Security authentication module

The security authentication module (opcauth.dll) can be used to authenticate the login for a tool. This is automatically used for all tools that have a user name but no password specified. When you launch a tool and specify only the user, HPOM does not ask for a password or check for one.

The security authentication module is installed by default on a node as part of the HP Operations agent package.

Deploy the security authentication module to domain controllers

If the tool uses domain accounts, then you must configure the domain controllers of the target nodes domain as managed nodes and deploy the HP Operations agent package to the domain controllers. The agent installation makes the security authentication module available on the domain controllers.

If there are several domain controllers in a domain, and depending on the availability of these domain controllers, the Windows authentication system will contact different domain controllers. For this reason the security authentication module must be available on all domain controllers of that domain. The security authentication module on the domain controllers authenticates the login for any machine when the tool launches. However, in this case, the account that the tool runs as does not have network credentials.

NOTE:
You cannot run tools using domain accounts without passwords if none of the domain controllers are available.

If the tool uses local accounts, no further action is necessary because the security authentication module is automatically deployed together with the HP Operations agent package, which is required to execute tools on the managed node.

Exclude the security authentication module from the agent installation

To exclude the security authentication module from the agent installation:

HTTPS agents
In the HTTPS agent installation defaults file, set the INSTALL_OPCAUTH option to false, for example:
```
[eaagt]
INSTALL_OPCAUTH = false
```
NOTE:
When you install an HTTPS agent manually, the HTTPS agent installation defaults file is not used and therefore the security authentication module is not registered.
DCE agents
Use the SetMgmtServer tool with the /auth /on option, for example:
```
SetMgmtServer /auth /on
```

Disable the security authentication module after the agent installation

To disable the security authentication module after the agent has been installed:

HTTPS agents
1. Manually remove the following registry entry:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\Auth130
2. Reboot the system after the key has been removed.
DCE agents
Manually remove the opcauth.dll file on the node where the tool user is authenticated:
%SYSTEMROOT%\opcauth.dll

If you remove this DLL, then a password will always be required to run a tool under the specified account. If you remove this DLL on all domain controllers, you cannot do a switch user without a password for domain accounts.

Related Topics: