33.7 Installing and Configuring Multiple Webgates for a Single IIS 6 Instance

To install each Webgate when you have several with one IIS instance:

1. Install the ISAPI Webgate as described in Registering and Managing 10g WebGates with Access Manager 11g.

2. Go to the Web site to protect, and configure webgate.dll as the ISAPI filter using these steps:

   1. Start the Internet Information Services (IIS) Manager: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager

   2. Right click Web Sites, and then click the Properties option.

   3. Click the ISAPI filter tab, look for the path to webgate.dll; if it is present in the filter, then select it and click the Remove button.

   4. Under Web Sites, right-click the name of the Web site to protect, and select the Properties option.

   5. Click the ISAPI filter tab to add the filter DLLs.

   6. Add the following filter to identify the path to the webgate.dll file, and name it "webgate".

      Webgate_install_dir/access/oblix/apps/webgate/bin/webgate.dll
      

   7. Save and apply these changes.

   8. Go to the Directory Security tab.

   9. Confirm that "anonymous access" and "basic authentication" are selected so that Access Manager provides authentication for this Web server.

   10. Save and apply these changes.

3. Go to Web sites level to protect and create an /access virtual directory that points to the newly installed Webgate_install_dir:

   1. Under Web Sites, right-click the name of the Web site to be protected.

   2. Select New and create a new virtual directory named access that points to the appropriate Webgate_install_dir/access.

   3. Under Access Permissions, check Read, Run Scripts, and Execute.

   4. Save and apply these changes.

4. In the file system, set directory permissions for Access Manager:

   1. In the file system, locate and right-click Webgate_install_dir\access, and the select Properties.

   2. Click the Security tab.

   3. Add user "IUSR_machine_name" and then select "Allow" for "Modify".

      For example, for a machine_name of Oracle, select IUSR_ORACLE.

   4. Add user "IWAM_machine_name" and then select "Allow" for "Modify"

      For example, for a machine_name Oracle, select IWAM_ORACLE.

   5. Add user "IIS_WPG" and then select "Allow" for "Modify".

   6. Add user "NETWORK SERVICE" and then select "Allow" for "Modify".

   7. For the group "Administrators", select "Allow" for "Modify".

5. If Webgate has been set up in Simple or Cert mode, perform the follow steps:

   1. In the file system, locate and right-click the "password.xml" file in Webgate_install_dir\access\oblix\config\password.xml.

   2. Click the Security tab.

   3. Give "Allow" for "Read" rights to users "IUSR_machine_name", IWAM_machine_name, "IIS_WPG", and "NETWORK SERVICE".

6. Add a new Web service extension using the following steps:

   1. Right click Web Service Extensions, and then select Add a new Web service extension....

   2. Add the Extension name Oracle Webgate.

   3. Click Add to add the path to the extension file, and then enter the path to the appropriate webgate.dll.

      Webgate_install_dir\access\access\oblix\apps\webgate\bin\webgate.dll
      

   4. Click OK to save the changes.

   5. Check box beside Set extension status to allowed.

   6. Click OK to save the changes.

7. Ensure that there is no webgate.dll in the ISAPI filter at the top Web site level ("web sites").

8. Perform the next set of tasks using instructions in the following topics:

   1. "Setting the Impersonation DLL for Multiple Webgates"

   2. "Enabling SSL and Client Certification for Multiple Webgates"

9. Repeat these steps when you install the next Webgate for the IIS instance.

The client's access token is known as an impersonation token. The impersonation token identifies the client, the client's groups, and the client's privileges. The information in the token is used during access checks when the thread requests access to resources on the client's behalf.

The Access System authenticates and authorizes the user. IISImpersonationExtension.dll of Access Manager in the wildcard extension behaves like a filter for each request to the Web server. The Access System designates a special user that does have the right to impersonate another user by configuring it using the impersonation username/password on the AccessGate Configuration page. That designated user must have "act as operating system" rights. DLL impersonates the user authenticated and authorized by Access Manager and generates the impersonation token.

You perform the following steps to set the impersonation DLL for each Webgate that protects a Web site for a single IIS Web server instance. You can do this either immediately after the installation task in the previous topic or all at one time.

To add the impersonation DLL:

You perform this task to set the enable client certification for each Webgate that protects a Web site for a single IIS Web server instance. You can do this either immediately after the adding the impersonation DLL to an individual Web site or all at one time.

If you select client certificate authentication during setup, you must also add the cert_authn.dll as one of the ISAPI filters in the respective Web site.

To enable SSL on the IIS v6 Web:

1. Start the Internet Information Services (IIS) Manager, if needed: Click Start, Programs, Administrative Tools, Internet Information Services (IIS) Manager.

2. Expand the local computer icon to display your Web Sites.

3. Expand the appropriate individual Web Site, then expand \access\oblix\apps\webgate\bin.

4. Right click cert_authn.dll and select Properties.

5. In the Properties panel, select the File Security tab.

6. In the Secure Communications sub-panel, click Edit.

7. In the Client Certificate Authentication sub-panel, click Accept Certificates and click OK.

8. Click OK in the cert_authn.dll Properties panel.

9. Repeat for each Webgate installed on this host.

10. Proceed to the next task: "To add cert_authn.dll as an ISAPI filter".

To add cert_authn.dll as an ISAPI filter: