How to use Windows Authentication with TLS 1.2 in Security Expert

[AndreasP]

Issue

Security Expert operators need to use Windows Authentication while maintaining TLS 1.2 encrypted communications between Security Expert clients and the server.

Product Line

EcoStruxure Security Expert

Environment

• Security Expert Server
• SX-AD-OPR

Cause

Windows Authentication requires specific installation and configuration settings. When TLS 1.2 is also required, additional configuration changes must be made to both the Security Expert server and client configuration files.

Resolution

To use both Windows Authentication and TLS 1.2 in Security Expert:

1. Install Security Expert with Enable Windows Authentication on DataService/Client Communications selected during installation. If this option was not selected, Security Expert must be uninstalled and reinstalled with Windows Authentication enabled.
2. Verify that Windows Authentication logins are working correctly before enabling TLS 1.2.
3. Ensure the Security Expert Data Service machine is joined to the Windows domain and that clients are logged into the same domain.
4. Configure TLS 1.2 on the Security Expert server and all client workstations.
5. Update the SecurityExpertSV.exe.config file on the server and the SecurityExpert.exe.config file on all clients with the following security configuration:

<security mode="TransportWithMessageCredential">
  <transport clientCredentialType="none"
             protectionLevel="EncryptAndSign"
             sslProtocols="Tls12"/>
  <message clientCredentialType="Windows"/>
</security>

6. Save the configuration files and restart the Security Expert Data Service.
7. Configure the operator accounts for Windows Authentication and map them to the appropriate Active Directory user accounts.

When logging in, specify the Security Expert server machine name. Do not leave the Server field blank or use localhost.

Validate that operators can successfully log in using Windows Authentication while TLS 1.2 communication remains enabled. 

You can find more details in AN 288 Security Expert - Using Active Directory - Integration Guide.