Integration Guide. SafeNet Authentication Service. Integrating Active Directory Lightweight Services

Transcription

1 SafeNet Authentication Service Integration Guide Technical Manual Template Release 1.0, PN: , Rev. A, March 2013, Copyright 2013 SafeNet, Inc. All rights reserved. 1

2 Document Information Document Part Number , Rev A Release Date August 2010 Trademarks All intellectual property is protected by copyright. All trademarks and product names used or referred to are the copyright of their respective owners. No part of this document may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, chemical, photocopy, recording, or otherwise, without the prior written permission of SafeNet, Inc. Disclaimer SafeNet makes no representations or warranties with respect to the contents of this document and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Furthermore, SafeNet reserves the right to revise this publication and to make changes from time to time in the content hereof without the obligation upon SafeNet to notify any person or organization of any such revisions or changes. We have attempted to make these documents complete, accurate, and useful, but we cannot guarantee them to be perfect. When we discover errors or omissions, or they are brought to our attention, we endeavor to correct them in succeeding releases of the product. SafeNet invites constructive comments on the contents of this document. These comments, together with your personal and/or company details, should be sent to the address or below. Contact Method Mail Contact Information SafeNet, Inc Millennium Drive Belcamp, Maryland 21017, USA TechPubs@safenet-inc.com 2

3 Contents Contents Introduction... 4 Third-Party Software Acknowledgement... 4 Active Directory Lightweight Directory Services Installation... 4 Creating an Instance... 4 Preparing ADLDS Schema Synchronization... 9 Active Directory Schema Analyzer Overview... 9 Launchingandusing ADSchemaAnalyzer utility... 9 Loading Active Directory/ADLDS Schema LDF Files Loading ADLDS Synchronization Schema LDF Files Editing/Customizing ADLDS Synchronization Config File Creating ADLDS Synchronization Config File Installing a Custom ADLDS Synchronization Config File First Time Synchronization Disabling SSL Authentication in ADLDS Creating ADLDS User for SAS Configuring ADLDS to Auto Synchronize ADAM Multi-Domain Support Creating an OU for additional Domains Create an OU within the existing ADLDS instance for the second domain information Displaying Currently Loaded Configurations Batch File Example Configuring SAS to Use ADLDS Proxy User Caveats Support Contacts

4 Introduction Third-Party Software Acknowledgement This document is intended to help users of SafeNet products when working with third-party software, such as Microsoft Active Directory Lightweight Services. Material from third-party software is being used solely for the purpose of making instructions clear. Screen images and content obtained from third-party software will be acknowledged as such. Active Directory Lightweight Directory Services Installation Microsoft Active Directory Lightweight Directory Services (formerly Microsoft Active Directory Application Mode) is part of Windows 2008 R2. To install Active Directory Lightweight Directory Services (ADLDS), go to: 1. Launch Server Manager. 2. Select Roles on the left pane. 3. Click Add Roles on the right pane. 4. When the wizard opens, click Next. 5. Place a check mark in Active Directory Lightweight Directory Services. 6. Click Add Required Features, then Next, and Next again. 7. Click Install. Creating an Instance The following instructions are used to create an instance (virtual LDAP domain) which SAS will use to query its user information from. The user information is populated into your instance from your main LDAP server (Active Directory). To create a new ADLDS instance: 1. Click Start > All Programs > Administrative Tools. 2. Select Active Directory Lightweight Directory Services Setup Wizard. The Active Directory Lightweight Directory Services Setup Wizard will open. 3. Click Next to begin creating a new ADLDS instance. On the Setup Options dialogue, to create a unique instance or replicate the information from an existing ADLDS instance. Since this is the first time through ADLDS, select A unique instance, and then click Next. 4

5 Figure 1 On the Instance Name page, provide a name for the instance. Choose a name that will be easily recognizable as it will be used when creating the Windows service. In this instance, SAS will be used as the instance name. Provide a Description for the instance name. Click Next to continue. Figure 2 By default, LDAP and LDAPS use port 389 and 636 respectively. If the default LDAP ports have been modified, change the port numbers accordingly. Click Next to continue 5

