Administration Console V2

Prerequisites

• Minimum TrustBuilder Authenticator 6.5 activated with this Administrator login

• To install the integrated certificates included in TrustBuilder Authenticator 6.5 App. The certificate is available in the “About” page of of your installed Authenticator 6 App. Save this file in a folder on the local computer. Install the certificate in the section of your "Manage computer certificates" in Windows (certmgr) on the local computer. Read the following instruction to install the certificate on Windows:

  • Rename the file in .crt format

  • Right click and select "Install certificate"

  • Select "open" and "Local Machine" in the Certificate Import Wizard screen

  • Select "Next" and "Place all certificates in the following store"

  • "Browse" Certificate store" and select "Trusted Root Certification Authorities"

  • Select "OK", "Next" and "Finish"

Authentication procedure

When you select this option, the console will check your accounts on your Authenticator 6 Desktop application.

When your account is found, your TrustBuilder Authenticator Desktop application will ask you to enter your PIN code to access the Admin Console v2.

You should generate an activation code for your administrator account:

• with an enrolled tool (My device > +Add a device)

or

• with your own online access to the administration console myinwebo.com > Service Users tab > Edit yout user > “Add a new device with…”

  

Go back to the Admin Console v2 authentication page and enter the generated activation code.

There are different ways to create users:

• Creation by API provisioning → please refer to the “User management with REST API” documentation or “User Management with SOAP API” documentation.

• Creation with external directories synchronization (AD, LDAP, Google Apps, etc.) → please refer to “IWDS” documentation.

• Creation with the administration console.

To add a new user:

• Go to User tab > Users sub-section > Add user.

• Enter the user name in the Login field.

• Enter the email address in the Email field (optional).

  

• Choose the user access level to the Admin Console:

  • User → has no access to the Admin Console.

  • Manager → can connect to the administration console and manage the users of the service.

  • Administrator → can connect to the interface, manage the users and administrate the parameters of the service.

• Click on Add to create the user.

• The user now appears in the users list. You can click on Edit to specify more details about the user (first name, last name, language, alternative logins). For first name and last name, note that the following special characters ' . - _ ! # ^ ~()[] are authorized.

A new user status is automatically “inactive”.

To activate a user, click on Edit (the user) > Get activation code (validity period = 15 minutes) or Get a long activation code (validity period = 48 hours). Provide the generated activation code to the user (See the Authenticator user guide to know more about how the user should use an activation code).

The user status can be checked from the users list (Users tab > Users sub-section). There are 3 user status:

You can search and filter users (Users tab > Users sub-section)

• Filter by login

  • If the login contains a "\”, you should to enter "\\" in the filter to find it. - Example: to find the login "test\user" you should filter on "test\\user"

  • The character "_" is a wildcard character that replaces or represents any character. - Example: you can find the login "test\user" by filtering on "test_user"

• Filter by roles (All roles, User, Manager, Administrator)

• Filter by status (All status, Activated, Pending Activation, not activated)

• Go to Users tab > Users sub-section > Edit.

• From the user edition mode, you can edit or add the user properties.

• Click on Save.

  

• Go to Users tab > Users sub-section > Lock / Unlock.

A locked user can no longer authenticate to your service. All user properties remain unchanged. If you unlock user, you restore their ability to authenticate to your service.

• Go to Users tab > Users sub-section > Delete.

• Click on Confirm Delete to validate your choice.

If you use directory syncing (IWDS), your directory remains the source of truth. Please refer to the Directory Syncing (IWDS) for more details.

Custom roles feature is not fully operational for now.

Roles defines the level of access to the console for a user. Custom roles are only available for group users.

• Click on +Add role.

• Define the role name as it will be displayed in the Administration console interface, in English and in French. Note that this name is never exposed to the user outside the administrator console.

  

• Check the box if you want to allow this new custom role admin console access.

  

This option is very important as it is the one that determines the custom role access to the Administration console.

• If the box is not checked, the role has no access to the console, and therefore has rights equivalent to the ones of the built-in 'user' role.

• If the box is checked, the role can access the console. The actions the role should have access to can be determined using the role actions check-list.

• Check actions you want to authorize for this role. The actions that are not checked are restricted.

• Click on Save at the end of page to create the new custom role.

To create a user group:

• Go to Users tab > Groups > Add group.

• Indicate a name for the new group.

• Select a security policy (see “Security policy section).

• Click on +Add to create the group. The new group is displayed in the group list.

• You should now add users to the group. There are different ways to add user to a group:

  • with Directory Sync (IWDS), your directory remains the source of truth. Please refer to the “IWDS” documentation for more details.

  • with Admin Console, you can add users from the user editing mode as well as from the group editing mode.

When you add a user to a group, you can assign them a custom role (See more details in the “Creating custom roles” section).

• Go to Users tab > Groups > Edit.

• From the group edition mode, you can edit the group properties.

• Click on Save.

  

• Go to Users tab > Groups > Delete.

• Click on Confirm Delete to validate your choice.

If you use directory syncing (IWDS), your directory remains the source of truth. Please refer to the Directory Syncing (IWDS) for more details.

Security policy determines the number of authentication devices a group user will be able to activate.

To create a security policy:

• Go to Users tab > Security policies sub-section.

• Click on +Add policy

• Indicate a name to the new security policy.

• Define the maximum number of authentication devices authorized for this policy.

  

When browsing the audit trail, you can refine your search with different filters:

• Filter by login: a text search based on the Login field

• Filter by Action: if you want to track specific operations in your service history

• Filter by date: you can select the appropriate time range from the past 5 weeks

The filters you define are persistent, even if you change the section.

You can export your search results in .csv format with the "Export selection" button at the bottom of the Application.

To generate a new token for MFA REST API:

• Go to the “API token” tab.

• Click on +Add API Token.

• Enter your PIN code and select the expiration date of the new token.

By default, a 13 months validity period is set. You can edit this setting as you wish.

• Click on “Generate”.

  

• The new API token generated is displayed:

  • Click the OK button to see the API Token generated list.

  • Click on Copy to use it in the REST API call.

From the API Token list, you can revoke a API Token generated. Click on Revoke and confirm your choice to revoke the token. This action deletes the API token from the API Token list and it is no longer usable for the REST API.

A revoked API Token is no longer usable within one hour after revocation.

The API Token generated via the Admin Console v2 should be used for the MFA REST API calls.

You should paste the token in the header of the REST API call.

For curl, add -H “Authorization: Bearer xxxxxxyyyyyyzzzzzz” or --header 'Authorization: Bearer xxxxxxyyyyyyzzzzzz'.

See more information