Safeguard Authentication Services stores Unix identity and login information in Active Directory. One Identity designed Safeguard Authentication Services to provide support for the following standard Active Directory schema extensions.
Table 21: Active Directory schema extensions
| Windows 2003 R2 Schema |
This schema extension is provided by Microsoft and adds support for the PosixAccount auxiliary class, used to store Unix attributes on user and group objects. |
| Services for Unix 2.0 |
Microsoft provides this schema extension with the Services for Unix 2.0 set of tools. It adds custom attributes to user and group objects, used to store Unix account information. |
| Services for Unix 3.0 |
Microsoft provides this schema extension with the Services for Unix 3.0 set of tools. It adds custom attributes to user and group objects, used to store Unix account information. |
It is possible to customize the schema setup to work with any schema configuration with Safeguard Authentication Services. No schema extensions are necessary with the new "schemaless" storage feature. When you configure Safeguard Authentication Services for the first time, Safeguard Authentication Services attempts to auto-detect the best schema configuration for your environment. The schema configuration is a global application setting that applies to all Safeguard Authentication Services management tools and Unix agents. You can change the detected settings at any time using Control Center.
If you do not have a schema that supports Unix data storage in Active Directory, you can configure Safeguard Authentication Services to use existing, unused attributes of users and groups to store Unix information in Active Directory.
To configure a custom schema mapping
- Open the Control Center and click Preferences then Schema Attributes on the left navigation pane.
- Click the Unix Attributes link in the upper right to display the Customize Schema Attributes dialog.
-
Type the LDAP display names of the attributes that you want to use for Unix data. All attributes must be string-type attributes except User ID Number, User Primary Group ID, and Group ID Number, which may be integers. If an attribute does not exist or is of the wrong type, the border will turn red indicating that the LDAP attribute is invalid.
NOTE: When customizing the schema mapping, ensure that the attributes used for User ID Number and Group ID Number are indexed and replicated to the global catalog.
- Click OK to validate and save the specified mappings in Active Directory.
Indexing certain attributes used by the Safeguard Authentication Services Unix agent can have a dramatic effect on the performance and scalability of your Unix and Active Directory integration project.
The Control Center, Preferences | Schema Attributes | Unix Attributes panel displays a warning if the Active Directory configuration is not optimized according to best practices.
One Identity recommends that you index the following attributes in Active Directory:
- User UID Number
- User Unix Name
- Group GID Number
- Group Unix Name
Note: LDAP display names vary depending on your Unix attribute mappings.
It is also a best practice to add all Unix identity attributes to the global catalog. This reduces the number of Active Directory lookups that need to be performed by Safeguard Authentication Services Unix agents.
Click the Optimize Schema link to run a script that updates these attributes as necessary. The Optimize Schema option is only available if you have not optimized the Unix schema attributes defined for use in Active Directory.
This operation requires administrative rights in Active Directory. If you do not have the necessary rights to optimize your schema, it generates a schema optimization script. You can send the script to an Active Directory administrator who has rights to make the necessary changes.
All schema optimizations are reversible and no schema extensions are applied in the process.
You can specify the user mobile number and user email address attributes to be used by the Starling push notifications.
Modifications to the Starling schema attributes configuration are global and apply to all Safeguard Authentication Services clients in the forest. For users configured to use Starling, this could cause user logins to fail.
To configure custom LDAP attributes for use with Starling push notifications
- From the Control Center, navigate to the Starling Attributes in one of the following two ways:
- Preferences | Starling Two-Factor Authentication and click the Starling Attributes link.
- Preferences | Schema Attributes
- Click the Unix Attributes link in the upper right to display the Customize Schema Attributes dialog.
-
Enter the LDAP display name for one or both of the Starling attributes used by the Starling push notifications:
- User Mobile Number
- User Email Address
- Click OK.
- Click Yes to confirm that you want to modify the Starling schema attributes configuration.
- Back on the Starling Two-Factor Authentication preference pane, the Starling attributes to be used are displayed.
