Hosted Services

Sassafras Software offers cloud hosting services for our AllSight and LabSight product tiers.

There are a few unique items of note when using our hosted service as compared to using an on prem server. The vast majority of the functionality is the same.

New Customers

You will receive an email with the URL of your hosted server. This will be used for all connections including in browser, from our client, and when using the KeyConfigure admin tool.

We will also provide the name and password of the initial administrator account in your instance. This account will be used to set up other accounts and/or enable external authentication for other privileged users.

Initial Setup

Upon login, there are a couple initial configuration tasks that are important to complete.

Computer ID Types

Go to Settings - Computer IDs. This dictates how computers will uniquely identify in the database. Most sites choose Serial as the primary ID because it allows for unique asset tracking through an entire lifecycle regardless of rename, reimage, etc. A good backup to this is Combined Serial (this uses any one of 3 serials that may be discoverable), followed by Name as a tertiary backup. Hardware Digest is always the very last fallback which can not be removed. The first item of Thin Client Name is for RDS style connections only and also can not be removed. QND is a default that can be removed as it is only impactful for our Japanese client base. For those with more complex virtual infrastructures additional options exist and should be discussed with Sassafras Support.

Mail

Go to Settings - Mail. It is highly recommended you set the options to send status and warning messages and daily status messages to keep the primary admin(s) informed of the server health. Only one email recipient can be specified, so it is recommended this be a list address that goes to the primary admins of the service.

Name

Go to Settings - General. You can set the Title that appears in the upper left to whatever name you wish for your organization.

Audits

Go to Settings - Audits. The top option sets the audit refresh cycle for your workstations. In most cases Daily is a good choice to keep your inventory as up to date as possible. Additionally, it is recommended that other than the Throttle setting, all options on this page be enabled.

Deployment

With the initial setup complete, it's time to deploy some clients. Install the KeyAccess client manually on some workstations and point them to the https address for your server. You MUST put https:// on the front of the server address or the clients will try to talk over UDP, which is for on prem servers and not available in the cloud. As soon as a client launches, you should see it appear in the Computers page of your server instance. Initially the Hardware inventory will appear, followed by the full Software Audit. The latter can take time depending on the size of the local drives to be scanned. For full scale deployment see our Client Deployment documentation.

Organizing computers into Divisions will be an important step to facilitate Reports and Maps. This can be automated using a couple methods. You can use Active Directory via our LDAP module to automatically have computers move into divisions based on AD OU structure. You will need to ensure your AD can accept communication from our Sassafras cloud server. Alternately you can build Rules that will organize computers based on some criteria like a naming convention. These options should be discussed further with Sassafras during your deployment so we can assist with the integration and configuration.

Management

While many functions can be accomplished using the Web UI, there are advanced features that require our KeyConfigure desktop application for administration. This is the "Admin" component in the installer downloads. As a cloud customer you'll only be concerned with the Client and Admin installers since we maintain the Server. When using KeyConfigure to connect to your server you must again use the https address to make the connection.

Authentication

It is likely you will want to leverage some manner of external authentication for privileged users. This may be Active Directory, Azure, or another supported method. The configuration of this can be complex as we support fully federated environments with granular access and privilege needs for a detailed permission structure. Sassafras technical staff are happy to assist with this configuration at all levels, and this should be completed as part of your startup sessions.


For a more complete walkthough and initial tour, please see our Full Walkthrough. Note that this guide is for on prem customers, so simply skip past any server installation steps that are not relevant.


Migrating

If you are migrating from on prem to hosting, here are the basic steps:

  • Shut down the on site KeyServer service - copying live data causes anomalies.
  • Copy the KeyServer Data folder from the server install directory, leaving out the Backups and Log Files folders, and zip it for upload. After copying you can start the KeyServer service again.
  • Upload the zip to us (info on this will be provided by email)
  • You will be notified when the server is ready. You can then connect to it and verify everything looks in order before repointing clients to it.
  • Considerations

  • If you use embedding, your links will need to be updated.
  • If you use integrations like the Jamf, InTune, or Papercut imports, relevant firewall rules will need to be updated to allow the new server access.
  • There will a data gap during the transition, between when you capture your data for migration, and when the clients are repointed.
  • You can use your old server for several weeks to monitor for non-migrated clients, and potentially use the built in auto update feature to make repointing clients (that are not on the latest version) easier.
  • KeyAccess 7.7.0.4 is required for https communication. Any computer running an older version of the client will not be able to connect to the cloud server.
  • AD authentication is not available in the cloud, but you can use the LDAP module to talk to AD if you allow the relevant connections in your firewall.
  • If you test clients before mass change over and use Bentley or other strict managed policies, be sure to take into account any possible overages you are opening up with two servers with all seats available.
  • Connecting

    You will receive an email confirming the DNS name of your hosted server, which will have been previously agreed on when arranging for the service (something like myorg.sassafrascloud.com). This same address with full https:// syntax will be used for ALL connections. That is:

  • Web Browser
  • KeyAccess (client) configuration
  • KeyConfigure (admin console) management
  • As an existing customer moving to the cloud hosting, you simply repoint all your clients to the new https address, and use that same address for connecting with KeyConfigure. Any local accounts including the Administrator password will be unchanged from the on prem implementation, so you can use those account for initial access.

    Differences

    There are a few items of note with hosted service:

  • Database Export is disabled. You can not export to other systems like MSSQL.
  • Mail server settings are not present because we use our hosted system to send email.
  • Additional References and Info

  • SaaS Subscription Agreement
  • Information Security Policy
  • Sassafras Cloud Security
  • Secure Coding Practices
  • Network Diagrams reference