Active Directory Rights Management Service Integration Guide
Active Directory Rights Management Service Integration GuidePrefacePreface 2013 SafeNet, Inc. All rights reserved.Part Number: 007-011230-001 (Rev F, 07/2013)All intellectual property is protected by copyright. All trademarks and product names used or referred to arethe copyright of their respective owners. No part of this document may be reproduced, stored in a retrievalsystem or transmitted in any form or by any means, electronic, mechanical, chemical, photocopy, recording orotherwise without the prior written permission of SafeNet.SafeNet makes no representations or warranties with respect to the contents of this document and specificallydisclaims any implied warranties of merchantability or fitness for any particular purpose. Furthermore, SafeNetreserves the right to revise this publication and to make changes from time to time in the content hereofwithout the obligation upon SafeNet to notify any person or organization of any such revisions or changes.SafeNet invites constructive comments on the contents of this document. These comments, together with yourpersonal and/or company details, should be sent to the address below.SafeNet, Inc.4690 Millennium DriveBelcamp, Maryland 21017USALimitationsThis document does not include the steps to set up the third-party software. The steps given in this documentmust be modified accordingly. Refer to Luna SA documentation for general Luna setup procedures.DisclaimersThe foregoing integration was performed and tested only with the specific versions of equipment and softwareand only in the configuration indicated. If your setup matches exactly, you should expect no trouble, andCustomer Support can assist with any missteps. If your setup differs, then the foregoing is merely a templateand you will need to adjust the instructions to fit your situation. Customer Support will attempt to assist, butcannot guarantee success in setups that we have not tested.Technical SupportIf you encounter a problem while installing, registering or operating this product, please make sure that youhave read the documentation. If you cannot resolve the issue, please contact your supplier or SafeNet support.SafeNet support operates 24 hours a day, 7 days a week. Your level of access to this service is governed by thesupport plan arrangements made between SafeNet and your organization. Please consult this support plan forfurther information about your entitlements, including the hours when telephone support is available to you.Technical Support Contact Information:Phone: 800-545-6608, 410-931-7520Email: support@safenet-inc.com SafeNet Inc.i
Active Directory Rights Management Service Integration GuideiiPreface SafeNet Inc.
Active Directory Rights Management Service Integration GuideTable Of ContentsTable of ContentsChapter 1 Introduction . 1Scope . 1Prerequisites . 2Chapter 2 Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2) . 3Before You Begin . 3Setup . 3Configure user accounts and groups . 3Configure AD RMS client computer (ADRMS-CLNT). 4To install Microsoft Office Word 2007/2010 Enterprise . 4Install Luna Cryptographic Service Provider (CSP) on Windows Server 2008 R2 . 4Install AD RMS with Luna Cryptographic Service Provider (CSP) on Windows Server 2008 R2. 5Chapter 3 Integrate Microsoft AD RMS with Luna SA (Windows Server 2012) . 21Before You Begin . 21Setup . 21Configure user accounts and groups . 21Configure AD RMS client computer (ADRMS-CLNT). 22To install Microsoft Office Word 2007 Enterprise . 22Install Luna Cryptographic Service Provider (CSP) on Windows Server 2012 . 22Install AD RMS with Luna Cryptographic Service Provider (CSP) on Windows Server 2012 . 23Chapter 4 Verifying AD RMS Functionality using ADRMS CLIENT. 52Chapter 5 Troubleshooting Tips. 55 SafeNet Inc.iii
Active Directory Rights Management Service Integration GuideivTable Of Contents SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 1IntroductionChapter 1IntroductionThis document outlines the steps to configure and integrate Active Directory Rights Management Services withLuna SA.Active Directory Rights Management Services (AD RMS) is an information protection technology that works withAD RMS-enabled applications to help safeguard digital information from unauthorized use. Content owners candefine who can open, modify, print, forward, or take other actions with the information. A single HSM (LunaSA) will be deployed to provide a security framework to the data in use, data at rest and the data in transit.Microsoft Office 2007/2010 Enterprise Edition will use Microsoft Active Directory Rights Management Servicesto implement document security utilizing Luna Cryptographic Service Provider (CSP) to store the AD RMS clusterkeys on Luna SA.Luna SA secures the AD RMS Cluster Key generated and used by the AD RMS. You can integrate the AD RMSwith the Luna SA by using the MSCAPI interface. The benefits of using Luna SA with the AD RMS are: Secure storage of the AD RMS Cluster KeyFIPS 140-2 level 3 validated hardwareFull life cycle management of the keysFailover supportLoad-balancing.Scope3rd Party Application Details Microsoft Active Directory Right Management ServicesSupported Platforms Windows Server 2008 R2 Enterprise EditionThe following Luna version have been tested at Windows Server 2008 R21. Luna SA v4.4.32. Luna SA v5.03. Luna SA v5.1 Windows Server 2012 Standard EditionThe following Luna version have been tested at Windows Server 2012 Standard Edition1. Luna SA v5.2.1HSMs and Firmware Version K5 HSM f/w 4.8.1K6 HSM f/w 6.0.8K6 HSM f/w 6.2.1K6 HSM f/w 6.10.1 SafeNet Inc.1
