Lab 1: Software Installation and Configuration Wizard

Software Installation and Configuration Wizard

As with any Windows application, Keyfactor begins with the installation of the software files. In the lab environment, we've staged the latest installation files in C:\Software\Keyfactor for you, which can be accessed via the Software folder shortcut located on the VM desktop.

Double-click the KeyfactorPlatform-12.5.0.msi installer package.
After the installer package loads, click Next on the dialog.
Accept the licensing agreement and click Next
You will be presented with the product components that you wish to install.
- By default, we choose to install everything but the CA Connector API.
  - Each component could be installed on a separate server, but for the lab, let's keep the defaults.
  - You can also choose to change the path where the bits are copied.
- By default, our installation wizard places these files at:
CODE
```
C:\Program Files\Keyfactor\Keyfactor Platform\
```
Note: If you are upgrading from an existing Keyfactor installation, this path will default to the previously used installation path.
Click Next
Click Install and allow the installation to run, and when it completes, click Finish. This will automatically open the Configuration Wizard.

For the next portion of the lab, we need to connect to the database.

Keyfactor Database Configuration

Server

Once the Keyfactor Database Configuration dialog loads, you will be prompted for a server name and credential type for accessing that database.
- Enter the following server name:

CODE

dc-sql-ca.kftrain.lab

For our lab environment, we will be using the Windows credential type. This connects to the database in the context of the logged-in administrative user.

Click Connect.

Database

The next step of the Database Configuration Wizard is to choose an existing database or create a new one, but we've already created a database for use with this lab (sample instructions for new database creation below.)

Click Browse to choose the pre-configured database, and for this activity, it will be the following:

CODE
```
Keyfactor (Version: 12.5.0)
```

Click Continue, and the Configuration Wizard will display a list of configurations that need to be completed to get the Keyfactor platform up and operational.
Click Upload on the License Upload page. You will find the license file “KeyfactorCommand-Training-Labs-License.cmslicense” in the C:\Software\Keyfactor directory.

Keyfactor Configuration Wizard

There are several tasks we will need to complete within the Configuration Wizard. We'll walk through each of these items individually.

Application Pools

This tab is where you create a new Application Pools that will be used to run our Keyfactor Web Applications on the IIS web server. This defines the configurations and identities that will apply to our application. This screen can be used to create new application pools and will display any available application pools for this server.

For this lab, we will be creating four Application Pools. We will create each of the Application Pools listed below. Click Add to create the first Application Pool.

Configuration	Value
Name	KeyfactorPortal
User	kftrain\kf_service
Password	Password1

Click Save. Next, click Add to create the second Application Pool.

Configuration	Value
Name	KeyfactorAgents
User	kftrain\kf_service
Password	Password1

Click Save. Next, click Add to create the third Application Pool.

Configuration	Value
Name	KeyfactorAnalysis
User	kftrain\kf_service
Password	Password1

Click Save. Next, click Add to create the fourth Application Pool.

Configuration	Value
Name	KeyfactorAPI
User	kftrain\kf_service
Password	Password1

Click Save.

As a reminder, this account must be part of the Constrained Delegation configuration covered in the previous lesson if users are going to manage and enroll with a Microsoft CA from the Keyfactor portal.

Authentication

This tab is where you configure Command to work with OAuth/your IdP. For this lab, we will be using Basic Authentication, so we will Uncheck the Use OAuth for Keyfactor Portal, API, and Orchestrators box.

Database

This tab is where you configure how the web application and service will connect to the database. For the lab, use Windows Authentication and leave the default for encryption.

Note: When configuring this in your own environment, choose the authentication method (Windows or SQL) and the user that will be used to authenticate to the database. If this user does not exist, the Wizard will attempt to create the user and add it to the selected database as db_owner. This will be done in context of the user used to connect to the database (see bottom status bar). If this user does not have appropriate database permission to make this change, the configuration will fail.

Here we also determine if we want to use Keyfactor Application encryption on top of the SQL encryption. The encryption section allows you to determine how data is encrypted within our secrets table. By default, all secrets are encrypted with the SQL server service master key. In some situations, an additional layer of protection may be required to ensure that secrets cannot be decrypted outside of the application. To enable this scenario, you can choose to use a certificate to encrypt the data before storage in SQL. This results in data that is encrypted using the certificate stored in the database and then encrypted using the Service Master Key. This is one way to ensure that only the application is able to decrypt secrets within the Keyfactor database.

Service

The Service tab allows you to define how the Keyfactor Command Service will be configured on this server. It should be noted that these service functions can be run on multiple servers, and care should be taken to ensure that the same function is not run on multiple servers. If you are going to separate duties between servers, it makes sense to break them down by category for ease of administration.

For the lab, enter the following user and password.

Configuration	Value
User	kftrain\kf_service
Password	Password1

Select the Start service on bootup check box.