Skip to main content

Active Directory DN

Connector name

agtaddn

Connector type

Executable

Type (UI field value)

Active Directory DN

Target system versions supported/tested

Active Directory installed on Windows 2008R2/2012/2016/2019/2022 servers and Active Directory forests.

Connector status / support

Bravura Security-Verified

This connector has been tested and is fully supported by Bravura Security.

Upgrade notes

The agtaddn.exe connector replaces the Legacy agtad.exe connector. Use the adtoaddn.exe utility to convert a Legacy Active Directory target system over to using the Active Directory DN agtaddn.exe connector and target system.

This connector uses protocols and interfaces built into the Windows server operating system to update and retrieve information from Microsoft Active Directory.

Connection to the domain can either be made using a domain administrator account or delegated ID. ADSI services are used to connect to the domain. The connector uses ADSI LDAP provider for all operations using the distinguished name. If the target system is configured to use SSL, an LDAP SSL connection is used. Otherwise, a secure connection using Kerberos is made over LDAP.

The Bravura Security Fabric Active Directory DN connector can dynamically identify the most suitable domain controllers on which to make password updates in order to expedite replication of the new password and intruder lockout flag for the user. For example, a password update and cleared lockout may be set on a DC in the same site as the user’s current workstation (identified by IP address), or nearest the user’s home directory file server. In either case, no connector software must be installed on the target Windows domain controllers.

The following Bravura Security Fabric operations are supported by this connector on user, account and account group-type objects (depending on your product license and version):

  • user verify password

  • get server information

  • user change password

  • administrator reset password

  • expire password

  • check password expiry

  • administrator verify password

  • enable account

  • disable account

  • check account enabled

  • unlock account

  • check account lock

  • create account

  • delete account

  • rename account

  • update attributes

  • move contexts

  • add user to group

  • delete user from group

  • add group to group

  • remove group from group

  • add owner (user) to group

  • remove owner (user) from group

  • add owner (group) to group

  • remove owner (group) from group

  • create group

  • update group

  • delete group

  • check account expiry

  • unexpire account

  • expire account

  • List:

    • accounts

    • attributes

    • groups

    • members

    • computer objects

    • member groups

  • persistent listing

The connector supports following operations when managing contacts (depending on your product license and version):

  • get server information

  • create account

  • delete account

  • rename account

  • update attributes

  • list account attributes

  • move contexts

  • add user to group

  • delete user from group

  • add group to group

  • remove group from group

  • add owner(user) to group

  • remove owner(user) from group

  • add owner(group) to group

  • remove owner(group) from group

  • create group

  • delete group

  • List:

    • accounts

    • attributes

    • groups

    • members

    • computer objects

    • member groups

For a full list and explanation of each connector operation, see Connector operations.

When Bravura Identity is licensed, the connector can be configured with the nrcifs program to:

  • List network resources

  • List permissions for each network resource

  • List the owners of a network resource

  • Add or delete owners for a network resource

  • List the ACLs on a directory or share

The connector is called by the Transaction Monitor Service (idtm). When Bravura Identity is installed, the connector is run by the View and update profile (IDR) module whenever users view resource details or manage group owners.

The following sections show you how to:

  • Define an account for the target system administrator in Active Directory

  • Create a delegated ID and modify the AdminSDHolder object.

  • Enable SSL connections

  • Create template accounts in Active Directory

  • Set the Active Directory target system address in Bravura Security Fabric

  • Set up Active Directory so that network resources can be managed in Bravura Identity

This chapter also describes how Bravura Security Fabric handles special attributes used when creating or modifying accounts on an Active Directory target.

See also

  • adtoaddn.exe utility to learn how to convert a Legacy Active Directory target system over to using the Active Directory DN agtaddn.exe connector and target system.

  • Windows Server to learn how to target Windows NT compatible servers and workstations.

  • Transparent Password Synchronization to learn how to implement transparent synchronization on an Active Directory domain.

In this section: