential Copy 20 Credential Add 100 Provisioning 200 Startup/Shutdown 400 Help 800 Settings Change 1000 Reauthentication 20000 Logon Field: System Username 40000 Logon Field: System Domain 80000 Logon Field: Third Field 100000 Logon Field: Username 200000 Logon Field: Fourth Field 800000 Application Password Change 1000000 Primary Logon Method Change 4000000 Backup/Restore 40000000 Event Types: Info | default: 0 | dword |
Primary Logon Methods\Authentication Manager | Allowed number of logon methods | AUI\MultiAuth:MaxPreferred This setting allows you to set the maximum number of logon methods that will be presented to a user. Once this number of logon methods have been presented (and skipped by) the user, a "Choose Logon" dialog is displayed. Defaults to 1. This setting is only used for the Multi-Authenticator primary logon. Note: This setting applies to ESSO-AM only. | Yes |  | default: 1 | dword | int
Primary Logon Methods\LDAP v2\Advanced | Alternate User ID location | AUI\LDAPauth:UserLocation Use to indicate where to locate a user object when the user validates against an attribute other than the username. Example: If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set UserLocation to empid=%user,ou=people,dc=computer instead of to uid=user,ou=people,dc=computer. Note: For Novell eDirectory, UserLocation should be: uid=%user,path to the object. Note: If using UserLocation, do not use UserPrepend or UserPaths. | Yes |  | default: none | string | string
Primary Logon Methods\LDAP v2\Advanced | Authenticator Grade | AUI\LDAPauth:AuthGrade Assigns an authentication grade to this primary logon method. This value is used for multi-level authentication. Note: This setting applies to ESSO-AM only. | Yes |  | default: 1 | dword | int
Primary Logon Methods\LDAP v2\Advanced | BIND Timeout | AUI\LDAPauth:Timeout Timeout (in milliseconds) of LDAP BIND call. | Yes |  | default: Depends on the operating system | dword | int
Primary Logon Methods\LDAP v2\Advanced | Include in "LDAP" credential sharing group | AUI\LDAPauth:PWSEnable Enables Credential Sharing from the Primary Logon Method to credentials in the Group Domain. (Also requires AccessManager:PWSEnable to be enabled.) | Yes | 0 Disable 1 Enable | default: 1 | dword |
Primary Logon Methods\LDAP v2\Advanced | Naming Attribute string | AUI\LDAPauth:UserPrepend String to prepend to UserPaths when the DN for a user is in the form of cn=%UserName%,ou=people,dc=computer instead of the form namingattribute=%UserName%,ou=people,dc=computer (where namingattribute can be any string). Note: This value usually needs to be set to cn for Novell eDirectory. Note: If using UserPrepend, you must use UserPathN and do not use UserPrepend. | Yes |  | default: none | string | string
Primary Logon Methods\LDAP v2\Advanced | Passphrase | AUI\LDAPauth:ResetEnable Allow the Reset passphrase to be used. | Yes | 0 Disable 1 Enable | default: 1 | dword |
Primary Logon Methods\LDAP v2\Advanced | When SSL fails | AUI\LDAPauth:SSLFallback Whether to fallback to an insecure connection when an SSL connection fails. Note: If set to 1 and any of Servers includes a port specification, the fallback port must also be specified as an additional Servers entry. For example, if the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as: mycomputer.com:1272 ;My secure SSL Port mycomputer.com:389 ;My fallback port | Yes | 0 Do not connect if the SSL connection fails 1 Connect without SSL (insecure) if the SSL connection fails | default: 0 | dword |
Primary Logon Methods\LDAP v2\Required | Servers | AUI\LDAPauth\Servers:ServerN Servers to try, in the format "computer[:port]" (one server per line), where computer is the server name or IP, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: 127.0.0.1 127.0.0.1:456 somewhereelse.com:8080 anotherplace.com Note: At least one server must be specified for this extension to work. Note: If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback. | No |  | default: none | string |
Primary Logon Methods\LDAP v2\Required | SSL | AUI\LDAPauth:UseSSL Connect via SSL. | Yes | 0 Connect without SSL (insecure) (default to port #389) 1 Connect via SSL (default to port #636) | default: 1 | dword |
Primary Logon Methods\LDAP v2\Required | User Paths | AUI\LDAPauth:UserPathN Fully qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree. Note: A value for either UserPrepend or at least one value for UserPaths must be specified for this extension to work. Note: If using UserPaths, do not use UserLocation. | Yes |  | default: none | string |
Primary Logon Methods\LDAP\Advanced | Active Directory: Domain name support enabled | AUI\LDAPauth:UsingAD Enables Active Directory domain-name support. End users can specify the domain name (e.g., domainname\username) at primary logon. Alternatively, the administrator can specify a default domain name (see the "Active Directory: Set domain name" setting) to let end users log on by username alone. If no domain is specified, then the local workstation's domain is used. | Yes | 0 Do not use AD domain names 1 Use AD domain names | default: 0 | dword |
Primary Logon Methods\LDAP\Advanced | Active Directory: Set domain name | AUI\LDAP:ADDomain The Active Directory domain name to use for primary logon if no domain is specified for the username/ID credential (e.g., domainname\username). This setting is used only if the "Active Directory: Domain name support enabled" setting is set to "Use AD domain names." If domain-name support is enabled and this setting is blank (and the end user does not specify a domain), then local workstation's domain is used. | Yes |  | default: none | string | string
Primary Logon Methods\LDAP\Advanced | Alternate User ID location | AUI\LDAP:UserLocation Use to indicate where to locate a user object when the user validates against an attribute other than the username. Example: If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set UserLocation to empid=%user,ou=people,dc=computer instead of to uid=user,ou=people,dc=computer. Note: For Novell eDirectory, UserLocation should be: uid=%user,path to the object. Note: If using UserLocation, do not use UserPrepend or UserPaths. | Yes |  | default: none | string | string
Primary Logon Methods\LDAP\Advanced | Authenticator Grade | AUI\LDAP:AuthGrade Assigns an authentication grade to this primary logon method. This value is used for multi-level authentication. Note: This setting applies to ESSO-AM only. | Yes |  | default: 1 | dword | int
Primary Logon Methods\LDAP\Advanced | BIND Timeout | AUI\LDAP:Timeout Timeout (in milliseconds) of LDAP BIND call. | Yes |  | default: Depends on the operating system | dword | int
Primary Logon Methods\LDAP\Advanced | Naming Attribute string | AUI\LDAP:UserPrepend String to prepend to UserPaths when the DN for a user is in the form of cn=%UserName%,ou=people,dc=computer instead of the form namingattribute=%UserName%,ou=people,dc=computer (where namingattribute can be any string). Note: This value usually needs to be set to cn for Novell eDirectory. Note: If using UserPrepend, you must use UserPathN and do not use UserPrepend. | Yes |  | default: none | string | string
Primary Logon Methods\LDAP\Advanced | SSL Fallback | AUI\LDAP:SSLFallback Fallback to an insecure connection when an SSL connection fails. Note: If set to 1 and any of Servers includes a port specification, the fallback port must also be specified as an additional Servers entry. For example, if the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as: mycomputer.com:1272 ;My secure SSL Port mycomputer.com:389 ;My fallback port | Yes | 0 Do not connect if the SSL connection fails 1 Connect without SSL (insecure) if the SSL connection fails | default: 0 | dword |
Primary Logon Methods\LDAP\Required | Servers | AUI\LDAP\Servers:ServerN Servers to try, in the format "computer[:port]" (one server per line), where computer is the server name or IP, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: 127.0.0.1 127.0.0.1:456 somewhereelse.com:8080 anotherplace.com Note: At least one server must be specified for this extension to work. Note: If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback. | No |  | default: none | string |
Primary Logon Methods\LDAP\Required | SSL | AUI\LDAP:UseSSL Whether to connect via SSL. | Yes | 0 Connect without SSL (insecure) (default to port #389) 1 Connect via SSL (default to port #636) | default: 1 | dword |
Primary Logon Methods\LDAP\Required | User Paths | AUI\LDAP:UserPathN Fully qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree. Note: A value for either UserPrepend or at least one value for UserPaths must be specified for this extension to work. Note: If using UserPaths, do not use UserLocation. | Yes |  | default: none | string |
Primary Logon Methods\Windows | When user's Windows password changes... | AUI\WinAuth:PWEnable Provide enhanced security by requiring entry of the old password when a new one is in use. | Yes | 0 Do not require the old Windows password 1 Require the old Windows password | default: 0 | dword |
Primary Logon Methods\Windows v2 | Include in "Domain" credential sharing group | AUI\MSauth:PWSEnable Enables Credential Sharing from the Primary Logon Method to credentials in the Group Domain. (Also requires AccessManager:PWSEnable to be enabled.) | Yes | 0 Disable 1 Enable | default: 1 | dword |
Primary Logon Methods\Windows v2 | Reauthentication dialog | AUI\MSauth:AuthOptions Determines how the user needs to reauthenticate. | Yes | 0 Use ESSO-LM dialog 1 Use GINA | default: 0 | dword |
Primary Logon Methods\Windows v2\Advanced | Authenticator Grade | AUI\MSauth:AuthGrade Assigns an authentication grade to this primary logon method. This value is used for multi-level authentication. Note: This setting applies to ESSO-AM only. | Yes |  | default: 1 | dword | int
Primary Logon Methods\Windows v2\Advanced | MultiAuth: Require set up for multi-authentication | AUI\MSauth:AuthState Determines whether to require user to set up this logon method during First Time Use if "MultiAuth" is selected as the primary logon method. This setting is only used for multi-authenticator primary logon. | Yes | 0 Disable this logon method for multi-authenticator use 1 User has option to set up this logon method 2 User is required to set up this logon method | default: 1 | dword |
Primary Logon Methods\Windows v2\Advanced | Passphrase | AUI\MSauth:ResetEnable Allow the Reset passphrase to be used. | Yes | 0 Disable 1 Enable | default: 1 | dword |
Primary Logon Methods\Windows\Advanced | Authenticator Grade | AUI\WinAuth:AuthGrade Assigns an authentication grade to this primary logon method. This value is used for multi-level authentication. Note: This setting applies to ESSO-AM only. | Yes |  | default: 1 | dword | int
Security\Advanced | Allow Password Revealing | Extensions\AccessManager:AllowReveal Whether to allow users to reveal passwords in Wizards and on property pages. Note: If this setting or the application configuration-specific setting are set to not allow reveal, then the password will not be revealed. | Yes | 0 Do not allow 1 Allow | default: 1 | dword |
Security\Advanced | Default encryption | CSP:PreferredCSP Select the encryption algorithm/strength for new/modified credentials. Note: Setting this to a value supported only on XP/2003 will disable the Agent on other OSs. | Yes | 0 Cobra 128-bit 512 Cobra 128-bit (also) 513 Blowfish 448-bit 1028 Triple-DES 168-bit 1285 AES 256-bit 25700 Triple-DES (MS CAPI) (All OSs) 25723 Triple-DES (MS CAPI) (XP/2003 only) 25956 RC-4 (MS CAPI) (All OSs) 25979 RC-4 (MS CAPI) (XP/2003 only) 26491 AES (MS CAPI) (XP/2003 only) | default: 25700 | dword |
Security\Advanced | Require reauthentication to Reveal passwords | Extensions\AccessManager:ReauthOnReveal Whether to require reauthentication if the user selects Reveal or Reveal All in Logon Manager and in dialogs. | Yes | 0 Do not require reauthentication 1 Require reauthentication | default: 1 | dword |
Security\Common | Reauthentication timer | Extensions\AccessManager:AutoLogin Time (in milliseconds) between reauthentication requests. If set to 4,294,967,295 (0xFFFFFFFF), the time will never expire and the user will never need to reauthenticate, except in forced authentication scenarios. Note: Default value for client-side installation is 900,000 (15 minutes), default in a Terminal Services environment is 4,294,967,295 (disabled). | Yes |  | default: 900000 | dword | int
Synchronization | Aggressive Synchronization | Extensions\SyncManager:AggressiveSync Determine whether to allow Aggressive Sync, which is to have the system perform a synchronization whenever a user performs any action that would require the most current credentials or settings available (e.g., an application requests credentials). Note: There is a significant performance impact on both the client and server computers. | Yes | 0 Do not allow 1 Allow | default: 0 | dword |
Synchronization | Delete local cache | Shell:CleanupOnShutdown Whether to delete the user's data files and registry keys upon shutdown of the agent. | Yes | 0 Do not delete 1 Delete | default: 0 | dword |
Synchronization | Deleted-credential cleanup | Shell:nDelDays Time (in days) before a credential's "deleted" flag is retained, after a credential is deleted. | Yes |  | default: 30 | dword | int
Synchronization | Disconnected Operation | Extensions\SyncManager:AllowDisconnected Determines whether ESSO-LM executes first-time-use setup when it is unable to connect to any synchronizer extension and no local cache is present. This check occurs when run with the /background parameter (for example, at startup). | Yes | 0 Do not continue running 1 Allow disconnected operation | default: 1 | dword |
Synchronization | Enable role/group security support | Extensions\SyncManager:RetrieveCO Enables role/group support for application logons, password policies, global agent settings, and passphrase question sets. | Yes | 0 Do not use role/group security. 1 Use role/group security | default: 0 | dword |
Synchronization | Interval for automatic re-sync | Extensions\SyncManager:CycleInterval Interval (in minutes) between automatic re-sync. This occurs whether a user-generated sync event occurs or not. A value of 0 disables this setting. | Yes |  | default: 0 | dword | int
Synchronization | Optimized Synchronization | Extensions\SyncManager:OptimizedSync Enable/disable Optimized Sync (using a checksum to determine changed credentials/settings, rather than retrieving all credentials/settings). | Yes | 0 Disable 1 Enable | default: 1 | dword |
Synchronization | Re-sync when network or connection status changes | Shell:MonitorNetwork Enables/disables monitoring for changes in the network connection status. When enabled, the Agent performs re-synchronization when a status change occurs (for example, re-connecting to the network). | Yes | 0 Ignore network status changes 1 Watch for and re-sync on network status changes | default: 1 | dword |
Synchronization | Sync Order | Extensions\SyncManager:SyncOrder Order to synchronize to synchronization extensions (by extension name, not type). Examples: SalesADAM,CorporateLDAP,CorporateAD FileSync Remote,AD,FileSync Local,SomethingElse CorpDir,CorpADAM,ADRemote Note: If no value is specified then all extensions will be used (in an unpredictable order). | Yes |  | default: none | string | synchronizers
Synchronization | Wait for synchronization at startup | Extensions\SyncManager:WaitForStartupSync Determine whether to wait for synchronization at startup, which ensures that the user's data is current. Note: There is a minor performance impact on the client computer. | Yes | 1 Wait for sync 0 Do not wait for sync | default: 1 | dword |
Synchronization\%AD%\Advanced | Configuration Objects Base Locations | Extensions\SyncManager\Syncs\%AD%\COBaseLocations:LocationN Where to begin the search for Configuration Objects. The search is from the specified location(s) downward. If no entries, the search is from the base location. | No |  | default: none | string |
Synchronization\%AD%\Advanced | Credentials to use | Extensions\SyncManager\Syncs\%AD%:AuthType Which credentials to use when authenticating to the Active Directory Server. | Yes | 0 Use local computer credentials only 1 Use Active Directory server account only (recommended that UserPathN be set) 2 Try local computer credentials; if it fails, use Active Directory server account | default: 2 | dword |
Synchronization\%AD%\Advanced | Descriptive name | Extensions\SyncManager\Syncs\%AD%:DisplayName Logon dialog title, to help differentiate between multiple synchronizer extensions having the same name. Note: This entry is not required. | Yes |  | default: none | string | string
Synchronization\%AD%\Advanced | Location for storing user credentials | Extensions\SyncManager\Syncs\%AD%:LocateInUser Enables storage of user-credential containers under their respective directory User objects and no locator object is used. When disabled (the default), credentials are stored as specified by the locator object. | Yes | 0 Store user credentials as specified by locator object 1 Store user credentials under respective directory user objects | default: 0 | dword |
