Chat now with support
Chat with Support

Safeguard Authentication Services 4.1.5 - Installation Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Authentication Services Installing and configuring Authentication Services Installing and joining from the Unix command line Getting started with Authentication Services Troubleshooting Enterprise package deployment

Join the host to AD without the Authentication Services application configuration

You can install the Authentication Services Agent on a Unix system and join it to Active Directory without installing Authentication Services on Windows and setting up the Authentication Services Application Configuration.

The Authentication Services 4.x client-side agent required detection of a directory-based Application Configuration data object within the Active Directory forest in order to join the host computer to the Active Directory Domain. Authentication Services 4.0.2 removed this requirement for environments where directory-based User and/or Group identity information is not needed on the host Unix computer. These environments include full Mapped-User environments, GSS-API based authentication-only environments, or configurations where the Authentication Services agent will auto-generate posix attributes for Active Directory Users and Groups objects.

Version 3 compatibility mode

When upgrading to or installing Authentication Services 4.1, you can choose not to configure Active Directory for Authentication Services and run your Authentication Services client agent in "Version 3 Compatibility Mode". While this prevents you from running the Control Center and accessing its many features and tools, you can join a host to an Active Directory domain when operating in "Version 3 Compatibility Mode".

Note: When you run the join command without first creating a One Identity Application Configuration, Authentication Services displays a warning.

Without the Authentication Services application configuration the following information is stored locally:

  • Application Licenses
  • Settings controlling default values and behavior for Unix-enabled users and groups
  • Schema configuration
Default User Login Name Changes

In VAS 3.5.x, the default user login name was the User Principal Name; Authentication Services 4.1 uses the sAMAccountName as the default user login name. After upgrading to 4.1, if you want to continue to login with the User Principal Name, then you must ensure that the username-attr-name in the vas.conf file is set to the User Principal Name before you begin the client agent upgrade.

Note: This is not necessary if the value of the User Principal Name prefix and the sAMAccountName are the same across your enterprise, which is the Active Directory default.

There are two ways to change the username-attr-name in the vas.conf file:

  1. Manually configure each client agent to use the User Principal Name.

    To manually configure each client agent to use the User Principal Name

    1. Before you upgrade each client agent, open the /etc/opt/quest/vas/vas.conf file and find the username-attr-name attribute in the [vasd] section.
    2. If there is no value set for this attribute, then set it to: 
      username-attr-name = userPrincipalName

    Note: If the attribute is already explicitly set to another value (such as: username-attr-name = uid), do not change it.

    Alternatively, you can run the following command on each client to change the setting in vas.conf: 

    vastool configure vas vasd username-attr-name userprincipalname

  2. Use Group Policy to automatically configure all the clients in your environment.

    To automatically configure all the clients in your environment

    1. Open the Group Policy Management Editor and navigate to Computer Configuration | Policies | Unix Settings | Quest Authentication Services | Client Configuration.

      Note: Your version of Group Policy Management Editor may not have the Policies directory layer.

    2. Double click Authentication Services Configuration to open the Properties.
    3. Enter username-attr-name in the vas.conf Settings box and click Search.
    4. Enter userPrincipalName and click OK.
Best Practice

Because Version 3 Compatibility Mode does not allow you run the Control Center and access its many features and tools, One Identity recommends that you create the application configuration so you can utilize full Authentication Services 4.1 functionality.

There are two ways to create the application configuration:

  1. When you start the Control Center from a Windows workstation, the Set up Authentication Services Active Directory Configuration Wizard starts automatically to lead you through the process of configuring Active Directory for Authentication Services.
  2. Alternatively, you can run vastool configure ad from the Unix command line to create the One Identity Application Configuration in Active Directory.

Configure Unix agent components

The Control Center gives you access to the tools you need to perform Unix identity management tasks.

Note: If the Control Center is not currently open, you can either double-click the desktop icon or access it by means of the Start menu.

Follow the steps outlined on the Control Center Home page to get your Unix agents ready.

Note: Of course, you can install Authentication Services without using Management Console for Unix. If you wish to do that, skip these instructions and go to: Installing and joining from the Unix command line.

To start the mangement console

  1. From the Control Center, click the Management Console link in the left-navigation pane.

Setup Management Console for Unix

The first time you launch the mangement console, the Setup Management Console for Unix wizard leads you through some post-installation configuration steps. Choose one of these options:

  • Skip the Active Directory configuration, I'll do that later from the console

    This option allows you to use the core features of the console and limits access to the console to the default supervisor account only.

  • Walk me through the configuration steps for using AD user accounts for logon to the console

    When you configure the console for Active Directory, you unlock additional Active Directory features.

    Note: To use the mangement console with Authentication Services, or to use roles to allow access to the console using Active Directory, you must configure the console for Active Directory log on.

Choose an option and click Next.

Note: If you choose the Skip option, the Identify Console dialog displays. (For more information, see Identify Console.)

If you choose the Walk me through option, it allows you to configure the console for Active Directory log on. (See Configure the Console for Active Directory on the mangement console online Help for details.)

Note: If you can not configure the console for Active Directory during your initial installation of Management Console for Unix, choose the Skip option. After the installation, log into the console as supervisor and configure the console for Active Directory from System Settings. (See Active Directory Configuration in the mangement console online Help for more information.)

Related Documents