Integration with the CipherTrust Manager
This section outlines the steps to integrate AD RMS with the CipherTrust Manager.
Setting up the Environment
The setup consists of the following systems in a private network:
| Host | Applications and Services |
|---|---|
| CipherTrust Manager | NAE |
| AD DC Server | Active Directory, Domain Name System (DNS) |
| AD RMS Server | AD RMS, Internet Information Services(IIS), Message Queuing, and Safenet ProtectApp CSP |
| AD RMS Client | Microsoft Office |
Note
Join AD RMS server and AD RMS client to AD Domain Controller.
Configuring AD DC
Configure the domain on AD Domain Controller. For more details, refer to Active Directory Domain Controller.
Add desired user accounts to the Active Directory. In this document, we are using the user accounts as mentioned in the following table. However, you can create the user accounts as per your requirement.
User Name E-mail Address Purpose rmssrv rmssrv@rms.local Enterprise Admins Schema Admins james james@rms.local Read Access user peter peter@rms.local Change Access user steve steve@rms.local Content Owner
Configuring CSP for AD RMS
Install AD RMS. For more details, refer to Microsoft documentation.
On the Post Installation screen, after installation is completed, either click Close to close the wizard or click Perform additional configuration. Moreover, you can click the Notification flag to open the configuration wizard later.
On the AD RMS screen, click Next.
On the AD RMS Cluster screen, select the Create a new AD RMS root cluster option, and click Next.
On the Configuration Database screen, select the Use Windows Internal Database on this server option, and click Next.
On the Service Account screen, click Specify... to select the Service Account.
Specify username as rmssrv and Password, click OK, and then click Next.
On the Cryptographic Mode screen, select a cryptographic mode, and click Next.
On the Cluster Key Storage screen, select Use CSP key storage option, and click Next.
On the Cluster Key CSP screen, select SafenetProtectApp enhanced RSA and AES Cryptographic provider from the CSP drop-down list. Further, select the Create a new key with the selected CSP option, and click Next.
On the Cluster Web Site screen, click Next. Ensure that the Default Web Site is listed.
On the Cluster Address screen, select Use an unencrypted connection (http://) and specify the Fully Qualified Domain Name (FQDN). Further, click Next to continue.
Note
FQDN should be the same as the AD RMS Server. You can rename the system to give it a user-friendly name.
On the Licensor Certificate screen, ensure that the server name (same as AD RMS Server) is listed, and click Next to continue.
On the SCP Registration screen, select the Register the SCP now option, and click Next.
On the Confirmation screen, click Install.
Click Close.
At this stage, a key is created on the CipherTrust Manager. Moreover, you can verify the integration using the instructions mentioned in Verifying the Integration.