Synchronization\%AD%\Advanced | Logon attempts | Extensions\SyncManager\Syncs\%AD%:RetryLockCount Number of times to present the retry dialog to the user. | Yes |  | default: 3 | dword | int
Synchronization\%AD%\Advanced | Prepend Domain when naming objects | Extensions\SyncManager\Syncs\%AD%:AppendDomain Enables prepending of the user's domain to the username in naming the user's container. Example: For the domain "passlogix" and user "jamesk" the container is named "jamesk" with this flag disabled and "passlogix.jamesk" with this flag enabled. Note: If you enable Prepend Domain, do not enable Enable Storing Credentials under User Object (in the Directory menu). If you do enable credential storage in User Objects, this option must be disabled (the default setting). If both options are enabled, no synchronization will occur. | Yes | 0 Disable 1 Enable | default: 0 | dword |
Synchronization\%AD%\Advanced | Prompt when disconnected | Extensions\SyncManager\Syncs\%AD%:AllowOffline Allow the user to work offline without prompting/notification if a synchronization event fails. | Yes | 0 Prompt/notify the user 1 Do not prompt | default: 0 | dword |
Synchronization\%AD%\Advanced | Search for locator and override objects | Extensions\SyncManager\Syncs\%AD%:StopAtRoot Controls how the Agent search for locator and override objects. | Yes | 0 Search all servers for locator/override. 1 Limit locator/override search to the server root. | default: 1 | string |
Synchronization\%AD%\Advanced | Servers | Extensions\SyncManager\Syncs\%AD%\Servers:ServerN Servers to try, in the format "computer[:port]" (one server per line), where computer is the server name, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: somewhereclose.com also.somewhereclose.com somewhereelse.com:8080 anotherplace.com Note: At least one server must be specified for this extension to work. Note: Active Directory requires use of computer names (not IP addresses). Note: If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback. | No |  | default: none | string |
Synchronization\%AD%\Advanced | User Paths | Extensions\SyncManager\Syncs\%AD%:UserPathN Fully qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree. Note: This entry is not required for this extension. | Yes |  | default: none | string |
Synchronization\%AD%\Advanced | When SSL fails | Extensions\SyncManager\Syncs\%AD%:SSLFallback Fallback to an insecure connection when an SSL connection fails. Note: If SSLFallback=1 and any of Servers includes a port specification, the fallback port must also be specified as an additional Servers entry. For example, if the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as: mycomputer.com:1272 ;My secure SSL Port mycomputer.com:389 ;My fallback port | Yes | 0 Do not connect if the SSL connection fails. 1 Connect without SSL (insecure) if the SSL connection fails. | default: none | dword |
Synchronization\%AD%\Required | Extension location | Extensions\SyncManager\Syncs\%AD%:Path Path\filename of the Active Directory synchronizer extension. | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\SyncMgr\ADEXT\adsync.dll | string | filename
Synchronization\%AD%\Required | SSL | Extensions\SyncManager\Syncs\%AD%:UseSSL Connect via SSL. | Yes | 0 Connect without SSL (insecure) (default to port #389). 1 Connect via SSL (default to port #636). | default: 1 | dword |
Synchronization\%ADAM%\Advanced | Configuration Objects Base Locations | Extensions\SyncManager\Syncs\%ADAM%\COBaseLocations:LocationN Where to begin the search for Configuration Objects. The search is from the specified location(s) downward. If no entries, the search is from the base location. | No |  | default: none | string |
Synchronization\%ADAM%\Advanced | Credentials to use | Extensions\SyncManager\Syncs\%ADAM%:AuthType Which credentials to use when authenticating to the ADAM server. | Yes | 0 Connect to ADAM with current user name 1 Use ADAM server account only 2 Try local computer credentials; if it fails, use ADAM server account | default: 2 | dword |
Synchronization\%ADAM%\Advanced | Prepend Domain when naming objects | Extensions\SyncManager\Syncs\%ADAM%:AppendDomain Enables prepending of the user's domain to the username in naming the user's container. Example: For the domain "passlogix" and user "jamesk", the container is named "jamesk" with this flag disabled and "passlogix.jamesk" with this flag enabled. | Yes | 0 Disable 1 Enable | default: 0 | dword |
Synchronization\%ADAM%\Advanced | Prompt when disconnected | Extensions\SyncManager\Syncs\%ADAM%:AllowOffline Allow the user to work offline without prompting/notification if a synchronization event fails. | Yes | 0 Prompt/notify the user 1 Do not prompt | default: 0 | dword |
Synchronization\%ADAM%\Advanced | User domain name to use | Extensions\SyncManager\Syncs\%ADAM%:UserDomain Domain name to use in the container name (e.g., DomainName.UserName) when Prepend Domain is enabled. The user can specify another domain the in the login dialog. Example: If User Domain is "MyDomain" (with Prepend Domain enabled) and the user logs on as jamesk, the container name used is MYDOMAIN.jamesk If the user logs on as HISDOMAIN\jamesk the container name used is HISDOMAIN.jamesk. | Yes |  | default: none | string | string
Synchronization\%ADAM%\Required | Extension location | Extensions\SyncManager\Syncs\%ADAM%:Path Path\filename of the Active Directory synchronizer extension. | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\SyncMgr\ADAMext\ADAMsyncExt.dll | string | filename
Synchronization\%ADAM%\Required | Servers | Extensions\SyncManager\Syncs\%ADAM%\Servers:ServerN Servers to try, in the format "computer[:port]" (one server per line), where computer is the server name, and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: somewhereclose.com also.somewhereclose.com somewhereelse.com:8080 anotherplace.com Note: At least one server must be specified for this extension to work. Note: Active Directory requires use of computer names (not IP addresses). Note: If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback. | No |  | default: none | string |
Synchronization\%DB%\Advanced | Append Domain when naming objects | Extensions\SyncManager\Syncs\%DB%:AppendDomain Enables appending of the user's domain to the username in naming the user's container. Example: For the domain "passlogix" and user "jamesk", the container is named "jamesk" with this flag disabled and "jamesk.passlogix" with this flag enabled. | Yes | 0 Disable 1 Enable | default: 0 | dword |
Synchronization\%DB%\Required | Extension location | Extensions\SyncManager\Syncs\%DB%:Path Path\filename of the Database synchronizer extension. | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\SyncMgr\DBEXT\DBExt.dll | string | filename
Synchronization\%DB%\Required | Servers | Extensions\SyncManager\Syncs\%DB%\Servers:Server List of servers to try, in the format "connection string" (one server per line) Note: At least one server must be specified for this extension to work. | No |  | default: none | string |
Synchronization\%File%\Advanced | Descriptive name | Extensions\SyncManager\Syncs\%File%:DisplayName Logon dialog title, to help differentiate between multiple synchronizer extensions having the same name. Note: This entry is not required. | Yes |  | default: none | string | string
Synchronization\%File%\Advanced | Logon attempts | Extensions\SyncManager\Syncs\%File%:RetryLockCount Number of times to present the retry dialog to the user. | Yes |  | default: 3 | dword | int
Synchronization\%File%\Advanced | Prepend Domain when naming user folders | Extensions\SyncManager\Syncs\%File%:AppendDomain Enables prepending of the user's domain to the username in naming the user's container. Example: For the domain "passlogix" and user "jamesk", the container is named "jamesk" with this flag disabled and "passlogix.jamesk" with this flag enabled. | Yes | 0 Disable 1 Enable | default: 1 | dword |
Synchronization\%File%\Advanced | Prompt when disconnected | Extensions\SyncManager\Syncs\%File%:AllowOffline Allow the user to work offline without prompting/notification if a synchronization event fails. | Yes | 0 Prompt/notify the user 1 Do not prompt | default: 0 | dword |
Synchronization\%File%\Required | Extension location | Extensions\SyncManager\Syncs\%File%:Path Path\filename of the File System synchronizer extension. | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\SyncMgr\FileSyncExt\filesync.dll | string | filename
Synchronization\%File%\Required | Server | Extensions\SyncManager\Syncs\%File%\Servers:Server1 UNC path to try. Examples: \\FS1\Users \\FS2\Extras D:\Backup Note: Server1 must be specified for this extension to work. Note: The File System extension requires use of proper UNC paths. Note: As of ESSO-LM 4.0, only one path is supported; failover is not supported. | No |  | default: none | string | string
Synchronization\%LDAP%\Advanced | Admin Group DN | Extensions\SyncManager\Syncs\%LDAP%:AdminGroup DN for the Administrative group. It is placed this value in the ACI. Example: cn=configuration administrators,ou=groups,ou=topologymanagement,o=netscaperoot | Yes |  | default: none | string | string
Synchronization\%LDAP%\Advanced | Alternate User ID location | Extensions\SyncManager\Syncs\%LDAP%:UserLocation Use to indicate where to locate a user object when the user validates against an attribute other than the username. Example: If users authenticate with an employee ID # for logon (validation against the empid attribute) and the user object is in ou=people,dc=computer, then set UserLocation to empid=%user,ou=people,dc=computer instead of to uid=user,ou=people,dc=computer. Note: For Novell eDirectory, UserLocation should be: uid=%user,path to the object. Note: If using UserLocation, do not use UserPrepend or UserPaths. | Yes |  | default: none | string | string
Synchronization\%LDAP%\Advanced | BIND Timeout | Extensions\SyncManager\Syncs\%LDAP%:Timeout Timeout (in milliseconds) of LDAP BIND call. | Yes |  | default: Depends on the operating system | dword | int
Synchronization\%LDAP%\Advanced | Configuration Objects Base Locations | Extensions\SyncManager\Syncs\%LDAP%\COBaseLocations:LocationN Where to begin the search for Configuration Objects. The search is from the specified location(s) downward. If no entries, the search is from the base location. | No |  | default: none | string |
Synchronization\%LDAP%\Advanced | Descriptive name | Extensions\SyncManager\Syncs\%LDAP%:DisplayName Logon dialog title, to help differentiate between multiple synchronizer extensions having the same name. Note: This entry is not required. | Yes |  | default: none | string | string
Synchronization\%LDAP%\Advanced | DSAME disabled-account support | Extensions\SyncManager\Syncs\%LDAP%:UsingDSAME Recognize disabled accounts on a Sun Java System Identity Server, formerly known as iPlanet Directory Server Access Management Edition (DSAME). | Yes | 0 The server is not a Sun Java System Identity Server. 1 The server is a Sun Java System Identity Server. | default: 0 | dword |
Synchronization\%LDAP%\Advanced | Logon attempts | Extensions\SyncManager\Syncs\%LDAP%:RetryLockCount Number of times to present the retry dialog to the user. | Yes |  | default: 3 | dword | int
Synchronization\%LDAP%\Advanced | Naming Attribute string | Extensions\SyncManager\Syncs\%LDAP%:UserPrepend String to prepend to UserPaths when the DN for a user is in the form of cn=%UserName%,ou=people,dc=computer instead of the form namingattribute=%UserName%,ou=people,dc=computer (where namingattribute can be any string). Note: This value usually needs to be set to cn for Novell eDirectory. Note: If using UserPrepend, you must use UserPathN and do not use UserPrepend. | Yes |  | default: none | string | string
Synchronization\%LDAP%\Advanced | Prompt when disconnected | Extensions\SyncManager\Syncs\%LDAP%:AllowOffline Allow the user to work offline without prompting/notification if a synchronization event fails. | Yes | 0 Prompt/notify the user 1 Do not prompt | default: 0 | dword |
Synchronization\%LDAP%\Advanced | Security Version | Extensions\SyncManager\Syncs\%LDAP%:SecurityVersion Update the ACI with a new :AdminGroup value when this value is higher than :SecurityUpgrade. | Yes |  | default: none | dword | int
Synchronization\%LDAP%\Advanced | When SSL fails | Extensions\SyncManager\Syncs\%LDAP%:SSLFallback Fallback to an insecure connection when an SSL connection fails. Note: If SSLFallback=1 and any of Servers includes a port specification, the fallback port must also be specified as an additional Servers entry. For example, if the SSL connection is to mycomputer.com:1272 then an additional entry must point to the fallback port, such as: mycomputer.com:1272 ;My secure SSL Port mycomputer.com:389 ;My fallback port | Yes | 0 Do not connect if the SSL connection fails. 1 Connect without SSL (insecure) if the SSL connection fails. | default: none | dword |
Synchronization\%LDAP%\Required | Directory Type | Extensions\SyncManager\Syncs\%LDAP%:DirectoryType The specific type of directory server. If the directory server is not listed, select "Unspecified LDAP Directory" for backwards compatibility in upgrade scenarios; otherwise select "Generic LDAP Directory" | Yes | 0 Unspecified LDAP Directory 3 Novell eDirectory 4 Novell NDS 5 Generic LDAP Directory 8 Sun Java System Directory 9 IBM Tivoli Directory Server 10Oracle Internet Directory | default: 0 | dword |
Synchronization\%LDAP%\Required | Extension location | Extensions\SyncManager\Syncs\%LDAP%:Path Path\filename of the LDAP Directory Server synchronizer extension. | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\SyncMgr\LDAP\ldapsync.dll | string | filename
Synchronization\%LDAP%\Required | Servers | Extensions\SyncManager\Syncs\%LDAP%\Servers:ServerN List of servers to try, in the format "computer[:port]" (one server per line), where computer is the server name or IP ,and port is assumed to be default (636 for SSL, 389 for no SSL) if not specified. Example: 127.0.0.1 127.0.0.1:456 somewhereelse.com:8080 anotherplace.com Note: At least one server must be specified for this extension to work. Note: If specifying a port value, see SyncManager\Syncs\%LDAP%:SSLFallback. | No |  | default: none | string |
Synchronization\%LDAP%\Required | SSL | Extensions\SyncManager\Syncs\%LDAP%:UseSSL Connect via SSL. | Yes | 0 Connect without SSL (insecure) (default to port #389). 1 Connect via SSL (default to port #636). | default: 1 | dword |
Synchronization\%LDAP%\Required | User Paths | Extensions\SyncManager\Syncs\%LDAP%:UserPathN Fully qualified path of where the user account is located. There can be unlimited paths to search. The extension searches these in order, looking for the user account. If not found, the extension will search the directory tree. Note: A value for either UserPrepend or at least one value for UserPaths must be specified for this extension to work. Note: If using UserPaths, do not use UserLocation. | Yes |  | default: none | string |
Event Logging \Syslog | Send messages to which host? | Extensions\EventManager\Syslog:RemoteAddress Enter the hostname to send messages to. Either a hostname or dotted IP v4-address can be used. Use 0.0.0.0 to disable sending to syslog-daemon, or use 255.255.255.255 to send to any daemon that's set up to receive broadcast messages. It must be on your local network as broadcast doesn't reach beyond a router. | No |  | default: none | string |
Extensions\EventManager\Database | Default Server | Extensions\EventManager\Database:Default Server If no other server is specified, the server to which the database log will be written. (OLE DB connection string) | No |  | default: Server1 | string |
Extensions\EventManager\Database | Servers | Extensions\EventManager\Database\Servers:ServerN List of Database servers, one per line, using the OLE DB format "Provider=sqloledb; Data Source=myServerName; Initial Catalog=myDatabaseName; User Id=myUsername; Password=myPassword". | No |  | default: none | string |
Extensions\EventManager\Logs | Extension location | Extensions\EventManager\Logs:Database Path to the Database Extension (DatabaseExt.dll). | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\DatabaseExt.dll | string |
Extensions\EventManager\Logs | Extension location | Extensions\EventManager\Logs:Syslog Path to the Syslog Extension (SyslogExt.dll). | No |  | default: C:\Program Files\Passlogix\v-GO SSO\Plugin\EventMgr\SyslogExt.dll | string |
WebViewer\EventManager\Logs | Extension location | WebViewer\EventManager\Logs:Syslog Path/filename to the Web Viewer Syslog extension (Syslog.dll). | No |  | default: C:\Program Files\Passlogix\SSOWebViewer\bin\Syslog.dll | string |
WebViewer\EventManager\Logs | Extension location | WebViewer\EventManager\Logs:WindowsEvent Path/filename to the Web Viewer Windows Event Logging extension (WindowsEvent.dll). | No |  | default: C:\Program Files\Passlogix\SSOWebViewer\bin\WindowsEvent.dll | string |
WebViewer\EventManager\Logs | Extension location | WebViewer\EventManager\Logs:LocalStorage Path/filename to the Web Viewer Local (XML) File Logging extension (XMLEvent.dll). | No |  | default: C:\Program Files\Passlogix\SSOWebViewer\bin\XMLEvent.dll | string |


Troubleshooting

Installation

Authenticators

Synchronizer Extensions

Uninstall

Agent Performance

Application Response

Authentication

Initial Authentication

Reauthentication

Application Configuration

All Applications

Windows Applications

Web Applications

Host Applications

Event Logging

Windows Event Viewer

Credential Sharing Groups

Synchronizer Extensions

Directory Extensions

File System Server

Roaming Profile Extension


Regular Expression Syntax

The following operators and meta-characters can be used to specify a text string pattern that the Agent uses to detect specific application windows. See Add Edit Window Title for more information.

The following explanations are adapted for the .NET regular expression reference. The complete description and syntax of regular expressions can be found on the Microsoft Developer Network website (www.msdn.microsoft.com).

Grouping
[ ] | Indicates a character class that matches any character inside the brackets. Example: [abc] matches "a," "b," and "c."
( ) | Indicates a character grouping operator. Example: (\d+,)*\d+ matches a list of numbers separated by commas (such as "1" or "1,23,456").
{ } | Indicates a match class.
| | Separates two expressions, exactly one of which matches (for example, T|the matches "The" or "the").
Matching

.

Matches any single character.

^

If ^ occurs at the start of a character class, it negates the character class. A negated character class matches any character except those inside the brackets. Example, [^abc] matches all characters except "a", "b", and "c").

If ^ is at the beginning of the regular expression, it matches the beginning of the input (for example, ^[abc] will only match input that begins with "a," "b," or "c").

$

At the end of a regular expression, $ matches the end of the input. Example: [0-9]$ matches a digit at the end of the input.

-

In a character class, a hyphen indicates a range of characters. Example: [0-9] matches any of the digits "0" through "9."

Repeat operators
! | Negates the expression that follows.
? | Indicates that the preceding expression is optional: it matches once or not at all. Example: [0-9][0-9]? matches "2" and "12").
+ | Indicates that the preceding expression matches one or more times. Example: [0-9]+ matches "1," "13," "666," and so on.
* | Indicates that the preceding expression matches zero or more times.
??, +?, *? | "Non-greedy" versions of ?, +, and *. These match as little as possible, unlike the greedy versions which match as much as possible. Example: given the input "<abc><def>," <.*?> matches "<abc>" while <.*> matches "<abc><def>."
Escape and abbreviation

\

Escape character that forces the next character to be interpreted literally. Example: [0-9]+ matches one or more digits, but [0-9]\+ matches a digit followed by a plus character).

If \ is followed by a number n, it matches the nth match group (starting from 0). Example: <{.*?}>.*?</\0> matches "<head>Contents</head>".

The \ is also used for abbreviations as described in the following table.

Abbreviation | Meaning | Matches
\a | Any alphanumeric character | [a-z A-Z 0-9]
\b | White space (blank) | [ \\t]
\c | Any alphabetic character | [a-z A-Z]
\d | Any decimal digit | [0-9]
\h | Any hexadecimal digit | [0-9 a-f A-F]
\n | New line | \r|\r?\n
\q | A quoted string | \"[^\"]*\"|\'[^\']*\'
\w | A simple word | [a-z A-Z]+
\z | An integer | [0-9]+


Troubleshooting: Installation

Installation

Authenticators

An authenticator is not installed when selected
  • By default, the installer does not install authenticators that will not work on the system. For example, if the Entrust Entelligence client is not installed, then the authenticator for the Entrust PKI will not be installed (Entrust Entelligence is available with ESSO-AM only).

Synchronizer Extensions

The Microsoft Active Directory extension is not installed when selected
  • By default, the installer does not install synchronizer extensions that will not work on the system. For example, if the Microsoft Active Directory client is not installed, then the synchronizer extension for the Microsoft Active Directory Server will not be installed.

