<< Click here to display Table of Contents >> Navigation: Install, Configure and Administer GN4 > Designing and Installing GN4 > Installing GN4 Step-by-step > Installing a GN4 Server:

Set up authentication on a GN4 server

Build 1501 on 14/Nov/2017 This topic last edited on: 21/Mar/2016, at 18:35

Contents

You can set up one of two authentication models:

•Standard authentication (no pass-through): GN4 will always prompt you to enter your login, even if you are already logged onto a domain, or your workstation.

•Windows authentication (pass-through): : GN4 will not prompt you to enter your login, but it will use your domain, or workstation login.

Set up standard authentication

To set up the standard authentication for GNPortal, select the GN4 applications (one at a time, if there are more than one), click Authentication, and make sure the settings are:

Anonymous Authentication: enabled

ASP.NET Impersonation: enabled

Forms Authentication: enabled

Basic Authentication: disabled

Windows Authentication: disabled

Then, edit Anonymous Authentication and select Application Pool Identity. This is needed to make function the management of the Back4 service in the Administrative Browser and the access to event log.

If you forget the above, when launching GN4 for the first time, the error about event log access is displayed - as software needs to create the event log, but it has no permissions.

Note: the names of GN4 users may be different of the domain users names.

Set up Windows authentication

IMPORTANT: Windows authentication requires that all the GN4 users have the same names as domain users, and that are defined in GN4 as:

domain\username

If the users naming in the current GN4 is not such, you have to change all user names.

Configure IIS to use Windows authentication

Note for the version 2.1: as GNPortal needs "Forms authentication" enabled but client apps need it disabled. Please create two different web apps to use both of them. No problems for I4.

Note for the version 2.0 and earlier: you don't need two different web apps.

To set up authentication, select the GN4 applications (one at a time, if there are more than one), click Authentication, and make sure the settings are:

In version 2.1 or newer, for GNPortal web application

Anonymous Authentication: disabled

ASP.NET Impersonation: enabled

Forms Authentication: enabled

Basic Authentication: disabled

Windows Authentication: enabled

In version 2.1 or newer, for Windows clients web application

Anonymous Authentication: disabled

ASP.NET Impersonation: enabled

Forms Authentication: disabled

Basic Authentication: disabled

Windows Authentication: enable

In version 2.0 and earlier (for all)

Anonymous Authentication: disabled

ASP.NET Impersonation: enabled

Forms Authentication: enabled

Basic Authentication: disabled

Windows Authentication: enabled

integratedauthentication1

Select now Windows Authentication and click on Advanced Settings... in the Action panel.

Deselect Enable Kernel-mode authentication and then click OK.

integratedauthentication2

In the Action pane, select Providers...

In the Available providers select Negotiate:Kerberos and click Add.

Select the "Negotiate:Kerberos" and move it up to the top. Click OK.

integratedauthentication3

Note: It might happen that in some cases the system still prompting for login even though the configuration is correct. In some cases the authentication works using the Machine IP name but not when using the Domain Name.

In this case try to move the NTLM protocol at the top.

The Application Pool should use the AppPool identity and not a domain user.

Configure permissions on TEMP folder

You need to setup the Change permissions on the folder that is declared as the tempDir folder in the SERVERCONFIG.

If such permissions are not configured, when uploading content, you may have the "Error in the activity 'parseFile': 'The type initializer for '<Module>' threw an exception.' (ERR1011)

Configure GN4 to use the Windows Authentication

Open the config\Global\GN4_Tark4_Common\PortalConfig.xml and then in the GNPortalConfiguration, set the LoginMode to be one of the following keys:

•WindowsStrict

Recommended. If you want the Windows authentication to reject Windows users that are not present in the database.

•WindowsLoose

If you want Windows authentication to map Windows users not present in the database to 'Guest' or 'Administrator'

Import the PortalConfig.xml as explained in Importing configuration files in database (quick chart) and then perform an IISreset as explained in Reset IIS.

Configure i4 to use the Windows Authentication

I4 2.1 or newer supports the Windows authentication. You just need to change the settings on the IIS server(s) to disable Anonymous and enable Windows Authentication.

Configure client applications to use the Windows Authentication

In the Connection dialog box, remove the "requires login" from the connection dialog.

In version 2.1 and newer

You can also remove adminsrv.asmx as it is not required anymore

In version 2.0 or earlier

Browser and Windows authentication

Use Internet explorer or Chrome. Firefox requires an additional plug-in.

Configure file system permissions

Edit the security for the gn4 log folder (the folder is defined in the appsettings.xml). Add the group Domain users and assign Full control permissions

Edit the security for the IIS gn4 folder (normally tera\gn4\web\gnportal). Add the group Domain users and assign Read & execute, List folder contents and Read permissions

Disable use of Events Log

Edit the appsetting.xml file and disable the usage of the Windows event log by setting the value to false:

Restart IIS.

Known issues

•A GN4 system with Windows authentication cannot save events in the Events log. Disable the Events log usage in GN4. For instructions, see "Disable use of Events log" above.

•If your url is gn4.mydomain.com because you use hostnames instead of using just the NetBIOS name then you face another layer of good challenges. You have to configure Service Principal Names (SPNs) and declare your web server in AD.

•If you run back4 on a different server than where IIS is running, you can have even more fun trying to configure back4 interface in gnpcInt.