Safeguard Authentication Services supports IPv6 and is designed to run equally in IPv4-only, dual-stack (IPv4 and IPv6), and IPv6-only environments. The following describes the IPv6 features and considerations when running Safeguard Authentication Services in an IPv6-enabled environment.
Note: Safeguard Authentication Services uses IPv6 when the operating system's DNS resolver correctly supports mapping of IPv4 addresses to IPv6 addresses. If a problem with address mapping is detected, Safeguard Authentication Services operates in IPv4-only mode, even if an IPv6 address is assigned and other applications use IPv6.
Safeguard Authentication Services uses IPv6 automatically when DNS contains IPv6 address records (AAAA records). These are most commonly published for servers running Windows 2008 or later on an IPv6-enabled network. Similarly, hosts may use IPv4 whenever IPv4 address records (A records) appear in DNS.
To ensure reliability, when connecting to a TCP service that is available over both IPv4 and IPv6, Safeguard Authentication Services uses an adaptive algorithm used by popular web browsers and published in RFC 6555. If an initial connection attempt does not complete in a short amount of time, it makes a parallel connection attempt using a subsequent address, if available. This happens in a fraction of a second and is usually invisible to the user, even if one protocol is perennially unavailable.
For UDP connections, the service sends packets in parallel using both protocols (when available). This provides the best performance and reliability, with a negligible effect on network traffic.
IPv6 connectivity in Safeguard Authentication Services depends on the operating system. To determine IPv6 availability on a host-by-host basis, run vastool info ipv6 on each client.
Note: You may need to update or patch your operating system for Safeguard Authentication Services to use IPv6.
The system resolver's address selection policies directly influence the addresses chosen by Safeguard Authentication Services when more than one address is available. Depending on the operating system, you may be able to configure the polices. For example, configure /etc/gai.conf on GNU libc-based operating systems. The standard address selection policies (RFC 3484) and fallback connection algorithm should obviate the need to alter the default address selection policy.
Note: Active Directory servers must be running Windows 2008 or later for IPv6 communication.
Safeguard Authentication Services provides many features designed to help you consolidate and organize your identity infrastructure by bringing Unix identity information into Active Directory. This section introduces you to some of the identity management tools available to you.
Note: You can access your Unix hosts from the Control Center to perform the command line tasks described in this section.
Before you deploy Safeguard Authentication Services in your enterprise, One Identity recommends that you have a strategy for resolving the user identities on each Unix host against Active Directory. Safeguard Authentication Services supports the following methods:
- Enterprise Identity. Unix User and Group identities have their Posix identity information centrally managed within Active Directory. All entities have the same credential information across the enterprise.
- Mapped User. User identity information is local to each Unix Host, however Active Directory users are mapped to a local Unix account. This enables the user to authenticate using an Active Directory password, while maintaining his existing local identity.
- Posix Identity Auto-generation. User identity information is not stored centrally within Active Directory, however Active Directory users have Posix identity attributes automatically generated for them when interacting with Unix Hosts. Users authenticate with an Active Directory password.
- Personalities. Personalities allow an Active Directory user to have multiple identity objects stored in Active Directory, allowing for multiple roles, multiple NIS domain consolidation, and so forth.
The following table describes each strategy, potential use cases, specific considerations, and the location in the Safeguard Authentication Services Administration Guide for more information.
Table 11: User deployment scenarios
|
Enterprise Identity
See Managing Unix users with MMC for details. |
| Posix attributes for both Users and Groups are stored in Active Directory. Active Directory users authenticate using Active Directory credentials. |
Enterprise identity is already defined within the corporation. User/Group identity/Authentication extended to Unix. |
UID/GID uniqueness, sufficient AD schema (for example, RFC2307), account provisioning privileges. |
|
Mapped User
See Mapping local users to Active Directory users for details. |
| Posix attributes for users are stored locally (for example, /etc/passwd file), and Active Directory users are mapped to a local account. The Unix credential contains local identity information and Active Directory authentication. |
Unix machines have predefined user identity (via /etc/passwd) but desire authentication auditing controls. Mapped User is typically a transitory state where the end state is Enterprise Identity. |
Map-file management, new account provisioning, account migration details (file ownership alignment, and so on) |
|
Autogen
See Automatically generating Posix user identities for details. |
| Active Directory Users and Groups do not have posix attributes assigned to them. Safeguard Authentication Services generates posix attributes for users and groups for identity purposes, and Active Directory password is used for authentication. |
Enterprise Identity accounts are not provisioned in Active Directory, or Unix Admin does not have permissions to provision Enterprise Identity accounts, and the Unix hosts have joined the Active Directory domain. Admins want AD users to log in to Unix machines with AD credentials. |
Potential for disparate UID/GID for same user, account migration details (file ownership alignment, and so on) |
|
Personalities
See Unix Personality Management for details. |
| Active Directory Users have many personalities, typically defined by membership in many NIS domains. Each personality represents a separate NIS identity. A Unix host defines which personality to use when joined to Active Directory. Identity is supplied by personality data stored in the directory, and authentication utilizes Active Directory passwords. |
Many NIS domains have been collapsed into a single Active Directory domain. Unix information across domains are not unique. Also used as a transitory migration state to Enterprise Identity. |
Personality management, personality OU architecture, new account provisioning, account migration details, domain separation. |
For more information please refer to the vastool, vasd, and vas.conf man pages.
Safeguard Authentication Services is designed to support any Active Directory schema configuration. If your Active Directory schema has built-in support for Unix attributes (Windows 2003 R2 schema, SFU schema), Safeguard Authentication Services automatically uses one of these schema configurations. Using a native Active Directory schema for Unix attributes is the best practice. However, if your Active Directory schema does not natively support Unix account attributes and a schema extension is not possible, Safeguard Authentication Services uses "schemaless" functionality where Unix account information is stored in the altSecurityIdentities attribute.
The schema configuration applies to all Safeguard Authentication Services Unix agents and management tools.
