Installing or updating AssureID Connect

Use the following procedures to install AssureID Connect:

1. Download the AssureID Connect automated script.
2. Customize the ConnectSettings.xml file for your environment.
3. Run the automated AssureID Connect install script (either locally or from a file share).
4. Install or update the database manually if you have an existing database or if you opted to not install the database using the automated script.

To update AssureID Connect on a server that already has the AssureID Connect Web Service installed and hosted, first run uninstall.bat to uninstall the AssureID Connect Web Service, and then install AssureID Connect on the server. For a new server installation, see theInstall AssureID Connect section.

Downloading the automated script

The AssureID Connect package, including installation scripts, are available for download at https://gbgamericas.my.site.com/support.

Customizing the settings file

The automated install script supports several installation configurations, including installing AssureID Connect on IIS, SQL Server using Windows Authentication or SQL Authentication, or MySQL (using the InnoDB storage engine), and using a connection string to Redis (or Amazon ElastiCache for Redis) as a caching layer.

Note: By default, the ConnectSettings.xml file automatically installs the database.

Edit the ConnectSettings.xml file (located in \Deploy\ApplicationSetup) to reflect your specific configuration. Follow the comments in the ConnectSettings.xml template file to customize the deployment for your environment.

AssureID Connect supports the FIPS 140-2 compliant password algorithm for increased security. You can specify whether to use FIPS 140-2 either with backward compatibility or alone, using the FIPS1402 setting in the ConnectSettings.xml file. By default, AssureID Connect will continue to recognize older passwords (which used a less secure algorithm).

Note: If you choose to install the database manually, you must set the Install setting in ConnectDatabase to false and then perform the installation.

Note: If you plan to change the default password, GBG recommends creating or updating the database manually first, and then changing the password.

Note: Installing the database automatically does not affect an existing database. The installation will not overwrite or delete an existing database.

Note: The database installation is only required when you install AssureID Connect in your environment for the first time.

For each server you install, you must configure the following settings:

• WebsiteName
• AppPoolname
• WebsiteDirectory
• WebSitePackageName
• DatabaseConnectionString
• CertificateSubject
• UseHttps
• Port

See ConnectSettings.xml settings for a complete description of the settings.

Running the automated install script

You can run the automated AssureID Connect install script either locally or from a file share.

Run the automated AssureID Connect install script locally

Run setup.bat. This installs all the required prerequisite software packages to install AssureID Connect.

Use the following procedure only if you plan to run the automated script from a file share.

Run the AssureID Connect automated install script from a file share

1. Copy the install package to the file share.
2. Copy setup.remote.bat to the C: drive.
3. Open a command prompt window as an Administrator.
4. Run c:\setup.remote.bat <path to file share (Remove trailing ‘\’)>.

Installing or updating the database manually

If you have an existing database or if you opted to not install the database using the automated script when you configured ConnectSettings.xml, then you must install and update the database manually.

Install the database manually

1. Go to Deploy\ApplicationSetup\SqlScripts to locate the database scripts in either the MSSQL or MySQL directories.
2. Run one of the following createConnectDatabase.sql scripts:

For Microsoft SQL Server: Run MSSQL\createConnectDatabase.sql from the master database using any SQL Server-compatible IDE, such as SQL Management Studio or Toad.

For MySQL: Run MySQL\createConnectDatabase.sql from any MySQL-compatible IDE, such as MySQL Workbench or Toad.

Update the database manually

1. Go to Deploy\ApplicationSetup\SqlScripts to locate the database scripts in either the MSSQL or MySQL directories.
2. Run one or more upgrade scripts, depending on your currently installed version. For example, if you are upgrading from version 1.9.4 to version 1.9.5:

For Microsoft SQL Server: Run MSSQL\Upgrade_ApplicationDatabase_1.9.4_to_1.9.5.sql from the master database using any SQL Server-compatible IDE, such as SQL Management Studio or Toad.

For MySQL: Run MySQL \Upgrade_ApplicationDatabase_1.9.4_to_1.9.5.sql from any MySQL-compatible IDE, such as MySQL Workbench or Toad.

Modifying the database connection string

The default connection string includes a username connectsql with a default password passw0rdSQL. GBG recommends that you keep the default username but change the default password. The username and minimum privileges are maintained by GBG as part of normal database upgrade activities. The database creation scripts (such as createConnectDatabase.sql, Upgrade_ApplicationDatabase_a.b.c_to_x.y.z) automatically create an appropriate user (connectsql) to use with the application.

Note: If you plan to change the default password, you should create or update the database manually first, and then change the password using your database management tool of choice.

To modify the password for the application, edit the DatabaseConnectionString setting in the ConnectSettings.xml file.

Disabling the code signing certificate check

The Microsoft runtime automatically checks to ensure that the digital certificate, which is used to sign the AssureID Connect assemblies, has not been revoked. It does this by making a periodic HTTP request on port 80 to the signing authority. If the port is blocked for security reasons, then this request will introduce a 15-second delay until the request times out. As an alternative to allowing outbound HTTP traffic on port 80, you can choose to disable the certificate check, either by using the following PowerShell commands provided by GBG, or by editing the local policy for the affected computers.

New-Item -Path HKLM:/Software/Policies/Microsoft/SystemCertificates/AuthRoot
New-ItemProperty -Path HKLM:/Software/Policies/Microsoft/SystemCertificates/AuthRoot -Name DisableRootAutoUpdate -Value 1

For more information, see https://www.windows-security.org/846e33d9761f62eced3b15aea3b51138/ turn-off-automatic-root-certificates-update

Recycling the application pool

GBG recommends performing a daily application pool recycle on each application server, taking into consideration the traffic/load and total number of servers in use. Although AssureID Connect and .NET garbage collection free up some resources, recycling the application pool will release any unused resources and re-instantiate the application. An application pool recycle event will make the AssureID Connect web service unavailable for up to 90 seconds.

See https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/applicationpools/ add/recycling/ for more information about modifying the application pool recycle settings.

Preparing for the initial transaction

In order to decrease latency of the first transaction, AssureID preloads the cache and OCR engines upon startup and primes AssureID Connect with a single transaction. Priming can take up to two minutes.

Using the tool of your choice, execute ping (perform an HTTP GET on https://appserverhostname/AssureIDService/ping) on all application server instances that will be used for AssureID transactions before allowing network traffic. The ping command returns a 503 until the transaction is complete. When complete, ping returns a 200.

Testing the AssureID Connect functionality

Use one of the following methods to test that the application server is functional and can connect to the database:

• In a web browser, type the following URL: https://appserverhostname/AssureIDService/ping

• Use the Workbench application to upload and process a document. The Workbench application is named AssureTec.AssureID.Web.Workbench.exe and is included in the distribution package in the Test folder. It is also available for download from GBG Support at https://gbgamericas.my.site.com/support.

  Note: The Workbench application requires the same credentials as the AssureID web service.