Adaxes installation guide

1. Log on to the operating system using an Active Directory domain account that has local administrator permissions on the computer.

2. Launch the Adaxes installation package (.msi). Alternatively, install Adaxes from the command line.

3. Read the information provided on the Welcome screen and click Next.

4. Accept the license agreement and click Next.

5. Select Adaxes components you want to install and click Next.

    If you selected the Adaxes service component

   • On the Adaxes service account page, specify the credentials of the user account under which the Adaxes service will run.

     Service account permissions

     The Adaxes service account should have the rights necessary to publish and unpublish the Adaxes service in Active Directory (create/delete service connection points). For information on how to grant the permissions, see Grant permissions to publish Adaxes service.

     If you are going to use this account to manage your domain, it should also have the necessary permissions to perform operations in the domain. For details, see Permissions required by Adaxes.

     Log on as a service right

     Since Adaxes service uses the service account to log on to the system, the Log on as service right will be granted to the account during the installation. However, this right can get revoked by a domain-based Group Policy. In this case, you will need to explicitly grant the Log on as a service right to the Adaxes service account in a domain-based Group Policy. For details, see How do I grant Log on as a service right.

     Access this computer from the network right

     Default Windows security settings grant the Access this computer from the network right to every user on every workstation and server. If you modified the default right assignment on the computer where Adaxes service is installed, you need to explicitly grant the Access this computer from the network right to the Adaxes service account in a domain-based Group Policy. For details, see How do I grant Access this computer from the network right.

   • Click Next.

   • On the Adaxes service configuration page, to achieve fault tolerance and load balancing, you can join the new Adaxes service to an existing Adaxes configuration set. For more details, see Multi-server deployment.

     To join the Adaxes service to a configuration set, select the Shared configuration option, specify the DNS host name of any Adaxes service from the configuration set, and then provide the credentials of the service account of any Adaxes service contained in the set.

   • Click Next.

   • On the Ready to install page, you can specify whether to open the Windows Firewall port that is used for communication between Adaxes clients (e.g. Adaxes Administration console or Adaxes Web interface) and the Adaxes service. If the Open port 54782 in Windows Firewall option is selected, an inbound rule for port 54782 will be added to Windows Firewall. If you uninstall Adaxes, the rule will be deleted automatically.

    If you selected the Web interface component

   • On the Web interface configuration page, configure IIS web site parameters for the Web interface and Web interface configurator.

     Available Web interfaces

     The list of Web interfaces available on a specific web server is determined by the configuration of each Web interface. For example, if you don't want the Web interface for administrators to be available from outside, you can disable it on all web servers located in the DMZ. For more details, see Disable a Web interface on specific web servers.

   • Click Next.

   • On the Adaxes service for Web interface page, specify the DNS host name of the Adaxes service the Web interface will connect to. The step is only available if you install the Adaxes service and Web interface components separately. When both components are installed simultaneously, Web interface will connect to the Adaxes service installed during the current installation.

     If the Adaxes service shares its configuration with other Adaxes services, the Web interface will connect to the nearest available Adaxes service contained in the configuration set.

   • Click Next.

    If you selected the REST API component

   • On the REST API configuration page, configure IIS web site parameters for REST API and click Next.

   • On the Adaxes service for REST API page, specify the DNS host name of the Adaxes service REST API will connect to. The step is only available if you install the Adaxes service and REST API components separately. When both components are installed simultaneously, REST API will connect to the Adaxes service installed during the current installation.

     If the Adaxes service shares its configuration with other Adaxes services, REST API will connect to the nearest available Adaxes service contained in the configuration set.

   • Click Next.

    If you selected the SPML Web service component

   • On the SPML service configuration page, configure IIS parameters for the SPML web service and click Next.

   • On the AD access for SPML Web service page, specify how you want Adaxes SPML Provider to access Active Directory. The page is only available if you install the Adaxes service and SPML Web service components separately. When both components are installed simultaneously, SPML Provider will use the Adaxes service installed during the current installation.

     Adaxes SPML Provider can access Active Directory directly or via an Adaxes service. Accessing Active Directory via Adaxes allows you to benefit from the Adaxes features like business rules, security roles and property patterns.

     If SPML Provider connects to Active Directory through an Adaxes service and the service shares its configuration with other Adaxes services, SPML Provider will connect to the nearest available Adaxes service in the configuration set.

   • Click Next.

    If you didn't select any of the Adaxes components

   Only Adaxes ADSI provider will be installed.

   Adaxes ADSI Provider is an API layer that lets you use ADSI interfaces to connect to and communicate with Adaxes service. You can use the ADSI Provider in custom client applications, standalone scripts, and scripts executed by business rules, scheduled tasks and custom commands.

6. On the Ready to install page, click Install.

1. Install the first instance of Adaxes service. This will create a configuration set with only one Adaxes service.

2. During the installation of subsequent instances of Adaxes service, join each new service to the configuration set.

    How to join a new service to a configuration set

   1. On the Adaxes service configuration page of the installation wizard, select the Shared configuration option.

   2. Specify the DNS host name of any Adaxes service from the configuration set.

   3. Provide the credentials of the service account of any Adaxes service contained in the set.

   To join a new service from another domain to a configuration set, the domains must have two-way trust relationships.

