Server initial configuration
1. Configure Access to the nodes
To access the VeridiumID application the internal and external FQDNs will need to be configured either in the clients DNS or directly into the hosts file on the local machine.
List of FQDNs:
# In case of SNI deployment
# Internal FQDNs
Admin Dashboard : admin-intFQDN
Self Service Portal: ssp-intFQDN
Websec API: intFQDN
Shibboleth Internal (Identity Provider): shib-intFQDN
# External FQDNs
Shibboleth External (Identity Provider): shib-extFQDN
Self Service Portal: ssp-extFQDN
DMZ Websec API: dmz-extFQDN
Websec API: extFQDN
# In case of Ports deployment
intFQDN: 9444, 9987, 443, 8945
extFQDN: 9987, 443, 8944, 8544
# Where intFQDN and extFQDN are the FQDNs provided during the installation.
2. Access the Admin Dashboard and generate the default admin certificate
After configuring access to the Admin Dashboard’s FQDN connect to it using the following URL:
in case of SNI deployment: https://admin-intFQDN/veridium-manager
in case of ports deployment: https://intFQDN:9444/veridium-manager
After accessing the Admin Dashboard click on Create Default Administrator:
Then complete the form and click on Save to download the Admin certificate:
After downloading the certificate add it to your local machine’s keystore or to the browser’s keystore and access the Dashboard in a new browser session, or an incognito window.
During the new access provide the certificate to access the Dashboard and accept the license:
3. Configure Services
For VeridiumID to work the following services will need to be configured:
LDAP connection
Email server connection (*Optional)
Twilio/SMS Gateway connection (*Optional)
License configuration
All services mentioned above can be configured by accessing the Quick Setup tab. To access this tab you can either:
Click on OK on the following notification (appears only when the services are not already configured → after the installation):
Select the Quick Actions icon from the Admin Dashboard (in the right side of the screen):
3.1 Configure LDAP connection
To configure the LDAP connection complete the following form with the correct credentials:
Make sure to have connectivity between the VeridiumID Webapplication nodes and the LDAP server. To check connectivity, connect using SSH to the VeridiumID nodes and run the following command: nc -vz LDAP_SERVER_IP PORT
To save the LDAP connection, first click on Test Connection and afterwards on Continue.
The next step will be to select which LDAP groups will be allowed to use VeridiumID applications, or leave the Allowed Groups empty to allow all groups. Click on Continue to go to the next step.
This step above is OPTIONAL and can be skipped. During this step you can test the LDAP query by clicking on Search User. To go to the next step click on Continue.
3.2 License configuration
During this step the VeridiumID license will be added to the server.
Either Drag & Drop the license archive or click in order to browse for the license archive.
In order to obtain a valid license archive, please contact VeridiumID.
After selecting the license archive click on Continue to advance to the next step.
3.4 Email Server configuration
During this step the configuration of the Email server will be made.
After completing the form, to test the connection click on Send Test Email and provide a valid email address.
After testing the email configuration click on Continue to advance.
3.4 SMS server configuration
During this step you can configure either the SMS Gateway or add you Twillio account in order to enable SMS usage from VeridiumID server.
To test the configuration click on Send Test SMS and provide a valid phone number (with country code):
To advance click on Continue.
3.5 Finishing the configuration
During this step the QR code used for enrolling VeridiumID mobile applications will be presented.
To finish the configuration click on Finish.
4. Update domain certificates
During the deployment a self-signed certificate is generate in order to complete the deployment.
4.1 Using one certificate for Veridium
Applies on the following cases:
same FQDN for internal and external services
different FQDN for internal and external services but the SSL termination is done in a different layer for external services
If Veridium is not used as a first SSL termination layer the self signed server.pem client certificate must be changed with a trusted one.
In Veridium manager, navigate to Tools → Haproxy configuration
In the Certificates tab select the type of the trusted client certificate that needs to be uploaded. The possible options:
PKCS12 - upload a certificate chain that contains also the private key and add the required password
CERTIFICATE - upload the certificate chain and private key as separate files
After uploading the certificate chain, the certificates part of the chain and the private key type are displayed below the upload boxes.
Click on Save button
When saving, the uploaded certificate chain is also added in the Veridium server Truststore
To apply the uploaded certificate on the server nodes a specific command must be ran on the webapp nodes. To do this, navigate to Settings → Nodes
On the right hand side panel expand the Haproxy category
Click on the “change server.pem” command
A pop-up will be displayed. Select from the drop-down field the all webapp nodes and click on Run
After the command is ran, the result status will be displayed for each node in the Nodes section.
