Skip to main content

Introduction

This guide describes how to integrate Entrust IDaaS with Entrust CloudControl. Entrust Identity as a Service is Cloud-based identity and access management (IAM) solution with multi-factor authentication (MFA), credential-based passwordless access, and single sign-on (SSO). Entrust CloudControl can be configured to use Entrust IDaaS as an external authentication method.

Product configurations

Entrust has successfully tested the integration of Entrust CloudControl with Entrust IDaaS in the following configurations:

System Version

Entrust CloudControl

6.5.0

Entrust IDaaS

5.24

VMware vCenter

7.0.1 U1

Requirements

Before starting the integration process, familiarize yourself with:

Procedures

This guide uses a standalone CloudControl deployment configured with Active Directory for authentication. CloudControl supports a cluster environment. For more information refer to the Entrust CloudControl Installation Guide in the online documentation.

Download the CloudControl software

  1. Go to https://my.hytrust.com/s/software-downloads .

  2. Log in and select HyTrust CloudControl .

  3. Open the HTCC_6.5.0_2022-03-01 folder. This folder contains version 6.5.0 that was used in this guide.

  4. Select the Entrust-CloudControl-6.5.0.650509.zip link to download the file.

    download cloudcontrol

  5. After the file has been downloaded, open the ZIP file to access to the OVA file.

Set up a content library in vCenter for the CloudControl OVA

  1. Log in to vCenter.

  2. Go to Menu > Content Libraries .

  3. Create a content library called HyTrust CloudControl .

  4. In the HyTrust CloudControl library, select Actions > Import item . For example:

    content library importitem

    The Import Library Item dialog appears.

  5. Select Local File and upload the CloudControl OVA file.

  6. After the file has been uploaded, select Import to import the OVA file into the library.

Deploy the CloudControl VM from the OVA

After the file has been imported into the content library, it is listed accordingly. Right-click the Name and select New VM from this Template to deploy the VM.

new vm

Follow the instructions during the deployment as needed.

Note
For more information refer to Installing CloudControl from an OVA in the online documentation.

Power on the appliance

  1. Log in to the vSphere Client.

  2. Locate the Entrust CloudControl virtual machine in the inventory.

  3. Right-click the CloudControl virtual machine and select Power > Power On .

Configure the CloudControl virtual appliance

This guide uses a Standalone Node setup. For more information refer to Creating a Standalone Node in the online documentation.

Set up the CloudControl GUI

After the standalone node has been configured, you must finish the setup using the GUI. For more information refer to Setting Up the CloudControl GUI in the online documentation.

Domain controller setup

Add a DNS Host entry in the domain controller for the CloudControl server.

For the purposes of this guide, the following Host was added to the local DNS server:

FQDN: cloudcontrol1-65.example.com

Active Directory setup

You must have Active Directory configured in order to use External Authentication with CloudControl.

Refer to the CloudControl online documentation for details instructions on how to setup Active Directory in CloudControl .

Adapt the steps below to match your organization Active Directory settings.

Users

For the purposes of this guide, four AD users were required. These are used in the configuration steps described in this guide.

htaServiceAccount

This is used in the Entrust CloudControl AD settings, to connect to the AD server.

etccadmin

This is used to log in to Entrust CloudControl after Active Directory services have been configured. It is whitelisted when external authentication is enabled, to show the whitelist feature that is available on the external authentication setup.

etccuser

This is used to log in to Entrust CloudControl after Active Directory services have been configured. It is the user that logs in to demonstrate the IDaaS login process.

idaasaduser

This is used in the Entrust IDaaS AD settings, to connect to the AD server.

Note
When creating the users in AD, make sure that the Last Name and Email fields are not empty.

Groups

Create a group in AD called ASC_SuperAdmin and make the etccadmin and etccuser users members of this group.

Active Directory setup - CloudControl

After Active Directory has the users and groups needed to setup Active Directory in CloudControl, you can configure Active Directory.

  1. Select Home > System > Primary Authentication .

    ccprimaryauthentication

  2. Select Configure Active Directory and Confirm you want to configure Active Directory.

    Once Active Directory is configured, local authentication is disabled.

  3. In the Details tab of the Configure Active Directory window, enter the following:

    1. Configuration Method : Select Manual .

      This guide uses a Manual configuration. However, in a production environment Entrust recommends that this field is set to Automatic Mode . The mode can also be changed later using the Actions menu, using Change to Automatic Mode .

    2. Default Domain Name : Enter the domain name.

    3. Root Domain Name : Enter the domain name.

    4. Security : Select None .

    5. Service Account : Enter the service account.

    6. Service Account Password : Enter the password used for the service account.

      ccaddetails

  4. In the Domain Controllers tab of the Configure Active Directory window, select the Add Domain Controller Now link.

  5. In the Add Domain Controller window, enter the following information:

    1. Name : The IP address/FQDN of the AD server.

    2. Priority : Select Primary .

    3. Port : 389 (for LDAP)

    4. User Search Context (Base DN) : Enter the search context that applies to you. For example, DC=example,DC=com .

    5. Group Search Context (Base DN) : Enter the search context that applies to you. For example: DC=example,DC=com .

      ccaddomaincontroller

  6. Select Continue .

  7. In the Global Catalogs tab of the Configure Active Directory window, select the Add a Global Catalog Now link.

  8. In the Add Global Catalog window, enter the following information:

    1. Name : The IP address/FQDN of the AD server.

    2. Priority : Select Primary .

    3. Port : 3268

    4. User Search Context (Base DN) : Enter the search context that applies to you. For example, DC=example,DC=com .

    5. Group Search Context (Base DN) : Enter the search context that applies to you. For example, DC=example,DC=com .

      ccadglobalcatalog

  9. Select Add .

  10. Select Continue .

  11. In the Add Additional Domains window, select Skip .

  12. In the ASC_SuperAdmin Role Mapping tab of the Configure Active Directory window, enter the AD Group Name to map to the ASC_SuperAdmin role.

    In this example, an AD Group with the same name as the role was created.

    ccadrolemapping

  13. Select Continue .

  14. The summary window displays the details.

    ccadsummary

  15. Select Apply to make the changes effective.

    A confirmation window is shown asking you to confirm the changes to Active Directory.

  16. Select Apply AD Settings and Log Out .

    You are logged out of CloudControl.

  17. Log back in with the AD user account and password. In this example, these accounts are etccadmin or etccuser , the only two accounts in the ASC_SuperAdmin group in AD.

Entrust IDaaS registration

Now you need to register for Entrust IDaaS. Entrust provides a 60-day free trial.

Once you register for Entrust IDaaS, you will have a unique IDaaS URL. For example, https://example.US.trustedauth.com .

Active Directory setup - Entrust IDaaS

After CloudControl is set up using Active Directory, you must setup Entrust IDaaS to use the same Active Directory services. To do this, configure a Gateway to sync users from an on-premises Active Directory. Changes made to your Active Directory are automatically synced with Identity as a Service through this Gateway. Adapt the steps below to match your configuration. The examples in this guide use the Identity as a Service Gateway provided by Entrust IDaaS.

For additional information, refer to Configure an on-premise directory in the online documentation.

Install the Identity as a Service Gateway

Download the Identity as a Service Gateway OVA and deploy it using vCenter. This is the Gateway that allows connection to the On-Premise Active Directory used by Entrust IDaaS.

For additional information, refer to Create and configure a Gateway Instance in the online documentation.

  1. On the Entrust IDaaS Home page, select Gateways .

    eihomegateways

  2. On the Gateways page, select IDENTITY AS A SERVICE GATEWAY to download the software.

    The Identity as a Service Gateway Download URL dialog appears.

  3. Select one of the following options:

    1. VMware vSphere to download a vSphere (.ova) image file.

    2. Microsoft Hyper-V to download a Hyper-V (.vhd) image file.

    In this guide, the VMware vSphere is selected. The file is downloaded to your device.

  4. Import your Gateway image file.

    Consult the VMware vSphere or Microsoft Hyper-V documentation for instructions on how to import your image file. Once the Gateway has been deployed, configure it. Power on your the virtual machine.

  5. In your Web browser, enter the IP address of your Virtual Machine using port 9090.

    https://xxx.xxx.xxx.xxx:9090

  6. Accept the browser self-signed certificate warning.

    The Identity as a Service Gateway Web Interface opens.

    Note
    		Internet Explorer is not supported.

  7. At the User Name prompt, enter entrust .

  8. At the password prompt, enter entrust .

    You are prompted to create a new password.

    Note
    		After you have changed your password, when you log in to the Web Interface, you must select Reuse my password for privileged tasks .

  9. At the (current) UNIX password prompt, enter entrust to confirm your existing password and select Log In .

  10. Enter a new password.

  11. At the Retype new password prompt, re-enter the password.

    The Identity as a Service Enterprise Gateway Configuration Tool dialog appears.

  12. Select Get Started .

    The Network Settings page appears.

  13. To change the default hostname:

    1. Select the Hostname link. The Hostname dialog appears.

    2. Enter a new hostname and select Save .

  14. To change the IP Configuration, select the IP Address link.

    1. Select Static or DHCP .

    2. Make the required network settings changes. A confirmation dialog appears.

    3. Select Save .

  15. Select Next . The NTP Settings page appears.

  16. Optionally, if you want to change any of the NTP Settings, do the following:

    1. On the NTP Settings page, select Edit .

    2. Make the required NTP Settings changes and select Save .

  17. Select Next .

  18. If required, select Configure . The Configure Proxy page appears.

    1. Enter the Proxy server host IP or Proxy host name .

    2. Enter the Proxy port number .

    3. Enter the Proxy username .

    4. Enter the Proxy password .

    5. Select Save .

  19. Select Next . The Registration Parameters dialog appears.

    Leave this window open. You will paste content from the Add a Gateway procedure into this page.

Add a Gateway

To add a Gateway to Entrust IDaaS:

  1. Access the Entrust IDaaS Home page. For example:

    eihomegateways

  2. Select Gateways .

    The Gateways page appears.

  3. Select the + icon on the left of the page and select Gateway .

    The Add Gateway dialog appears.

  4. Enter a Gateway Name and then select Add .

    The Gateway is added. The Waiting for Gateway to Establish connection dialog appears.

    eigatewaycreated

  5. Copy the registration code.

  6. Back in the Identity as a Service Gateway registration page, paste the Registration Code you copied when you created the Gateway.

  7. Select Register .

  8. Back in the Waiting for Gateway to Establish connection dialog, select Close .

After the Identity as a Service Gateway is configured and connected to a Gateway in Entrust IDaaS, you can create a directory.

Creating a directory

To tie the AD server to Entrust IDaaS, create a directory using the Gateway that was created in the previous step.

  1. Access the Entrust IDaaS Home page. For example:

    eihomegateways

  2. Select Directories .

    The Directories List page appears.

  3. Select the + icon on the left of the page and select Active Directory (on-premise) .

    The Add Directory page appears.

  4. In the Connection Settings section of the page, enter the following information:

    1. Directory Name - Name of the directory.

    2. Username - Name of the AD user used to read the Active Directory inventory.

    3. Password - The password for the AD user to access the Active Directory server.

    4. Directory Servers - Select Add to enter the Active Directory server information.

      1. On the Directory Server Dialog, enter the IP/FQDN of the Active Directory server, the Port and select Add .

        eidirectoryconnectionsettings

  5. In the Attribute Mappings section, leave the default settings.

    You may need to adjust some of the fields according to your AD settings.

  6. In the SearchBase & Group Filters section, enter the following:

    1. Root Domain Name Context - Enter the AD search string to view the directory.

    2. Group Filters - Enter the Group Name you created in your AD server for Entrust CloudControl. Only users in this group will be allowed.

      eidirectoryfilters

  7. In the Synchronization section, do the following:

    1. Select the Synchronization Agent . This is the Gateway that was created in the previous section.

    2. Once selected, either adjust the other fields in the section according to your AD settings or leave the defaults.

      eidirectorysync

  8. Once all the information has been provided, select Add

    The Directory List page appears.

    eidirectorylist

  9. Select the Sync icon on the directory list row to sync the directory.

  10. Once synced, the users belonging to the Group filter specified in the Directory appears under Users in the Home page.

    eiuserslist

Entrust IDaaS application configuration

After the AD is setup and configured, you can create a Generic Web Application that uses OpenID Connect and OAUTH Cloud Integration. This is the application that CloudControl uses to be able to integrate with IDaaS.

  1. Log in to Entrust IDaaS.

  2. Select Applications on the Home page.

  3. Select the + icon on the left of the page to create a new Generic OpenID Connect and OAuth Cloud Integration .

    The Add Application Select an Application Template page appears.

  4. Scroll down the template list and from the OpenID Connect and OAuth Cloud Integrations section select Generic Web Application .

    eiappgenericwebapp

    The Add Generic Web Application page appears.

  5. Change the Application Name , Description and Add an Application Logo if required.

    eiappaddgenericwebapp

  6. Select Next .

    The Add Generic Web Application page appears.

  7. In the Setup page, under General Settings , do the following:

    1. Capture Client ID and Client Secret . These details are needed to configure the OpenID connect in Entrust CloudControl. For example:

      • Client ID : 080fe01a-xxxx-xxxx-xxxx-dc3f2c5f6c42

      • Client Secret : 9bIXVaDyxxxxxxxx_xxxxxxxxx1xN83TGyoE

    2. Change Token / Revocation Endpoint Client Authentication Method to Client Secret Post .

    3. Change Subject ID Attribute to UserPrincipalName .

    4. For Login Redirect URLs , select ADD to add the login redirect for your CloudControl instance.

      Important
      		You must use the FQDN of the CloudControl server and not its IP address.

    5. For Logout Redirect URLs , select ADD to add the logout redirect for your CloudControl instance.

      Important
      		You must use the FQDN of the CloudControl server and not its IP address.

    For example:

    eiappsetupgeneralsettings

  8. In the Setup page, under Supported Scopes :

    1. Select Your Unique Identifier .

    2. Select Email Address .

    3. Leave all other settings as default.

    For example:

    eiappsupportedscopes

  9. Select Submit .

    The Add Generic Web Application Complete page appears.

    eiappcompleted

You can now add a resource rule to the application.

Add a resource rule to the application

You must add a resource rule to the application so that an AD group and users from that AD group can access the application.

For additional information, refer to Create a resource rule in the online documentation.

  1. In the Entrust IDaaS application, select the Main Menu > Resources > Resource Rules .

    The Resource Rules List page appears.

    eiresourceslist

  2. Select the + icon on the Generic Web Application - Entrust CloudControl application created in the previous section.

    The Add Resource List page appears.

  3. In the General Settings setup, select the Group(s) you want to use that applies to the users for the application.

    eiresourcerulesgeneral

  4. Select Next .

  5. In the Authentication Conditions setup, under Authentication Decision :

    1. Change Low Risk > First Factor to Password .

    2. Enable the following Low Risk > Second Factors and drag them to the following order, or to the order that applies to your organization:

      • One Time Password

      • Entrust Soft Token Push

      • FIDO2

      • Software / Hardware Token

      • Grid Card

    3. Clear the remaining Low Risk > Second Factors check boxes.

  6. Keep the defaults for the remaining fields in the Authentication Decision setup. For example:

    eiresourcerulessettings

  7. Select Submit .

Enable external authentication in CloudControl to use Entrust IDaaS

After Entrust IDaaS is set up, you can enable external authentication in CloudControl to use Entrust IDaaS. CloudControl must be setup using the same Active Directory server as the one configured in Entrust IDaaS.

  1. Log in to the CloudControl instance

  2. Select Home > System > External Authentication .

    ccprimaryauthentication

  3. In the External Authentication tab, under Configuration , enter the following information:

    1. For Authentication Type , select OpenId Connect .

    2. For Client ID , enter the Client ID of the Entrust IDaaS application created earlier.

    3. For Client Secret , enter the Client Secret of the Entrust IDaaS application created earlier.

    4. For Base URL , enter your Entrust IDaaS URL followed by api/oidc .

    5. For Name , enter a name.

    For example:

    ccenableexternalauthentication

  4. In the External Authentication tab, under Whitelist , enter the user ID of a user that you do not want to use IDaaS for authentication.

    This provides a user that can bypass external authentication in the event of configuration issues. In this example, the etccadmin user was added. If you want to bypass external authentication, log in with [email protected] .

    ccexternalauthenticationwhitelist

  5. Select Enable .

    The OpenID Connect Configuration dialog appears.

  6. Select Verify and Enable .

    External configuration is enabled.

    ccexternalauthenticationenabled

Test external authentication using Entrust IDaaS

After Entrust IDaaS and Entrust CloudControl are set up, you can test the configuration and make sure Entrust IDaaS is used when you attempt to log in to CloudControl.

Make sure you do the steps below on a server that has access to the CloudControl DNS entry and the Entrust IDaaS URL.

In this section, the etccuser and etccadmin users are used, which were created earlier in this guide. Use the AD users that you have setup.

Testing IDaaS authentication

To test Entrust IDaaS with CloudControl using external authentication:

  1. Open a browser and access the URL of the CloudControl server. Log in using the etccuser user.

    This is the user that was created for testing the IDaaS integration. For example:

    testlogin

  2. Select Continue .

    The login screen takes you to the Entrust IDaaS login screen.

    testloginidaas

  3. Select Next .

  4. Enter the etccuser password.

    Entrust IDaaS sends an OTP code to the email for etccuser .

  5. Enter the OTP code.

  6. Select Login .

    Entrust IDaaS authenticates the user and redirects you back to the CloudControl home screen.

    testlogincc

Testing whitelist authentication

You can now test the whitelist configuration. When external authentication was set up, a user was added to the whitelist configuration. If that user is used for logging in, CloudControl will not use Entrust IDaaS to authenticate the user. Instead, the internal authentication method configured is used. In this example, the user in the whitelist configuration is [email protected] .

If you log in, it will not use IDaaS. For example:

  1. Open a browser and access the URL of the CloudControl server. Log in using [email protected] .

    This is the user created and added to the whitelist of the external authentication settings:

    testloginwhitelist

  2. Select Continue .

    The login screen asks for the user password.

  3. Enter the password and select SIGN IN .

    testloginwhitelistpassword

    CloudControl logs the user into the application without going to IDaaS.

RESOURCES
RELATED PRODUCTS
Join us 10/10 for the webinar, "Own your keys, not your HSM"
Register now
Close