6 Figure 3 NOTE: If installation is performed on a domain controller, or a second ADLDS is being created, then the ports will default to and respectively. On the Application Directory Partition page, select Yes, create an application directory partition. Create a partition with the name in the following syntax: DC=blackshield,dc=domain,dc=com (for example, DC=blackshield,dc=intel,dc=com) Click Next to continue. Figure 4 6

7 On the File Locations page, verify the default file location is acceptable. After verifying, click Next to continue. Figure 5 On the Service Account Selection page, select the Network service account radio button. Click Next to continue. Figure 6 On the ADLDS Administrators page, select Currently logged on user DOMAIN\Administrator. Click Next to continue. 7

8 Figure 7 On the Importing LDIF Files page, select the following: MSInetOrgPerson.LDF MSUser.LDF MSUserProxy.LDF Click Next to continue. Click Next again to create the ADLDS instance. Click Finish once the instance has been created. Figure 8 8

9 Preparing ADLDS Schema Synchronization The previous steps will have created and prepared your ADLDS instance to accept LDAP information. During the setup of the ADLDS instance, you told it to load 3 LDF files. These files provide the AD LDS instance information pertaining to particular LDAP object classes, attributes and help it understand as to what its default schema should look like. However, the three provided LDF files do not provide ALL needed information. You are required to use a utility provided by Microsoft called AD Schema Analyzer. Active Directory Schema Analyzer Overview AD Schema Analyzer is a utility that will analyze your current LDAP schema and then analyze what is currently in the local ADLDS schema. It will create an LDF file with all the missing object classes and attributes in ADLDS so that your synchronization can be performed successfully. Launchingandusing ADSchemaAnalyzer utility To start the AD Schema Analyzer, launch a command prompt and navigate to: C:\Windows\ADAM Type in: ADSchemaAnalyzer The AD DS/LDS Schema Analyzer will appear. Figure 9 In the AD DS/LDS Schema Analyzer, click File, and then select Load target schema. Figure 10 9

10 Enter the following information for your Active Directory Server: Server:[port] - IP or DNS of Active Directory:Port Username - Username(ex.Administrator) Password Password for user Domain Domain name (ex., Intel.com) Under Bind type, select Secure. Under Server type, select AD DS/LDS. Click OK when all the information has been entered. Figure 11 At the bottom of the AD DS/LDS Schema Analyzer, the application is attempting to load the AD schema and all its attributes. The base schema must now be loaded. Figure 12 In the AD DS/LDS Schema Analyzer, click File. Select Load base schema. 10

11 Figure 13 Enter the following information for the local AD DS/LDS instance: For Server:[port], enter :389. Under Bind type, select Secure. Under Server type, select Auto. Click OK when all the information has been entered. Figure 14 For the local AD DS/LDS instance, only the server and port are required. 11

12 After clicking the OK button, the application will compare the two schemas and once it is finished, it will display Done completing schema. Figure 15 Within the AD DS/LDS Schema Analyzer, click the Schema menu. Select Mark all non-present elements as included. Figure 16 NOTE: A message will display the total amount of non-present elements that were marked as included. Within the AD DS/LDS Schema Analyzer: 1. Click the file and then select Create LDIF file. Figure 17 12

13 2. In the Save As window, provide a name for the LDF file. 3. Provide the file with a recognizable name as will be used in the next section. 4. Save the LDF file in the default directory. Loading Active Directory/ADLDS Schema LDF Files To load the custom LDF file that was created in the previous section, a command will be required to be executed from the command prompt within the ADAM directory. On the ADLDS system, launch a command prompt and navigate to: C:\Windows\ADAM Issue the following command: ldifde -i -s localhost -c CN=Configuration, DC=X #ConfigurationNamingContext -f (custom LDF filename).ldf NOTE: The (customldffilename).ldf is to be replaced to the filename of the LDF file that was created in the previous section. After executing the command, it will show the following text output: Connecting to "localhost" Logging in as current user using SSPI Importing directory from file "(customldffilename).ldf" Loading entries... NOTE: Loading entries may take a while depending on how many attributes are being loaded. Once the command has completed, a message in the command line is displayed as follows. (Number of entries may vary) Figure 18 Loading ADLDS Synchronization Schema LDF Files On the ADLDS system, launch a command prompt and navigate to: C:\Windows\ADAM Issue the following command: ldifde -i -s localhost -c CN=Configuration, DC=X #ConfigurationNamingContext -f MS-AdamSyncMetaData.ldf 13