1. Install Adaxes Web interface on each web server in the web farm.

    Command line

   To install Adaxes Web Interface from the command line, run the following command:

   msiexec /quiet /i "<path>adaxes.msi" ADDLOCAL=AppWebUIFeature ADMWEBSERVICECONFIGSET="<config-set-id>"
   

   where:

   • <path> – the path to the Adaxes installation file (adaxes.msi or adaxes_x86.msi).
   • <config-set-id> – the identifier of the Adaxes service configuration set. For details, see Get the configuration set ID.

   To install Adaxes Web interface and Web interface configurator, run the following command:

   msiexec /quiet /i "<path>adaxes.msi" ADDLOCAL=AppWebUIFeature,AppConfigWebUIFeature ADMWEBSERVICECONFIGSET="<config-set-id>"
   

   where:

   • <path> – the path to the Adaxes installation file (adaxes.msi or adaxes_x86.msi).
   • <config-set-id> – the identifier of the Adaxes service configuration set.

2. Configure client affinity for the web farm. For example:

    Application Request Routing Module {id=app-request-routing}

   1. Launch Internet Information Services (IIS) Manager.

   2. Select the server farm and double-click Server Affinity.

   3. Enable the Client affinity option and click Apply.

    F5 BIG-IP Local Traffic Manager (LTM) {id=f5-big-ip}

   1. Go to the F5 BIG-IP LTM configuration page.

   2. Expand Local Traffic in the navigation panel and select Profiles.

   3. Open the Persistence tab and then click Create.

   4. In the General Properties section type the desired name of the profile you are creating.

   5. Select Source Address Affinity in the Persistence type drop-down list.

   6. Customize other settings of the profile according to your requirements and click Finished.

   7. Open the virtual server(s) that hosts Adaxes Web Interface and open its Resources tab.

   8. In the Default Persistence Profile drop-down list, select the name of the persistence profile you have created.

   9. Save the changes.

    Citrix NetScaler {id=citrix-netscaler}

   1. Go to the Citrix NetScaler VPX configuration page.

   2. Navigate to Traffic Management > Load Balancing > Virtual Servers.

   3. Select the virtual server you use for load balancing and click Edit.

   4. In the Persistence list, select the SOURCEIP option.

   5. Save the changes.

1. Install a read-only domain controller (RODC) in the DMZ.

   Adaxes Web interface and Administration console can be installed only on a computer that is joined to an Active Directory domain. Since DMZ is usually a highly restricted piece of network, it is recommended to use read-only domain controllers. RODCs provide a one-way replication from your internal network to the DMZ and thus decrease the risks when a DMZ machine gets compromised. For details on how to deploy RODCs in the DMZ, see Active Directory Domain Services in the Perimeter Network.

2. Open port 54782 in the firewall.

   By default, Adaxes Web interface and Adaxes Administration console use port 54782 for communication with the Adaxes service. You can change this port after the installation if required.

    How to change the port after installation

   • Open the folder where Adaxes service is installed which is C:\Program Files\Softerra\Adaxes 3\Service by default.

   • Open the Softerra.Adaxes.Service.exe.config file with a text editor.

   • Locate XML element configuration\system.runtime.remoting\application\channels\channel.

   • Change the value of the port parameter.

     <configuration>
         ...
         <system.runtime.remoting>
             <customErrors mode="Off" />
             <application>
                 <channels>
                     <channel ref="tcp" port="54782" priority="2" secure="true">
     

   • In a multi-server environment, repeat the above steps for each Adaxes service in the configuration set.

3. Configure which Web interfaces will be available in the DMZ. For example, if you don't want the Web Interface for administrators and help desk to be available from outside, you can allow them only on the web servers located inside your local network. For more details, see Disable Web interface on specific web servers.

If you do not want to install a read-only domain controller and Adaxes Web interface in the DMZ, but still need to make the Web interface accessible from outside, you can use an application delivery controller (e.g. Citrix NetScaler, Nginx, CloudFlare, etc.). For example, the controller can be placed in the DMZ to accept requests from outside and pass them to the Adaxes Web interface installed in your local network.

1. If you want to uninstall the Adaxes service component, make sure that the service is running. This is necessary to correctly unregister the service from your system (remove the service connection points and clean up the configuration set metadata).

2. Open Add or Remove Programs and select Softerra Adaxes.

3. Click Remove and follow the steps provided.

1. Back up the Adaxes configuration.

2. Uninstall the old version of Adaxes.

3. If you have Adaxes 2017.2 and older, you need to do an intermediate update to Adaxes 2021.1. Otherwise, skip this step.

    Upgrade from Adaxes 2017.2 and older

   1. Download and install Adaxes 2021.1.

   2. Restore the Adaxes configuration.

   3. Navigate to the folder where Adaxes Web interface is installed. By default, the folder is C:\Program Files\Softerra\Adaxes 3\Web Interface.

   4. Migrate the old configuration of your Web interface using the Softerra.Adaxes.Web.Migration.UI.exe tool.

   5. Back up the Adaxes configuration once again.

   6. Uninstall Adaxes 2021.1.

4. Install the latest version.

5. Restore the Adaxes configuration.

6. Activate your license key.

1. Uninstall the old version of Adaxes service.

2. Install the latest version. During the installation, join the new Adaxes service to your configuration set.