Chat now with support
Chat with Support

Active Roles 7.4.1 - Administration Guide

Introduction About Active Roles Getting Started Rule-based Administrative Views Role-based Administration
Access Templates as administrative roles Access Template management tasks Examples of use Deployment considerations Windows claims-based Access Rules
Rule-based AutoProvisioning and Deprovisioning
About Policy Objects Policy Object management tasks Policy configuration tasks
Property Generation and Validation User Logon Name Generation Group Membership AutoProvisioning E-mail Alias Generation Exchange Mailbox AutoProvisioning AutoProvisioning for SaaS products OneDrive Provisioning Home Folder AutoProvisioning Script Execution Office 365 License Management Office 365 Roles Management User Account Deprovisioning Office 365 Licenses Retention Group Membership Removal Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Relocation User Account Permanent Deletion Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Notification Distribution Report Distribution
Deployment considerations Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Container Deletion Prevention policy Picture management rules Policy extensions
Workflows
Understanding workflow Workflow activities overview Configuring a workflow
Creating a workflow definition Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configuring an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Example: Approval workflow E-mail based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic Groups Active Roles Reporting Management History
Understanding Management History Management History configuration Viewing change history
Workflow activity report sections Policy report items Active Roles internal policy report items
Examining user activity
Entitlement Profile Recycle Bin AD LDS Data Management One Identity Starling Management One Identity Starling Two-factor Authentication for Active Roles Managing One Identity Starling Connect Azure_Overview
Config ARS to Manage Hybrid AD Objects Managing Hybrid AD Users Office 365 roles management for hybrid environment users Managing Office 365 Contacts Managing Hybrid AD Groups Managing Azure O365 or Unified Groups
Managing Configuration of Active Roles
Connecting to the Administration Service Adding and removing managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server Replication Appendix A: Using regular expressions Appendix B: Administrative Template Appendix C: Communication ports Appendix D: Active Roles and supported Azure environments Appendix E: Enabling delegation for Federated Authentication

Prerequisites for using Access Rules

Before you can use Access Rules, the following conditions must be fulfilled:

  • Claim support must be enabled in your Active Directory domain. For details, review the topic Enabling claim support, later in this document.
  • For Access Rules to use device claims, Group Policy setting Computer Configuration\ Policies\Administrative Templates\System\Kerberos\Support Compound Authentication with the Always option must be enabled on the client computers, in addition to the Kerberos client support for claims, compound authentication and Kerberos armoring setting (see Client computer).
  • The Active Roles Administration Service must be installed on a computer running Windows Server 2012 or a later version of the Windows Server operating system.
  • The Active Roles Administration Service that performs authorization using Access Rules must be installed in the Active Directory forest where the user account of the authorizing user is defined and in which the claim types used by the Access Rules are created. Active Roles does not support the use of Access Rules for cross-forest authorization.
  • Group Policy setting Computer Configuration\Policies\Administrative Templates\ System\Kerberos\Kerberos client support for claims, compound authentication and Kerberos armoring must be enabled on the computer running the Administration Service.
  • The Administration Service must be configured to support Kerberos authentication.

Configuring the Administration Service to support Kerberos authentication

Access Rules require the Active Roles Administration Service to support Kerberos authentication. This is because Windows claims are delivered inside Kerberos tickets. To enable Kerberos authentication, the Service Principal Name (SPN) of the Active Roles Administration Service must be added to the service account (domain user account under which the Administration Service runs). For example, suppose that:

  • arsrv.domain.com is the FQDN of the computer running the Administration Service
  • arsrv is the name of the computer running the Administration Service

In this example, the following SPNs must be added to the service account:

  • aradminsvc/arsrv.domain.com
  • aradminsvc/arsrv

You can add the SPNs to the service account by using the Setspn command line tool:

  1. setspn -s aradminsvc/<FQDN> <ServiceAccountName>

For example, setspn -s aradminsvc/arsrv.domain.com domain\arsvcacct 

  1. setspn -s aradminsvc/<name> <ServiceAccountName>

For example, setspn -s aradminsvc/arsrv domain\arsvcacct

Managing Windows claims

Claims are statements about an authenticated user or device, issued by an Active Directory domain controller running Windows Server 2012 or later. Claims can contain information about the user or device retrieved from Active Directory.

Dynamic Access Control (DAC), a feature of Windows Server 2012, employs claims-based authorization to create versatile and flexible access controls on sensitive resources by using access rules that evaluate information about the user who accesses those resources and about the device from which the user accesses those resources. By leveraging claims in the user's authentication token, DAC makes it possible to allow or deny access to resources based on the Active Directory attributes of the user or device.

Active Roles uses claims-based access rules to improve authorization management for Active Directory administration. With claims-based access rules, Active Roles adds more flexibility and precision in delegating control of Active Directory objects, such as users, computers or groups, by extending the Active Roles authorization model to recognize and evaluate the claims specific to the user who requests access to those objects or device used to request access.

Enabling claim support

Claims-based authorization requires:

  • Domain controller running Windows Server 2012 or later, with claim support enabled
  • Domain-joined client computer running Windows 8, Windows Server 2012 or a later version of the Windows operating system, with claim support enabled (if you need to use device claims)
Related Documents