Safeguard Authentication Services provides many features designed to help you consolidate and organize your identity infrastructure by bringing Unix identity information into Active Directory. This section introduces you to some of the identity management tools available to you.
Note: You can access your Unix hosts from the Control Center to perform the command line tasks described in this section.
Before you deploy Safeguard Authentication Services in your enterprise, One Identity recommends that you have a strategy for resolving the user identities on each Unix host against Active Directory. Safeguard Authentication Services supports the following methods:
- Enterprise Identity. Unix User and Group identities have their Posix identity information centrally managed within Active Directory. All entities have the same credential information across the enterprise.
- Mapped User. User identity information is local to each Unix Host, however Active Directory users are mapped to a local Unix account. This enables the user to authenticate using an Active Directory password, while maintaining his existing local identity.
- Posix Identity Auto-generation. User identity information is not stored centrally within Active Directory, however Active Directory users have Posix identity attributes automatically generated for them when interacting with Unix Hosts. Users authenticate with an Active Directory password.
- Personalities. Personalities allow an Active Directory user to have multiple identity objects stored in Active Directory, allowing for multiple roles, multiple NIS domain consolidation, and so forth.
The following table describes each strategy, potential use cases, specific considerations, and the location in the Safeguard Authentication Services Administration Guide for more information.
Table 12: User deployment scenarios
|
Enterprise Identity
See Managing Unix users with MMC for details. |
| Posix attributes for both Users and Groups are stored in Active Directory. Active Directory users authenticate using Active Directory credentials. |
Enterprise identity is already defined within the corporation. User/Group identity/Authentication extended to Unix. |
UID/GID uniqueness, sufficient AD schema (for example, RFC2307), account provisioning privileges. |
|
Mapped User
See Mapping local users to Active Directory users for details. |
| Posix attributes for users are stored locally (for example, /etc/passwd file), and Active Directory users are mapped to a local account. The Unix credential contains local identity information and Active Directory authentication. |
Unix machines have predefined user identity (via /etc/passwd) but desire authentication auditing controls. Mapped User is typically a transitory state where the end state is Enterprise Identity. |
Map-file management, new account provisioning, account migration details (file ownership alignment, and so on) |
|
Autogen
See Automatically generating Posix user identities for details. |
| Active Directory Users and Groups do not have posix attributes assigned to them. Safeguard Authentication Services generates posix attributes for users and groups for identity purposes, and Active Directory password is used for authentication. |
Enterprise Identity accounts are not provisioned in Active Directory, or Unix Admin does not have permissions to provision Enterprise Identity accounts, and the Unix hosts have joined the Active Directory domain. Admins want AD users to log in to Unix machines with AD credentials. |
Potential for disparate UID/GID for same user, account migration details (file ownership alignment, and so on) |
|
Personalities
See Unix Personality Management for details. |
| Active Directory Users have many personalities, typically defined by membership in many NIS domains. Each personality represents a separate NIS identity. A Unix host defines which personality to use when joined to Active Directory. Identity is supplied by personality data stored in the directory, and authentication utilizes Active Directory passwords. |
Many NIS domains have been collapsed into a single Active Directory domain. Unix information across domains are not unique. Also used as a transitory migration state to Enterprise Identity. |
Personality management, personality OU architecture, new account provisioning, account migration details, domain separation. |
For more information please refer to the vastool, vasd, and vas.conf man pages.
Safeguard Authentication Services is designed to support any Active Directory schema configuration. If your Active Directory schema has built-in support for Unix attributes (Windows 2003 R2 schema, SFU schema), Safeguard Authentication Services automatically uses one of these schema configurations. Using a native Active Directory schema for Unix attributes is the best practice. However, if your Active Directory schema does not natively support Unix account attributes and a schema extension is not possible, Safeguard Authentication Services uses "schemaless" functionality where Unix account information is stored in the altSecurityIdentities attribute.
The schema configuration applies to all Safeguard Authentication Services Unix agents and management tools.
If you do not have a schema that supports Unix data storage in Active Directory, you can configure Safeguard Authentication Services to use existing, unused attributes of users and groups to store Unix information in Active Directory.
To configure a custom schema mapping
- Open the Control Center and click Preferences then Schema Attributes on the left navigation pane.
- Click the Unix Attributes link in the upper right to display the Customize Schema Attributes dialog.
-
Type the LDAP display names of the attributes that you want to use for Unix data. All attributes must be string-type attributes except User ID Number, User Primary Group ID, and Group ID Number, which may be integers. If an attribute does not exist or is of the wrong type, the border will turn red indicating that the LDAP attribute is invalid.
NOTE: When customizing the schema mapping, ensure that the attributes used for User ID Number and Group ID Number are indexed and replicated to the global catalog.
For more information, see Active Directory Optimization in the Control Center online help.
- Click OK to validate and save the specified mappings in Active Directory.
