Configuring Trusted Agent with PowerShell

Create a self-signed certificate is required for signing the PowerShell script.

1.Open Windows PowerShell ISE, and then enter the following code in the Script Pane (you need to provide a name for the certificate).

#certificate  name should be provided
$CertificateName = "<name of certificate>"
#Create a Self-Signed SSL certificate
$Certificate = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Subject "CN=$CertificateName" -KeySpec Signature -Type CodeSigningCert
Write-host "Certificate Thumbprint:" $Certificate.Thumbprint

2.Run the code.

This creates a code signing certificate in your Personal\Certificates folder in Windows Certificate Manager.

3.Open the Windows Certificate Manager console (search "Manage user certificates" to locate this app), and locate the certificate file in the Personal\Certificares folder.

4.Copy the certificate file to the Trusted Root Certification Authorities\Certificates folder.

5.Copy the certificate thumbprint:

6.In Windows PowerShell ISE, run the following script, entering the thumbprint you copied in the previous step, and the file path to the PowerShell script (.ps1) file you created as mentioned in the note under "Prerequisites":

This verifies and signs the code signing certificate in the Trusted Root Certification Authorities\Certificates folder.

$thumbprint = "<enter the thumbprint you copied>"
$ScriptPath = "<enter the file path to the powershell script>"
#Get the Certificate from Cert Store$CodeSignCert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Thumbprint -eq $thumbprint}
#Sign the PS1 fileSet-AuthenticodeSignature -FilePath $ScriptPath -Certificate $CodeSignCert

1.In Windows Certificate Manager, select the certificate you copied to the Trusted Root Certification Authorities\Certificates folder.

2.Right-click and select All Tasks > Export.

The Export Wizard opens.

3.Click Next, select No, do not export the private key, and then click Next again.

4.Select DER encoded binary X.509 (.CER), and then click Next.

5.Enter a file name, click Browse and navigate to the folder you want to save in, and then click Save.

6.Click Next, check the settings are as expected, and then click Finish.

Once you have completed the prerequisites and have a validated self-signed certificate, add a new script only policy.

1.Log in to Neurons for ITSM as an Administrator.

2.Open the Configuration console and click Extend > Integration Tools > Trusted Agent Connection.

3.Click New trusted agent connection to open the Trusted Agent Connections form.

4.Enter the connection settings in the Configuration section of the Trusted Agent for Connections form.

5.Click Push Policy Settings.

You must configure and push a script policy before you can add a PowerShell execution.

1.Open the Configuration console and click Extend > Integration Tools > Trusted Agent Connection.

2.Click New PowerShell Execution to open the New PowerShell Execution form.

3.Enter the configuration settings in the Configuration section of the form.

4.Click Save.

Before starting this procedure, you need to complete the procedures as described in Prerequisites above to provide a self-signed certificate for the hybrid configuration.

1.From the Configuration console, click Extend > Integration Tools > Trusted Agent Connection.

2.Select the LDAP policy to open the Trusted Agent Connections form.

3.Click the Policy Type drop-down and select Hybrid.

4.Click Select a File, and then navigate to the folder where you saved the self-signed certificate, select the file, and then click Open.

5.Click Update Policy Settings.

Add the PowerShell script you want to execute.

1. Click Extend > Integration Tools > Trusted Agent Connection.

2.Click New PowerShell Execution to open the New PowerShell Execution form.

3.Enter the configuration settings in the Configuration section of the form.

4.Click Save.

This procedure must be completed prior to installing Trusted Agent as described in Install Trusted Agent. Also note that In the current version of Neurons for ITSM, you can add only one Trusted Agent connection.

1.In the Configuration console, select Extend > Integration Tools > Trusted Agent Connections.

The Trusted Agent Connections form is displayed. You configure a new connection or edit an existing connection using this form.

2.Click New trusted agent connection to open the Trusted Agent Connections form.

3.Enter the connection settings in the Configuration section of the Trusted Agent for Connections form.

4.Optional: Generate a SignalR API Key to enable external authentication:

5.Click Push Policy Settings.

While the LDAP settings for the Trusted Agent are being processed, the Status is displayed as Pending.

The settings push can take up to 20 minutes to complete. Click Refresh to check if the push has completed. When completed successfully, the Status is displayed as Success. A pop-up message is also displayed.

If the push fails, a Failed pop-up message is displayed.

If a failed push occurs, check your settings are correct, and then:

•Push the settings again.

•If the push still fails, refresh the page in the browser, and push the settings again.

When processing is complete, an enrollment key, comprising of the tenant ID and activation key, is displayed in the Enrollment Key field.

6.Under the Download URL for Installer (Windows) section, click Download to download the installer files.

When completed successfully, proceed to installing the Trusted Agent before continuing with the remaining procedures in this topic, refer to Install Trusted Agent

To add a PowerShell execution script, refer to Add a PowerShell Script.

•Connect Trusted Agent to the Directory Server and Test the Connection.

•Configure Root Nodes, Save and Synchronize Directory Information and Enable External Authentication.

•Check the LDAP Import Log, Verify Employee Import and External Authentication.

•Synchronizing Existing LDAP Settings for Trusted Agent