Good to know

At this point the FrontEnd installation is complete. The following steps below are optional / exotic configuration scenarios. They are required only if one of the following cases applies to you: 

Configure Frontend (Dashboards) for Anonymous Access 

  1. Open Services and start the installed FE Core service.

  2. Check that service is successfully started without any errors in Event Viewer or in the log file → C:\Program Files\Luware AG\LUCS-FE\FeCore\Log\regularLog.txt
  3. Open Internet Information Services (IIS) Manager and make sure that the AnonymousAuthentication and FormsAuthentication values are enabled for the web application:

    1. Click ‘LUCS – Frontend’ -> ‘Authentication’ item

  4. Enable AnonymousAuthentication and FormsAuthentication values if it is necessary:

  5. Open Configuration Editor for the web application and unlock anonymousAuthentication and windowsAuthentication sections if it is necessary.
    (info) These sections should be unlocked by default after installation by the Front End setup.

  6. Select ‘anonymousAuthentication’ value from the ‘Section’ dropdown: 
    System.webServer – > security -> authentication

  7. Unlock ‘anonymousAuthentication’ section if necessary (unlocked by default):

  8. Click ‘WinAccount’ folder -> Authentication and make sure the ‘AnonymousAuthentication’ value is enabled and ‘WindowsAuthentication’ section is disabled.

  9. Click Application Pools -> DefaultAppPool -> Advanced Settings

  10. Click the browse icon for the ‘Identity’ value in the ‘Process Model’ section

  11. Set ‘Built-in account’ value to the ‘NetworkService’.

  12. Ensure that the binding settings are set to appropriate values in IIS under the created web site ‘LUCSFrontend’.
  13. If LUCS Front end application was moved to a different machine, the database must be defragmented.

    1. To defragment the database, the command below must be run from App_Data\DataStorage folder of the installed application:

      esentutl /d Data
      CODE

Client Certificate Authentication

This chapter applies when you want to disable the standard Windows Authentication and switch to certificate-based authentication in the frontend.


The actions below result in updates to the Frontend Config files located in the default installation directories:

C:\Program Files\Luware\TM-FE\
C:\Program Files\Luware\LUCS-FE\
C:\Program Files\Luware\LUCS-WebConfigurator
CODE

In particular: 

  • Web.config

  • \WinAccount\Web.config
  • AppSettings.config

Back up and re-merge your config files when updating your product installation to avoid having to perform the settings below again.

Configuration Windows Server 2012 R2 / 2016 / 2019

  1. Open Server Manager.
  2. In Server Manager, click the Manage menu, and then click Add Roles and Features.

  3. On the Server Roles page, expand Web Server (IIS), expand Web Server, expand Security, and then select IIS Client Certificate Mapping Authentication.

  4. Finish installation and Close Results

Configuration of Personal Certificates

(info) This step is depending on your local IT policy. The steps below showcase a test account configuration from Luware and may vary greatly on your system.  If already have a Client Authentication Certificate Issued for your user you can skip to the next step.

  1. Open MMC (Microsoft Management Console)

  2. Check in Certificates - Current User > Personal > Cerificates that a personal certificate is issued to the user that is supposed to log into the LUCS frontend later

    If no Personal/Certificates are available, right mouse click on main panel and select All Tasks/Request new Certificate → Contact your system administrator / certificate authority to request a certificate

    → After a personal certificate is rolled out and available, continue with the next step.

Internet Information Services (IIS) configuration

(tick) This configuration must be done on all server instances where IIS is running and hosting any LUCS frontend websites.

LUCS Server configuration

  1. In IIS open the root node (Server)

  2. Open Authentication dialog and set Active Directory Client Certificate Authentication to "enabled".

Luware-LUCS-Site configuration

(info) When you already have configured SSL you can skip step 1 to 4.

  1. In IIS open Sites and select Luware-XX-FE 
  2. Open Site Bindings configuration and Add new binding.

  3. In Site Binding dialog select https type, and select necessary SSL Certificate.


  4. Click OK to create new binding.
    (warning)To avoid logins being possible without HTTPS we recommend to remove all existing Bindings except thew newly created at this point.
  5. Open SSL Settings dialog of Luware-LUCS-FE

  6. Set check box "Require SSL" and Ignore client certification radio button and Apply settings.

  7. Click Apply to save changes.
  8. Again within Luware-LUCS-FE site, open Configuration Editor 

  9. Go to  "sytem.webServer/security/authentication/" and set "clientCertificateMappingAuthentication" to false.


  10. Click Apply to save changes.

Luware-LUCS-WinAccount Folder configuration

  1. Again within Luware-LUCS-FE open folder "WinAccount" 
  2. Open SSL Settings dialog of WinAccount

  3. Check box "Require SSL" and select "Require client certification" radio button.

  4. Click Apply to save changes.

  5. Again within Luware-LUCS-FE > WinAccount folder

  6. Locate and set Windows Authentication to "Disabled"


  7. Again within Luware-LUCS-FE Open Configuration Editor dialog of WinAccount
  8. Set webServer/security/authentication/clientCertificateMappingAuthentication to true.

  9. Set webServer/security/authentication/windowsAuthentication to false.

Sources: https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/iisclientcertificatemappingauthentication/