Server Mode (CLI Interface)

Server Mode, also referred to as Unattended Mode, is the command-line deployment of the Windows Agent, intended for automation, service accounts, and CI/CD scenarios with no interactive UI. It supports Local Users and Certificate authentication.

As of Signum 4.30.1, it is possible to choose to store certificates in the Personal certificate store under the current user or the local machine. The machine-wide option supports running under a service account with no interactive user.

Install the Server Agent

1. Download the Signum Windows Agent .msi from the Signum SaaS Portal.

2. In the same directory as the .msi, create a new plain text file with the extension .bat, for example signum-agent-config.bat.

3. Copy and paste the following, replacing the placeholder values to match the environment. See Installation Parameters. Ensure the file name of the agent matches the file name of the .msi that was downloaded.

msiexec /i kf-agent-x64-4.30.1-456b2f45-MS-WO_Trust.msi /qb ^
RTPRIMARY="Deployment URL" RTSECONDARY="Deployment URL" ^
CLIENTID="The ClientID from the SaaS Portal" ^
AuthMode="LocalUsers" AGENTMODE="SERVER" ^
Language="en-US" ^  
echo Exit Code is %errorlevel%

4. With both the .bat file and .msi in the same directory, run the .bat file by double clicking in Windows Explorer, and this will launch the Installer.

$env:PATH = "C:\Program Files\KeyFactor\;" + $env:PATH 

Use the Setup Tool

With the Agent msi installed, the CLI tool for authenticating users to the service can be found in C:\Program Files\KeyFactor\rtsetup.exe.

To run the setup tool in PowerShell, set to PATH for the current terminal:

$env:PATH = "C:\Program Files\KeyFactor\;" + $env:PATH

Authenticate with Local User

To authenticate with a local user:

rtsetup.exe -authMode=LocalUsers -username=YOUR_USERNAME -password=YOUR_PASSWORD

If you do not supply the -password parameter, there will be a prompt where it can be entered via STDIN:

password:
RTService currently has status Running, the service is stopping
Starting RTService
RTService currently has status Running
RTService restarted.
Warning! Applications that are currently open must be restarted in order to refresh certificates from Signum.

Authenticate With Certificate

Before you can authenticate with a certificate, you need to select the certificates store where Signum certificates will be stored.

Select the Certificate Store

Using the CLI tool, the -targetStore flag places the certificates from Signum in the selected store. You can specify either the User Certificate Store My or the Local Machine Certificate Store LocalMachine.

Example using the User Certificate Store:

rtsetup.exe -authMode=LocalUsers -username="test@domain" -targetStore=My

Example using the Local Machine Store:

rtsetup.exe -authMode=LocalUsers -"username=test@domain" -targetStore=LocalMachine

Enable Certificate Login

To enable certificate-based login, set the -authMode flag to Certificate and provide the required certificate thumbprint using the -thumbprint flag. When configured, the Windows agent in Server Mode authenticates using the specified certificate.

To find the required certificate thumbprint:

Get-ChildItem Cert:\CurrentUser\My

Provide the certificate thumbprint in the -thumbprint flag:

rtsetup.exe -authMode=Certificate -thumbprint=[certificate thumbprint] store=[My|LocalMachine]

For more information about logging in with certificates, see Use Certificate-based Authentication.

Logout

To log out, run the following command:

rtsetup.exe logout