14 After executing the command, it will show the following text output: Connecting to "localhost" Logging in as current user using SSPI Importing directory from file "MSAdamSyncMetaData.ldf" Loading entries... Once the command has completed, a message in the command line is displayed as follows. (Number of entries may vary) Figure 19 Editing/Customizing ADLDS Synchronization Config File ADLDS requires a special file in order to determine the information it should synchronize from LDAP. In a nutshell, this file will ultimately contain connection information to the target LDAP server, and the destination ADLDS instance. It will also contain information as to what attributes will be synchronized. Creating ADLDS Synchronization Config File This section will provide steps on how to create an ADLDS Synchronization file. The file that will be created will indicate to ADLD S the objects and attributes that will be synchronized from an LDAP server. This file is loaded into ADLDS using a special command, and then is used by any subsequent automated synchronization. There are two options to creating a customized ADLDS Synchronization file. The first option is to copy the MSAdamSyncConf.xml file and modify the necessary information. The second option is to copy the sample AD LDS Synchronization XML Config File, modify the necessary information, and save it to a file. Option 1 The MSAdamSyncConf.xml file is located in c:\windows\adam. Make a copy of the file to the desktop, and open the file with a text editor. There are 6 lines that are required to be modified within the synchronization file. The lines are: <source-ad-name>your-dc-hostname</source-ad-name> Hostname of Active Directory Server (ensure it is resolvable by DNS) <source-ad-partition>dc=yourdomain,dc=com</source-ad-partition> Instance path of Active Directory tree (Ex.,dc=intel,dc=com) <source-ad-account>administrator</source-ad-account> <target-dn>dc=blackshield,dc=cryptocard,dc=com</target-dn> Domain name of Active Directory (ex., intel.com) Local ADLDS instance (See Figure 14 on page 11 for local ADLDS DN.) 14

15 <base-dn>dc=yourdomain,dc=com</base-dn> Remote LDAP Distinguished Name (Active Directory Server) An optional but non-critical line that can be modified is the description. Here is Microsoft's explanation of the values in the event the above explanation is not adequate or is not clear. The following is taken out of the ADAM Quick Start Guide produced by Microsoft. <source-ad-name>seattledc1</source-ad-name> Replace the value of <source-ad-name> with the name of the source Active Directory domain controller <source-ad-partition>dc=fabrikam,dc=com</source-ad-partition> Replace the value of <source-ad - partition> with the distinguished name of the source domain <source-ad-account>administrator</source-ad-account>. <account-domain>fabrikam.com</account-domain>. <target-dn>o=microsoft,c=us</target-dn>. <base-dn>dc=fabrikam,dc=com</base-dn> Replace the value of <source-ad-account> with the name of an account tin the Domain Admins group of the source domain Replace the value of <account-domain> with the fully qualified name of the source domain Replace the value of <target-dn> with the name of the partition of the target ADAM instance Replace the value of <base-dn> with the base distinguished name of the source domain Option 2 Copy the ADLDS Synchronization XML Config file below into NotePad. Then modify the following section s below that is in bold. For more information and explanation, see the previous section. <doc> <configuration> <description>blackshield AD LDS Sync File</description> <security-mode>object</security-mode> <source-ad-name>your-dc</source-ad-name> <source-ad-partition>dc=yourdomain,dc=com</source-ad-partition> <source-ad-account>administrator</source-ad-account> <account-domain>yourdomain.com</account-domain> <target-dn>dc=blackshield,dc=cryptocard,dc=com</target-dn> 15

