Signing Web Login Tokens with a Stored Certificate

When you enable web login, GENESIS Security acts as an OpenID Connect (OIDC) provider and signs the tokens it issues. By default, Security signs them with an auto-generated temporary key. Security generates a new temporary key every time the FrameWorX Server restarts, so every client that signed in before the restart must sign in again. Servers behind a load balancer cannot share a temporary key. For a production system, sign the tokens with a certificate that you install on the server.

Two services read the certificate's private key, so the accounts they run under need Read permission on that key. The GENESIS FrameWorX Server service signs the tokens, and it runs as Network Service by default. The GENESIS Workbench Point Manager service checks the certificate when you apply the settings, and it runs as NT SERVICE\IcoWorkbenchService by default.

To sign web login tokens with a certificate from the local machine certificate store:

  1. Install the certificate, including its private key, in the Personal store of the local computer.

  2. Give both service accounts permission to read the private key:

    1. On the server, open Manage computer certificates (certlm.msc).

    2. Go to Personal > Certificates, right-click the certificate, and then select All Tasks > Manage Private Keys.

    3. Select Add, enter Network Service, and then select OK.

    4. With Network Service selected, select the Allow check box for Read.

    5. Repeat the previous two steps for NT SERVICE\IcoWorkbenchService, and then select OK.

    If your system runs these services under different accounts, give those accounts the permission instead. The Log On As column in Services shows the account each service runs under.

  3. Open Workbench and in Project Explorer, expand your project > Security, and then double-click Global Settings.

  4. On the Web Login tab, in the OIDC Provider / OAuth Authorization Server Settings section, complete the following settings:

    Setting Name

    Value

    Signing credentials type

    Stored certificate

    Select certificate by

    One of the Local machine certificate store options, to find the certificate by its full Subject Distinguished Name, by any element of its Subject Distinguished Name, or by its thumbprint

    Certificate identifier

    The subject or thumbprint of the certificate. You can also browse the local machine certificate store and select the certificate.

  5. Select Apply.

    If Workbench reports that it cannot use the certificate because the keyset does not exist, one of the service accounts cannot read the private key. Repeat step 2, and then select Apply again.