REPLAY 4: Agent-Core Authentication

When configuring Replay, a single credential shared between the Replay Core and Replay Agent is recommended. If Replay Agent is not in the same domain or workgroup as the Replay Core, unique credentials can be specified for each Replay Agent using the authentication button available within the “Protect” wizard.

Replay software requires authentication for the following components:

• Replay Admin Console when connecting to a remote Replay Core for management
• Replay Core communicating with Replay Agents
• Replay Agents communicating with Replay Cores
• Replication between Cores
• Replay Agent and Replay Core services

During authentication all credentials are validated to ensure the user is in the local “Administrators” group or in the “ReplayAdministrators” group (domain or local).  If the credential is not in either of the groups, authentication will fail. If you use the ReplayAdministrators group, these credentials will also ensure that the Administrator level credentials are not required for authorization purposes.  NOTE:  Replay Agent and Replay Core services must have local “Administrators” privilege.

This feature allows the security administrator to set up separate credentials for different Replay Agents.  For single domain or multi-domain implementation with trusts, the default service credentials are sufficient. For environments with different domains, Replay Agent and Replay Core credentials must be specified .

Example 1

There are machines in the network located on multiple domains or workgroups. The security administrator may want to create one account on the Replay Core in the ReplayAdministrators group and one account each on the Agent machines. To configure authentication using the ReplayAdministrators group:

WORKGROUPA will have WORKGROUPA\ragent1 for agent credentials and COREDOMAIN\radmin for core credentials.

DOMAINB will have DOMAINB\ragent2 for agent credentials and COREDOMAIN\radmin for core credentials.

DOMAINC will have DOMAINC\ragent3 for agent credentials and COREDOMAIN\radmin for core credentials.

Example 2

There are servers at multiple customer sites. The security administrator requires a separate credential for each customer.  The administrator will need to create three accounts on the Replay Core in the ReplayAdministrators group and one account each on the Agent machines. To configure authentication using the ReplayAdministrators group:

CUSTOMER A will have CUSTOMER-A\ragent for agent credentials and MSPDOMAIN\CUSTOMER-A for core credentials. Customer B will have CUSTOMER-B\ragent for agent credentials and MSPDOMAIN\CUSTOMER-B for core credentials. Customer C will have CUSTOMER-C\ragent for agent credentials and MSPDOMAIN\CUSTOMER-C for core credentials.

In both of these examples, none of these credentials have to be an administrator. The credential, however, must be members of the ReplayAdministrators group.

When authenticating in “WORKGROUP” scenario, edit the C:\Windows\system32\drivers\etc\HOSTS file on both the Replay Core and Replay Agent machines and add the hostname of the core along with its IP address.