Active Directory Rights Management Service Integration GuideChapter 1IntroductionDistributions Luna SA 1U Appliance s/w v4.4.3Luna SA 1U Appliance s/w v5.0Luna SA 1U Appliance s/w v5.1Luna SA 1U Appliance s/w v5.2 Luna SA Client s/w v4.4.1Luna SA Client s/w v5.0Luna SA Client s/w v5.1Luna Client s/w v5.2.1PrerequisitesLuna SA SetupPlease refer to the Luna SA documentation for installation steps and details regarding configuring and settingup the box on Windows systems. Before you get started ensure the following: 2Luna SA appliance has a secure admin passwordLuna SA has a hostname suitable for your networkLuna SA network parameters are set to work with your networkInitialized the HSM on the Luna SA applianceCreated a partition on the HSM and allocated a partition password to be used later by CSP to register theclient with the partition.Created and exchanged certificates between the Luna SA and the "Client" system.Registered the Client with the Partition and Run the command, vtl verify to display a partition from LunaSA. The general form of command is C:\Program Files\LunaSA vtl verify.Enabled Partition "Activation" and "Auto Activation" (Partition policy settings 22 and 23 (applies to LunaSA with Trusted Path Authentication [which is FIPS 140-2 level 3] only). SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)Chapter 2Integrate Microsoft AD RMS with Luna SA(Windows Server 2008 R2)This chapter outlines the steps to install and integrate Active Directory Rights Management Services with LunaSA.Before You Begin You should familiarize yourself with Microsoft Active Directory Rights Management Services and the setupprocess for the AD RMS. Refer to the appropriate help files for more information and pre-installationrequirements.Setup The setup consists of the following systems in a private network as per the table below:Operating SystemWindows Server 2008 R2EnterpriseWindows Server 2008 R2EnterpriseWindows Vista Applications and ServicesActive Directory, Domain Name System(DNS).AD RMS, Internet Information Services(IIS) 7.0, and Message QueuingMicrosoft Office Word 2007 EnterpriseEditionorMicrosoft Office Word 2010 EnterpriseEditionDescriptionDomain ControllerComputer NameADRMS-DCAD RMS ServerADRMS-SRVAD RMS ClientADRMS-CLNTConfigure the domain controller on ADRMS-DCConfigure the AD RMS root cluster computer on ADRMS-SRVConfigure the AD RMS client computer on ADRMS-CLNTConfigure user accounts and groupsIn this section you create the user accounts and groups in the LUNARMS domain.First, add the user accounts shown in the following table to Active Directory or AD DS. Use the procedurefollowing the table to create the user accounts.Account NameADRMSADMINADRMSSRVCNicole HollidayUser Logon NameADRMSADMINADRMSSRVCNHOLLIDAE-mail addressGroupEnterprise AdminsEmployees,FinanceLimor uart eeringOnce the user accounts have been created, Active Directory Universal groups should be created and these usersadded to them. The following table lists the Universal groups that should be added to Active Directory. Use theprocedure following the table to create the Universal groups. SafeNet Inc.nhollida@lunarms.com3
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)Group NameFinanceMarketingEngineeringEmployeesE-mail ineering@lunarms.comemployees@lunarms.comFinally, create a shared folder on ADRMS-SRV so that other users can find documents saved to the network. Tocreate a shared network folder that can be modified by CP&L employees1.2.3.4.5.6.7.8.9.10.11.12.Click Start, click My Computer, and then double-click Local Disk (C :).Click File, point to New, and then click Folder.Type Public for the new folder, and then press ENTER.Right-click Public and then click Sharing and Security.On the Sharing tab click the Share this folder option, and ensure that Public is in the Share namebox.Click Permissions.In the Group or user name box click Everyone.Select the Full Control check box in the Allow column of the Permissions for Everyone box.Click OK.Click the Security tab, and then click Users (ADRMS-SRV\Users) in the Group or user name box.In the Permissions for Users box select the Full Control check box in the Allow column.Click OK.Configure AD RMS client computer (ADRMS-CLNT)To configure ADRMS-CLNT, you must install Windows Vista, configure TCP/IP properties, and then join ADRMSCLNT to the domain lunarms.com. You must also install an AD RMS-enabled application. In this example,Microsoft Office