Queries on AD / ADSI connector pre-requisites

[GauravJain]

Hi - As per Saviynt connector documentation for ADSI, one of the pre-requisite is to install ".NET Framework 4.5 and ASP.NET 4.5 are installed on the server where IIS is installed."

Question is, can we use any other version available on our sever for both .NET and ASP.NET or we have to use version 4.5 only?

Another query is - how / from where we can export public key certificate required for secure AD connection? Any document to guide on this or steps you can share would be helpful.

Regards

Gaurav

[This message has been edited by moderator to merge reply comment]

[rushikeshvartak]

4.5 and later should work

To export a public key certificate for secure Active Directory (AD) connection, you typically follow these steps:

1. Using Microsoft Management Console (MMC):

   • Press Win + R to open the Run dialog.
   • Type mmc and press Enter to open the Microsoft Management Console.
   • Go to File -> Add/Remove Snap-in.
   • Add the Certificates snap-in for the Computer account.
   • Navigate to Certificates (Local Computer) -> Personal -> Certificates.
   • Locate the certificate you want to export.
   • Right-click on the certificate, choose All Tasks, and then Export.
   • Follow the Export Wizard to export the certificate, making sure to include the private key if needed.
   • Save the certificate file in the desired location.

2. Using PowerShell:

   • Open PowerShell with administrative privileges.
   • Use the Export-PfxCertificate cmdlet to export the certificate:
     powershell

     $cert = Get-Item -Path Cert:\LocalMachine\My\CertificateThumbprint Export-PfxCertificate -Cert $cert -FilePath "C:\Path\To\Exported\Certificate.pfx" -Password (ConvertTo-SecureString -String "YourPassword" -Force -AsPlainText)

   Make sure to replace CertificateThumbprint with the actual thumbprint of your certificate and set a strong password for the exported PFX file.

3. Using Certificate MMC Snap-in:

   • Press Win + R to open the Run dialog.
   • Type certmgr.msc and press Enter to open the Certificate Manager.
   • Navigate to Certificates (Local Computer) -> Personal -> Certificates.
   • Locate the certificate you want to export.
   • Right-click on the certificate, choose All Tasks, and then Export.
   • Follow the Export Wizard to export the certificate.

[DixshantValecha]

Hi @GauravJain,

How to Setup the LDAPS at AD server,
1. Create Server Authentication certificate with Subjact as FQDN of the DC, for ex. Subject = "CN=<DC fqdn>"
2. Start Microsoft Management Console (MMC).
3. Add the Certificates snap-in that manages certificates on the local computer.
    Expand Certificates (Local Computer), expand Personal, and then expand Certificates. A new certificate should exist in the Personal store. In the Certificate Properties dialog box, the intended purpose displayed is Server Authentication. This certificate is issued to the computer's fully qualified host name.
4. Restart the domain controller.How to Verify an LDAPS connection
1. After a certificate is installed, please restart the domain controller.
2. Start the Active Directory Administration Tool (Ldp.exe).
3. On the Connection menu, click Connect.
4. Type the name of the domain controller to which you want to connect.
5. Type 636 as the port number.
6. Click OK.
[Note : RootDSE information should print in the right pane, indicating a successful connection. ]

[GauravJain]

Hi @rushikeshvartak @DixshantValecha 

Another query i have w.r.t ADSI connector pre-requisite is on Service account permissions. Following are the permissions listed in document Preparing for Integration (saviyntcloud.com) :

"Provide the Least Privilege to the Service Account if the domain administrator rights are not granted to it:

• • Directory replication permissions across domains in a forest. This is only required for import.

  • Permissions to create, update, move, or delete an object and add or remove access from resources in a cross-domain environment. The account must also be a member of the Enterprise Admins group. This is only required for provisioning.

"

Is it necessary to have "Enterprise Admins" access on Service account for provisioning purpose? As we know this is one of the highest privileges in AD and we may not want to take that much risk. Do we have any alternative to this or its a must requirement from AD provisioning perspective. 

Please let me know if any questions.

Regards

Gaurav

[rushikeshvartak]

Access to "Enterprise Admins" for a service account in ADSI is not a must. It's recommended to avoid assigning such high privileges. Explore alternative approaches like delegating specific permissions using RBAC or customizing permissions to meet AD provisioning needs with reduced security risks.

[GauravJain]

then why saviynt documentation says "The account must also be a member of the Enterprise Admins group".

[GauravJain]

Hi @rushikeshvartak i have raised a feedback on documentation for this change. Will close this post considering its not a "must" requirement.

[GauravJain]

Hi @rushikeshvartak While configuring a high availability connection, is it possible to configure multiple comm separated domain url's instead of configuring multiple comma separated Domain controllers?

[rushikeshvartak]

elaborate with example please 

[GauravJain]

Hi @rushikeshvartak As per Saviynt documentation Preparing for Integration (saviyntcloud.com)

under heading "Configuring a High-Availability Connection" - "To support high-availability, the connector uses the domain controller (DC) locator process to locate an active domain controller. "

this is a dynamic way of finding an active domain controller where we have to configure an active AD domain. One domain can have multiple domain controllers. So, the DC locator feature used by connector will find an active domain controller and use it for establishing the connection.

So my question is, can we define multiple domain url's as comma separated so that if connector cant find an active domain controller in one domain then it will go and fetch from another domain.

secondly, another way of doing this is, we can configure multiple comma separated domain controller url's as a static list in connector. but we dont want to do this because its a static list and in future if a domain controller gets decommissioned then we will have to manually update this configuration. so, ideally its not good for setting up HA connection.

this is an important aspect and we need clarification on it.

Let me know if you require any further inputs.

[rushikeshvartak]

You can define URL as LDAP://100.100.100.10:389,LDAP://200.100.36.31:389,LDAP://145.100.36.32:389,LDAPS://abc.me.com:636

This currently supported 

[GauravJain]

Thanks @rushikeshvartak @DixshantValecha I will try out the given suggestions and get back.

Can you also confirm on the AD certificate -  can we use root CA (certified authority) to establish secure connectivity with our AD server (LDAPS)?

[rushikeshvartak]

Yes, you can use a root certificate authority (CA) to establish secure connectivity with your Active Directory (AD) server using LDAPS (LDAP over SSL/TLS). LDAPS provides secure communication between LDAP clients and servers by encrypting the data exchanged between them.

[shibinvpkvr]

Do we know from which version onwards comma separated format is supported? 

[rushikeshvartak]

5.5x

[shibinvpkvr]

Oh ok. So AD connector URL parameter supports comma separated DC urls from 5.5 onwards!? Didn’t know. Thanks for that info