ADAM (AD LDS) Pass thru Authentication. Idalia Torres STC Using ADAM to Keep AD out of Harm s Way

Transcription

1 ADAM (AD LDS) Pass thru Authentication Idalia Torres STC Using ADAM to Keep AD out of Harm s Way

2 Overview What is it? What s New in ADLDS? Instal ADAM Instance Extend ADAM Schema Select Target Class Extend Target Class Edit Configuration File Synchronization Finishing Touches What s Next?

3 What is it? ADAM Active Directory Application Mode Windows Server 2003 Windows XP Professional SP1 SP1 available for Server 2003 NOT at R2 level Included in Server 2003 R2 AD LDS Active Directory Lightweight Directory Services Server role in Windows Server 2008 Download for Windows 7

4 What s New in AD LDS? Install from Media (IFM) Generation Audit AD LDS changes Data Mounting Tool Support for AD Sites and Services to manage replication among AD LDS instances Dynamic list of LDIF files during installation Recursive linked attribute queries

5 Install ADAM instance Type of Instance: Instance Name: LDAP Port: SSL Port: Appl Dir Partition Name: ADAM Service Account: ADAM Admin: Import Ldif: Unique Instance or Replica of an existing instance Instance# (accept default or use any appropriate name, this will be the Service name for this instance) 389 (or any other available port from 1025 to 65535, the Wizard will suggest the next available port) 636 (or the next available port after the one chosen above) Use any DNS-style distinguished name (dc=adam#,dc=myschool,dc=edu) Network SA local administrators group (or any local or domain user or group that will have full administrative access to this instance) Import the following LDF files: MS-UserProxy.LDF or MS-UserProxyFull.LDF, MS-InetOrgPerson.LDF, and MS-User.LDF (also MS-AdamSyncMetadata.LDF and MS-ADLDS-DisplaySpecifiers.LDF in AD LDS)

6 Extend ADAM Schema Include all of Windows 2003 (or Windows 2008) AD objects ldifde -i -f MS-AdamSchemaW2K3.LDF -s localhost:[ldap-port#] -c CN=Configuration,DC=X #ConfigurationNamingContext Include attributes needed to use AdamSync ldifde -i -f MS-AdamSyncMetadata.ldf -s localhost:[ldap-port#] -c CN=Configuration,DC=X #ConfigurationNamingContext Import the eduperson schema ldifde -i -f eduperson.ldif -s localhost:[ldap-port#] c cn=schema,cn=configuration,dc=x #schemanamingcontext Import the sunyperson schema ldifde -i -f sunyperson.ldif -s localhost:[ldap-port#] -c cn=schema,cn=configuration,dc=x #schemanamingcontext

7 Which Target Class? top person sn, telephonenumber introduced userproxy organizationalperson givenname introduced user userproxyfull inetorgperson

8 Extend Target Class Extend the user proxy class in ADAM How additional attributes not included in the class eduperson and sunyperson auxilliary classes custom campus attributes LDIF file Schema management snap-in (ADAM) regsvr32 adam-schmmgmt.dll (ADLDS) regsvr32 schmmgmt.dll

9 Edit Configuration XML source-ad-name = FQDN of AD domain source-ad-partition = DN of AD domain target-dn= Target partition in ADAM (Application Directory Partition Name) base-dn = DN of search base in AD object-filter = LDAP query for the users to synchronize attributes = attributes that you want to bring from AD user-proxy = use correct source class in AD and target class in ADAM

10 Sample Configuration XML <doc> <configuration> <description>adamsync configuration file for Instance3</description> <security-mode>object</security-mode> <source-ad-name>ourdomain.fredonia.edu</source-ad-name> <source-ad-partition>dc=ourdomain,dc=fredonia,dc=edu</source-ad-partition> <source-ad-account></source-ad-account> <account-domain></account-domain> <target-dn>dc=adam3,dc=fredonia,dc=edu</target-dn> <query> <base-dn>ou=fredonia_users,dc=fredonia,dc=edu</base-dn> <objectfilter>( (&(objectclass=user)(!useraccountcontrol: :=2))(&(objectclass=user)(isdeleted=true)))</object-filter> <attributes> <include>objectsid</include> <include>sourceobjectguid</include> <include>lastagedchange</include> <include>userprincipalname</include> <include>mail</include> <exclude></exclude> </attributes> </query> <user-proxy> <source-object-class>user</source-object-class> <target-object-class>userproxy</target-object-class> </user-proxy> </configuration> </doc>

11 Synchronization Install configuration file adamsync /install localhost:[ldap-port#] MS-AdamSyncConf.xml Make sure to install the configuration file after any changes Synchronize ADAM with AD adamsync /sync localhost:[ldap-port#] "[Appl Dir Partition Name] Run synchronization command after new AD accounts are created or on schedule

12 Finishing Touches Update additional attributes via script or other tools Give Read Property rights to self dsacls \\localhost :[ldap-port#] \[Appl Dir Partition Name] /G SELF:RP;;userProxy /I:S Install security certificate in ADAM instance personal store

13 What s Next? FEDERATION Trusted authentication Controlled release of attributes Use ADAM (ADLDS) as attribute store

14 Questions

15 Contact Feel free to contact me with your questions: Idalia Torres Systems Administrator SUNY Fredonia (716)