All URLs are specified in lowercase. The json format does not allow comments in the file, so you must delete lines beginning with the characters "//" |
You need to recycle Indeed.Idp application pool after every change to the configuration file. You can do this in IIS Manager snap-in, or with powershell command
|
URL example: https://pam.domain.local/pam/idp |
Go to C:\inetpub\wwwroot\pam\idp folder and edit appsettings.json file:
Connection String parameters:
Password - the password for that service account
"ConnectionStrings": { "DefaultConnection": "Server=sql.domain.local; Database=IPAMIdP; Integrated Security=False; User ID=IPAMSQLServiceOps; Password=password" }, |
If using a Named Instance of Microsoft SQL Server, the value of the Server parameter must be specified in the Server Name\\Named instance format.
|
In the Provider section, select the DBMS connection provider:
ConsoleAppClientSecret - Hash for Console App utility authentication
CoreApiSecret - Hash for PAM Core component authentication
SecondFaCacheLifetimeSeconds - 2nd factor caching time in seconds
List of available client ids -
"pam-gateway"
"pam-remote-client"
"IdentitySettings":{ "AdminSids": [ "S-1-5-21-1487179672-2651565253-5257550508-0000", "S-1-5-21-1487179672-2651565253-5257550508-0001" ], "IdpUrls": [ "https://pam.domain.local/pam/idp" ], "Lang": "en", "SigningCertificate": "", "GatewaySecret": "N2u7dSLd5f8BmLHe5BImaOg7HWb9gCeKdTGCIC0iy9o=", "ConsoleAppClientSecret": "", "SshProxyClientSecret": "pgJSv8V5+mWMEecN3e6Lvp/pWBlbOOdiAuaU4nYvtv4=", "CoreApiSecret": "m2Ux/xH/uifL5xuILdkChgwyyZDDY8DacwHMUgURs7k=", "IdpApiSecret": "yGJHfNmHT0EX5GidmZ0GxChcqWLPx8HxXAyefo8eUWb6azPnBZIhQ5J1twyA3S+fomKeJpYbxHgQqyRilGadWg==", "RemoteInstallerClientSecret": "", "Enable2FaCacheForClients": [ "pam-management-console" ], "SecondFaCacheLifetimeSeconds": 60 }, |
Key - data encryption key in the IDP database
"Encryption": { "Algorithm": "AES", "Key": "3227cff10b834ee60ad285588c6510ea1b4ded5b24704cf644a51d2a9db3b7e5" }, |
The encryption key is generated by the IndeedPAM.KeyGen.exe utility, which is included in the Indeed PAM distribution kit and is located in the /Misc directory. |
SessionLifetime - maximum duration of a user session in seconds
"PamSettings": { "ManagementConsoleUrls": [ "https://pam.domain.local/pam/mc" ], "UserConsoleUrls": [ "https://pam.domain.local/pam/uc" ], "CoreUrls": [ "https://pam.domain.local/pam/core" ], "SessionLifetime": 43200 }, |
This section is required to search and add users to the Roles. It is filled in the same way as the similar section in the Pam Core settings.