HTTPS Gateway Server

PAM360 now allows you to configure a secure HTTPS gateway server to act as an intermediary proxy, facilitating the launch of privileged connections to resources that support URLs and are not accessible from PAM360 user devices. The connections are established using HTTPS-based web links, where the target URL can be an internal or external resource URL or an intranet link. You can also configure the HTTPS gateway server with a preferred port, KeyStore path, and KeyStore password to secure the connection to the target URL.

For additional information on the configurations and limitations of the HTTPS gateway server, please refer to the following sections.

1. Prerequisites
2. Roles and Permissions
3. Configuring HTTPS Gateway Server
4. Configuring Resources for HTTPS Gateway Connections

4.1 Configuring Auto Logon Helper for HTTPS Gateway Connections

4.2 Adding URL (HTTPS-Based) to the Resources

4.3 HTTPS Gateway Connections

4.4 Autofill Support for Websites and Applications

5. Functional Behavior in Multi-Server Environment
6. Limitations of HTTPS Gateway Server

1. Prerequisites
(Applicable from PAM360 Builds 7400 and Above)

If session recording is enabled for HTTPS gateway connections, users should have an active PAM360 extension session to initiate an HTTPS gateway session from the PAM360 web interface.

2. Roles and Permissions

By default, users with the administrator role can configure the HTTPS gateway server, and users with administrator and connection user roles can take HTTPS connections through the gateway server. Apart from the user roles described above, administrators can allow other PAM360 users to either configure the HTTPS gateway server and(or) to take HTTPS connections through the configured gateway by enabling the custom roles that follow:

1. HTTPS Gateway Server - Navigate to 'Admin >> Customization >> Roles >> Add Role >> PAM360 Settings', and enable the custom role 'HTTPS Gateway Server'. Enabling this custom role will allow the users to configure the HTTPS gateway server.
2. HTTPS Gateway Connection - Navigate to 'Admin >> Customization >> Roles >> Add Role >> Remote Access', and enable the 'HTTPS Gateway Connection'. Enabling this custom role will allow the users to launch HTTPS connections through the configured gateway server.

3. Configuring HTTPS Gateway Server

Post PAM360 installation, by default, the HTTPS gateway server will be configured and running in PAM360. To reconfigure the HTTPS gateway server as per your requirements mentioned below, navigate to 'Admin >> Configuration >> HTTPS Gateway Server' and follow the below steps:

1. Port - The HTTPS gateway server is configured with port 8285 by default. If you have port 8285 configured for another application/instance in your organization, update the port at your convenience as available.
2. KeyStore Path - By default, a KeyStore file named 'httpsCerts.keystore' will be available in the conf folder of the PAM360 installation directory to save all the HTTPS connection-related certificates. If you need:
   1. A unique KeyStore file for greater security reasons to save all your HTTPS connection-related certificates
   2. To make your HTTPS gateway connection secure
   You can create a new KeyStore file of type '.keystore' and enter the respective file path in this KeyStore Path field.
3. KeyStore Password: If you have created a new KeyStore file specific to this HTTPS gateway server, enter the respective KeyStore password that you have added while generating the new KeyStore file.
4. Click Update to save and start the HTTPS gateway server with the updated configuration.

5. Most HTTPS connections will work securely through the HTTPS gateway server. A few specific HTTPS connection URLs require their respective root certificate to connect securely through the HTTPS gateway server. For those URLs to work securely, their relevant root certificates have to be imported into the HTTPS gateway server's KeyStore. To import those certificates into the KeyStore, do the steps that follow:
   1. Navigate to 'Admin >> HTTPS Gateway Server >> Connection Certificates'.
   2. Browse the path of the respective URL's root certificate.
   3. Click Import to save the added certificate in the configured KeyStore file for further secure HTTPS connections.
   4. After importing each certificate, the HTTPS gateway server has to be restarted. To do so, you can use the toggle button in the Server Settings tab.

For the HTTPS gateway server to work efficiently in an organization with load balancer(s) configured for PAM360 web service, do the steps that follow:

1. Configure the remote host feature of PAM360.
2. Navigate to <PAM360 Installation Directory/conf> and open the file named system_properties.
3. Add a new system property https.gateway.server.loadbalancer.enabled=true.

