Gatekeeper Admin Tool

---

The following settings can be configured from the Gatekeeper tab.

Upgrading Gatekeeper Admin Tool

For more information on upgrading to the latest version of Specops Authentication, click here.

View certificates

The certificates for both the Gatekeeper Client and the Gatekeeper Backend Authentication can be accessed by clicking on the View link.

Change proxy settings

If your organization is using a forward proxy server to route internet traffic externally, you will need to configure the proxy server to allow the Gatekeeper to reach the internet. Click Edit on the Proxy row and specify the address as a complete URL, including the protocol and any custom port.

Change Gatekeepers

If you have multiple Gatekeepers, you can switch between them:

Specops Gatekeeper Admin Tool

1. Click Change on the top left.
2. In the Select Gatekeeper window, highlight the Gatekeeper you want to switch to.
3. Click OK.

General commands

In the top right of this tab there is a box with general commands. These include the following:

• Refresh: refreshes the information in the tab.
• Check for new admin tool version: checks if the admin tool needs to be updated.
• Migrate from SPR: opens the migration wizard for migrating Specops Password Reset data.
• Clear caches on all Gatekeepers: clears all caches on the Gatekeepers.

Managing offline Gatekeepers

In order to correctly resolve all available Gatekeepers, any offline (unused) Gatekeepers need to be disposed of correctly. The recommended way to do this is via the Gatekeeper Admin Tool.

Unregistering Gatekeepers (recommended)

Specops Gatekeeper Admin Tool

1. In the Gatekeeper Admin Tool, make sure you have accessed the Gatekeeper you want to unregister (for information on changing to other Gatekeepers, see the Change Gatekeeper section above.
2. Click Unregister in the top right of the Gatekeeper Installation field.
3. Confirm that you want to unregister this Gatekeeper by clicking Yes in the Unregister Gatekeeper window.

Manually removing gatekeepers

If, for any reason, the offline (unused) Gatekeeper was not unregistered using the abovementioned method (e.g. because the server it was installed on is no longer present for some reason), additional manual steps need to be taken.

1. Remove the Gatekeeper from the cloud
   1. Access Authentication Web and click on Gatekeepers.
   2. Highlight the Gatekeeper you want to unregister in the list.
   3. Click Unregister Gatekeeper
      NOTE

      This unregister process is not the same as the one performed by the Gatekeeper Admin Tool. The unregister process initiated from the Gatekeeper Admin Tool will perform all necessary steps to dispose of the unused Gatekeeper, and does not require any manual steps.
   4. In the confirmation window, click Unregister.
2. Remove the Service Connection Point (SCP) from Active Directory.
   1. On the server where the Gatekeeper is installed, open the Active Directory Users and Computers tool.
   2. Make sure that Advanced Features is turned on (top menu View > Advanced Features).
   3. Navigate to System > Specops > SpecopsAuthentication > Gatekeepers.
   4. Right-click on the correct Gatekeeper and select Delete.

---

The following settings can be configured from the Active Directory Settings tab.

Edit the scope of management

The Active Directory scope determines which users can use the Specops Authentication service.

Specops Gatekeeper Admin ToolActive Directory Settings

1. On the Gatekeeper Admin Tool , click Active Directory Settings.
2. Find the row where the current Active Directory scope is displayed, and click Edit.
3. Select the desired Active Directory scope, and click Add. Multiple locations can be selected if you want multiple scopes of management.
4. Click OK.

Enable password resets in Specops Authentication

You can enable the uReset and Secure Service Desk features in Specops Authentication. For uReset enable end-users to address common tasks related to password management, including forgotten passwords. This feature is locked unless you have uReset as a part of your subscription. For Secure Service Desk this enables the administration of users in Secure Service Desk. This feature is locked unless you have Secure Service Desk as a part of your subscription.

Specops Gatekeeper Admin ToolActive Directory Settings

Specops Gatekeeper Admin ToolActive Directory Settings

1. In the Gatekeeper Admin Tool, click Active Directory Settings.
2. In the Active Directory Settings section, click Change in the Allow password resets row.
3. Select one of the following options when enabling the password reset feature:
   • Standard Security Mode: All users that are members of the Specops Authentication Service Desk Agents group will be able to reset passwords for other users.
   • Delegated Security Mode: The access control for resetting passwords for other users is based on the actual security configuration (‘reset password’ permission) in Active Directory.
4. Click OK.

Add/remove members to security groups

You can add additional members to the Admin, User admin, Gatekeepers, and Reporting Readers groups. Users that are members of the Admin group are portal administrator on the Specops Authentication Web . Users that are members of the User Admin group are able to access the user management features on the Specops Authentication Web . Users that are members of the Gatekeepers group have permission to read user information.

Specops Gatekeeper Admin ToolActive Directory Settings

1. On the Gatekeeper Admin Tool , click Active Directory Settings.
2. Find the security group you want to edit, and click Edit members.
3. To add a member, click Add member, and enter the name of the user or group you want to add, then click OK.
4. To remove a member, select a member from the Group members list, and click Remove selected member, then click OK.
5. Click OK.

Reporting Readers group

Members of the Reporting Readers security group in the Gatekeeper Admin Tool can log in to Specops Authentication Web to view reports. Unless they are also members of other security groups, they will not see any other sections in Specops Authentication Web.

Specify preferred Domain Controller

By default, Specops Authentication will use the closest available Domain Controller. Click Change to specify the preferred Domain Controller.