16 <query> <base-dn>dc=yourdomain,dc=com</base-dn> <object-filter>(objectclass=*)</object-filter> <attributes> <include></include> <exclude>extensionname</exclude> <exclude>displaynameprintable</exclude> <exclude>flags</exclude> <exclude>isprivelegeholder</exclude> <exclude>mscom-userlink</exclude> <exclude>mscom-partitionsetlink</exclude> <exclude>reports</exclude> <exclude>serviceprincipalname</exclude> <exclude>accountexpires</exclude> <exclude>admincount</exclude> <exclude>primarygroupid</exclude> <exclude>useraccountcontrol</exclude> <exclude>codepage</exclude> <exclude>countrycode</exclude> <exclude>logonhours</exclude> <exclude>lockouttime</exclude> </attributes> </query> <schedule> <aging> <frequency>0</frequency> <num-objects>0</num-objects> </aging> <schtasks-cmd></schtasks-cmd> </schedule> </configuration> <synchronizer-state> <dirsync-cookie></dirsync-cookie> <status></status> <authoritative-adam-instance></authoritative-adam-instance> 16

17 <configuration-file-guid></configuration-file-guid> <last-sync-attempt-time></last-sync-attempt-time> <last-sync-success-time></last-sync-success-time> <last-sync-error-time></last-sync-error-time> <last-sync-error-string></last-sync-error-string> <consecutive-sync-failures></consecutive-sync-failures> <user-credentials></user-credentials> <runs-since-last-object-update></runs-since-last-object-update> <runs-since-last-full-sync></runs-since-last-full-sync> </synchronizer-state> </doc> Once all changes have been made, save the file to C:\Windows\ADAM, with a.xml extension. Please provide a name that is recognizable as the xml file will be used in the next section. Installing a Custom ADLDS Synchronization Config File The following instruction will explain how to install the custom configuration file that was created in the previous section. The custom configuration file should be placed in C:\Windows\ADAM. Launch a command prompt and navigate to: C:\Windows\ADAM Type the following command: ADAMSync /install localhost:389 %windir%\adam\ (custom sync filename).xml After running the command, the prompt will move to the next line and display Done. NOTE: If there is a second XML file to add a second domain, then please use the same command above, but specify the appropriate filename. First Time Synchronization After installing the custom XML configuration file, a sync must occur between the LDAP Server specified in the custom XML config file to the ADLDS instance. The following instructions in this section will require the creation of a directory to store a sync file, and then running the command to start the sync. A directory needs to be created for the ADLDS synchronizations logs. Create a directory on the C:\ drive named ADLDS Logs. 17

18 Launch a command prompt and navigate to: C:\Windows\ADAM Type the following command: ADAMSync /fs localhost:389 "dc=blackshield,dc=cryptocard,dc=com" /log C:\ADLDS-Logs\sync.log NOTE: (Optional)AdditionalDomain:..."OU=Domain2,dc=cryptoserver,dc=sparks,dc=com"/log C:\ADAMLogs\syncDomain2.log Synchronization of data Active Directory to the newly created ADLDS instance can take from 5 minutes to 5 hours depending on how many users exist within Active Directory. Please monitor the ADLDS Sync log in C:\ADLDSLogs\sync.log as it can grow in size rapidly and cause low disk space. Disabling SSL Authentication in ADLDS By default, SSL authentication is enabled ADLDS. The instructions in this section will show how to disable SSL authentication into ADLDS. This is needed to allow SAS to bind (authenticate) to the ADLDS instance without requiring a certificate. To disable SSL authentication, the ADSI Edit tool will be needed. NOTE: If SSL authentication is required to access an ADLDS instance from a remote system, then please skip this section. Please also note that ADLDS should have a valid certificate loaded. To launch the ADSI Edit tool go to: Start All Programs Administrative Tools ADSI Edit In the ADSI Edit application: Right-click on ADSI Edit on the left pane. Select Connect to. Figure 20 18

19 In the Connection Settings window, perform the following: Select the Select a well known Naming Context radio button, and select Configuration in the dropdown menu. Select the Select or type a domain or server: (Server Domain [:port]) option, and then enter in localhost:389 in the field below. Enter a name for the connection settings. (Ex: Local AD LDS Instance) Click the OK button. Figure 21 In the ADSI Edit application, expand the newly added object, and then: Expand CN=Configuration,CN= > CN=Services > CN=WindowsNT. Right-click on CN=DirectoryService. Select Properties. 19

20 Figure 22 NOTE: Refresh the ADSI Edit application if the expand button is not visible. In the CN=DirectoryServiceProperties window, scroll down and find the msds OtherSettings attribute, and highlight it and select Edit. Figure 23 Select RequireSecureProxyBind=1 under the Values section. Select the Remove button. The RequireSecureProxyBind=1 value then goes to Value to add field. Change the value from 1 to 0. Click the Add button. Click OK. 20

21 Figure 24 Creating ADLDS User for SAS With the ADLDS instance configured, a user must now be created so when SAS connects to the AD LDS instance. The user will be created as a user that is part of the ADLDS instance. This user is outside of the synchronization that is occurring between the source Active Directory and destination ADLDS instance. To start the Ldp application, launch a command prompt and navigate to: C:\Windows\ADAM Type Ldp The Ldp application will open. Figure 25 In the Ldp application, click on Connection > Connect. 21

22 Figure 26 In the Server field, enter localhost. Click OK. Figure 27 In the Ldp application, click Connection and then select Bind. Figure 28 22

23 Under the Bind type section, select Bind as currently logged on user. If Encrypt traffic after bind is selected, clear this option. Click OK. Figure 29 In the right pane, output will appear at the bottom. The last line should read: Authenticated as: Domain\Username. Figure 30 In the Ldp application, click on View, and then select Tree. In the BaseDN field, select the DN of the ADLDS Instance. Click OK. Figure 31 23

24 In the Ldp instance, select Browse and then select Add child. Figure 32 Enter the following in the DN field: cn=adamproxy,dc=blackshield,dc=cryptocard,dc=com The cn=adamproxy within the DN field is the user that is being created. Under Edit Entry, enter the following information: Attribute: ObjectClass Values: userproxy Click Enter. Figure 33 24

25 Open a command prompt and type in the following: whoami /user The command prompt will display the username, along with the user s SID. Copy the SID as it will be needed to be added as an attribute in the Add Child window. Figure 34 In the Edit Entry section of the Add Child window, enter the information in the respective fields: Attribute:ObjectSID Values: S Click Enter. Figure 35 Once the ObjectSID attribute and its value have been added to the Entry List, click Run. 25

26 Configuring ADLDS to Auto Synchronize To have ADLDS auto-synchronize based on a schedule, a batch file will need to be created either through Scheduled Task or the AT command. Add the following command to the batch file to automate the sync: ADAMSync /sync localhost:389 "DC=blackshield,DC=cryptocard,DC=com" /log C:\adamlogs\autoSync.log A time interval will need to be set within Scheduled Task or using the AT command on how often you would like this command to run. In turn, this is specifying how often ADLDS will synchronize user information from LDAP to the ADLDS instance. [Optional Second Domain] ADAMSync /sync localhost:389 "OU=Domain2,DC=cryptoserver, DC=Domain,DC=com" /log C:\adamlogs\autoSync.log NOTE: ADAMSync /sync localhost:389 "OU=Domain2,DC=cryptoserver,DC=Domain,DC=com" /log C:\adamlogs\autoSyncDomain2.log must have an associated XML synchronization file installed prior to telling it to sync pointing to the OU=Domain2 as a <targetdn>. ADAM Multi-Domain Support It may come to a point where ADLDS will be required to connect to more than 1 Active Directory domain. This can be achieved by manually loading in a separate synchronization XML file into the ADAM instance which is configured to pull information from a second domain. Creating an OU for additional Domains An OU needs to be created with the ADLDS instance and then information will be synced to the OU. Create an OU within the existing ADLDS instance for the second domain information Open ADAM ADSI Edit. Connect to the Distinguished Name (DN) of your ADLDS instance: for example, DC=blackshield,DC=cryptocard,DC=com. Right-click the base DN (top of the domain) and select New Object. Select Organizational Unit. 26