Word 2007 Enterprise Edition is installed on ADRMS-CLNT.To install Microsoft Office Word 2007/2010 Enterprise1. Log on to ADRMS-CLNT with the LUNARMS\Administrator account or another user account in the localAdministrators group.2. Double-click setup.exe from the Microsoft Office 2007/2010 Enterprise product disc.3. Click Customize as the installation type, set the installation type to Not Available for all applicationsexcept Microsoft Office Word 2007 Enterprise, and then click Install Now. This might take severalminutes to complete.Install Luna Cryptographic Service Provider (CSP) on Windows Server2008 R2For Luna SA v4.4.1: Run the command, register.exe to register Luna CSP. The general form of command isC:\Program Files\LunaSA\CSP Register.exeFollow the instruction to register the Luna SA partition and provide the partition password when it promptsfor password.For Luna SA v5.0: 4Run the command, registerCSP64.exe to register Luna CSP. The general form of command is SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)C:\Program Files\LunaSA\CSP RegisterCSP64.exe To list the Luna Cryptographic Services for Microsoft Windows. The general form of command isC:\Program Files\LunaSA\CSP RegisterCSP64.exe /lFor Luna SA v5.1: Run the command, register.exe to register Luna CSP. The general form of command isC:\Program Files\LunaSA\CSP Register.exe To list the Luna Cryptographic Services for Microsoft Windows. The general form of command isC:\Program Files\LunaSA\CSP Register.exe /lInstall AD RMS with Luna Cryptographic Service Provider (CSP) onWindows Server 2008 R2To install the Microsoft Active Directory Rights Management Services:1. Login to ADRMS-SRV as lunarms\adrmsadmin.2. Click Start, point to Administrative tools, and then click Server Manager. The Server Manager snapin appears.3. Select Roles in the console tree.4. Right-click Roles and then click, Add roles. The Add Roles wizard appears. SafeNet Inc.5
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)5. Click Next.6 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)6. Select Active Directory Rights Management Services checkbox from Server Roles to install on thisserver. You will receive a warning stating Add roles services and features required for ActiveDirectory Rights Management Services.7. Click Add Required Role Services.8. Click Next to continue. SafeNet Inc.7
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)9. Click Next on the Active Directory Rights Management Services windows.8 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)10. Select Active Directory Rights Management Server checkbox from the Role Services.11. Click Next to continue. SafeNet Inc.9
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)12. Select Create a new AD RMS cluster.13. Click Next to continue.14. Select Use Windows Internal Database on this Server.10 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)15. Click Next to continue.16. Specify the Domain User Account.17. Click OK to continue.18. Click Next to continue. SafeNet Inc.11
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)19. Select Use CSP key storage for AD RMS cluster key storage.20. Click Next to continue.12 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)21. Choose Luna Cryptographic Services for Microsoft Windows from the CSP dropdown to store theAD RMS cluster key and select Create a new key with the selected CSP.22. Click Next to continue.23. Select Default Web Site for the virtual directory. SafeNet Inc.13
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)24. Click Next to continue.25. Select Use an unencrypted connection (http://) for the connection type for the AD RMS cluster. Givethe FQDN then click Validate.26. Click Next to continue.14 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)27. Enter a name for the server licensor certificate.28. Click Next to continue.29. Ensure that the Register the AD RMS service connection point now option is selected, and thenclick Next to register the AD RMS service connection point (SCP) in Active Directory duringinstallation. SafeNet Inc.15
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)30. Click Next on the Web Server (IIS).31. Click Next on the Select Role Services.16 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)32. Click Install on the Confirm Installation Sections.33. Click Close to exit the Add Roles wizard after viewing the installation results. AD RMS root clusterkeys will be generated and stored on Luna SA HSM. SafeNet Inc.17
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)34. After restarting the system, open the Active Directory Rights Management Services console.35. You will see Luna Cryptographic Services for Microsoft Windows under:Trust Policies - Trusted Publishing Domains18 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2) SafeNet Inc.19
Active Directory Rights Management Service Integration GuideChapter 2Integrate Microsoft AD RMS with Luna SA (Windows Server 2008 R2)Security Policies – Cluster Key Password20 SafeNet Inc.
Active Directory Rights Management Service Integration GuideChapter 3Integrate Microsoft AD RMS with Luna SA (Windows Server 2012)Chapter 3Integrate Microsoft AD RMS with Luna SA(Windows Server 2012)This chapter outlines the steps to install and integrate Active Directory Rights Management Services with LunaSA.Before You Begin You should familiarize yourself with Microsoft Active Directory Rights Management Services and the setupprocess for the AD RMS. Refer to the appropriate help files for more information and pre-installationrequirements.Setup The setup consists of the following systems in a private network as per the table below:Operating SystemWindows Server 2012StandardWindows Server 2012StandardWindows Server 2012Standard Applications and ServicesActive Directory, Domain Name System(DNS).AD RMS, Internet Information Services(IIS), and Message QueuingMicrosoft Office Word 2007 EnterpriseEditionDescriptionDomain ControllerComputer NameADRMS-DCAD RMS ServerADRMS-SRVAD RMS Clie
Active Directory Rights Management Service Integration Guide Chapter 1 Introduction Chapter 1 Introduction This document outlines the steps to configure and integrate Active Directory Rights Management Services with Luna SA. Active Directory Rights Management Services (AD RMS) is an information protection technology that works with
DNS is a requirement for Active Directory. Active Directory clients such as users computers) use DNS to find each other and locate services advertised in Active Directory by the Active Directory domain controllers. You must decide whether DNS will be integrated with Active Directory or not. It is easier to get Active Directory up and
An Active Directory forest is a collection of one or more Active Directory domains that share a common Active Directory schema . Most Active Directory environments exist with one Active Directory domain in its own Active Directory forest .
Active Directory Recovery Planning Chewy Chong Senior Consultant Systems Engineering Practice Avanade Australia SVR302 . Key Takeaways . Backup utility, DNS Manager, Active Directory Domains and Trusts Microsoft Management Console snap-in, Active Directory Installation Wizard, Active Directory Schema snap-in, Active Directory Sites and .
Module 4: Principles of Active Directory Integration This module explains how Active Directory can be integrated and used with other Active Directory Forests, X.500 Realms, LDAP services and Cloud services. Lessons Active Directory and The loud _ User Principle Names, Authentication and Active Directory Federated Services
Active Directory: Microsoft's modern directory service for Windows, originating from the X.500 directory and supports LDAP. Apache Directory Server: Directory service written in Java, supporting LDAP, Kerberos 5 and the Change Password Protocol. eDirectory: This is NetIQ's implementation of directory services.
1. The Structure of the Active Directory Environment The whole AD environment composes the following systems and services Active Directory Server: A server that is running Microsoft Windows Server 2008 Enterprise with DNS, DHCP, Active Directory Domain Services, and Active Directory Certificate Service, which provides AD, DNS, and DHCP services.
Introducing Active Directory Countless books, articles, and presentations have been written on the subject of Active Directory, and it is not the intention of this book to repeat them. However, it is important to review a few basic terms and concepts inherent in Active Directory. Figure 3-1 illustrates the concepts that make up an Active Directory.
Text and illustrations 22 Walker Books Ltd. Trademarks Alex Rider Boy with Torch Logo 22 Stormbreaker Productions Ltd. MISSION 3: DESIGN YOUR OWN GADGET Circle a word from each column to make a name for your secret agent gadget, then write the name in the space below. A _ Draw your gadget here. Use the blueprints of Alex’s past gadgets on the next page for inspiration. Text and .
