Quick A-Z Deployment Overview

The following sections illustrate the end-to-end deployment of the push-based solution with HID Approve for Windows 10 and the ActivID Self-Service Portal (for registration and testing).

Configure the Azure Push Gateway

  1. Log on to the ActivID Management Console and select the Configuration tab.

  2. Under Environment, select OOB Delivery Gateway.

  1. Add an Azure Windows gateway with the following parameters:

    • Azure connection string
    • Hub Path
    • Supported OS List (set to WINDOWS)

  1. Click Save.

  2. Under Authentication, select Authentication Policies.

  1. Add the new gateway to the push-based authentication policies:

    • Mobile push-based Logon Validation (AT_PASA)
    • Mobile push-based Action Validation (AT_TDS)

  1. Click Save.

Configure the Push Device Type

  1. Log on to the ActivID Management Console and select the Configuration tab.

  1. Under Authentication, select Device Types and then Mobile push based Validation (DT_TDSV4) to edit the settings.

  1. Set URL for operation validation to the server public URL (for example, https://<server>:<port>).

  2. Set Server TLS certificate to the Base 64 value of the ActivID AS server SSL certificate.

    3. Note:  To get the Base 64 value, retrieve the SSL certificate by connecting with a browser to the server public URL with Firefox.

    Save the certificate as PEM BASE 64 encoded (for example, as myserverSSLcertificate.crt). Then edit this file with Notepad and copy the content, including the -----BEGIN CERTIFICATE----- & -----ENDCERTIFICATE----- mentions.

  1. Click Save.

Important: If a reverse proxy is used to access the ActivID AS, make sure that you have configured the proxy server URL and TLS certificate values (NOT the ActivID AS internal URL and SSL certificate values).

Register a User

  1. Log on to the ActivID Management Console as ftadmin.

  1. Select the Helpdesk tab and then click Register User.

  2. Select your Admin Group, enter the User Attributes and then Create a Password for the user (based on Customer Static password).

  3. Complete the registration.

Install HID Approve

  1. Go to the Microsoft Windows Store on your Windows 10 machine.

  1. Search for the HID Approve app and install it.

    Note: Alternatively, your organization can provide a deep link that checks if the application is already installed on the device. If it is not, you are directed to the application on the relevant store, prompting them to install it.

  2. Configure your browser for  the SSL connection - make sure that the Root CA of the ActivID AS server SSL certificate is imported into your browser’s Trusted Root Certification Authorities Store.

    3.   

    Configure a CA-signed server SSL certificate for the application server and you can then import the associated Root CA.

Activate the Service

  1. Log on to the ActivID Self-Service Portal using the username and password for the registered user.

  1. Click Activate my device.

  2. Under Software Tokens and Apps, select On my PC.

  3. Click HID Approve for Windows 10 to activate the application on your PC using a URL (link) activation.

  1. Launch HID Approve on your PC.

    2. Then the service will be activated automatically.

  1. Click OK to add the service.

Test Push for Your Service

Note: By default, the AT_PASA authentication policy is used to test push-based notifications. To define a different policy, set the value in the token.push.verify.authpolicy property of the ActivID Self-Service Portal.

Once the service is successfully registered on your device, you can test it.

  1. Log on to the ActivID Self-Service Portal with your username and password and select View and Update my devices.

  1. Select your Push device from the list and click Next.

  1. Select Push Notification then click Next.

  1. Click Test.

    2. You will receive a notification on your device that you can approve or decline.

  1. Approve the test transaction by push using HID Approve.