C E N T R I F Y D E P L O Y M E N T G U I D E Centrify Cloud Connector Deployment Guide Abstract Centrify provides mobile device management and single sign-on services that you can trust and count on as a critical component of your corporate identity and access infrastructure. Our thorough approach to availability, reliability, scalability, security and privacy ensures that you can depend on Centrify as a trusted partner and provider. This document is a step by step guide how to deploy the Centrify Cloud Connector to connect to Active Directory and or LDAP databases.
Contents Abstract... 1 Overview... 3 Installing the Centrify Cloud Connector... 4 Enabling LDAP directory authentication... 10 High Availability (HA) setup... 13 Conclusion... 14 Contact Centrify... 14
Overview For customers who want to integrate the Centrify Cloud with their on-premises Active Directory or LDAP directory for user authentication or connect to their on-premises applications like SAP NetWeaver / SharePoint / etc without the need for VPN, A Centrify supplied software program called the Centrify Cloud Connector needs to be installed inside their environment. The Centrify Cloud Connector is a simple Windows service that runs behind a customer s firewall to provide real-time authentication, policy and access to user profiles without synchronizing data to the cloud. The Cloud Connector seamlessly integrates with Active Directory or LDAP without opening extra ports in an organization s firewall, or adding devices in their DMZ and acts as a gateway for access to on-premises applications without the need for VPN. The Cloud Connector delivers the following security capabilities: For each tenant, a unique PKI Certificate issued from the Centrify Cloud to the Cloud Connector during registration. All communications between the Centrify Cloud and the Centrify Cloud Connector are encrypted and mutually authenticated for each tenant using these unique certificates. None of the traffic between the Centrify Cloud and the Cloud Connector can be read by the Azure infrastructure.
Installing the Centrify Cloud Connector The Centrify Cloud Connector can be downloaded directly from the tenant. To integrate Active Directory into the Centrify Cloud the Cloud Connector must be installed on a Domain joined windows system. To integrate a LDAP directory into the Centrify Cloud Service the Cloud Connector must be installed on a Windows system that is able to communicate with the LDAP directory. Initial configuration of the Cloud Connector follows installation with the Cloud Connector configuration wizard, which launches automatically. For both, Active Directory and LDAP directories, the initial installation and configuration is the same. The additional configuration needed for LDAP directories is covered in the next chapter. 1. Log on to the Centrify Cloud Manager at https://cloud.centrify.com/manage 2. Click on Settings 3. Click on Cloud Connectors 4. Click on Add Cloud Connector
5. Click on Download 64 bit to download the Cloud Connector application installer to your local hard drive For integrating Active Directory with the Centrify Cloud Service, the Cloud Connector must be installed on a Domain joined Windows system For integrating LDAP directory with the Centrify Cloud Service, the Cloud Connector must be installed on a Windows system that can communicate with the LDAP directory 6. Using Windows Explorer locate the file downloaded and extract the content onto the System where you want to install the Cloud Connector 7. Double click the Cloud-Mgmt-Suite-xx.x-win64.exe installer
8. Click on Next 9. Check the I accept the terms in the license agreement and click on Next 10. Follow the wizard instructions and click on Install 11. Once the installer finishes the Cloud Connector configuration dialog will open automatically 12. To start the configuration click on Next
13. Enter your tenant administrative username and password NOTE: Your role must have the Register Cloud Connectors administrative right to download the Centrify Cloud Management Suite package and register the Cloud Connector 14. Optionally you can configure a web proxy for connection to the Centrify Cloud Service 15. Click on Next
16. The Cloud Connector will validate the configuration and test connection to the Centrify Cloud Service. Upon successful completion of the tests the Cloud Connector will connect to the Cloud Service and start the Cloud Connector services. 17. Click on Finish
18. Within the Centrify Admin Portal go to Settings Cloud Connectors to confirm successful connection to your Cloud Connector 19. This is all configuration needed to enable users to authenticate using their domain credentials against onpremises Active Directory
Enabling LDAP directory authentication 1. Within the Centrify Admin Console go to Settings Directory Services 2. Click on Add LDAP Directory
3. Fill out all the fields in the Add LDAP dialog and click on Test Connection For example, a LDAP directory for the company centrifydemo.us with an admin user in a container for Users under the root the configuration would be. Base DN: DC=centrifydemo,DC=us Bind DN: CN=admin,CN=Users, DC=centrifydemo,DC=us This is just an example and the LDAP prefix depend on the LDAP server schema configuration.
4. Under Roles you now can select from which User Directory to add users to a Role for authentication and authorization 5. Go to Roles double click on an existing Role (or add a new Role) Members Add Members
High Availability (HA) setup To enable High Availability you simply install the Centrify Cloud Connector on more than one Windows system within your environment. The Centrify Cloud Service will automatically load balance user authentication requests and AppGateway for connection to on-premises apps between the available Cloud Connectors. For Active Directory environments each system on which the Cloud Connector is installed must be a domain joined system For LDAP directory, each system on which the Cloud Connector is installed must be able to communicate with the LDAP directory A single Cloud Connector can serve as AD Proxy, LDAP Proxy and AppGateway simultaneously A single Cloud Connector can support one Active Directory Domain or multiple forests if a trust relationship between the forests exist A single Cloud Connector can support multiple LDAP directories, there are no limitations on the number of LDAP directories support.
Conclusion The Centrify Cloud Connector runs on a host computer in your environment and manages communications between Active Directory and/or LDAP directory and the Centrify Identity Platform. It specifies groups whose members can enroll devices and a group whose members can manage devices. It also monitors Active Directory for group policy changes, which it sends to the Centrify identity platform to update enrolled devices. The cloud connector configuration application allows you to complete the initial configuration, if necessary, to make changes, and to configure additional features such as logging and sending alerts that are set to default values during initial configuration. You can also run this application to monitor the status of your cloud connector. The identity platform uses all of the available Cloud Connectors configured for a service. Each server has its own Cloud Connector configuration program that you launch on the computer hosting the Cloud Connector. However, when you make a change to any of the Cloud Connectors in an installation (that is, servers registered to the same customer ID), the changes are propagated to all the servers in the installation to ensure that they are all in sync. The Centrify Cloud Connector Configuration Program is installed on any computer where a Cloud Connector is installed. Contact Centrify Centrify strengthens enterprise security by managing and securing user identities from cyber threats. As organizations expand IT resources and teams beyond their premises, identity is becoming the new security perimeter. With our platform of integrated software and cloud-based services, Centrify uniquely secures and unifies identity for both privileged and end users across today s hybrid IT world of cloud, mobile and data center. The result is stronger security and compliance, improved business agility and enhanced user productivity through single sign-on. Over 5000 customers, including half of the Fortune 50 and over 80 federal agencies, leverage Centrify to secure their identity management. Learn more at www.centrify.com. Santa Clara, California: +1 (669) 444-5200 Email: sales@centrify.com EMEA: +44 (0) 1344 317950 Web: www.centrify.com Asia Pacific: +61 1300 795 789 Brazil: +55 11 3958 4876 Latin America: +1 305 900 5354