Chat now with support
Chat with Support

Change Auditor 7.4 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Introduction

Change Auditor has the following authentication methods:

•
Windows Forms Authentication (enabled by default)
When users log in, the current Windows logon user security context is used to authenticate with the coordinator. Typically, user account and password are not required.
•
Active Directory Client Certificate Authentication
When users log in, they must specify a smart card or certificate. User account and password are not required.

Certificate authentication for client coordinator communication.

Client Authentication Page

The Client Authentication page is displayed when Client Authentication is selected from the Configuration task list in the navigation pane of the Administration Tasks tab.

From this page, you can define the authentication method required to access a particular Change Auditor installation.

Windows Forms Authentication

When this option is enabled, Change Auditor uses the standard login entry form where users specify login Windows credentials in both the clients. Credentials are securely verified with Active Directory to authenticate user access to Change Auditor. The current Windows logon user security context is used to authenticate with the coordinator. Typically, user account and password are not required.

Active Directory Client Certificate Authentication

When this option is enabled, authentication is performed using smart cards or certificates associated with Active Directory users. This permits users to log into clients using Smart Card-based authentication technologies.

 

* 
NOTE: If you are having issues using the web client, ensure that Active Directory Client Certificate Authentication is set to enabled in IIS configuration at the server level. Also verify that your IIS server certificates are correctly configured.

Once this option has been selected users will be prompted for credentials each time they log in. They can enter a user name and password or connect using a smart card and enter their personal identification number.

* 
NOTE: Smart card authentication is used only to log on to Change Auditor clients. For any other areas within Change Auditor where you are required to supply credentials (such as agent deployment and management, template creation, and restore values), you must enter a user name and password.
* 
IMPORTANT: Changing the authentication method affects all clients and requires an update and re-deployment of some components. Because of this, you should only modify the authentication method as part of an overall change to the Change Auditor deployment as a result of new requirements or architectural changes.

Changing authentication methods

If you move from the default Windows Forms Authentication to Active Directory Client Certificate Authentication:

•
A coordinator is required on each IIS server where the Change Auditor web client is installed. Installing the coordinator on the same computer as the IIS web server allows Change Auditor to securely and reliably authenticate the user account by its certificate without transmitting any credentials on the network.
For more information see the Installation Guide and follow the Change Auditor Coordinator Setup wizard to install a new coordinator.
•
Each web client will need to be configured to use the coordinator that is on the local IIS server. The web client will use this particular coordinator for accessing your Change Auditor installation. If a web client is already installed and using a different coordinator, it will need to be uninstalled, and re-installed to use the local coordinator. A reinstall is also necessary to change the web server configuration to allow Active Directory Client Certificate Authentication.
•
Before you install the web client, ensure that your system meets the following minimum requirements:
•
IIS web server is configured with appropriate certificates to support Smart Cards.
•
Web site exists and is configured to use the HTTS protocol.
•
Active Directory Client Certificate mapping authentication is enabled in IIS on a server level.
•
Change Auditor coordinator is installed locally on the computer where you plan to install the web client.

If you move from Active Directory Client Certificate Authentication to Windows Forms Authentication, you will need to:

•
Uninstall and re-install the web client. A re-install is necessary to change the web server configuration to allow Windows Forms Authentication.
To change the authentication method
1
Open the Administration Tasks tab and click Configuration.
2
Select Client Authentication in the Configuration task list to open the Client Authentication page.
3
Select the required method and click Apply.
Because this is a significant change which may require the re-deployment of Change Auditor components, you are presented with a confirmation dialog. Select Yes to continue or No to return to the Client Authentication page.

Certificate authentication for client coordinator communication

•
Introduction
•
Installation settings
•
Deployment
•
Windows client configuration

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating