Secure MiddleTier Communication

Communication between the ZENworks ZDM Management Agent and the MiddleTier (xTier Web Proxy Services) is handled by HTTP or HTTPS. Some business will want this traffic secure (https) as usernames and passwords do pass over this protocol.

The web service, whether apache or IIS, must be configured to use a minted certificate. This certificate can be provided by a trusted ROOT Certificate authority or your local Directory service (Active Directory or eDirectory). I will list the steps for IIS and using eDirectory as the trusted ROOT Certificate source.

Minting a Certificate on IIS
I am going to give a quick overview as full details are provided in the Novell Documentation.

1. Generate a Certificate request from the IIS administration page.
2. Going to Consoleone or iManager generate a certificate response
3. IIS Administration page provide certificate response.
4. Export the eDirectory ROOT CA (Security container, Self signed .DER file)
5. Import the ROOT CA into the local workstation
6. Import the certificate from the MiddleTier server into the workstation. (It is critical that the certificate be placed in the local Computer store. Do not let the certificate wizard place the certificate for you)

It's possible that the following registry change will be required if the ROOT CA is not trusted from like Thawte.

Middle Tier Authentication Troubleshooting

Learned some new tricks troubleshooting the Novell ZENworks MiddleTier authentication infrastructure.
I had forgotten about some logs in c:\windows\system32\log files which can be very useful.
The logs can at least show that connections are being made and what is being accessed via IIS. The logs are IIS generated and are not ZEN specific. XTIER does report some logs to this directory. You can control XTIER logging with these following keys.

(MT) ZENworks Middle Tier Server logging on Windows servers is enabled in the registry

Location: HKEY_LOCAL_MACHINE\SOFTWARE\Novell\XTier\Configuration\XTLOG
Name: Log-Error
Name: Log-Warning
Name: Log-Informational
Name: Log-Success
Type: DWORD Value
Data: 0 (Debug log file will NOT be written to)
Data: 1 (A new debug log file will be created each time with a unique name)

Output: %System Root%\System32\LogFiles\Xtier

http://support.novell.com/cgi-bin/search/searchtid.cgi?10093312.htm

I also found that packet traces are a big asset.

If you can authenticate to https://serverip/oneNet/nsadmin then the zenworks ZDM agent should be able to authenticate also.

Comments more than welcome as I left a lot out.