Safeguard Authentication Services 5.0.2 - Administration Guide

Configure Active Directory

To utilize full Active Directory functionality, when you install Safeguard Authentication Services in your environment, One Identity recommends that you prepare Active Directory to store the configuration settings that it uses. Safeguard Authentication Services adds the Unix properties of Active Directory users and groups to Active Directory and allows you to map a Unix user to an Active Directory user. This is a one-time process that creates the Safeguard Authentication Services application configuration in your forest.

If you do not configure Active Directory for Safeguard Authentication Services, you can run your Safeguard Authentication Services client agent in Version 3 Compatibility Mode, which allows you to join a host to an Active Directory domain.

For more information, see Version 3 Compatibility Mode.

When running Safeguard Authentication Services client agent in Version 3 Compatibility Mode, you have the option in One Identity Management Console for Unix to set the schema configuration to use Windows 2003 R2. See Configure Windows 2003 R2 Schema in the management console online help for details. The Windows 2003 R2 schema option extends the schema to support the direct look up of Unix identities in Active Directory domain servers.

You can also create the Safeguard Authentication Services application configuration from the Unix command line, if you prefer. For more information, see Creating the Application Configuration from the Unix Command Line in the Safeguard Authentication Services Installation Guide.

Configuring Active Directory

The first time you install Safeguard Authentication Services in your environment, One Identity recommends that you perform this one-time Active Directory configuration step to utilize full Safeguard Authentication Services functionality.

To configure Active Directory for Safeguard Authentication Services

1. In the Safeguard Authentication Services Active Directory Configuration Wizard Welcome dialog, click Next.
2. In the Connect to Active Directory dialog:
   1. Provide Active Directory login credentials for the wizard to use for this task:
      • Select Use my current AD logon credentials if you are a user with permission to create a container in Active Directory.
      • Select Use different AD logon credentials to specify the Active Directory credentials of another user, enter the User name and Password.

      Note: The wizard does not save these credentials; it only uses them for this setup task.

   2. Indicate how you want to connect to Active Directory:

      Select whether to connect to an Active Directory Domain Controller or One Identity Active Roles Server.

      Note: If you have not installed the One Identity Active Roles Server MMC Console on your computer, the ActiveRoles Server option is not available.

   3. Optionally enter the domain or domain controller and click Next.
3. In the License Safeguard Authentication Services dialog, for Add a license, browse to select your license file and click Next.

   Refer to About licenses for more information about licensing requirements.

   Note: You can add additional licenses later from Safeguard Authentication Services Control Center | Preferences | Licensing.

4. In the Configure Settings in Active Directory dialog, accept the default location in which to store the configuration or browse to select the Active Directory location where you want to create the container and click Setup.

   Note: You must have rights to create and delete all child objects in the selected location. For more information on the structure and rights required see Windows permissions.

5. Once you have configured Active Directory for Safeguard Authentication Services a message like this displays: You've successfully completed the setup. Click Close.

   The Control Center opens. You are now ready to configure your Unix Agent Components.

   Refer to Configure Unix Agent Components in the Safeguard Authentication Services Installation Guide for more information.

About Active Directory configuration

The first time you install or upgrade the Safeguard Authentication ServicesWindows components in your environment, One Identity recommends that you configure Active Directory for Safeguard Authentication Services to utilize full functionality. This is a one-time Active Directory configuration step that creates the application configuration in your forest. Safeguard Authentication Services uses the information found in the application configuration to maintain consistency across the enterprise. Without the application configuration, store UNIX attributes in the RFC2307 standard attributes to achieve the most functionality.

The Safeguard Authentication Services application configuration stores the following information in Active Directory:

• Application Licenses
• Settings controlling default values and behavior for Unix-enabled users and groups
• Schema configuration

The Unix agents use the Active Directory configuration to validate license information and determine schema mappings. Windows management tools read this information to determine the schema mappings and the default values it uses when Unix-enabling new users and groups.

The Safeguard Authentication Services application configuration information is stored inside a container object with the specific naming of: cn={786E0064-A470-46B9-83FB-C7539C9FA27C}. The default location for this container is cn=Program Data,cn=Quest Software,cn=Authentication Services,dc=<your domain>. This location is configurable.

There can only be one Active Directory configuration per forest. If Safeguard Authentication Services finds multiple configurations, it uses the one created first as determined by reading the whenCreated attribute. The only time this would be a problem is if different groups were using different schema mappings for Unix attributes in Active Directory. In that case, standardize on one schema and use local override files to resolve conflicts. You can use the Set-QasUnixUser and Set-QasUnixGroup PowerShell commands to migrate Unix attributes from one schema configuration to another. Refer to the PowerShell help for more information.

The first time you run the Control Center, the Safeguard Authentication Services Active Directory Configuration Wizard walks you through the setup.

You can modify the settings using Safeguard Authentication ServicesControl Center| Preferences. To change Active Directory configuration settings, you must have rights to Create Child Object (container) and Write Attribute for cn, displayName, description, showInAdvancedViewOnly for the Active Directory configuration root container and all child objects.

In order for Unix clients to read the configuration, authenticated users must have rights to read cn, displayName, description, and whenCreated attributes for container objects in the application configuration. For most Active Directory configurations, this does not require any change.

The following table summarizes the required rights.

At any time you can completely remove the Safeguard Authentication Services application configuration using the Remove-QasConfiguration cmdlet. However, without the application configuration, Safeguard Authentication Services Active Directory-based management tools do not function.

Join the host to AD without the Safeguard Authentication Services application configuration

You can install the Safeguard Authentication Services Agent on a Unix system and join it to Active Directory without installing Safeguard Authentication Services on Windows and setting up the Safeguard Authentication Services Application Configuration.

The Safeguard Authentication Services 4.x client-side agent required detection of a directory-based Application Configuration data object within the Active Directory forest in order to join the host computer to the Active Directory Domain. Safeguard Authentication Services 4.0.2 removed this requirement for environments where directory-based User and/or Group identity information is not needed on the host Unix computer. These environments include full Mapped-User environments, GSSAPI based authentication-only environments, or configurations where the Safeguard Authentication Services agent will auto-generate posix attributes for Active Directory Users and Groups objects.