---

If you do not wish to use the default Specops configuration, which uses third-party providers, such as SendGrid, to send email notifications, you can configure your own SMTP provider in this section of the Gatekeeper Admin Tool. For information on editing the default Specops configuration in Specops Authentication Web, please refer to the Specops Authentication Web page.

Configuring SMTP settings

SMTP settings can be configured in three ways:

• Using the Specops Default Configuration (configured in Specops Authentication Web
• Using SMTP with anonymous access
• Using SMTP with basic authentication

Specops Gatekeeper Admin ToolEmail Configuration

1. Click Edit
2. Select which type of configuration you would like to use from the drop-down (anonymous or basic authentication)
3. Enter the domain for the SMTP server (required field)
4. Set the maximum number of concurrent connections the Gatekeeper will use whan sending emails.
   NOTE

   Any time changes are made in this field, all affected Gatekeepers need to be restarted.
   NOTE

   The default for the maximum number of concurrent connections is set to 10. Please consult your SMTP server documentation on how many concurrent connections are allowed.
5. Enter the SMTP port (default is set to port 25)
6. Use the dropdown to set whether TLS (Transport-Level Security) is to be used.
   NOTE

   Set this option to Yes if you want to enable encryption for outgoing mail. Note that enabling TLS will automatically set the SMTP port to 587.
   NOTE

   Note that a valid SSL certificate is required to use TLS when sending SMTP mails.
7. Enter the Sender Email Address (required field) and Sender Display Name
8. For Basic Authentication only: enter the SMTP username and password
9. Click OK
10. Click OK in the success dialog box and restart all Gatekeepers if the Max concurrent connection option was changed.

---

You can use Microsoft Entra ID to sync on reset or change password. In order to configure Microsoft Entra ID setting in the Gatekeeper Admin Tool, first you have to set up an App in Microsoft Entra ID and give it the correct permissions.

Requirements

Configuring an app in Microsoft Entra

1. Login to https://entra.microsoft.com/
2. Click on Microsoft Entra ID. This should bring you to your org's directory.
3. Click on App Registrations.
4. Click on New registration.
5. Enter a name for the app in the Name field.
6. Using the radio buttons, select the supported account type (Single Tenant or Multitenant)
7. Click on Register. In the following app summary screen, under the Essentials section, make a note (copy) of the Application (client) ID and the Directory (tenant) ID. These will be used for configuration.
8. In the left navigation of the app summary screen, click Certificates & Secrets.
9. Click on New client secret. Enter a description and set an expiry period using the Expiry dropdown, then click Add.
10. Copy and store the secret in the Value column for the password. This will also be used for configuration.
    NOTE

    When configuring a sync point (Specops Password Sync), note that this value needs to be pasted in the Provider password field in the Sync Point configuration.
11. In theMicrosoft Entra ID admin center's (left-most) left navigation, click on Microsoft Entra ID, then click on Roles and administrators.
12. In the list, click on a role that will be sufficient for resetting passwords.
    NOTE

    For an overview of roles and their permissions, please go to Working with users in Microsoft Graph. Note that the minimum required role for resetting passwords is the Password Administrator role.
13. Click on Add assignments at the top. The Add Assignments sidebar will open on the right.
14. In the search box, enter the registered app name, click on the app in the search result list, then click Add at the bottom.

Next steps

Write down or copy the Application (client) ID, Directory (tenant) ID, and the Client Secret, then proceed to configure the Microsoft Entra ID Settings in the Gatekeeper Admin Tool.

Configuring the Gatekeeper Admin Tool

Specops Gatekeeper Admin ToolMicrosoft Entra ID

1. In the Gatekeeper Admin Tool, select Microsoft Entra ID Settings.
2. In the Microsoft Entra ID Settings field, click Edit.
3. Enter the Client ID (Application (client) ID).
4. Enter the Tenant ID (Directory (tenant) ID).
5. Enter the Client Secret (Client Secret Value).
6. Click OK.
7. In the right navigation box, click Test connection to see if a connection to Microsoft Entra ID was established.

Once the connection is established, the Gatekeeper will start syncing with Microsoft Entra ID on password reset or change.

---

This section shows the settings for Windows Integrated Authentication. These settings can also be edited here.

Windows Integrated Authentication allows users' Active Directory credentials to pass through their browser to a web server, sent hashed (NTLM) or encrypted (Kerberos). Configuring Integrated Authentication for the user will automatically authenticate the user with Windows Identity, and grant the Windows Identity authentication token.

Enabling Integrated Authentication

By default, Integrated Authentication is disabled for new customers. If you want to use Integrated Authentication, do the following:

NOTE
It is recommended to use the Group Managed Service Accounts account type during installation of Getekeepers. For more information, see the Group Managed Service Accounts information below.
1. In the Gatekeeper Admin Tool, select Windows Identity.
2. In the Integrated Authentication Settings field, click Edit.
3. In the Select authentication protocol dropdown, select the protocol you want to use: NTLM or Kerberos.
   NOTE

   It is not recommended to use the NTLM protocol. NTLM is a legacy protocol that provides less security. Please consider using the Kerberos protocol instead.
4. Click OK.
5. Add the Integrated Authentication url to the Local Intranet in Internet Options for every client.
   NOTE

   This can be done by adding the URL to the list of Trusted Sites in Windows Control Panel> Internet Options > Security Tab > Local Intranet > Site, then add the URL. It can also be done through the registry. More information on the latter can be found here. Note that the blogpost referenced here deals with a different URL, although the process is the same.

For more information on Windows Identity, please see the Windows Identity page.