Enterprise Vault™ Installing and Configuring

Step 1: Register a new application in Identity Provider with the details about Enterprise Vault Server

1. Sign in to the Identity Provider administrator portal.
2. Register New Application. During the application registration, if asked, provide the following details:

   • Name of the App: Enterprise Vault Search

   • Platform: Web based

   • Sign On Method: SAML 2.0

   • Single sign on URL OR ACS URL: https://<your-EVserver-server-name-here >/EnterpriseVault/Search/SamlAcs.aspx

     Note:

     The URL specifies the location where the SAML assertion is sent by the IdP with a HTTP POST. This is often referred to as the SAML Assertion Consumer Service (ACS) URL of the application.

   • Audience URI (SP Entity ID) or Issuer: https://<your-EV-server-namehere>/

     Note:

     It specifies the application-defined unique identifier that is the intended audience of the SAML assertion. This is most often the SP Entity ID of the application.

   • Ensure that the Attribute Statement of assertion is configured to return the User Principal Name (UPN) value of the user (for example, user@WindowsADdomain.com), with attribute name UPN. Enterprise Vault uses this value to map with the Windows Active Directory user for authorization.

     Note:

     Ensure that the Response configuration is such that the SAML Response and the Assertion in the response must be signed using Signature Algorithm RSA-SHA256.

     Enterprise Vault currently does not support automatic configuration for SAML using MetaData URL. All the configuration details need to be configured manually.

3. Once the application is registered, go to the Sign On tab of the registered application, and then click View Setup Instructions. Note down the following values of the registered application:

   • Identity Provider Single Sign-On URL value: The location where the SAML request will be sent to the IdP with a HTTP POST. You need this value to set the SSO Service Location setting in Enterprise Vault Administration Console.

   • Identity Provider Issuer value: The unique identifier of the registered application in IdP, that is the intended source who sends the SAML assertion. This is most often the IdP Entity ID of the application. You need this value to set the Issuer URL in Enterprise Vault Administration Console.

   • Download the certificate of your registered application, and save the certificate (.cert or .cer) file somewhere on your Enterprise Vault server. If multiple formats of the certificate are presented for download by the IdP, then choose the Base64 Certificate format for download. You need this certificate file while configuring SSO on Enterprise Vault Administration Console.

4. Assign permissions to all the required users who should be allowed to access Enterprise Vault Search.

Step 2: Configure the required properties in Enterprise Vault Administration Console

1. In the Administration Console, go to Site > Properties > Single Sign-On page.
2. Configure Single Sign-On for Enterprise Vault Search.

   For more information on how to configure Single Sign-On, see Site Properties: Single Sign-On in the Administration Console help.

Step 3: Update Enterprise Vault Search site settings in IIS and Web.config file

1. Update Enterprise Vault Search site authentication settings in IIS

   • On the Enterprise Vault server, Open Internet Information Services (IIS) Manager.

     If you are using Windows Server 2012 or higher version, on the taskbar, click Server Manager, click Tools, and then click Internet Information Services (IIS) Manager.

   • In the Connections pane, expand the server name, expand Sites, and go to the following level in the hierarchy pane: Default Web Site > EnterpriseVault > Search, and then click on that Search Web site or Web application.

   • Scroll to the IIS section in the Feature View pane, and then double-click Authentication.

   • In the Authentication pane, enable the following items, and disable the remaining items, using the Enable/Disable option in the Action pane:

     Name	Status
     Anonymous Authentication	Enabled
     Forms Authentication	Enabled
     ASP.NET Impersonation	Enabled
     Basic Authentication	Disabled
     Windows Authentication	Disabled
     Digest Authentication	Disabled

2. Update Enterprise Vault Search site configuration settings in Web.config

   • On the Enterprise Vault server, locate the Enterprise Vault Search site mapped folder, which is located at: <Enterprise Vault Install Directory>\EVSearch\EVSearchClient. For example: C:\Program Files (x86)\Enterprise Vault\EVSearch\EVSearchClient

   • Take backup of the Web.config file.

   • Open the Web.config file in any Text or XML editor application.

     Change 1 of 4:

     Locate the following section:

     <authentication mode="Windows"/>
         <!--Uncomment following for SAML config, AND comment out above--> 
         <!--<authentication mode="Forms">
           <forms loginUrl="SamlStartSSOAuth.aspx" defaultUrl="Shell.aspx">
           </forms>
         </authentication>
         <authorization>
           <deny users="?" />
         </authorization>-->

     Modify the above section to following:

     <!--<authentication mode="Windows"/>-->
         <!--Uncomment following for SAML config, AND comment out above--> 
         <authentication mode="Forms">
           <forms loginUrl="SamlStartSSOAuth.aspx" defaultUrl="Shell.aspx">
           </forms>
         </authentication>
         <authorization>
           <deny users="?" />
         </authorization>

     Change 2 of 4:

     Locate the following section:

     <!--Uncomment following for SAML/IDP configuration-->
       <!--<location path="SamlStartSSOAuth.aspx">
         <system.web>
           <authorization>
             <allow users="*" />
           </authorization>
         </system.web>
       </location>
     
       <location path="SamlAcs.aspx">
         <system.web>
           <authorization>
             <allow users="*" />
           </authorization>
         </system.web>
       </location>
     
       <location path="ErrorPage.aspx">
         <system.web>
           <authorization>
             <allow users="*" />
           </authorization>
         </system.web>
       </location>-->

     Modify the above section to following:

     <!--Uncomment following for SAML/IDP configuration-->
       <location path="SamlStartSSOAuth.aspx">
         <system.web>
           <authorization>
             <allow users="*" />
           </authorization>
         </system.web>
       </location>
     
       <location path="SamlAcs.aspx">
         <system.web>
           <authorization>
             <allow users="*" />
           </authorization>
         </system.web>
       </location>
     
       <location path="ErrorPage.aspx">
         <system.web>
           <authorization>
             <allow users="*" />
           </authorization>
         </system.web>
       </location>

     Change 3 of 4:

     Locate the following section:

     <!--Set UseRestrictedSecurity to "0",
     with SAML/IDP configuration. 
     This is required for IE 11 support-->
         <add key="UseRestrictedSecurity" value="1"/>

     Modify the above section to following:

     <!--Set UseRestrictedSecurity to "0", 
     with SAML/IDP configuration. 
     This is required for IE 11 support-->
         <add key="UseRestrictedSecurity" value="0"/>

     Change 4 of 4:

     Locate the following section:

     <!--Uncomment following for SAML/IDP configuration-->
         <!--<add key="SAML.SP.ACSURL" 
     value=
     "https://EV-SERVER.Domain.com/EnterpriseVault/Search/SamlAcs.aspx" />
         <add key="SAML.SP.Issuer" 
     value=
     "https://EV-SERVER.Domain.com/EnterpriseVault/Search" />-->

     Modify the above section to following:

     <!--Uncomment following for SAML/IDP configuration-->
         <add key="SAML.SP.ACSURL" 
     value=
     "https://EV-SERVER.Domain.com/EnterpriseVault/Search/SamlAcs.aspx" />
         <add key="SAML.SP.Issuer" 
     value=
     "https://EV-SERVER.Domain.com/EnterpriseVault/Search" />

     The value should be your Enterprise Vault server name.

   • Save the changes to the Web.config file.

   • Restart IIS for the changes to take effect.

     Run this command as Administrator: iisreset