Uninstall

User credentials remain after uninstall

  • Only the current user's credentials can be removed by the standard uninstall. A simple batch file can handle removing other credentials. For Windows 2000, for example:

    CD /D %UsersProfile%

    CD .

    For /D %Z in (*.*) do Del /F/S/Q "%Z\Application Data\SSO"

  • You will need to manually delete registry entries for other users. This can be done in RegEdit or RegEdit32 (RegEdt32.exe), or you can push the following *.reg file to each user:

    Windows Registry Editor Version 5.00

    HKey_Current_User\Software\Passlogix]


Troubleshooting: Agent Performance

Agent Performance

Application Response

The agent responds slowly, applications are slowed, or specific functions within applications are slowed, when the agent is running.

  • Some antiviral software programs check agent modules too aggressively. To resolve this, disable checks of ssoshell.exe and/or of the %ProgramFiles%\Passlogix\v-GO SSO directory tree.
  • Some antiviral software programs check *.mdb files too aggressively. The agent stores user credentials in *.mdb files. To resolve this, disable checks of *.mdb files, of the file %UserName% aml.mdb, and/or of files in the %AppData%\Passlogix directory.


Troubleshooting: Authentication

Authentication

Initial Authentication

User logs onto a computer with different domain/workgroup accounts but sees the same credentials.

  • The problem is that the local computer's Windows account provides the user's Registry Hive (HKCU), not the domain/workgroup account. There are two workarounds: use the CleanupOnShutdown feature or use a different Windows account for each domain/workgroup logon.

Reauthentication

Users are never asked to reauthenticate.

  • Make sure Extensions\AccessManager:AutoLogin is set to the desired value. The value is in milliseconds; a value of 900000 (default for client-side installations) is 15 minutes.

Users have to reauthenticate too frequently.

  • Make sure Extensions\AccessManager:AutoLogin is set to the desired value. The value is in milliseconds; a value of 900000 (default for client-side installations) is 15 minutes.
  • Make sure other force-reauth settings are set appropriately. These settings include:
  • Overriding settings: Extensions\AccessManager:ReauthOnReveal
  • Application configuration settings: ForceReauth


Troubleshooting: Application Configuration

Application Configuration

All Applications

The Agent doesn't recognize pre-existing logon credentials after an upgrade

After an upgrade of the Agent, users report that applications for which they have previously provided credentials no longer function. Instead, a message box appears, advising that the credentials do not correspond to configured logons. The applications appear in Logon Manager in grey, italicized text.

  • Create a Bulk Add list to update the user's entlist.ini. Also note that in ESSO-LM, preconfigured logons for Windows and Web applications are provided in Console templates, rather than in the Agent's applist.ini. Create the required application logons, using console templates. then create the Bulk Add list to update the user's entlist.ini.

An application is not available in the list of predefined applications when you add credentials.

  • Shut down the Agent making sure that no ssoshell.exe processes are running, and restart the Agent.

The Agent can be started and Logon Manager can be opened without the user authenticating.

  • Shut down the Agent, kill any running ssoshell.exe or SSObho.exe processes, and restart the Agent.

Windows Applications

Predefined Windows Applications

The Agent does not recognize a password change window

The Agent does not respond to an application's configured password-change dialog

This can be remedied by adding the password-change form's window title to the main logon form's window-title matching list.

  • In the Console, select the application in the left pane and click the General tab. Double-click the Password Change form for the application to open the form configuration dialog box. Note the Window Titles of the form, then click Cancel. Double-click the Logon form for the application and, under Window Titles, click Add. Enter the window title of the Password Change form, click OK, then click OK to close the form configuration dialog box.

Double-logon or Wrong Window

The agent responds twice to an application or responds to a previously-invisible window or to the wrong window
  • Use one or more (additional) Match sections and Field keys to specify more precise matching criteria.
  • Specify the window class that should be ignored in Ignore this Window Class in the Miscellaneous tab (see) on the application configuration.
The Agent does not respond to any Windows application.
  • Shut down the agent, kill any running ssoshell.exe or SSObho.exe processes, and restart the Agent.
The Agent does not respond to a specific Windows application
  • Use fewer matching criteria.
  • Check that the application configuration values that are numbers are in decimal, not hexadecimal.
  • Check that the application configuration values that are strings are the exact ones in the application dialog boxes.
  • If using multiple sections, try a test with just one section.
The Agent provides credentials but does not submit
  • Verify that Auto Submit is set in the Miscellaneous tab of the application configuration and AutoOK is set in the specific set of credentials.

SendKeys Issues

Web Applications

Responding to Any Web Applications

The Agent does not detect or respond to a specific web page
  • Check that the page has a password field (Field Type of Password); without it, the Agent will ignore the page.
  • Check that SSObho.exe is running.
  • Try disabling Java, JavaScript, and/or ActiveX support.
The agent responds slowly to a specific web page
  • Check that the page has finished loading. The Agent does not respond to a page until the page finishes loading completely.
  • Try turning off images.
  • Try disabling Java, JavaScript, and/or ActiveX support.
The Agent doesn't respond to a loaded Web Application
  1. Start the agent, then trigger the Agent from Title Bar Button |
  2. Log On Using ESSO-LM or ÿ+L.
  3. Refresh the Browser Page.
The agent doesn't respond to a selected logon using ESSO-LM
  • There is a known issue in the Agent where it does not respond to Web Applications in this way. The Agent still responds via the other triggers.
If the browser is embedded within another application, the agent may respond as if the browser is a Windows Application.
SSObho.exe does not run

If the Agent does not recognize web pages properly, make sure that SSObho.exe is running. If it is not, the Agent may think the user is in a Terminal Services session. To correct this:

  1. Shut down the Agent. (Verify no SSO* tasks are running in Task Manager.)
  2. Uninstall the Agent.
  3. Make sure the following files are not present on the user's computer:
    • SSOwts.exe
    • SSOwts.exe
    • SSOwts.exe

  4. Search using RegEdit in the system hives of the registry (for example, NOT in HKEY_CURRENT_USER or HKEY_USERS) for references to SSO, vGO, and Passlogix. Delete all inappropriate references, especially:

    HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix and its children

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04EB19CE-B3B3-11D2-8A09-006008C7059E} and its children

    HKEY_CLASSES_ROOT\CLSID\{04EB19CE-B3B3-11D2-8A09-006008C7059E} and its children

    HKEY_CLASSES_ROOT\AppID\SSO WTS.EXE and its children

    HKEY_CLASSES_ROOT\AppID\{6B9E3EFF-C54A-472C-821B-6FC464B58235} and its children

    HKEY_CLASSES_ROOT\SSObho.HelperObject and its children

    HKEY_CLASSES_ROOT\SSObho.HelperObject.1 and its children

  5. Reinstall the Agent.

When Predefining Web Applications

The Agent provides credentials but does not submit
  • If a Submit field is of type Image, make sure that the URL is exact, including the protocol.
  • If a Submit field is not present, add one.
Instead of submitting the page, the Agent triggers a link to another page or some other action (for example, cancel/clear).
  • Add a Submit field to the application configuration.
The Web page uses more than three fields (for example, a Social Security # as three fields and a password).
  • Break the logon up into two (or more) logons. Then the user will select (via the Logon Chooser) first the credential lacking the password (with Auto Submit disabled) and then the credential with the password.

Web Applications that are not predefined

The Agent provides credentials but does not submit
  • Keep the system focus on the window that is requesting the credentials; if you switch to another window, the Agent will supply the credentials but not tell the page to submit.
Instead of submitting the page, the Agent triggers a link to another page or some other action (for example, cancel/clear)
  • Turn off Auto Submit for that credential, and manually trigger page submission.
  • Predefine the page, specifying the Submit field.
  • When adding credentials, the window title is stored instead of the URL.
    • Check that SSObho.exe is running. (See above.)

    Host Applications

    Responding to Any Host Applications

    The Agent does not respond to any Host application
    • Shut down the Agent, kill any running ssoshell.exe or SSObho.exe processes, and restart the Agent.
    • Check that HLLAPI is properly enabled in the host emulator.
    • Check that MFEnable=1.
    • Check that the coordinates are relative to the top-left corner, where the top-left corner is (1,1) (row 1, column 1).
    The Agent does not respond at all to any Telnet application
    • Check that the Host emulator supports Telnet through HLLAPI or through a scripting language. Note: The Agent supports Telnet through HLLAPI only for ScanPak Aviva and NetManage Rumba

    Responding to a specific Host Application

    One or more credential fields are not inserted, or are partially inserted
    • Check that the coordinates are relative to the top-left corner, where the top-left corner is (1,1) (row 1, column 1).
    • Check that application configuration coordinates are for the exact place where credentials are inserted; usually, there is a space after the field prompts (for example, "Username:Space"), and the credential field needs to be inserted after the space.
    • If a special character sequence is used between fields, check that the sequence is valid, that Delay Field is set to a sufficiently-high value.
    The Agent does not respond at all to a specific Host application.
    • Check that the coordinates are relative to the top-left corner, where the top-left corner is (1,1) (row 1, column 1).
    • Use fewer matching criteria.
    The Agent does not respond at all to a specific Telnet application
    • Check that the coordinates for all fields are set to (1,1).


Troubleshooting: Event Logging

Event Logging

All Extensions

No events are recorded
  • The Filter setting is not set. For testing purposes, set to 0xFFFFFFFF (to log all events) and restart the agent.
  • The agent has not reached the Retry setting (default: 30 minutes). To change the value from the default, set Extensions\EventManager:Retry or Extensions\EventManager\%Extension%:Retry to a lower value. To verify that the Event Logging is occurring, open the user's %UserName% AML.mdb file, look in the SSOSection column for entries with the name starting with CacheItem (for example, CacheItem1). These items are the events, cached until the retry time is reached. At the retry time, the cached events will be sent to the extension(s).
The wrong events are recorded
  • The Filter setting is set improperly. Review the Event Logging Filter , note the precise bit order and conversion from binary to hexadecimal/decimal.

Windows Event Viewer

Credentials do not arrive at the server
  • The server name is not properly set. Do not use leading "\\" characters. Specify the proper NetBIOS name (not the TCP/IP name).
Credentials do not arrive at the server
  • The server name is not properly set. Do not use leading "\\" characters. Specify the proper NetBIOS name (not the TCP/IP name).
Credentials on the server are missing data; category and event labels are only numbers and the Description is similar to "The description for Event ID ( ### ) in Source (ESSO-LM) cannot be found.

The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event:"

  • The server is not properly configured. See Windows Event Logging extension for instructions on configuring the server.


Usage Reports

Usage Report Dialog Box

The usage report is helpful in monitoring access of users and applications, and also troubleshooting problems.

Use this dialog box to generate usage reports with information about the user, application, modified date, and the date last used. In the Output File field, enter a descriptive name for the output file and use the Browse button to select a place to save the report. Optionally, check the Include header row box to include a header row for the report.


Troubleshooting: credential sharing groups

Credential Sharing Groups

Credential Sharing Groups are not working
  • Make sure Extensions\AccessManager:PWSEnable=1.
A Password Change within an application in the Domain or LDAP groups does not notify the authenticator of the change
  • Make sure AUI:ShareToAuth=1.


Troubleshooting: Synchronizer Extensions

All Synchronizer Extensions

Directory Extensions—All Directory Support

User Connections

Cannot connect via SSL
  • Make sure the directory connection works without SSL.
A user cannot create an object on the directory
  • Make sure the user is connecting to the directory.
  • Make sure UserPaths points to a valid location.
  • A SSOlocator object for the user does not exist, either specifically for the user or as a default object. Put a default object in the location UserPaths points to; if this works, you can move the default object up the tree or put a user-specific object on the tree.

Admin Objects

Admin objects (vGOAdminOverride, vGOentlist, vGOftulist) cannot be altered.

Existing objects cannot be overwritten. Instead, delete the old objects and then push new ones.

User Objects

  • Microsoft Active Directory Server
  • Sun Java System Directory Server
  • Novell eDirectory

File System Server

User connections

A user cannot create an object on the directory
  • Make sure the user can connect to the File System share directly (for example, in Explorer).


Copyright dates for each product:

Copyright dates for each product:Product Doc URLs

SSO: Copyright ©1998–2009, Passlogix, Inc. All rights reserved.

SSPR: Copyright ©2004–2009, Passlogix, Inc. All rights reserved.

AM: Copyright ©2004–2009, Passlogix, Inc. All rights reserved.

PM: Copyright ©2005–2009, Passlogix, Inc. All rights reserved.

SM: Copyright ©2005–2009, Passlogix, Inc. All rights reserved.

SAM: Copyright ©2008-2009, Passlogix, Inc. All rights reserved.

ODE: Copyright ©2008-2009, Passlogix, Inc. All rights reserved.

Documentation URLs

PASSLOGIX

https://passportal.passlogix.com/Passlogix%20Documentation/Forms/AllItems.aspx

https://passportal.passlogix.com/Pages/KnowledgeBase.aspx

ORACLE 6X

http://download.oracle.com/docs/cd/E10805_01/index.htm

Oracle 7X

http://download.oracle.com/docs/cd/E12472_01/index.htm

IBM

http://publib.boulder.ibm.com/tividd/td/IBMTivoliAccessManagerforEnterpriseSingleSign-On6.0.html


Add Sharing Group

Use this dialog box to add and name a new credential sharing group.

  • To add a sharing group, enter a Group Name and click OK.

To display this dialog box:

  • Right-click Credential Sharing Group and choose New Group from the shortcut menu.

    or

  • Choose CredentialSharing Group from the Insert menu.


Add Synchronizer

Use the Add Synchronizer dialog box to include a synchronizer in the Agent's search list. (available with a set of Global Agent Settings selected).

  1. Enter a Name for the new synchronizer.
  2. Select a Sync Type from the list.
  3. Click OK to add the synchronizer and return to the Synchronizers dialog box.

To display this dialog box:

  1. Select a set of Global Agent Settings.
  2. Do one of the following:

    • Right-click Synchronization and select Manage Synchronizers from the shortcut menu.

      or

    • Choose Synchronizer from the Insert menu.
  3. Click Add. The Add Synchronizer dialog box displays.


Multiple Authenticator Support

Multiple authentication supports the use of multiple logon methods to authenticate an end-user. This feature provides an authenticator that is capable of supporting graded authentication as well as alternative authentication methods.

(ESSO-AM's Multiple Authenticator:

  • Accepts authentication using different authenticators.
  • Supports Graded Authentication.
  • Allows multiple authenticators to be used interchangeably during a user session, between the initial logon and the logout.
  • Allows multiple authenticators to be used interchangeably between sessions.
  • Provides administrators the ability to:
  • Allow or disallow the use of multiple authenticators
  • Specify the default primary authenticator
  • Specify which authenticators are mandatory for enrollment
  • Restrict access to applications based upon the strength of the authenticator used
  • Allow or disallow the use of multiple authenticators interchangeably during a single session
  • Allow or disallow the use of multiple authenticators interchangeably between sessions.


Add/Edit Notes

Use this dialog box to add or modify notes about the selected configuration item or settings.

  • Type or edit your notes, then click OK.

Use this dialog with the following configuration items:

  • General tab for (selected application)
  • Password Policy Subscribers tab
  • Selected Credential Sharing group
  • Selected Set of Global Agent Settings


Installing an ADAM Instance

  1. Launch ADAMSetup.exe
  2. Select A unique instance and click Next.
  3. Enter your instance name and click Next.
  4. Specify port numbers of 10000 and 10001 (10,000 range, for easy recall) and click Next.
  5. Specify the root DN (for example, OU=SSPR, DC=Oracle,DC=Com) and click Next.
  6. Specify an easy-to-find base location (for example, %RootDrive%\ADAM\Instance) and click Next.
  7. Specify the run privileges and click Next.
  8. Specify the administrative permissions and click Next.
  9. Select Do not import LDIF files for this instance of ADAM and click Next.
  10. Click Next as requested to proceed.
  11. Click Finish.


Configure Global Agent Settings (for an MSI package)

Configuring Global Agent Settings

Use the Configure Global Agent Settings dialog box to select the set of Global Agent Settings to include in an AdminOverride object for synchronization or for a customized Windows Installer package (.msi file).

Do one of the following:

Deploying or Packaging Global Agent Settings from the Current Console Configuration

  1. Select Use Administrative Console as Source.
  2. Select a set of settings from the drop-down list.
  3. Click OK.

Deploying or Packaging Global Agent Settings from a File

  1. Select Use File as Source.
  2. Enter a path and filename for the .INI file or click Browse to locate it.
  3. Click OK.

To display this dialog box for an AdminOverride object:

  • Connect to a synchronizer repository, right-click an AdminOverride object, then select Configure from the shortcut menu.

To display this dialog for creating an MSI package

  • From the Insert menu, select Generate Customized MSI, then, in the Configuration group, next to Global Agent Settings, select Choose.


Edit Columns

Use the Edit Columns dialog box to select and order the logon details that appear as columns in the Agent's Logon Manager and Logon Chooser dialog boxes.

  • To add detail columns, select the columns in the Available list, then click >> to move your selections to the Selected list.
  • To remove detail columns, select the columns in the Selected list, then click << to move your selections to the Available list.
  • To change the order of the columns, select a column in the Available list and click Up or Dn.


Event Logging Filter

Event Logging: Filter Options

Select the events you want to log, then click OK. The table below groups the filters by function.

You must select Event Types Info to enable Event Logging.

Type | Name
Changes to user data (Credential) | Credential Add
 | Credential Copy
 | Credential Delete
 | Credential Edit
Agent controls used (Feature) | Help
 | Reauthentication
 | Settings Change
 | Startup / Shutdown
Credential data supplied (Logon) | Logon Field: Fourth Field
 | Logon Field: System Domain
 | Logon Field: System Username
 | Logon Field: Third Field
 | Logon Field: Username
 | Sync User Information
Agent actions and changes (Application) | Primary Logon Method Change
 | Backup/Restore
 | Application Password Change
Event Types | Event Types Info (must be selected to enable Event Logging)


Select AD Users or Groups (for AD role/group support)

Add User or Group (for Active Directory Role/Group Support)

Use this dialog box to select the individual users or user groups to add to the access list for the current configuration item (application logon, password policy, global agent settings or passphrase set).

Controls
List Names From | Select an Active Directory domain or server.
Names | Lists the names of users and groups for the selected domain or server. Select one or more names to add to the access list.
Add

Copies user(s) and group(s) selected in the Names list to the Add Names list. Use Ctrl+click or Shift+click to select multiple entries.
Members | When a group is selected the Names list, displays the Global Group Membership dialog box, which lists the members of the selected group.
Search | Displays the Find Account dialog box for searching one or more domains for a specific user or group.
Add Names

Display the names of the user(s) or group(s) for whom you have you have added so far. Click OK to add these names to the access list for the current configuration item.

You can type or edit user names in this list. However, your entries are checked for invalid account names, and duplicate account selections are automatically removed when you click OK.


Global Group Membership (for AD Role/Group Support)

The Global Group Membership dialog box lists the members of a group selected in the Add User or Group dialog box. Use this dialog box to select the individual members to add to the access-control list for the current configuration item. (use Ctrl+click or Shift+click to select multiple entries). Click Add to copy the selected named to the Add Names list in the Add User or Group dialog box.


Find Account (for AD role/group support)

Find Account (for Active Directory Role/Group Support)

Use the Find Account dialog box to search for a specific individual user account or user group in a specific domain or across multiple domains, then add any or all of the search results to the access-control list for the current configuration item (application logon, password policy, global agent settings or passphrase set).

1. Search for names
Find a User or Group | Type the name of a user or group to search for. Only exact user/group name matches are allowed.
Search All/Search Only in | Search all available domains (displayed in the list box below) or select specific domains to search. Use Ctrl+click or Shift+click to select multiple entries.
Search | Begin searching for the user/group name.
2. Add results to list
Search Results | Lists the user and group accounts that match the search criteria.
Add | Add user(s) and group(s) selected in the Search Resultslist to the Add Names list in the Add User or Group dialog box. Use Ctrl+click or Shift+click to select multiple entries.


Configure SSO Support: Select Applications and Password Policies

Configuring ESSO-LM Support: Select Applications and Password Policies and Session Lists

Use this Wizard page to select application logons and password policies and ESSO-KM lists from the current console session to deploy to the current synchronization repository. You can choose all applications and policies, select applications and policies individually, or remove items from either list. When your selection is complete, select Next to continue.

Lists
Applications | Lists the application logon configurations to be deployed.
Password Generation Policies | Lists the password policies to be deployed.
ESSO-KM Application List | Lists the ESSO-KM applications lists to be deployed.
Controls
Applications | Lists the application logon configurations to be deployed.
Password Generation Policies | Lists the password policies to be deployed.
ESSO-KM Application List | Lists the ESSO-KM applications lists to be deployed.


Configure SSO Support: Select Global Agent Settings

Configuring ESSO-LM Support: Select Global Agent Settings

Use this Wizard page to select a set of global agent settings from the current console session to deploy to the current ESSO-LM synchronization repository.

  1. From the list, select a set of Global Agent Settings.
  2. Select Next to continue.


Select Users or Groups (for LDAP role/group support)

Add Users or Groups (for LDAP Role/Group Support)

Use this dialog box to select the individual users or user groups that are to be added to the access list for the current configuration item (application logon, password policy, global agent settings or passphrase set).

Controls

Search Base | The base (highest-level) directory to begin searching for user/group accounts. All subdirectories of the base directory are searched Type a location or click Change to browse the directory tree.
Change | Displays the Select Search Base dialog box to browse for a base directory for the search.
Search | Begin searching the base directory for wsers and groups.
Users and Groups | Lists the search results. Select the names to be added to the access list for the current configuration item. Use Ctrl+click or Shift+click to select multiple entries. Click OK when finished to copy your selections to the access list.


Select Search Base (for LDAP Role/Group Support)

Use this dialog to browse to and select the base (highest-level) directory to search for user/group names. Click OK when finished to return to the Select Users or Groups dialog box.


Configure SSO Support: Include passphrase questions

Configuring ESSO-LM Support: Include passphrase questions

Use this Wizard page to deploy the passphrase questions from the current console session to the current synchronization repository. See Passphrase Questions for more information.

Send the Passphrase questions Select this checkbox to deploy the current set of passphrase questions. Select Next to continue.


Configure SSO Support: Summary

Summary (Configure SSO Support)

Use this Form Wizard page to review the configuration. To make changes, use the Back and Next buttons to display a page. When your configuration is complete, select Finish.


Configure SSO Support: Role/Group Support

Configuring ESSO-LM Support: Select Mode Role/Group Support

This Wizard page displays the option to apply role/group access control support for ESSO-LM configuration information.

If Standard mode (the default) is selected, configuration information is stored on the directory as standard ESSO-LM objects: EntList (for logons and policies), FTUList (for bulk-add and passphrase questions), and AdminOverride (global agent settings).

Select Advanced mode to enable role/group support. All application logons, password policies, global agent settings, and passphrase question sets are added to the current synchronization repository as individual objects.

Enable Role/Group Support
  • Select this checkbox to enforce role/group access-control settings for all logons, policies, global agent settings, and passphrases.
  • Clear this checkbox to deploy configurations information without enforcing access control. Click Next to continue.


End-User Experience\Response\Host/Mainframe Apps\Error Loop

Error Loop (End-User Experience - Response - Host/Mainframe)

The Host/Mainframe Error Loop settings control the Agent's default behavior when it supplies incorrect credentials to host/mainframe logons.

Application-specific settings override these settings.

Maximum retries before prompting | Controls the number of logon retries for host/mainframe logons. The default is 1.
Maximum time for retries before prompting | Controls the timeout for host/mainframe logons. The default is 30 seconds.
Require password confirmation when modifying password | Indicates whether to display the Confirm Password field in the Logon Error dialog box for host/mainframe logons. The default is to Requirepassword confirmation.


End-User Experience\Response\Web Apps\Error Loop

Error Loop (End-User Experience - Response - Web )

The Web Error Loop settings control the Agent's default behavior when it supplies incorrect credentials to Web logons.

