Windows Agent

The Signum Windows Agent provides an authenticated user access to signing certificates from the Signum Server and a connected HSM for use with signing tools that support working with Microsoft’s API for Key Storage Providers (KSP). Some examples would be Signtool, Jarsigner, Nuget Signer, VSIX signer, and more.

Installation Requirements

• Microsoft Windows 10 & 11 (64 bits)

• Windows Server 2019 and later (64 bits)

• Microsoft Visual C++ 14.29.30133 (The installer will prompt and download this automatically unless configured for a silent/quiet

• SQL Compact - The installer will prompt and download this automatically where possible unless configured not to.)

• .NET 4.7

• Administrator privileges during install

Installation

To install the Windows Agent, a.bat file setup with initial configuration parameters needs to be run targeting or in the same directory as the Signum Agent .msi installer. With the basic format being:

configuration_parameter_key="some_value" for example AuthMode="LocalUsers"

Below is an example .bat file that installs a particular version of the Signum Windows Agent .msi .

msiexec /i kf-agent-x64-3.72.2-2a4f19c5-MS-WO_Trust.msi ^
RTPRIMARY="signum.kfdemo1.us.app.az.keyfactorsaas.com" RTSECONDARY="signum.kfdemo1.us.app.az.keyfactorsaas.com" ^
CLIENTID="Scic1jVkgyDjfFlLugkA5hwMlD8vVqX8U4H+GXHOka4=" ^
AuthMode="LocalUsers" AGENTMODE="USER" ^
Language="en-US" ^
NO_FIREFOX="1" NO_EDGE="1" NO_CHROME="1" NO_IEXPLORER="1" ^
/l* log.txt ^  
echo Exit Code is %errorlevel%

Installation Parameters

Below are the available parameters to pass during installation. Note that some of these parameters are for other use cases with prior versions of Signum.

Most Frequently Used Parameters

Additional Parameters

Optional Additional Registry Settings

These properties cannot be passed at installation but can be set directly in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Evolium\Redtrust.

Windows Agent in USER mode

With the agent installed in USER mode i.e. with the user interface, there should be a “RTTrayApp” process running which is the Signum Windows Agent. Looking in the System tray, there should be an icon showing the Keyfactor Signum Agent.

Right clicking on the tray Icon will bring up several options.

About

Information about the Agent.

Settings

Note, this option is only present if the AuthMode is LocalUsers. The Settings section allows a user assigned to a LocalUsers Domain an option to update their credentials to the service.

Certificates

The Certificates part of the Agent only shows what certificates are available to the authenticated user based on the policies that have been defined. If multiple certificates are listed, making no selections in this window will make all of those certificates available and is the default behavior. Making a specific selection here will make only the selected certificates available on the machine.

Login

Selecting login on the Agent will bring up a login window where a LocalUser can enter their credentials. The option to remember user credentials is disabled by default, if enabled the user would automatically be logged in after restarting the machine. Logging out of the Agent would again prompt for the credentials. Reach out to Keyfactor about enabling this feature.

A user logging in to a Saml or Oauth Domain after clicking login would be taken to the IDP login page based on the DefaultDomain property configured as part of the Agent Parameter.

Logout

Logging out will terminate the Signum session and requires the user to re-authenticate to connect.

Windows Agent in SERVER Mode

Additional information about the Agent in Server mode.

• Certificates are stored in the machine certificate store instead of the user store.

• Credentials are configured using the rtsetup tool

• Only LocalUsers is supported as a Domain type for Signum

Using the Setup Tool

With the Agent msi installed (see Installation above), navigate to the installation folder (default location C:\Program Files\KeyFactor) and open the “rtsetup.exe” using command prompt or powershell. The tool will provide information about usage seen below. Running the rtsetup.exe tool with the parameters described will authenticate the LocalUser’s credentials, if the server information was set during the install there is no need to re-enter using the tool.

PS C:\Program Files\KeyFactor> .\rtsetup.exe
Tool to configure the Redtrust Server Agent.

Usage:

    rtsetup.exe -authMode=[LocalUsers|Ldap] -username=[username] -password=[password]

    or
    #Recommended if your password contains special characters:
    
    rtsetup.exe -authMode=[LocalUsers|Ldap] -username=[username]

    or

    rtsetup.exe -authMode=ActivationCode -code=[activation code]

Optional parameters:

    -primaryServer=[IP or hostname]

    -secondaryServer=[IP or hostname]

    -servicePort=[Port] (default value: 443)

Note: Both need to be set at once. Port is only updated when servers are set.

Login Example

PS C:\Users\Demo> & "C:\Program Files\KeyFactor\rtsetup.exe" -authMode=LocalUsers -username=test@domain
password:
RTService currently has status Running, stopping...
Starting RTService
RTService currently has status Running
RTService restarted.

Logout Example

PS C:\Users\Demo> & "C:\Program Files\KeyFactor\rtsetup.exe" logout

Editing Settings

Once the Agent has been installed many of the parameter settings can be changed by editing the registry at:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Evolium\Redtrust

After making changes, restart the System service that is running “RTService”. It may also be necessary to quiet and relaunch the Tray Application, this can be done by ending the “RTTrayApp” process in Task Manager and then relaunching by running the “RTTrayApp” found in C:\Program Files\KeyFactor.