User Console

Axidian User Console (User Console) is a web application that runs on IIS. In User Console, the user can manage their authenticators.

How to open User Console

• In the browser: http(s)://server dns/am/uc
• In IIS: <machine name>\sites\Default Web Site\am\uc

Install User Console

System requirements

1. To install User Console, start Axidian.UserConsole-version number.x64.ru-ru.msi located at Axidian version number\Axidian User Console\version number.

2. When the installation is complete, you will be prompted to generate a new IDP certificate. This is an optional setting.

   info

   The certificate is required for authentication in User Console using Identity Provider. This certificate is not intended for establishing the SSL connection.

   If this certificate was generated earlier, disable the option.

   If this option is enabled, a new self-signed certificate is generated and installed in the Local Machine → Personal certificate store. The certificate is used to encrypt data transmitted between the authentication server and the client application.

HTTPS binding in IIS Manager

User Console is a web application that runs on the AIS database. During the installation process, SSL is required for User Console in the settings, which requires to enable HTTPS connection.

1. In IIS Services Manager, in the left menu, navigate to Axidian Access → sites → Default Web Site.
2. In the Actions section of the right menu, click Bindings.
3. Click Add and set the following parameters in the window that appears:
   • In the Type field, select https.
   • In the Port field, specify 443.
   • In the SSL Certificate field, select the Core Server certificate.
4. Click OK to save the link.

If you do not plan to use the HTTPS protocol, disable the SSL requirement in the IIS settings for User Console.

Also, in C:\inetpub\wwwroot\am\uc\Web.config, change the value of the requireSSL parameter to false as follows:

<httpCookies httpOnlyCookies="true" requireSSL="false" />

Confirgure authentication

You can set different authentication methods to log in to User Console.

Windows Authentication

Authentication using Windows Authentication

By default, User Console is configured to use SAML authentication. If necessary, you can configure transparent Windows authentication as follows:

1. Run the editor with administrator rights.
2. Open the C:\inetpub\wwwroot\am\uc\Web.config configuration file.
3. To specify the URL for connecting to Core Server, for the Url parameter in the amAuthServer tag set the value, such as http(s)://full_dns_name of the server/am/core/.

<amAuthServer Url="https://amserv.axidian-id.local/am/core/"/>

Note

To ignore server certificate errors, in the am\uc\Config\ApplicationSettings.config file, change the isIgnoreCertErrors parameter to true.

4. Start IIS Manager, select Default Web Site → am and open the uc application.
5. Open Authentication and enable the following methods:
   • ASP.NET
   • Windows Authentication
6. Disable all other methods.
7. Open C:\inetpub\wwwroot\am\uc\Web.config\Web.config for editing.
8. For the amAuthentication tag, in the mode parameter, specify Windows. Optionally, you can add the enableLogout="true parameter to configure the ability to log out of the User Console.

Note

Leave the loginUrl parameter unchanged. When using Windows authentication, this parameter is not taken into account.

<amAuthentication mode="Windows" loginUrl="" identityProviderCertificateThumbprint="" serviceProviderCertificateThumbprint="" enableLogout="true"/>

9. Save the changes and restart the IIS server.

The User Console will be available at: http(s)://full_dns_name of the server/am/uc/.

Identity Provider

Authentication using Identity Provider

You can set up a secure login to User Console using Identity Provider.

caution

To log in to User Console using Identity Provider, you need to install and configure an authentication provider.

Edit the User Console configuration file

caution

Before editing the configuration file, follow these steps:

1. Start IIS Service Manager.
2. Select <server Name> → Sites → Default Web Site → am → uc.
3. Select Authentication and enable the options Anonymous Authentication and Authentication using forms.

1. Open С:\inetpub\wwwroot\am\uc\web.config.

2. In the amAuthServer Url parameter, specify the address of Core Server, such as http(s)://full_dns_name of the server/am/core/.

   <amAuthServer Url="https://amserv.axidian-id.local/am/core/"/>

3. In the amAuthentication parameter, do the following:

   • In the mode line, specify the Saml value.

   • In the loginUrl line, specify the Identity Provider address, such as http(s) format://full_dns_name of the server/am/idp/.

     <amAuthentication mode="Saml" loginUrl="https://server.test.local/am/idp/>

   • In the identityProviderCertificateThumbprint line, specify the fingerprint of the Identity Provider certificate.

     Tip

     If Identity Provider and User Console are installed on different servers, export the certificate without the private key from the server with the Identity Provider module to the server with User Console. The certificate must be added to the certificate store in Local Machine → Personal.

     Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=idp"}

   • In the serviceProviderCertificateThumbprint line, specify the fingerprint of the User Console certificate that was generated during the installing.

     Information

     The certificate is installed in the LocalMachine → Personal certificate store with the common name ucsp.

     Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=ucsp"}

4. Save the changes and restart the IIS server.

Edit the Identity Provider configuration file

caution

Before editing the configuration file, follow these steps:

1. Start IIS Service Manager.
2. Select <server name> → Sites → Default WebSite → am → idp.
3. Select Authentication and disable the Windows Authentication option.

1. Open C:\inetpub\wwwroot\am\idp\app-settings.json for editing.

2. In the PartnerServiceProviderConfigurations parameter, perform the following actions:

   • In the SingleLogoutServiceUrl line, specify the address of the server where User Console was deployed, such as http(s)://full_dns_name of the server/am/uc/Account/SLOService.

