June 10, 2016

AD SelfService Plus Configuration Notes

• manageengine
• Tools

Here to download AD SelfService Plus: https://www.manageengine.com/products/self-service-password/download-free.html The installation itself is pretty simple. If you are upgrading, download the patch from here: https://www.manageengine.com/products/self-service-password/service-pack.html   1.Ports Needed for Firewall Rules: Source IP:  Domain Controller Destination IP: AD Self Service Server IP Port number:389/636/88/445/25/135/464/137/138/139/1443/1434   Source IP:  AD Self Service Server IP Destination IP: Domain Controller Port number:389/636/88/445/25/135/464/137/138/139/1443/1434   Source IP:  User Machine Destination IP: AD Self Service Server IP Port: 9251(for https), 8888(for http)   2. Invalid Email-ID When Sending Out Email Expiry Notifications? After testing, I found out that when sending a test email to the same domain from exchange, it will succeed, but failed on sending to another domain users. The fix is just to use authentication  on the SMTP server instead of anonymous authentication.   3.  How to Setup Web Certificate for AD SelfService from an Internal CA? 3.1 Create a https web certificate for IIS Here is an excellent guide on how to install: https://windowsserveressentials.com/2013/02/06/manually-creating-a-certificate-request-windows-server-essentials-sbs/ Once you have that certificate, apply it in your IIS ” Edit Bindings”. After this step, we finish certificate for https://www.aaa.com:443 3.2 Use IIS Redirect Point https://www.aaa.com/  to https://www.aaa.com:9251 ( default AD SelfService port) 3.3 Generate a https web certificate for AD SelfService 3.3.1 Generate keystore file “<installation dir.\jre\bin” keytool -genkey -alias tomcat -keypass -keyalg RSA -validity 1000 -keystore <keystore_name>.keystore 3.3.2 Generate web certificate request file keytool -certreq -alias tomcat -keyalg RSA -keystore < keystore_name >.keystore -file <csr_name>.csr 3.3.3 Request web certificate from Internal CA “advanced certificate request” , Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file. “Download certificate chain” link to download “PKCS #7 Certificates” types Copy and paste the certificate file under “<installation dir.\jre\bin” folder 3.3.4 Download CA Certificate Copy and paste the certificate file under “<installation dir.\jre\bin” folder 3.3.5 Import certificate into”.keystore”file Keytool –import –trustcacerts –alias tomcat –file certnew.p7b –keystore <keystore_name >.keystore 3.3.6 Trust internal CA keytool -import -alias <internal CA_name> -keystore ..\lib\security\cacerts -file certnew.cer 3.4 Associate the certificate with ADSelfService Plus:

1. Copy the “.keystore” file from “\jre\bin” folder to “\conf” folder.
2. Take a back up copy of “server.xml” file as “server.xml_bak” and edit the file.
3. Replace the value of “keystoreFile” to ”./conf/<keystore_name>.keystore” at the last Connector tag (End of the page).
4. Replace the password for “keystorePass” to “password as given while creating keystore”
5. Save the server.xml file and start ADSelfService Plus.