Note:
Without the configured remote host feature and new system property, the server will receive the load balancer IP address for all the received requests instead of the actual one, which allows the IP address to reach the maximum HTTPS gateway threshold than the permitted value.

4. Configuring Resources for HTTPS Gateway Connections

Once done with the HTTPS gateway server configuration, you can proceed with auto-logon configuration and adding resource URLs from the Resources tab for further use of HTTPS gateway connections.

4.1 Configuring Auto Logon Helper for HTTPS Gateway Connections

By default, the HTTPS Gateway connection supports resources of types - Web Site Accounts, Windows, WindowsDomain, and Linux. If you want to use this HTTPS gateway for other resources that support web-based URLs, do the steps that follow:

1. Navigate to Admin >> Customization >> Auto Logon Helper.
2. Click the edit icon beside the HTTPS Gateway.
3. Select the resource types that support web-based URLs and move them to the right column.
4. Click Save to update the supported resource types.

4.2 Adding URL (HTTPS-Based) to the Resources

You can add URLs to the resources in PAM360 either while adding a new resource or by editing an existing resource using the resource edit option. Follow these steps to add a resource URL to existing resources in PAM360:

1. Navigate to the Resources tab.
2. Click the Edit Resource icon under the Resource Actions column beside the desired resource for which you wish to configure a URL.
3. In the pop-up that appears, enter a valid URL of type HTTPS web link in the Resource URL field.
4. Click Save to update.

You can share this resource with the users in your environment. Users with the HTTPS Gateway Connection privilege can launch an HTTPS gateway session to the configured URL from the Connections tab. The resource will have the HTTPS gateway connection as a connection type for website sessions.

4.3 HTTPS Gateway Connections

Users with the HTTPS Gateway Connection privilege (administrators, connection users, users with custom roles) can launch HTTPS gateway sessions to the configured URLs using any of the following methods:

1. From Connections >> Remote Connections >> HTTPS Gateway Connections.

2. By clicking the Open HTTPS Gateway Connections option under the Remote Connection column beside the configured resources on the Resources tab.

Once the session to the target URL is launched from the respective page, the web page will open in a new tab with the server URL and the custom port as provided. (E.g., https://server-name:8285/GS_36c1cc2f_/{uri})

4.4 Autofill Support for Websites and Applications
(Procedure Applicable from Build 7400 onwards)

PAM360 supports autofill for website sessions launched via an HTTPS gateway from the PAM360 web interface. The credentials must be stored within a resource in PAM360 to autofill them on a website or application. When you attempt to log into a website, click the PAM360 extension icon that appears beside the credentials field on the target site and choose an account. The corresponding username and password will be auto-filled, and you can manually hit enter to log into the website.

5. Functional Behavior in Multi-Server Environment

1. Disabling the HTTPS gateway server on a single server within the application scaling-configured environment will not stop the gateway server entirely. Further, to stop the HTTPS gateway server entirely, you need to restart the PAM360 application on all the remaining available servers.
2. For the HTTPS gateway connection functions to work seamlessly on multiple servers (primary and secondary):
   1. The KeyStore path must be provided in the form of a common UNC path.
   2. The port should be the same across multiple servers.
3. It is not possible to set up the HTTPS gateway server on the Read-Only server.

6. Limitations of HTTPS Gateway Server

1. We support adding only HTTPS-based web links as connections in PAM360.
2. If users navigate to sites different from the configured target URLs, their actions will no longer be routed through the HTTPS gateway server.
3. If a website uses external services for authentication processes, such as login, user credential validation, or single sign-on (SSO), these actions will not be routed through the HTTPS gateway server.
4. We do not support websites that contain absolute css and js source paths.
5. We do not support websites that allow requests only from trusted domains.
6. Connections to other ManageEngine product URLs such as Password Manager Pro, ServiceDesk Plus, etc., can lead to session tracking conflicts due to shared cookie names, potentially leading to unexpected logouts. Therefore, certain website functions may not work as expected.
7. Users can launch only one HTTPS gateway connection per browser session.
8. We do not support HTTPS gateway connections to websites that support web socket connections.