If the command ran successfully on a node then the corresponding line in the nodes list will turn green
If the command failed on a node, then the corresponding line will turn red. To check the logs of the command execution on one node, click on the View actions on the corresponding line. Each execution log can be opened and see the status.
4.2 Using 2 client certificates for Veridium (internal and external)
Applies when:
Veridium is the first layer of SSL termination and there are used different internal and external FQDN
To change it the VeridiumID server will require two certificates containing the certificate and full-chain of it (one for the internal domain and another for the external).
The certificates can be in PKCS12, P7B, PEM format.
Before adding the certificates, the haproxy configuration template must be changed from the templates section to accommodate the serverExt.pem and serverInt.pem client certificates. By default, the platforms uses the server.pem client certificate for the use case when the SSL termination is done on another layer.
Changing the Haproxy configuration
In Veridium manager go to Tools → Tenant configuration
In the templates tab click on “haproxy”
There are 2 files that will be displayed. Click on the View icon for haproxy.cfg file to see the content on the right-hand side
in the content box, search for the string “server.pem”. For each occurrence found, comment the line (by adding # in front of it) where “server.pem” was found and uncomment the commented line below which sets the serverInt or serverExt certificates, as in the example below. There should be 10 occurrences where this change needs to be made.
Save the configuration
Go to Tools-> Nodes
On the right hand side panel, expand the Haproxy category and click on “change Haproxy.cfg” command.
A pop-up will open where the webapp nodes must be selected for the template change to be applied.
Click on the Run button
Change serverExt.pem
In Veridium manager, navigate to Tools → Haproxy configuration
In the Certificates tab select the type of the trusted client certificate that needs to be uploaded for external traffic. The possible options:
PKCS12 - upload a certificate chain that contains also the private key and add the required password
CERTIFICATE - upload the certificate chain and private key as separate files
After uploading the certificate chain, the certificates part of the chain and the private key type are displayed below the upload boxes.
Click on Save button
When saving, the uploaded certificate chain is also added in the Veridium server Truststore
To apply the uploaded certificate on the server nodes a specific command must be ran on the webapp nodes. To do this, navigate to Tools → Nodes
On the right hand side panel expand the Haproxy category
Click on the “change serverExt.pem” command
A pop-up will be displayed. Select from the drop-down field the all webapp nodes and click on Run
After the command is ran, the result status will be displayed for each node in the Nodes section.
If the command ran successfully on a node then the corresponding line in the nodes list will turn green
If the command failed on a node, then the corresponding line will turn red. To check the logs of the command execution on one node, click on the View actions on the corresponding line. Each execution log can be opened and see the status.
Generate and change serverInt.pem
To be able to add a client certificate for the internal traffic, a valid certificate must be generated from the internal certificate authority service.
Generate CSR
In Veridium manager go to Tools → Haproxy configuration → CSR tab
Click on the view icon for the HAPROXY_CNF_BASE64
Add the necessary details for the CSR
Click on Save
Click on Generate private key (this step is required if the client doesn’t already have a private key to be used). If the client already has a private key, it must be uploaded in veridium manager using the “Upload private key” button
Click on generate CSR and save the file
Access your internal Certificate authority service to generate the internal certificate (Below example is for Microsoft Active Directory Certificate Services)
Select “Get a certificate”
Select “advanced certificate request”
Add the content of the CSR saved at step 6 and select the Certificate Template = Web Server 10 and Submit
Download the certificate chain Base64 encoded
Get the private key generated at step 5 ( or the private key already owned) from Tools → Haproxy configuration → Config details tab -> Download HAPROXY_PUBLIC_CERT_KEY_PEM_BASE64
Go to Tools → Haproxy configuration → Certificates Tab and select Type=CERTIFICATE
Upload the generated certificate chain and the private key and click save
To apply the uploaded certificate in the serverInt.pem file on the server, Go to Tools → Nodes
Expand the Haproxy category and click on “change serverInt.pem” command
In the displayed pop-up select the webapp nodes and click on Run
The status of the execution will be displayed for each node.
4.3 Enable Certificate Pinning
Access the Admin Dashboard and navigate to Settings → Certificates → Pinning and enable the feature from the right side of the screen.
After this to create pins for the new domain certificates click on Upload Certificate for pin certificate and upload the new External domain certificates.
5. Configuring and Managing Email Alerts & Lost Mode Cron Jobs in Veridium Manager
Configuring and Managing Email Alerts & Lost Mode Cron Jobs in Veridium Manager