Active Directory DN

You can configure the Active Directory connector so that all connections to the ADSI LDAP Provider are made over SSL (using server certificates). Encryption strength depends on the certificate strength.

To do this, you must:

Bravura Security Fabric uses a designated account (for example, psadmin) on the Active Directory target system to perform operations.

The target system administrator should be a member of the Domain Admins group to list users, and should have the following permissions for password and account operations:

The administrator should also be able to enumerate domain controllers in the domain.

If you are targeting multiple domains in an Active Directory forest with this connector, the target system administrator should be a member of the Enterprise Admins group in the forest root, and the username should be entered into Bravura Security Fabric in UPN format. In this case, while the target system administrator does not need to be a user in the forest root domain, the forest root domain or a domain controller in that domain should be specified in the target address.

Ensure that you set and note the account’s password. You will be required to enter the login ID and password when you add the target system to Bravura Security Fabric .

If you want to configure this account with control limited to the users and services needed by Bravura Security Fabric rather than full administrative control, see Minimizing administrative account rights .

If you want to configure an account with specific delegated control, see Delegating control .

In Active Directory, you can delegate administration of users to a specific individual or group, eliminating the need for the Bravura Security Fabric target system administrator to have authority over an entire domain. We refer to the user as the delegated ID.

If you use a delegated ID, you may also need to configure the AdminSDHolder object .

It is highly recommended that you enable SSL between domain controllers and the Bravura Security Fabric server.

The following steps are used in Windows Server 2012. The steps may vary in other versions.

To create a target system administrator with delegated control, also known as a delegated ID :

For setting more granular permissions, use the ADSI Edit tool. See your Windows documentation for detailed information.

The following applies to Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, and Windows Server 2003 with SP2.

The default owner for AdminSDHolder is the Domain Admins group. If your target system administrator is a member of this group, Bravura Security Fabric can reset domain administrator accounts. If you chose to delegate administration of users to a specific individual or group, the AdminSDHolder container will need to be modified.

In order to reset domain administrator accounts using a Delegated ID, configure permissions on the AdminSDHolder object to allow the management account group, created when you created the delegated ID, to reset passwords on AdminSDHolder.

Refer to the following link for detailed instructions:

https://technet.microsoft.com/en-us/library/cc772662%28v=ws.10%29.aspx

Bravura Security Fabric uses template accounts as models or "blueprints" for creating new accounts in Active Directory. The following example illustrates how you can create a template account in Active Directory:

The following instructions are for Windows 2012 Active Directory. Details may vary depending on your version of the software.

To set up shares/folders in your Active Directory domain:

The share is now available to be managed by Bravura Identity .

Publishing shares

If you want to use the listadresources program to list the share, you must publish the share in the directory. To do this:

See the listadresources usage information .

In order to manage printers as network resources in Bravura Security Fabric, the server to which the printer is attached must be a member of the domain.

To set up printers in your Active Directory domain:

The printer is now available to be managed by Bravura Identity .

To set up mail distribution lists in your Active Directory domain, using the Exchange Management Console:

The distribution groups will propagate to Active Directory and can be managed by Bravura Identity .

Alternatively, you can manage the Exchange distribution groups using the Exchange connector.

Active Directory allows groups to be managed by other groups. If you configure a group with access to a network resource to be managed by another group, all members of the managing group will become group owners in Bravura Identity .

You can limit the list of group owners presented to users by selecting a managing group that contains fewer members, or use an IDACCESS OWNERS PLUGIN plugin (Manage the system > Workflow > Options > Plugins).

If a managed group does not have a description entered, then the group name is displayed by default when requesting access to network resources.

Use the listadresources program to list network resources (shares, printers, mail distribution lists) in a Microsoft Active Directory domain .

You can then use the resulting output file with the loadnetres program to import the resources into Bravura Security Fabric .

Usage

listadresources -hostid <target ID> -outfile <filename> [-validateperm]

Output file format

The output file format for listadresources is the same as the input file format for loadnetres.

The file is written in KVGroup format:

"" "" = {
  "<resource type>" "<publish name>"= {           # required
    "Address" = "<UNC path of the resource>"        # required for shares and printers
    "TargetId" = "<target ID>"                       # required
    "Description" = "<description>"  # not required
    "ValidatePermissions" = "<true|false>"          # not required
  }
 ...   # You can specify multiple KVGroups, one for each resource.
}

The <resource type> is one of:

ValidatePermissions determines the value of the Users are only allowed to see sub-resources when they have read permission for a resource checkbox for a share/folder resource. The default is false.

Example

The following is an example of the file format:

# KVGROUP-V1.0
"" "" = {
  "F" "share1" = {
    "Address" = "\\\\10.0.26.115\\share1"
    "Description" = "A shared folder"
    "TargetId" = "ADDOM"
  }
  "M" "AllSalesGroup" = {
    "Description" = "Distribution list for sales"
    "TargetId" = "ADDOM"
  }
  "P" "COMPUTERNAME-Printer1" = {
    "Address" = "\\\\computername.example.com\\Printer1"
    "Description" = "First floor printer"
    "TargetId" = "ADDOM"
  }
  "F" "share2" = {
    "Address" = "\\\\10.0.26.115\\share2"
    "Description" = "Another shared folder"
    "TargetId" = "ADDOM"
    "ValidatePermissions" = "true"
  }
}

You can restrict user, contact and group listing by using LDAP search filters. On the Target system address configuration page, add a search filter; for example:

You can restrict Bravura Security Fabric to list only those users, groups and computer objects that exist in one or more named containers; for example, if your Active Directory is divided into organizational units. To do this, on the Target system address configuration page, specify:

These fields allow multiple values. To fill in multiple values, select List from the drop-down list box displaying in front of these fields, and use the More button to add additional input boxes when more than one value is given. The value in each input box is treated as a single value, for example:

You can also exclude OUs to further restrict the listing of users. This option will remove all users that match the OU listed. To do this, specify OUs to exclude from listing. When the exclude OUs option and any of the list OUs options are used together, the listing process will list OUs first and then remove objects that match the exclude criteria.

If there are many OUs to list, there is an option to include all OUs in a file. To use the file, select File option from the drop-down list and specify file name in the field.

These files must be located in the \<instance>\script\ directory and contain a list of OUs to list or exclude users from. They cannot be combined into one file and must be separate.

For listing users from OUs:

# KVGROUP-V2.0

   listOUs = {

     "OU=people,OU=it,DC=example,DC=com";

     "OU=people,OU=hr,DC=example,DC=com";

   }

For listing groups from OUs:

# KVGROUP-V2.0

   listGroupOUs = {

     "OU=Groups,OU=it,DC=example,DC=com";

     "OU=Groups,OU=hr,DC=example,DC=com";

   }

For listing computers from OUs:

# KVGROUP-V2.0

   listComputerOUs = {

     "OU=ComputerOU,OU=it,DC=example,DC=com";

     "OU=ComputerOU,OU=hr,DC=example,DC=com";

   }

For excluding OUs:

# KVGROUP-V2.0

   excludeOUs = {

     "OU=disabled,OU=it,DC=example,DC=com";

     "OU=disabled,OU=hr,DC=example,DC=com";

   }

Some default Active Directory OUs require a different notation when listing from them. If the OU is a "Container" type instead of an "Organizational Unit" type, use ’CN’ instead of ’OU’ before the name. For example, the default Computers and Users OUs are "Container" types. To list from these OUs, the KVG would look like "CN=Users,OU=it,DC=example,DC=com";

The connector will not list any OU if an OU file is empty.

By default if an OU list includes invalid OUs the list will return success. You can cause the listing to abort when invalid OUs are detected by setting Abort listing when an invalid OU is encountered.

You can restrict Bravura Security Fabric to list only those users, groups and computer objects who exist in one or more named groups. To do this, on the Target system address configuration page, specify:

These fields allow multiple values. To fill in multiple values, select List from the drop-down list box displaying in front of these fields, and use the More button to add additional input box(es) when more than one value is given. Value in each input box is treated as a single value, for example:

If there are many groups to list, there is an option to include all groups in a file. To use the file, select the File option from the drop-down list and specify file name in the field.

These files must be located in the \<instance>\script\ directory and contain a list of groups to list from. They cannot be combined into one file and must be separate.

For listing users from groups:

# KVGROUP-V2.0

   listGroups = {

     "CN=IT,OU=Groups,DC=domain,DC=local";

     "CN=Sales,OU=Groups,DC=domain,DC=local";

     "CN=Finance,OU=Groups,DC=domain,DC=local";

   }

For listing member groups from groups:

# KVGROUP-V2.0

   listGroupGroups = {

     "OU=Groups,OU=IT,DC=domain,DC=local";

     "OU=Groups,OU=Sales,DC=domain,DC=local";

     "OU=Groups,OU=Finance,DC=domain,DC=local";

   }

For listing computers from groups:

# KVGROUP-V2.0

   listComputerGroups = {

     "OU=Computers,OU=IT,DC=domain,DC=local";

     "OU=Computers,OU=Sales,DC=domain,DC=local";

     "OU=Computers,OU=Finance,DC=domain,DC=local";

   }

Active Directory DN connector will not list any group if the group file is empty.

By default if a group list includes invalid groups the list will return success. You can cause the listing to abort when invalid groups are detected by setting Abort listing when an invalid group is encountered.