Application-specificsettings override these settings.

Maximum retries before prompting | Controls the number of logon retries for Web logons. The default is 1
Maximum time for retries before prompting | Controls the timeout for Web logons. The default is 30 seconds.
Require password confirmation when modifying password | Indicates whether to display the Confirm Password field in the Logon Error dialog box for Web logons. The default is to Require password confirmation.


End-User Experience\Response\Windows Apps\Error Loop

Error Loop (End-User Experience - Response - Windows)

The Windows Error Loop settings control the Agent's default behavior when it supplies incorrect credentials to Windows logons.

Application-specificsettings override these settings.

Maximum retries before prompting | Controls the number of logon retries for Windows logons. Default is 1.
Maximum time for retries before prompting | Controls the timeout for Windows logons. Default is 30 seconds.
Require password confirmation when modifying password | Indicates whether to display the Confirm Password field in the Logon Error dialog box for Windows logons. Default is to Require password confirmation.


Event Logging

The Event Logging settings control how the Agent records program events.

  • Use the XML File (Event Logging) settings to set different options for local logging.
  • Use the Advanced (Event Logging > Windows Event Viewer) settings to set different options for Windows Event logging.
Select events to log: Displays the Event Logging Filter to specify which events to log to log. Click "…" to display a checklist of events.


Edit List

Use this dialog box to enter items described in the window title bar (for example, Servers).

  1. Type one item for each line. Press Enter at the end of each line. Do not use any other delimiter characters.
  2. Click OK when finished.

Use this dialog box with the following global agent settings:

LDAP Synchronizer | UserPaths
LDAP Synchronizer Servers | Servers
LDAP Authenticator Servers | Servers
Active Directory Synchronizer | UserPaths
Active Directory Synchronizer Servers | Servers
Database Synchronizer Servers | Servers
Shell Tasks | Deletion Tasks PreTasks RefreshTasks StartupTasks


Synchronizers

Displays the current set of available synchronizers and the order by which the Agent searches them.

To add a synchronizer:

  • Click Add. The Add Synchronizer dialog box appears.

To change the search order:

  • Select a synchronizer and click the up or down buttons to reposition it.

To display this dialog box:

  1. Select a set of Global Agent Settings.
  2. Do one of the following:

    • Right-click Synchronization and choose Manage Synchronizers from the shortcut menu.

      or

    • Choose Synchronizer from the Insert menu.
    • Choose Synchronizer from the Insert menu.


Export Format

Use this dialog box to select an output format for the selected set of settings.

Options

Administrative Override Object | Export the settings as an administrative override object (INI) file.
HKLM Registry | Export the settings as a registration-entries (REG) file.
Both | Export both file types.
Unicode encoding (.REG format only) | Export the .REG file in Unicode format.

Exporting a Set of Global Agent Settings

  1. (Optional) Select Unicode format for the .REG file, if desired.
  2. Click an option.
  3. In the File Save dialog box, locate and open the folder for each file, name the file, and click Save.


Host/Mainframe Wizard (Cursor Position) 870

Cursor Position (Host/Mainframe Form Wizard)

Use this Form Wizard page to indicate the row and column of the cursor for the logon/password-change form of a host/mainframe application that uses a scrolling screen.

  1. Click or use the arrow keys to place the text cursor in the exact position that it appears in the Telnet application's window.
  2. Click Next to display the next wizard page. Click Back to re-paste the screen text.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Field Matching - Fixed Screen (Host/Mainframe Form Wizard)

Use this Form Wizard page to define the fields of a fixed-screen logon or password-change form.

  1. Place the cursor at the starting position of a field.
  2. Right-click and choose the field type (Username/ID, Password, Third Field, Fourth Field) from the shortcut menu. Repeat this procedure for each required field.
  3. To remove a defined field click Remove.
  4. Select a Tab Character to move from one field to the next; the options are Tab, Enter, and None.
  5. When your selections are complete, click Next to display the Summary page. Click Back to modify the matching text for the form itself.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Field matching - scrolling screen (Host/Mainframe Wizard)

Field Matching - Scrolling Screen (Host/Mainframe Form Wizard)

Use this Form Wizard page to define the text position and the sequence of logon prompts of a scrolling screen logon or password-change form.

  1. In the console's Fields wizard page, place the cursor at the prompt-entry position. Click Add, then select the first field type requested. Repeat this procedure for each required prompt.
  2. To modify a defined field's settings, click Edit.
  3. To remove a defined field click Remove.
  4. When your selections are complete, click Next to display the Summary page. Click Back to modify the matching text for the form itself.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Paste Screen Text (Host/Mainframe Form Wizard)

Use this Form Wizard page to paste the text of the host/mainframe application's logon or password change screen into the console for configuration.

  1. Start the target application in the host/mainframe emulator or Telnet.
  2. In the target application, all of the onscreen text and copy it to the Windows Clipboard.
Some emulators provide a Copy command or button; others let you select Ctrl+C to copy. In Windows Telnet, select the text and select Enter.
  3. In the console, click Paste Text.
If the emulator screen does not use return or line-feed characters, adjust the Characters per Line to set proper text wrapping.
  4. Click Next to display the next wizard page or click Back to change the screen type.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


context\HostWizard_Screen

Screen Type (Host/Mainframe Form Wizard)

Use this Form Wizard page to select the host/mainframe application's screen type for a logon or password change window.

Choose one of the following:

  • Fixed Screen. For applications running on a host/mainframe emulator that present logon forms as static text pages.
  • Scrolling Screen. For applications running on Telnet or other scrolling-screen comsole that request logon information as a series of prompts.

If you have already selected a screen type in this Wizard session, click Next to display the next Wizard page. Click Back to change the form type.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host/mainframe application logons.


Summary (Host/Mainframe Host Wizard)

Use this Form Wizard page to review the configuration. To make changes, use the Back and Next buttons to display a page. When your configuration is complete, click Finish.


Support Information

Direct all questions, comments, or errata regarding the information contained in this document to:

Passlogix, Inc.

75 Broad Street, Suite 815

New York, NY 10004 USA

Tel: (212) 825-9100

Fax: (212) 825-0326

E-mail: info@passlogix.com

Web: http://www.passlogix.com

For customer support, please contact:

E-mail: Support@passlogix.com

US: (888) 713-5470

EMEA: 00 44 (0)808 2342735

Australia: +61 1800 153 807


Matching offset example

Offset Matching Example

Following is a sample portal page that contains three windows. The goal is to log on to the Sales Database window. In order to do that, isolate that window from all the others windows on the page.

Like most portal sites, the windows can be rearranged and windows can be added or removed by the user so the order and the existence of windows can change. This can be done using both Detection Matching and Offset Matching (collectively referred to as Web Matching). This example describes Offset Matching.

Below is an HTML fragment that is shown when you click View > Source from the browser’s toolbar (the HTML has been greatly simplified to illustrate the important elements):

<div name=”portalLogon1”>

<p>

Accounting Database

</p>

<form>

Username: <input type=”text” name=”username”>

Password: <input type=”password” name=”password”>

<input type=”submit” >

</form>

</div>

<div name=”weatherStation”>

<form>

Zip Code: <input type=”text” name=”zipCode”>

<input type=”submit” >

</form>

<p>Temperature is now 72°</p>

</div>

<div name=”portalLogon2”>

<p>

Sales Database

</p>

<form>

Username: <input type=”text” name=”username”>

Password: <input type=”password” name=”password”>

<input type=”submit” >

</form>

</div>

Each window is represented by a <div> tag and each <div> tag has a name attribute, which you use to filter out windows that are not pertinent to your task.

To do this, add an Offset Match to look for all <div> tags with the name attribute that contains the word portalLogon. Click Add to match this criterion.

For this example, all the windows are now filtered out except the two portalLogon windows. The Agent now focuses only on the following windows:

<div name=”portalLogon1”>

…

</div>

<div name=”portalLogon2”>

…

</div>

To isolate the Sales Database window, you must add another offset match form. The HTML source indicates that the window to isolate contains a <p> tag that contains the text Sales Database. Click Add to match this criterion.

The Agent now sees only one window:

<div name=”portalLogon2”>

…

</div>

Since the targeted window is isolated, this is all the matching that you need to add.

The remaining task is to set the Offset Start values. To set this, determine at which match the form you want is visible. In this example, there are two matches.

The first matches the <div> tag, and the second match matches the <p> tag. In this match, the <form> tag is visible since it is contained in the <div> tag:

<div name=”portalLogon2”>

…

<form>

…

</form>

</div>

In the second match, the <form> tag cannot be seen since it is not contained in the <p> tag.

<p>

Sales Database

</p>

The Offset Match cannot be set to 2. It must be set to 1. This tells the Agent that the form offset for the fields is relative to the first match (the <div> match), as follows:

<div name=”portalLogon2”>

<p>

Sales Database

</p>

<form>

Username: <input type=”text” name=”username”>

Password: <input type=”password” name=”password”>

<input type=”submit” >

</form>

</div>

All the form offsets and field offsets in the Fields list (found in the General tab) are relative to the above HTML.


Edit Passphrase Question

Edit Passphrase Questions

Use this dialog box to add or edit the passphrase question that appears during First-Time Use , the setup wizard that is invoked when (a) the Agent is started for the first time after installation or (b) the administrator deploys a ftulist object (for example, the ftulist.ini file). This option is used for Windows Authenticator v2 and LDAP Authenticator v2 only. In ESSO-AM, this option is used for Smart Card authentication (SCAuth).

On first-time use, ESSO-LM users select a passphrase question and supply an answer. This stored passphrase answer can be used to reset ESSO-LM authentication if the user later changes the primary logon password. The next time single-sign-on re-authentication is required, the user enters the new password, and ESSO-LM displays the passphrase question to confirm the user's identity.

Adding a Windows/LDAP Authenticator Passphrase

  1. Select a Language, then click Add.
  2. In the Edit Question dialog box, type a Question.
  3. Select or enter a Minimum Length for the reply.
  4. Click OK.

Controls

Language | Select language for passphrase questions.
Enabled/Question | Lists current passphrase questions. Checked items are the enabled passphrases for the current password set. To disable a passphrase click the checkbox to clear it (see Note below. To modify a passphrase question, double-click it, or select it and click Edit.
Add | Add a new passphrase question; displays the Edit Question dialog box.
Remove | Delete the selected passphrase question; displays a confirmation prompt. See Note below.
Edit | Modify the selected passphrase question; displays the Edit Question dialog box.
Remove or Disable? Once a passphrase question has been created, deployed, and put into use by end-users, it should not be deleted. Users who have selected a passphrase question that has been deleted will not be able to change their passwords without losing access to their ESSO-LM credentials. Instead, to remove an in-use passphrase question (and keep it from being displayed during first-time use), disable the question by clearing its checkbox in the list in Tools>Edit Passphrase Questions dialog box.


Add Passphrase Question

Edit Question (For Passphrase)

  1. Type a Question.
  2. Select or type a Minimum Length for the reply.
  3. Click OK.


Password Change

Password Change Tab (for a Selected Application)

Use the Password Change tab to set or modify options that control how the Agent manages password changes.

The Agent distinguishes between logon and password change fields that appear on the same screen or on different tabs of a dialog box. In the instance of this type of screen, the Agent prompts the user, through the Action Chooser dialog box, to select a password change or logon. You can configure a period of time for which the user will not need to change passwords, and hence will not receive the Action Chooser.

Controls

Password Change Options
Wizard Behavior

Controls how the Agent responds when an application prompts the end user to change passwords. The options are:

  • Prompt User: Prompts the user with the Password Change Wizard.
  • Manual w/Auto Option: Prompts user to select a new password, but lets the Password Change Wizard offer to generate a password automatically.
  • Auto only: Generates a new password automatically, and does not allow the user to select the new password.
  • Auto w/Manual Option: Generates a new password automatically, but first allows the user to select a new password.
  • Quietly Generate and Submit Password: Generates and submits password without prompting the user.
  • Manual only: Prompts the user to select a new password; does not let the Password Change Wizard automatically generate a password.
Enable Password verify pop-up dialog | Check this box if you want to display the password change verification pop-up dialog box, which provides an additional confirmation that the password has been changed.
Password Generation Policy | Select a password generation policy. To subscribe multiple applications to a policy, see Policy Subscribers.
Credential Sharing Group | Select a credential sharing group. To assign multiple applications to a password group, see Credential Sharing Groups.
Password Expiration Options
Enable Password Expiration | Select this check box to require users to change passwords after a specified period.
Number of days until password expires | Enter or select the number of days for which a user's password is valid.
Run this command when the password expires | Type the full path and command (or click Browse to locate the executable file) that should be invoked when the user attempts to log on after the Number of days setting has elapsed. (Example C:\Program Files\PassChange\passchange.exe. )
Action Chooser Grace Period
Days Enter the length of the grace period (in days) for which the Agent will not display the Action Chooser dialog box.


Password Generation Policy

Displays the currently available password generation policies and provides access to policy settings. Click Password Generation Policy in the left pane to display the current password policies in the right pane.

See Setting Password Policies for more information.

To add a new password policy:

  1. Do one of the following:
  • Click Add in right pane

or

  • In the left pane, right-click Password Generation Policy then click New Policy on the shortcut menu.
  2. Enter a Policy Name and click OK. The Policy Subscribers tab appears in the right pane, where you can add applications that will use the new policy

To modify a listed password policy's configuration:

  1. Click a policy, then click Edit. The Policy Subscribers tab appears in the right pane.

To delete one or more password policies:

  1. Select a policy (use Ctrl+click or Shift+click to select multiple entries), then click Remove.


Test_Password_Policy

Use the Test Password Policy dialog box to generate a set of test passwords based on the currently-selected password policy. This lets you preview how the Agent will respond to a password change request from an application that subscribes to this policy. You can choose the number of test passwords to generate.

If the password constraints you have set are contradictory or too restrictive to generate any passwords, a message appears explaining how many passwords failed the test and why.

Generating Test Passwords

  1. Select or enter the Number of test passwords to generate.
  2. Click Generate Passwords. The test passwords display in the output window.
  3. When you are finished, click Done to close the dialog box.


SmartCardAuth

Smartcard Authenticator (SCAuth)

1535/property sheet

Use the settings in this dialog box to specify how ESSO-LM authenticates user through a smart card.

Controls
ResetEnable Enable the passphrase challenge for additional security. Users must provide a passphrase answer during First Time Use. This is the default setting.


Architecture

Copyright ©2006-2009, Oracle. All rights reserved.

Version 11.1.1.1.0


Border values

Border Values for Web Logon Credential Fields

Values for Feedback Color follow the standard for the border attribute in cascading style sheets (CSS). The table below lists valid colors and their RGB values. See Web Applications (End-User Experience - Response) for the Feedback Color setting in which these values are used.

Width

  • Thin
  • Medium
  • Thick
  • A unit of pixels, inches, etc (examples: 3px. ).

Style

  • none
  • dotted
  • dashed
  • solid
  • double
  • groove
  • ridge
  • inset
  • outset

Color

A color keyword or RGB value; common examples include the following:

Keyword | RGB Equivalent | Keyword | RGB equivalent
aqua | #00FFFF | navy | #000080
black | #000000 | olive | #808000
blue | #0000FF | purple | #800080
fuchsia | #FF00FF | red | #FF0000
gray | #808080 | silver | #C0C0C0
green | #008000 | teal | #008080
lime | #00FF00 | white | #FFFFFF
maroon | #800000 | yellow | #FFFF00


Directory Tree

Copyright ©2006-2009, Oracle. All rights reserved.

Version 11.1.1.1.0


images\Directory_Tree1_vml

[ Return to text ]


SSL_support

ESSO-LM supports the use of Secure Sockets Layer (SSL) and enables it by default. When deciding whether to use SSL, consider the following:

  • ESSO-LM encrypts all credentials locally through the user’s configured authentication method, and transmits and stores those credentials in encrypted form.
  • For repositories that use pass-through authentication (for instance, Active Directory or ADAM), ESSO-LM secures all transactions with the central repository (including authentication to the repository); no credentials of any type are transmitted in clear text.
  • When using LDAP repositories or pass-through repositories in conjunction with ESSO-KM, the repository authentication will be a clear-text LDAP transaction if SSL is not enabled. If this authentication must be secure, enable SSL for transactions between the client and the repository.

For complete instructions on setting up SSL certificates, refer to the following documentation:

  • Microsoft Active Directory Server: Microsoft MSDN
  • Sun Java System Directory Server: Sun Java System Directory Server Administrators Guide
  • Novell eDirectory: eDirectory 8.5 Administration Guide

SSL is configured with the registry keys UseSSL and SSLFallback.


Seagull BlueZone

For a complete list of supported versions, please refer to the latestESSO-LM Release Notes.

ESSO-LM supports Seagull BlueZone. No setup steps are necessary.


Configure Applications (for an MSI package)

Configure Applications

Use the Configure Applications dialog box to select the application logons to include in an EntList object for synchronization or for a customized Windows Installer package (.msi file).

Do one of the following:

Deploying or Packaging Application Logons from the Current Console Configuration

  1. Select Use Administrative Console as Source.
  2. Do one of the following:

    • Choose Send All Applications.

      or

    • Choose Send Some Applications, then:
  3. Click Select Apps.
  4. In the Select Applications dialog box, select the applications to package and click OK.
  5. If desired, select Create First-Time-Use (FTUList) object.
  6. Click OK.

Deploying or Packaging Application Logons from a File

  1. Select Use file as Source.
  2. Do either or both of the following:
    • Enter a path and filename for the Application (EntList.ini) file or click Browse to locate it.
    • Enter a path and filename for the First-Time Use (FTUList.ini) file or click Browse to locate it.
  3. Click OK.


Session Manager Actions

Oracle Enterprise Single Sign-on Kiosk Manager Actions

This panel contains the list of actions that have been created. An action tells ESSO-KM to do something, such as run a program, call a .Net method, or terminate a specific application.

Use this panel to create, edit, copy and delete action lists:

  1. Click Create to define a new action list. The three types of actions that can be created are Terminate lists, Run lists, and Special Actions lists.

    or

  1. Highlight an action name, and:
    • Click Edit to make changes to this action.
    • Click Copy to quickly make a copy of an action. To change the name, right-click the action in the left pane and click Rename. You can also perform a copy by right-clicking the action in the left pane and clicking Copy.
    • Click Delete to delete an action. A confirmation message dialog will appear before the action is deleted. If this action was associated with a session state, it will be deleted from the session state as well.


Add Custom Authenticator

Custom authenticators allow you to filter events based on that authenticator. To add a custom authenticator, click the Add button on the Authenticators tab. This opens the Custom Authenticator dialog box:

  1. Enter an Authenticator Name. This is the authenticator name that displays.
  2. Enter an Authenticator Value. The authenticator value is the name that the authenticator is known by within the code. This name comes from the authenticator itself. For example, the value for Windows Authenticator v1 is WinAuth, for Windows Authenticator v2 is MSAuth, and for Smart Card is SCAuth.
  3. Click OK.


Add Custom Event

To add a custom event, click the Add button on the Events tab. The Custom Event dialog box opens.

  1. Enter an Event Name. This is the event name that displays.
  2. Enter an Event Value. An external application generates the custom event, sending a message to the ESSO-KM hidden window. The value is the custom value that the other application sends.
  3. Click OK.


Session Runlist netapi example

.Net API Sample C# code with properties for the "User Change" event.

using System;

using System.Collections.Generic;

using System.Text;

using System.Windows.Forms;

namespace ClassLibraryTest

{

public class TestClass

{

private string m_userName;

private string m_domainName;

public string UserName

{

set

{

m_userName = value;

}

get

{

return m_userName;

}

}

public string DomainName

{

set

{

m_domainName = value;

}

get

{

return m_domainName;

}

}

public void UserChange()

{

MessageBox.Show("UserChange called with user: " + DomainName + "\\" + UserName);

}

public void SessionStart()

{

MessageBox.Show("SessionStart called");

}

public void SessionEnd()

{

MessageBox.Show("SessionEnd called");

}

public void SessionLocked()

{

MessageBox.Show("SessionLocked called");

}

public void SessionUnlocked()

{

MessageBox.Show("SessionUnlocked called");

}

public void PreSessionUnlocked()

{

MessageBox.Show("PreSessionUnlocked called");

}

public void AuthLogon()

{

MessageBox.Show("AuthLogon called");

}

public void AuthTimeout()

{

MessageBox.Show("AuthTimeout called");

}

public void DeviceIn()

{

MessageBox.Show("DeviceIn called");

}

public void DeviceOut()

{

MessageBox.Show("DeviceOut called");

}

public void GracePeriod()

{

MessageBox.Show("GracePeriod called");

}

}

}


Session Select Action List

Oracle Enterprise Single Sign-on Kiosk Manager > Session States > Actions > Associate Select Actions

Use this dialog box to select one or more actions to associate to this session state. Select the actions to add to this session state (use Ctrl+click, or Shift+click to select multiple entries). Click OK.

If actions are associated with this session state, and you are adding new actions, ALL actions need to be re-selected, otherwise the list of actions will be replaced with the newly selected actions.


SM Add App to LeaveDefault

Oracle Enterprise Single Sign-on Kiosk Manager > Keep Running List > Select Default Applications

Use this dialog box to add default applications to the list of applications to keep running on session end.

  • Select the desired applications to keep running on session end and click OK.

    The selected applications are then listed in the AppPath Keys dialog box.


SM Add AppPathKeys

Process Path Key

The Process Path Key is the name of the process executable, such as IEXPLORER.EXE is the process path key for Internet Explorer. Use this dialog to add an application to the list of applications.

  • Type a Process Path Key and click OK.

    The Process Path Key is then created in the AppPath Keys dialog box.


Add Select Applications

Select Application, Password Policies, or Session List Dialog Box

Use the Select Applications (or Password Policies or Session List) dialog box to do one of the following:

  • Select one or more application logon configurations to include in a group or policy, or for export to an installer package
  • Select individual applications and password policies for deployment to a directory using role/group support
  • Add Oracle Enterprise Single Sign-on Kiosk Manager application lists to send.

Adding Applications, Policies, or Session Lists to a Group or Package

  1. Select the applications to add to this group. (Use Ctrl+click or Shift+click to select multiple entries.)
  2. Click OK.
  3. Click Add in one of these dialog boxes to open Select Applications:
    • Bulk-Add tab
    • Policy Subscribers tab
    • Selected credential sharing group
    • Configure Applications (Generate MSI)
    • Manage Templates
    • Configure SSO Support: Select Applications and Password Policies


Edit Server List

Use this dialog box to remove servers that are listed in the Server Name drop-down box on the Connect to Repository dialog box.

  1. Select a server and click Delete.
  2. Click OK when finished.


Error_Loop_Apps

Error Loop tab (by Application Type)

Use the Error Loop tab (under Applications) to control the appearance and behavior of the Logon Error (Error Loop) dialog box for each application type (Window, Web, Host/Mainframe).

  • To set error loop globally, for all applications, use the settings in the Error Loop property sheet.
  • To set Error Loop for individual applications, use the settings in the Error Loop tab for each application .

See Settings > Controlling Repeated Logon Attempts for more information.

Controls

Logon Timeout (sec.)

[TimeOut]

Maximum time in seconds between successive logon attempts before Logon Error dialog box appears. Default is 3.

Max. Retries

[MaxRetry]

Maximum number of retries (after first try) allowed before Logon Error dialog box appears. Default is 1.

If Logon Timeout is set to 0, a logon error (for example, entering the wrong credentials) will not display the Logon Error dialog box.

Hide "Confirm Password"

[HideConformPW]

Whether to hide the password confirmation field in the Logon Error dialog box. Default is No.
(Global registry equivalents shown in brackets.)


First_Time_Use_Apps

First Time Use Tab

Use the First Time Use tab (under Applications) to control specific behaviors of the Setup Wizard.

To display the First Time Use tab:

  • Click Applications in the left pane, then click the First Time Use tab in the right pane.

