Shared environments prerequisites

Technical checklist for shared environments. This page provides an overview of known prerequisites that are required in order to be able to work with the Trust1Connector.

Supported environments

Also take into account the general prerequisites

All supported operating systems require an administrator to install the proxy software. It is advised to install the proxy on a system administrator account and let the users install their own trust1connector API afterwards.

In shared environments it is required to install the Trust1Connector-Proxy before any of the Trust1Connector-API installations have been done as the reserved web-server ports will interfere with eachother

Windows

Support from Windows 7 and later.

MacOS

Support from macOS 10.9(OS-X Mavericks) and later.

Virtual deskop (Citrix, TeamServer, ...)

Supported. Each instance of the virtual desktop has to install the Trust1Connector API

Virtual applications (Citrix XenApp)

Supported

When using a virtual application, the Trust1Connector Proxy should be installed on the Citrix server. In addition the Windows SmartCard daemon and the smart card redirection should be enabled. Configuration

There is some configuration required to allow access to the smartcard reader from the virtual application.

More info about this can be found at https://helgeklein.com/blog/2013/04/getting-smart-card-readers-to-work-with-citrix-xendesktop/.

Virtual Application

Create a belfiusweb.bat file (or any other name to your preference) on the server and add the following lines:

start "Trust1Connector" /B "C:\Program Files\T1T\Trust1Connector\trust1connector_agent.vbs"
start "Chrome" /B "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
@cls
@exit

You can also specify another browser, just change the executable path accordingly.

This bat file should be used as the executable for the virtual application. Give the virtual application a descriptive name and logo (can be the Chrome or Belfius logo for example).

In order to properly close all resources when the users closes the Chrome browser, additional configuration must be done in the registry. Follow the guide at https://support.citrix.com/article/CTX891671. The value of the registry key should be:

conhost.exe,gcl-service.exe,wscript.exe

If the registry already exists, just add these values prefixed with a comma (no spaces).

Silent installation

The Windows installation can be silently installed using the Windows command prompt

msiexec /i Trust1Connector/x64.msi /qn

To uninstall the Trust1Connector through the Windows command prompt

msiexec /x Trust1Connector-x64.msi /qn

Supported Browsers

The Trust1Connector is designed to be browser independent. However there are some browsers which require some extra information in order to be able to use the Trust1Connector.

Additional configuration

Internet Explorer 11 (Windows 7)

If there is an error stating that TLS1.0 should be enabled (the error will be visible when browsing to info page), configure the Windows 7 machine to allow a higher security protocol. Follow the steps described at https://manage.accuwebhosting.com/knowledgebase/3008/How-do-I-enable-TLS-12-on-Windows-7.html to configure this. If changing the settings for TLS 1.2 only do not resolve the issue, perform the same steps for TLS 1.1.

Mozilla Firefox

Supported

Microsoft Edge (pre chromium version)

In some cases we have observed Microsoft Edge blocking connections to localhost, making it unable to communicate with the installed Trust1Connector instance.

Microsoft runs as a modern Windows app, which means it has network isolation enabled by default for security reasons. However, by default an exception is made for loopback/localhost addresses. This means that on most Edge browsers, communication with the GCL instance will not be a problem.

In specific cases though (exact reasons as yet unknown), it seems that this exception is ignored or not applied correctly, blocking communication with localhost.

If you find yourself in this situation, try the following options to resolve:

A. Enable the loopback option

Open your browser and type about:flags in the address bar. This will open a hidden browser settings menu. Locate the Developer settings and make sure the option to Allow localhost loopback is checked.

The number of options under the Developer settings heading can vary between the different versions of Microsoft Edge, but the localhost loopback option should always be there.

Once the option is enabled, fully close down Microsoft Edge and restart the browser.

If this option was already enabled, try disabling it, restarting the browser and then re-enabling.

Check if this has resolved the issue. If not, proceed to option B.

B. Use the command prompt

Open a command prompt as administrator(!) and execute the following command:

CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe

Windows will respond with the message OK.

Restart Microsoft Edge and check if the issue is resolved.

Additional info can be found here:

https://blogs.msdn.microsoft.com/msgulfcommunity/2015/07/01/how-to-debug-localhost-on-microsoft-edge/https://www.ibm.com/support/knowledgecenter/en/SSPH29_9.0.3/com.ibm.help.common.infocenter.aps/r_LoopbackForEdge.html

Antivirus

The Trust1Connector and some installation files are digitally signed. On some machines however the Trust1Connector is flagged/blocked by an antivirus. Disabling the antivirus temporary can allow the user to install the Trust1Connector for some antivirus tools. Below we provide procedures for some antivirus software to be able to install the Trust1Connector.

Antivirus	Whitelisted
Symantec	✅
ESET
Avast
McAfee
AVG
Norton
Bitdefender
Kaspersky
Fortinet
Trend Micro
Comodo Group

If your antivirus is not whitelisted, or if it does not appear in this list, please contact us so that we can add it.

ESET

If the user receives an notification that a script from the Trust1Connector is blocked

The procedure at https://support.eset.com/kb2908/?locale=en_US&viewlocale=en_US can be used to solve the issue.

Permissions

The Trust1Connector requires read and write access on some locations. The parent folders are automatically created if the permissions are correct.

Windows

Trust1Connector API

Location	Require permission
%LOCALAPPDATA%\Trust1Connector	read + write

Trust1Connector Proxy

Location	Required permission
%PROGRAMFILES%\Trust1Connector-Proxy	read + write

macOS

Location	Required permission
~/Library/Application Support/Trust1Connector	read + write

Persistence

On shared environments such as Citrix virtual desktop it is advised that some user folders are persisted after logout/reboot of the user. If the application will be kept instead of reinstalling each time the user logs in

Windows

Trust1Connector API

Location	Require permission
%LOCALAPPDATA%\Trust1Connector	read + write

Trust1Connector Proxy

Location	Required permission
%PROGRAMFILES%\Trust1Connector-Proxy	read + write

macOS

Location	Required permission
~/Library/Application Support/Trust1Team/Trust1Connector	read + write

Log files

In case of errors, it can be advised to provide logfiles to the support team. The location of these files depend on the OS.

Windows

Trust1Connector API

Location	Description
%LOCALAPPDATA%\Trust1Connector\logs	Log files of the API application together with the Sandbox

Trust1Connector Proxy

Location	Description
%PROGRAMFILES%\Trust1Connector-Proxy\logs	Proxy log files

macOS

Location	Description
~/Library/Application Support//Trust1TeamTrust1Connector/resources/logs	Sandbox logs
~/Library/Application Support//Trust1TeamTrust1Connector/resources/t1c-api/logs	Webserver logs

Installation not detected

If the application doesn't detect the Trust1Connector or keeps prompting to download the installation files, a couple of steps can be performed to check if the installation was successful.

Check the installation

On Windows, open the configuration screen and list the installed programs. The Trust1Connector should be listed with it's version.

In the browser

Open a browser and navigate to https://t1c.t1t.io:51983/info. The response should be similar to

{
    "t1CInfoOS": {
        "architecture": "64",
        "os": "Mac OS X",
        "version": "10.16"
    },
    "t1CInfoJava": {
        "runtime": "11.0.9.1+1",
        "spec": "11",
        "java": "11.0.9.1"
    },
    "t1CInfoUser": {
        "timezone": "Europe/Brussels",
        "country": "GB",
        "language": "en",
        "home": "Not Applicable",
        "tempDir": "Not Applicable"
    },
    "t1CInfoAPI": {
        "service": {
            "url": "https://t1c.t1t.io",
            "apiPort": "51783",
            "gRpcPort": "49851",
            "deviceType": "DEVICE",
            "distributionServiceUrl": "https://ds.t1t.io"
        },
        "activated": false,
        "status": "INACTIVE",
        "sharedEnvironment": false,
        "uid": "no ID available",
        "modules": [
            "beid",
            "luxtrust",
            "luxeid",
            "diplad",
            "oberthur_73",
            "idemia_cosmo_82",
            "aventra_myid_4",
            "pkcs11",
            "pkcs11_objects",
            "camerfirma",
            "eherkenning",
            "chambersign",
            "certigna",
            "airbus",
            "jcop3",
            "remoteloading",
            "emv",
            "crelan",
            "fileexchange",
            "rawprint",
            "wacom-stu"
        ],
        "version": "3.3.1",
        "logLevel": "WARN"
    }
}

Check the logfile

The logfile can be used for diagnostics, these are located at Log files.

Check the service

Windows

Trust1Connector API

Open the task manager and verify in the details tab that the trust1connector-sandbox.exe and trust1connector-api.exe are running

Trust1Connector Proxy

Open the Windows services (Ctrl+R -> services.msc) and verify if the t1c-proxy service is running. Also make sure the trust1connector-proxy is running in the taskmanager in the detail window

macOS

Open the terminal and enter

launchctl list | grep com.t1t

The output should be similar to

24639	0	com.t1t.t1c.api
24637	0	com.t1t.t1c.grpc

Support

Diagnostics

In case the above steps and checks do not resolve an issue, please contact you support channel with diagnostics of your system.

Open a browser of you preference and navigate to https://t1c.t1t.io:51983/info. Copy this data into a text file and include it together with the logfiles

Citrix diagnostics

For Citrix environments there are some diagnostic tools available provided by Citrix. Open https://support.citrix.com/article/CTX135075 and install the Citrix Diagnostic Toolkit (CDT). The Citrix Data Packager tool will create a .zip file with all kinds of information about the system and active processes. This .zip file can be send to the support team together with the logfiles and info endpoint data.