Listing group membership recursively

You can recursively list all users and computers contained groups specified by the " Groups to list …" options.

To list user and computer objects recursively, select the List nested groups option.

If specified, the connector recursively searches for groups managed by the groups specified in the address, then constructs a user list search based on all groups.

If not specified, only immediate members of a specified group are listed.

Listing managed group membership recursively

You can recursively list users’ group membership for groups contained within groups specified by the Groups to list users from option. To list group membership recursively, select the List members for nested groups option.

If selected, the connector recursively searches for groups managed by the groups specified in the address, then constructs a user list search based on all managed groups.

If not selected, only immediate members of a specified group are listed.

Depending on the version of Bravura Security Fabric you have installed, you may need to list groups and group managers in flattened form if nested groups are not supported. Bravura Security Fabric versions 9.0.1 or earlier do not support nested groups.

To list nested groups recursively in flattened form, select When listing group members and managers, list groups as their individual user members.

If selected, the list of groups constructed will list all the immediate members of the specified group and all the members of the groups nested within the specified group.

You can specify the format of the users long ID during listing. The default long ID listed is the NT4 domain name format.

You can select the fully qualified domain name (FQDN) name format as an alternative. To do this, select "DN" from the Name format list on the Target system address configuration page.

The fully qualified domain name (FQDN) long IDs have the potential to be longer than the 200 characters allowed by the Bravura Security Fabric.

Use the default NT4 name format when there are domain accounts that run a service, scheduled task, DCOM object, COM+ application, or IIS anonymous access on a managed target system.

You can specify the format of the groups long ID during listing. The default long ID listed is the fully qualified domain name (FQDN) name format.

Use the NT4 domain name format when there are nested domain groups within local groups of a member server. To do this, select "NT4" from the Group Name format list on the Target system address configuration page.

The fully qualified domain name (FQDN) long IDs have the potential to be longer then the 200 characters allowed by the Bravura Security Fabric .

In a global, native-mode Active Directory domain, password resets may take a long time to replicate from the domain controller serving the Bravura Security Fabric server to domain controllers accessed by users.

Bravura Security Fabric can bypass this replication process by directly setting a user’s new password and account status flags (intruder lockout, change password flag and expiry time/date) on each DC that the user might access. This includes DCs in the site from which the user’s web browser connected to Bravura Security Fabric , DCs in the site housing the user’s home directory, and regional DCs accessed by mail, database or other systems that the user might access.

To accelerate password replication in this way, set the Program to generate a list of target systems on the Target system information page for your Active Directory domain to dcselect.exe.

The sub-host plugin adds a list of DCs and sites to the help desk password reset screen, so that a help desk user can reset passwords on specific domain controllers. The plugin also automatically selects domain controllers for all self-service functions, based on the user’s web browser IP address and home directory server IP address.

To specify additional domain controllers for users of certain sites, edit the text file dc.man in the \<instance>\script\ directory. This file has the format:

domain domain-name site site-name DC1 DC2 

Site names may contain the wild cards ? (any single character) and ⋆ (any sequence of characters).

An example of dc.man follows:

domain example.com

# Every user should get a password reset on this central DC:

site ⋆ centraldc.example.com

# Users in Madrid should get a reset in London too:

site madrid.⋆ londondc1.example.com londondc2.example.com

# Users in Hong Kong should get a reset in Tokyo:

site hk.example.com tokdc1.example.com tokdc1.example.com

Dates are stored in Active Directory in two formats.

The dates in Bravura Security Fabric are stored in ISO standard format (YYYY-MM-DD HH24:MI:SS). The conversion between ISO format and native Active Directory format is handled by the agent. A request attribute only needs to accept the ISO format.

Dates displayed and set must be in Coordinated Universal Time (UTC).

To force users to change their password the next time they log into Windows, set the pwdLastSet attribute to 0. This value corresponds to the User must change password at next logon checkbox in Active Directory Users and Computers. Note that Bravura Security Fabric does not copy this property from the template account.

The pwdLastSet attribute cannot be set if the template account has the Password never expires checkbox enabled. You can clear the Password never expires attribute by clearing the corresponding UF_DONT_EXPIRE_PASSWD flag of the userAccountControl attribute.

These settings can be found in the Environment, Sessions, Remote Control, and Terminal Services Profiles of Active Directory users.

By default, the Windows Terminal Services attributes are set to ignore. To use these attributes to perform an action other than ignore, you must configure Active Directory to run through a proxy on the target system.

You can configure Bravura Security Fabric to use a profile/request attribute to prompt users for the destination container when creating or moving accounts on a target system that supports contexts.

When the Profile/request attribute to use as the container DN option is configured on the Target system information page (Manage the system > Resources > Target systems), users can:

To allow users to select a container for a create account or move context operation: