You can install the Safeguard Authentication Services Agent on a Unix system and join it to Active Directory without installing Safeguard Authentication Services on Windows and setting up the Safeguard Authentication Services Application Configuration.
The Safeguard Authentication Services 4.x client-side agent required detection of a directory-based Application Configuration data object within the Active Directory forest in order to join the host computer to the Active Directory Domain. Safeguard Authentication Services 4.0.2 removed this requirement for environments where directory-based User and/or Group identity information is not needed on the host Unix computer. These environments include full Mapped-User environments, GSSAPI based authentication-only environments, or configurations where the Safeguard Authentication Services agent will auto-generate posix attributes for Active Directory Users and Groups objects.
When upgrading to or installing Safeguard Authentication Services 4.x, you can choose not to configure Active Directory for Safeguard Authentication Services and run your Safeguard Authentication Services client agent in Version 3 Compatibility Mode. While this prevents you from running the Control Center and accessing its many features and tools, you can join a host to an Active Directory domain when operating in Version 3 Compatibility Mode.
Note: When you run the join command without first creating a One Identity Application Configuration, Safeguard Authentication Services displays a warning.
Without the Safeguard Authentication Services application configuration the following information is stored locally:
- Application Licenses
- Settings controlling default values and behavior for Unix-enabled users and groups
- Schema configuration
Best practice
Because Version 3 Compatibility Mode does not allow you run the Control Center and access its many features and tools, One Identity recommends that you create the application configuration so you can utilize full Safeguard Authentication Services functionality.
There are two ways to create the application configuration:
- When you start the Control Center from a Windows workstation, the Set up Safeguard Authentication Services Active Directory Configuration Wizard starts automatically to lead you through the process of configuring Active Directory for Safeguard Authentication Services.
- Alternatively, you can run vastool configure ad from the Unix command line to create the One Identity Application Configuration in Active Directory.
The Control Center gives you access to the tools you need to perform Unix identity management tasks.
Note: If the Control Center is not currently open, you can either double-click the desktop icon or access it by means of the Start menu.
Follow the steps outlined on the Control CenterHome page to get your Unix agents ready.
To start the management console
- From the Control Center, click the Management Console link in the left navigation pane.
The first time you launch the management console, the Setup One IdentityManagement Console for Unix wizard leads you through some post-installation configuration steps.
Choose one of these options:
- Skip the Active Directory configuration, I'll do that later from the console
This option allows you to use the core features of the console and limits access to the console to the default supervisor account only.
-
Walk me through the configuration steps for using AD user accounts for logon to the console
When you configure the console for Active Directory, you unlock additional Active Directory features.
Note: To use the management console with Safeguard Authentication Services, or to use roles to allow access to the console using Active Directory, you must configure the console for Active Directory log on.
Choose an option and click Next.
Note: If you choose the Skip option, the Identify Console dialog displays. For more information, see Identify Console dialog.
If you choose the Walk me through option, it allows you to configure the console for Active Directory log on. See Configure the Console for Active Directory in the One Identity Management Console for Unix Administration Guide for details.
Note: If you can not configure the console for Active Directory during your initial installation of Management Console for Unix, choose the Skip option. After the installation, log in to the console as supervisor and configure the console for Active Directory from System Settings. See Active Directory Configuration in the One Identity Management Console for Unix Administration Guide for more information.
