You can install the Authentication Services Agent on a Unix system and join it to Active Directory without installing Authentication Services on Windows and setting up the Authentication Services Application Configuration.
The Authentication Services 4.x client-side agent required detection of a directory-based Application Configuration data object within the Active Directory forest in order to join the host computer to the Active Directory Domain. Authentication Services 4.0.2 removed this requirement for environments where directory-based User and/or Group identity information is not needed on the host Unix computer. These environments include full Mapped-User environments, GSS-API based authentication-only environments, or configurations where the Authentication Services agent will auto-generate posix attributes for Active Directory Users and Groups objects.
When upgrading to or installing Authentication Services 4.1, you can choose not to configure Active Directory for Authentication Services and run your Authentication Services client agent in "Version 3 Compatibility Mode". While this prevents you from running the Control Center and accessing its many features and tools, you can join a host to an Active Directory domain when operating in "Version 3 Compatibility Mode".
|
Note: When you run the join command without first creating a One Identity Application Configuration, Authentication Services displays a warning. |
Without the Authentication Services application configuration the following information is stored locally:
In VAS 3.5.x, the default user login name was the User Principal Name; Authentication Services 4.1 uses the sAMAccountName as the default user login name. After upgrading to 4.1, if you want to continue to login with the User Principal Name, then you must ensure that the username-attr-name in the vas.conf file is set to the User Principal Name before you begin the client agent upgrade.
|
Note: This is not necessary if the value of the User Principal Name prefix and the sAMAccountName are the same across your enterprise, which is the Active Directory default. |
There are two ways to change the username-attr-name in the vas.conf file:
To manually configure each client agent to use the User Principal Name
username-attr-name = userPrincipalName
|
Note: If the attribute is already explicitly set to another value (such as: username-attr-name = uid), do not change it. Alternatively, you can run the following command on each client to change the setting in vas.conf: vastool configure vas vasd username-attr-name userprincipalname |
To automatically configure all the clients in your environment
|
Note: Your version of Group Policy Management Editor may not have the Policies directory layer. |
Because Version 3 Compatibility Mode does not allow you run the Control Center and access its many features and tools, One Identity recommends that you create the application configuration so you can utilize full Authentication Services 4.1 functionality.
There are two ways to create the application configuration:
Setup Management Console for Unix
Configure the console for Active Directory logon
Set Supervisor Password dialog
Management Console for Unix log on page
Add hosts to the management console
The Control Center gives you access to the tools you need to perform Unix identity management tasks.
|
Note: If the Control Center is not currently open, you can either double-click the desktop icon or access it by means of the Start menu. |
Follow the steps outlined on the Control Center Home page to get your Unix agents ready.
|
Note: Of course, you can install Authentication Services without using Management Console for Unix. If you wish to do that, skip these instructions and go to: Installing and joining from the Unix command line. |
To start the mangement console
The first time you launch the mangement console, the Setup Management Console for Unix wizard leads you through some post-installation configuration steps. Choose one of these options:
This option allows you to use the core features of the console and limits access to the console to the default supervisor account only.
Walk me through the configuration steps for using AD user accounts for logon to the console
When you configure the console for Active Directory, you unlock additional Active Directory features.
|
Note: To use the mangement console with Authentication Services, or to use roles to allow access to the console using Active Directory, you must configure the console for Active Directory log on. |
Choose an option and click Next.
|
Note: If you choose the Skip option, the Identify Console dialog displays. (For more information, see Identify Console.) If you choose the Walk me through option, it allows you to configure the console for Active Directory log on. (See Configure the Console for Active Directory on the mangement console online Help for details.) |
|
Note: If you can not configure the console for Active Directory during your initial installation of Management Console for Unix, choose the Skip option. After the installation, log into the console as supervisor and configure the console for Active Directory from System Settings. (See Active Directory Configuration in the mangement console online Help for more information.) |
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy