Safeguard Authentication Services 5.0.2 - Administration Guide

Supporting legacy LDAP applications

The Safeguard Authentication Services daemon, vasproxyd, provides a way for applications that use LDAP bind to authenticate users to Active Directory without using secure LDAP (LDAPS). Instead of sending LDAP traffic directly to Active Directory domain controllers, you can configure applications to send plain text LDAP traffic to vasproxyd by means of the loopback interface. vasproxyd proxies these requests to Active Directory using Kerberos as the security mechanism.

vasproxyd provides the following features:

• Secure LDAP authentication without SSL

  LDAP is designed as a data access protocol. The use of LDAP as an authentication mechanism introduces important security considerations—especially since most applications are only able to produce simple bind credentials. vasproxyd allows applications to use LDAP simple bind securely by generating the appropriate Kerberos authentication traffic. The use of Kerberos eliminates the need for public key cryptography while providing a high level of security.

• Authenticated anonymous searches

  Many applications require the use of anonymous LDAP searches. vasproxyd allows you to specify a service account that can authenticate and proxy anonymous queries so that applications that expect to be able to use anonymous LDAP can operate with Active Directory without requiring modification of Active Directory to allow anonymous queries.

• allow/deny authorization

  vasproxyd allows you to add an additional layer of application authorization based on Active Directory user name, Active Directory group membership, or Active Directory Organizational Unit (OU) containership. In other words, vasproxyd returns an LDAP BindResponse error on an (otherwise valid) LDAP bind attempt if the authenticating user is not authorized by means of settings in the users.allow/ users.deny files.

Installing the LDAP proxy

You can install the LDAP proxy package using the install.sh script.

To install the LDAP proxy

1. Insert the Safeguard Authentication Services distribution media and navigate to the root directory of the installation media.
2. Run the following command as root:

   ./install.sh vasproxy

3. Follow the prompts to complete the installation.

Configuring the LDAP proxy

The LDAP proxy must be configured for each application that will use it. LDAP proxy configuration is stored in the [vasproxyd] section of vas.conf. Each setting in the [vasproxyd] section specifies a proxy handler configured to listen on a specific local port for LDAP traffic.

To configure the LDAP proxy for an application

1. Open vas.conf and add a proxy handler for your legacy application. A proxy handler is a multi-valued setting. For example:

   [vasproxyd] 
   mydomain = { 
      listen-addrs = 127.0.0.1:10000 
      enable-anonymous = true 
      service-principal = mydomain.example.com@EXAMPLE.COM 
      allow-deny-name = mydomain 
      daemon-user = mydomain 
      connection-timeout = 120 
      largest-ldap-message = 2000000 
      } 

   This example configures a proxy handler for the mydomain application. The name is only used for identification in log files. It does not have to match the name of the application. This proxy handler listens on the localhost port 10000. For a complete list of all proxy handler options and their meanings, see the vasproxyd man page. After you set up the proxy, you may need to adjust the legacy application configuration to use the proxy address and port.

2. After you have configured the LDAP proxy handler, restart the service. The method for restarting the service differs by platform:

   Linux and Oracle Solaris:

   /etc/init.d/vasproxyd restart

   HPUX:

   /sbin/init.d/vasproxyd restart

   AIX:

   stopsrc -s vasproxyd startsrc -s vasproxyd

IPv6

Safeguard Authentication Services supports IPv6 and is designed to run equally in IPv4-only, dual-stack (IPv4 and IPv6), and IPv6-only environments. The following describes the IPv6 features and considerations when running Safeguard Authentication Services in an IPv6-enabled environment.

Safeguard Authentication Services uses IPv6 automatically when DNS contains IPv6 address records (AAAA records). These are most commonly published for servers running Windows 2008 or later on an IPv6-enabled network. Similarly, hosts may use IPv4 whenever IPv4 address records (A records) appear in DNS.

To ensure reliability, when connecting to a TCP service that is available over both IPv4 and IPv6, Safeguard Authentication Services uses an adaptive algorithm used by popular web browsers and published in RFC 6555. If an initial connection attempt does not complete in a short amount of time, it makes a parallel connection attempt using a subsequent address, if available. This happens in a fraction of a second and is usually invisible to the user, even if one protocol is perennially unavailable.

For UDP connections, the service sends packets in parallel using both protocols (when available). This provides the best performance and reliability, with a negligible effect on network traffic.

IPv6 connectivity in Safeguard Authentication Services depends on the operating system. To determine IPv6 availability on a host-by-host basis, run vastool info ipv6 on each client.

The system resolver's address selection policies directly influence the addresses chosen by Safeguard Authentication Services when more than one address is available. Depending on the operating system, you may be able to configure the polices. For example, configure /etc/gai.conf on GNU libc-based operating systems. The standard address selection policies (RFC 3484) and fallback connection algorithm should obviate the need to alter the default address selection policy.