   • In the Thumbprint line, specify the fingerprint of the User Console certificate.

     Tip

     If Identity Provider and User Console are installed on different servers, export the certificate without the private key from the server with the deployed User Console to the server with the Identity Provider module. The certificate must be added to the certificate store in LocalMachine → Personal.

     Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=ucsp"}

     "PartnerServiceProviderConfigurations": 
               {
                 "Name": "urn:axidian:selfservice",
                 "SingleLogoutServiceUrl": "https://server.axidian.local/am/uc/Account/SLOService",
                 "PartnerCertificates": [
                   {
                     "Thumbprint": "C77EDF29EA05B468BDAF553DE3D804DA4B139C1E"

3. In the AllowWinPwdIfAuthMethodsAreNotAvailable parameter, you can set the value to true, which will allow you to log in to User Console using Windows Password via IDP, even if this method is not specified in the app-settings.json configuration file. If the AllowWinPwdIfAuthMethodsAreNotAvailable parameter is set to true, the following scenarios are possible:

   • Only the registered and user-accessible authentication methods are displayed. With multi-factor authentication, if at least one of the authentication methods is not available, the entire chain is not displayed.
   • If there are no authentication methods available, including methods that do not require registration in User Console (Windows Password, Email, and SMS), Windows Password is displayed.

4. Save the changes and restart the IIS server.

Configure logout from User Console using Identity Provider

1. Open C:\inetpub\wwwroot\am\uc\Web.config for editing.
2. In the amAuthentication parameter, add the enableLogout parameter with the value true (the default value is false).

   <amAuthentication mode="Saml" loginUrl="https://server.test.local/am/idp/" enableLogout="true"/>
3. Open C:\inetpub\wwwroot\am\idp\app-settings.json for editing.
4. Change the PartnerServiceProviderConfigurations parameter. In the stringSingleLogoutServiceUrl, specify the server address for User Console, such as http(s)://full_dns_name of the server/am/uc/Account/SLOService.

   "PartnerServiceProviderConfigurations": [
             {
               ...
               "SingleLogoutServiceUrl": "https://server01.test.local/am/uc/Account/SLOService",
               ...
               ]
             }
5. Save the changes and restart IIS.

Example of logging in to User Console using Identity Provider

1. Open User Console in the browser at http(s)://full_dns_name of the server/am/uc/.

2. In the authentication window that appears, click Back to select the authentication method. By default, the last method used is suggested.

3. To select the authentication method, click Select.

   Information

   If a user does not have a registered authenticator, select Windows Password.

   Note

   Logging out of Identity Provider in the user session does not lead the user exiting User Console until the browser restarts or the cookie retention period expires. Cookie retention time for Identity Provider is 30 minutes.

4. Enter the password and click Sing in. If the data is entered successfully, the user profile appears.

5. To exit User Console, perform the following steps:

   Note

   This option is active if you have configured the enableLogout parameter.

   • Click the username at the top of the window.

   • From the drop-down list, select Exit.

     Information

     When exiting User Console, you automatically exit Identity Provider.

Enable brute-force protection

In Axidian Access, you can configure account selection protection for the User Console component.

If this setting is enabled, then when you enter a non-existent username, Axidian Access simulates the login of an existing user: displays authentication methods, asks for a password, and then displays the error Invalid username or authenticator, or the device is locked.

If this setting is disabled, then when a non-existent username is entered, Axidian Access displays the error Internal Server error: User not found.

This setting is disabled by default.

To enable brute-force protection, follow these steps:

1. Open C:\inetpub\wwwroot\am\core\Web.config.
2. In the appSettings parameter, in the Bruteforceprotectionapps line, specify the Self Service and Identity Provider values.

   <appSettings>
       ...
       <add key="bruteForceProtectionApps" value="Self Service, Identity Provider" />
   </appSettings>
3. Save the changes and restart the IIS server.

Set the session lifetime

Information

This setting is optional.

To change the session lifetime in User Console, perform the following steps:

1. Open C:\inetpub\wwwroot\am\uc\Config\ApplicationSettings.config.
2. Set the required value for the sessionExpirationTimeInMinutes parameter. The default value is 30 (minutes).

   <amApplicationSettings isIgnoreCertErrors="false" sessionExpirationTimeInMinutes="30"/>
3. Save the changes.

Display/hide version number in User Console

You can remove User Console headers with the information about the platform and version number, perform the following actions:

1. Open C:\inetpub\wwwroot\am\uc\Web.config.
2. Depending on the version of IIS:
   • For IIS 10: Remove comments from the following lines:

     <security>
           <requestFiltering removeServerHeader="true" />
        </security>
   • For IIS 10 and above, perform the following actions:
     • Set Rewrite URL.
     • Add the following lines to the <system.webServer> section:

       <rewrite>
       <outboundRules>
           <rule name="replace server header" patternSyntax="Wildcard" lockItem="false">
             <match serverVariable="RESPONSE_SERVER" pattern="*" />
             <action type="Rewrite" value="MyServer" />
           </rule>
       </outboundRules>
       </rewrite>

Disable localization changes

To prevent a user from changing the language in User Console:

1. Open C:\inetpub\wwwroot\am\uc\Web.config.
2. For the IsEnabled parameter of the amCulture tag, set the false value.

   <amCulture isEnabled="false" />
3. Restart the IIS server.