Controls

Minimize number of steps during Setup Wizard

Select to have Setup Wizard display the minimum number of pages necessary to set up ESSO-LM after installation:

If this option is selected:

  • Only one (default) primary logon method is available. If multiple authenticators have been installed, only the first authenticator in the registry is presented for user setup.
  • Bulk add applications are not presented for user selection.
  • The summary screen does not appear at the end of the Setup Wizard.

If this option is cleared:

  • All installed authenticators are presented for user setup.
  • Bulk add applications are presented for user selection.
  • The summary screen appears at the end of the Setup Wizard.


Matching tab (for configuring a Web application)

Matching Tab (for a Selected Web Application)

Use the Matching (Web) tab to distinguish among similar forms within the same Web application. The supported form types, referred to here as target forms, are:

  • Logon
  • Password change
  • Password change success
  • Password change failure

This tab is typically used to refine the detection match criteria, that is, the set of HTML tags and values you use to identify a specific page. You can then create an offset match that uses a subset of the detection match to identify the desired logon or password-change form on the page.

To display this tab:

  • Create a new Web application logon.

    or

  1. In the left pane, select Applications and select a Web application.
  2. Click the General tab in the right pane.
  3. Select a form from the list and click Edit.
  4. From the General tab in the Web form-configuration dialog box, select the Matching tab.

Creating or Modifying Detection-Matching Criteria

  1. In the Detection Match list, do one of the following:
  2. Click Add to create a new matching criterion.
  3. Select a match and click Edit to modify an existing match.
  4. From the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  5. If necessary, adjust the match criteria order.
  6. Select a match to move.
  7. Click the up or down arrows.
  8. Click OK.

Use the AND, OR, and NOT operators to specify the conditions under which the Agent should respond to Web match combinations.

If you assign a match value of AND to a match criterion, that criterion must be present for the Agent to respond to a page. So, when several fields are assigned an AND operator, all those criteria must be present.

If you assign a match value of OR to several match criteria, the Agent responds if any one of the criteria is present.

The NOT operator is used as an excluder when performing a match. The Agent responds to any criteria that are assigned the AND and OR operators, unless the conditions of the NOT criteria are present. The Agent excludes the instances specified by the NOT operator.

Offset Matching

Offset matching should only be used with portal Web pages.

This type of matching is used with portal pages that have multiple windows that the user can rearrange, add, and remove. If the site you are matching on is not a portal, leave the offset matching section on this panel blank.

With regular match detection, the forms must always appear in the same order. With offset matching, you can rearrange the forms (which look like a window) and isolate a specific window from all the others. This only applies to portal pages because these pages are dynamic, and ordinal values are used to match instead of field names.

Use the Offset Start field to tell ESSO-LM which match result's forms to use for the form offsets. The offset start value should be the number of the offset matches. For example, if there are 3 offset matches, the offset start value should be 3.

Creating or Modifying Offset Matching Criteria

  1. In the Offset Match list, do one of the following as needed:
    • Click Copy from Detection to copy defined Detection Match criteria.
    • Click Add to create a new matching criterion.
    • Select a match and click Edit to modify an existing match.
  2. In the Edit Match dialog box, enter or select the required information, then click OK to return to this dialog box.
  3. If necessary, adjust the match criteria order.
  4. Select a match to move.
  5. Click the up or down arrows.
  6. Select an Offset Start.
  7. Click OK.


Matching tab

Matching tab (for Configuring a Windows application)

Use the Matching (Windows) tab to distinguish among similar forms within the same Windows application. The supported form types, referred to here as target forms, are:

  • Logon
  • Password change
  • Password confirmation
  • Password change success
  • Password change failure

The Agent uses the match criteria you supply to distinguish among similar forms. This lets the Agent apply a single set of user credentials appropriately to these multiple forms. You can use also use matching to identify forms that the Agent should ignore.

Do one of the following:

  • Click Add to create a new matching criterion.

    or

  • Select a Match and click Edit.

    The Matching dialog box appears.

The easiest and most efficient way to create match criteria is by using the Control Match Wizard. The Wizard lets you specify match criteria by selecting elements from the target form itself. You can also create and modify match criteria manually.


Fields (of a host/mainframe logon form)

Add or Edit Fields

Use the Fields dialog box to specify a credential field of the logon or password-change form.

You must also specify the location (row and column number) of the first character of the field. Use the cursor-position indicator in the status bar at the bottom of the session window to find the starting row and column numbers of the field. When you have completed your entries, click OK.

See Adding Host/Mainframe Applications for more information.

Controls

Function

Select the field type:

  • UserID
  • Password/OldPassword
  • Third Field
  • Fourth Field
  • New Password
  • Confirm New Password
Row | (Fixed screen applications only) Type the row number (vertical screen coordinate) of the first character of the field.
Column | (Fixed screen applications only) Type the column number (horizontal screen coordinate) of the first character of the field. If the column number is variable, (for example, most Unix systems include the affected username as part of the "New Password" and "Confirm Password" field labels when changing passwords), you can use a regular expression to wildcard the variable portion of the field label so that ESSO-LM always injects credentials in the correct spot.


Citrix_Environment_Install

Configuring ESSO-LM in a Citrix Environment

Default Installation of ESSO-LM in Citrix MetaFrame

The ESSO-LM default installation process automatically detects and installs the components necessary for ESSO-LM to function in a Citrix environment. The installation process enables ESSO-LM support for every application published on that Citrix server.

Installing ESSO-LM on Citrix MetaFrame

  1. Log on to the terminal server as an administrator and close all applications.
  2. Click Start and then click Run.
  3. From the drop-down list in the Run dialog box, select cmd and press Enter.
  4. At the command prompt, enter change user /install and press Enter.
  5. Install ESSO-LM with the appropriate installation options for your environment.
  6. At the command prompt, enter change user /execute when installation is complete.

Controlling ESSO-LM for Specific Applications in Citrix

The following section explains how to change from the default installation of ESSO-LM and to enable ESSO-LM for only specific applications in a Citrix environment. There are two steps in this process. The first step is to remove the global ESSO-LM support. The second is to specify which applications are going to be SSO-enabled through their published application configurations.

Removing Global ESSO-LM Support

  1. Click Start and then click Run.
  2. In the Run dialog box, enter Regedit and press ENTER.
  3. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
  4. From the right pane, right-click the AppSetup string value and select Modify.
  5. Delete the value data in this entry that refers to SSOLauncher. (C:\Program Files\Passlogix\v-GO SSO\wts\ssolauncher.exe /nossoshutdown)
  6. If you are using Windows Authentication v1 add the CheckForParentProcess key into the Passlogix registry hive. This ensures authentication event handoff to ESSO-LM.

HKEY_LOCAL_MACHINE\SOFTWARE\Passlogix\AUI\WinAuth\

DWORD:

CheckForParentProcess

Value=0

Removing ssolaucher.exe from AppSetup configures ESSO-LM not to function with any applications on this Citrix server unless specified in your published applications configuration.

Specifying Which Applications Are SSO-Enabled Through the Published Application Configuration (SSOLauncher)

Since ESSO-LM support is now globally disabled, you must specify which applications to publish with ESSO-LM support by including the SSOLauncher.exe command in the published application properties.

  1. Open Citrix Management Console.
  2. Locate and publish the application you would like to enable for single sign-on.
  3. Right-click on the published application and select Properties.
  4. Select the Application Location tab.
  5. Add to the front of the Command Line the following syntax: C:\Program Files\Passlogix\v-GO SSO\wts\SSOLauncher.exe/application

The command for SSOLauncher.exe is added to the published application’s command line; it does not replace it.

Following is an example of the command line syntax for the application ACT:

C:\Program Files\Passlogix\v-GO SSO\wts\SSOLauncher.exe” /application C:\ProgramFiles\ACT\act.exe

This example assumes that ESSO-LM and ACT are both installed on the C:\ drive of the Citrix Server.

See SSOLauncher for MetaFrame XP Servers for more information.


context\HostWizard_TextMatch

Text to Match (Host/Mainframe Form Wizard)

Use this Form Wizard page to indicate text that identifies the screen as a logon or password change form.

  1. Select a block of text that identifies the screen as a logon or password change form. Right-click the selection, and select Add as Text Match.
  2. Repeat this step for additional text blocks.
  3. To remove a text match, select the match in the lower pane and click Remove.
  4. Click Next to define the form fields. Click Back to display the previous wizard page.

See Host/Mainframe Form Wizard for an overview of the procedure for configuring host and mainframe application logons.


Credential field

Credential Field (Windows Form Wizard for RSA-securID Applications)

Use this Form Wizard page to select the fields of the application's logon or password change window.

See Windows Form Wizard (RSA-securID applications) for details of the procedure for configuring Windows applications.

Credential Fields

Displays the fields of the currently selected application window. Click on the headers (Class, ID, or Text, to sort the list. Right-click a field in the list to display a shortcut menu of field types and the submit control:

  • SecurID Username
  • Passcode
  • Tokencode
  • Next Passcode
  • Next Tokencode
  • Confirm New PIN
  • SecurID Other Field
  • OK (submit control)

Refresh

Updates the field list.

Use "Send Keys" for this form, do not use Control IDs

Indicates that the Agent should transmit logon data to this form as a series of keystrokes, rather than by addressing individual fields by Control ID. See SendKeys for more information.

Refresh | Updates the field list.
Back | Go back to the previous Wizard page
Next | Go forward to the next Wizard page.


SendKeys for Sessions in a Windows Application

Kiosk Manager SendKeys (for a Windows Application)

Use the SendKeys dialog box to specify a series of keystrokes that ESSO-KMshould transfer to the logon form.

See Adding Telnet Applications for information about configuring logons for Telnet applications.

The tabs in the right pane of the SendKeys dialog box provide the keystroke options. Select or type the options you need on each tab. Click the Insert button to add the key or action to the series.

Your selections appear in the list in the left pane. To change the order of the series, select an item and click the up or down arrows to move it. To delete an item, select it and click Remove.

Controls

Text tab

Enter text to insert

Type any literal text to add to the series.

Insert

Add the text to the series.

Delay tab

Length of delay (in seconds)

Type or select a delay between keystrokes.

Insert

Add the delay to the series.

Special Keys tab

Category/Keys

Choose a keystroke category (for example, Movement keys) from the left list, then a specific key (for example, Page Down) from the right list.

Key Press

Insert the key as a single keystroke (default)

Key Down/Up

Insert the key as a pair of actions: key-press and key-release. This option lets you insert other keystrokes between these actions to indicate one or more keys held down as another is typed, as for a "hot key" combination that moves the focus to a specific text box.

For example, to insert the keystroke "Alt+P", choose the Key Down/Up option, then select Modifier for the Category and Alt for the Key. and click Insert. This inserts two actions: [Down:Alt] and [Up:Alt]. Select the Text tab and type P in the text box. In the left pane, select [Up:Alt] then click Insert. The P is inserted between the two Alt-key actions, producing "Alt-P.

Insert

Add the keystroke to the series.


Matching tab

Matching Tab (for Configuring a Windows Logon Form)

Use the Matching (Windows) tab to map user credentials of the currently selected logon to other logon, password-change, or password-confirmation forms (referred to here as target forms) within the same application. The Agent uses the match criteria you supply to distinguish among similar forms that use the same credential data. This lets the Agent apply a single set of user credentials appropriately to these multiple forms. You can use also use matching to identify forms that the Agent should ignore.

Do one of the following:

  • Click Add to create a new matching criterion.

    or

  • Select a Match and click Edit.

The Matching dialog box appears.

The easiest and most efficient way to create match criteria is by using the Control Match Wizard. The Wizard lets you specify match criteria by selecting elements from the target form itself. You can also create and modify match criteria manually.


Select Window [Class]

The Select Window dialog box lets you select the class name for an onscreen window. Use this dialog to specify a window class that the Agent should allow or that it should ignore.

The Select Window dialog box displays when you select one of the following options in the Miscellaneous tab (for a Windows logon).

  • Allowable Class: Select a logon or password-change window class that must be present in order for the Agent to execute a logon.
  • Ignore this Window Class:Select a logon or password-change window class that should be ignored when detecting credential fields.
Controls
Window List | Displays the windows of currently applications. Click on the column heads to sort the list.
Show hidden window | Select to include hidden windows in the Window list.