27 Give the OU a name of Domain2. In the second domain's XML synchronization file, edit the following: <targetdn>ou=domain2,dc=blackshield,dc=cryptocard,dc=com</targetdn> NOTE: A second MS-AdamSyncConf.xml file will need to be created with the new settings pointed at a new domain referencing a <targetdn> of the new ADAM instance 'Domain2' OU. Name the second XML file MS-AdamSyncConf2.xml. Edit other settings within the second XML file as needed. For example, when the second XML file is installed using the command ADAMSync /installlocalhost:389 %windir% \ADAM\MSAdamSyncConf2.xml, it loads in what it should be synchronizing for one particular domain. Displaying Currently Loaded Configurations To display the currently loaded ADAM synchronization files perform the following: Open a command prompt and navigate to: C:\Windows\ADAM Enter the following command: AdamSync /list localhost:389 It should list something similar to this: C:\WINDOWS\ADAM>ADAMSync/listlocalhost:389 Listing configuration files: >"DC=blackshield,DC=CRYPTOCard,DC=com": BlackShieldSync >"OU=Domain2,DC=blackshield,DC=cryptocard,DC=com": BlackShieldSync Done. NOTE: If you want ADAM to synchronize information from both domains at a given time interval, you will need to ensure that all needed XML files have been loaded and have both been instructed to do a full sync, /fs. Batch File Example Example Line 1 Line 2 ADAMSync /sync localhost:389 "DC=blackshield,DC=cryptocard,DC=com" /log C:\adamlogs\autoSyncDomain1.log ADAMSync /sync localhost:389 "OU=Domain2,DC=blackshield,DC=cryptocard,DC=com" /log C:\adamlogs\autoSyncDomain2.log 27

28 Line explanations Line 1 Line 2 This line synchronizes changes from Domain 1 into ADAM top DN This line synchronizes changes from Domain 2 into ADAM Domain 2 OU Configuring SAS to Use ADLDS Proxy User Now that ADLDS has been configured, it is now time to configure SAS to connect to the ADLDS instance for the user source. During the user source configuration, provide the IP/DNS name of the ADLDS system, NOT the ADDC system. This is to be done at the LDAP Configuration screen. Figure 36 In the LDAP Credentials screen, enter cn=adamproxy in the User DN. Click the drop-down menu and select the Base DN of the ADLDS instance. (e.g., dc=blackshield,dc=cryptocard,dc=com) Select Append Base DN to User DN. Enter the Password for the user. Figure 37 (Refer to Figures 33 through 35 beginning on page 24.) NOTE: For more detailed installation instructions, refer to the SAS Administrator Manual. 28

29 Caveats If multiple domains are being synchronized to a single ADLDS instance, than the container names must be unique. When importing users within the same Container name, ADLDS will rename the container to a random name. If a user (e.g., JDoe) exists in two domains with the same username, and within the same container name, than one of the usernames must be changed (e,g., JDoe2) so that both users will be synchronized to the ADLDS instance. It is recommended that a separate Container be created within ADLDS when synchronizing data from the second domain. This is to indicate within the synchronization XML file that the BASE DN is within the newly created container. This will allow two completely separate sets of LDAP information easily stored within ADLDS. For example, an OU has been created within ADLDS called 'Domain2'. In the second domain XML file, the base DN that will be used is CN=Domain2,DC=blackshield,DC=cryptocard,DC=com). NOTE: A user that exists in ADLDS can never use their Microsoft static password to authenticate against SAS. Usernames must be unique if multiple domains are synchronized to an ADLDS instance. Then the users will be displayed properly within SAS. Support Contacts If you encounter a problem while installing, registering, or operating this product, please make sure that you have read the documentation. If you cannot resolve the issue, contact your supplier or SafeNet Customer Support. SafeNet Customer Support operates 24 hours a day, 7 days a week. Your level of access to this service is governed by the support plan arrangements made between SafeNet and your organization. Please consult this support plan for further information about your entitlements, including the hours when phone support is available to you. Table 1: Support Contacts Contact Method Address Contact Information SafeNet, Inc Millennium Drive Belcamp, Maryland USA Phone United States International Technical Support Customer Portal Existing customers with a Technical Support Customer Portal account can log in to manage incidents, get the latest software upgrades, and access the SafeNet Knowledge Base. 29