LDAP integration

LDAP integration is available on only SAS PCE.

Use the Comms > LDAP module to configure LDAP integration. In SAS PCE v3.4 and later, LDAP integration is implemented as a service, replacing the Direct LDAP Integration feature that was included in earlier releases of SAS PCE.

LDAP integration should be configured only where a high speed, permanent connection is assured, and LDAP failover is configured. The loss of connection between the Virtual Server and all LDAP user sources will result in an authentication service outage.

The SAS PCE LDAP Integrator service enables SAS PCE to make a direct connection to LDAP without the need for an external agent. The service runs automatically on startup. It scans LDAP users and groups every five minutes, and updates the SAS PCE database to match the contents of LDAP. The scan interval is not configurable.

The user information is stored internally in the SAS PCE database, and SAS PCE is not required to make connections to LDAP for each authentication demand, which results in efficient performance. SAS PCE can continue to operate even when LDAP is disconnected or non-responsive.

Configuring LDAP integration enables users to be automatically added, suspended, or removed from an account’s Virtual Server, which eliminates the need to manually create and manage users or to use a synchronization agent.

With integration, UserIDs, group membership, and other LDAP/AD user attributes are validated against the LDAP source for every user lookup and authentication that is performed in the Virtual Server. Integration supports additional functionality, such as chained authentication (LDAP authentication followed by OTP authentication) and static password validation against Active Directory.

In addition to basic user information, synchronization includes the users' Active Directory group membership, which can be used for:

• Automatic provisioning of tokens to users.

• Automatic revocation of tokens from users

• LDAP pre-authentication and authorization

• Chained authentication

Configure the LDAP User Source

For performance reasons, LDAP integration is not recommended where the directory server and SAS are communicating across the internet. If integration over the internet is required, it must be across a high speed, low latency connection with guaranteed availability. If your LDAP/AD does not use a default schema, you must configure a compatible schema in the Virtual Server before you configure the LDAP User Source. Do this from the Schema Management section.

1. Select Comms and expand the LDAP module.

2. Click LDAP User Source.

   

3. Configure the Virtual Server to connect directly to your LDAP/Active Directory.

4. Host name or IP Address— The FQDN host name or IP address of your LDAP/AD.

5. Port— The port number allowed to connect to LDAP/AD.

6. Use TLS for LDAP connection— Select this option and use port 636.

   You must select this option to use SafeNet Synchronization Agent with your Active Directory and the secure default settings that are enforced by Microsoft. See Security Advisory -ADV190023.

7. Number of Failover Hosts—The number of failover LDAP/AD servers to which the Virtual Server will attempt to connect in the event the primary LDAP/AD cannot be reached.

8. Connection Timeout (secs)—The time in seconds before the connection terminates.

9. Click Next.

10. Select an LDAP Schema from the list, and then click Next.

11. Provide a valid user account that can be used by the Virtual Server to connect to your LDAP/AD.

    The Virtual Server does not write to LDAP. The account privileges need only be sufficient to allow the Virtual Server to connect and browse the schema.

    

    After a connection is established, the Virtual Server automatically detects all DNs containing users that will be integrated with the Virtual Server. Users added or removed from these DNs are automatically added or removed from the Virtual Server.

12. To remove DNs from integration with the Virtual Server, select the Manually edit searched containers option.

13. To use the Virtual Server to authenticate users in your LDAP/AD user source, as well as users that are not in that user source, select the Use Local Database option.

14. The Virtual Server can simultaneously support LDAP integration or LDAP synchronization, and the creation and management of users in its SQL database.

    

15. Click Done to save the configuration.

    Users in your LDAP/AD directory are automatically populated in the Virtual Server.

Schema Management

You can add a custom schema to the Virtual Server.

1. Click Schema Management.

   

2. In the Schema drop-down list, select a default schema that is most like your custom schema.

   

   The page displays the default schema mappings.

3. Adjust the defaults to map your schema to the User and Group Attributes, Object Class, and Custom Fields where:

   • User Attributes and Custom Fields

     These are the fields that appear in the User detail.

     The Virtual Server in conjunction with LDAP Pre-auth Rules can take advantage of additional attributes found in Active Directory including:

     • userAccountControl— The Virtual Server does not authenticate a User whose account is disabled in Active Directory.

     • lockoutTime— The Virtual Server authenticate a user only during the Days/Times set in Active Directory.

     • memberOf— The Virtual Server authenticates a user based on their Active Directory group membership. This is usually combined with source IP and other attributes in Pre-authentication rules.

     • accountExpires— The Virtual Server does not authenticate an expired Active Directory user account.

LDAP synchronization

Users can be automatically added, suspended, or removed from the account’s Virtual Server by using the LDAP Synchronization Agent, eliminating the need to manually create and manage users. The agent comes with support for standard Active Directory, eDirectory, and SunOne. The agent can be configured to support non-standard schemas.

This method requires the installation of a Synchronization Agent, normally somewhere on the same network as the AD/LDAP directory.

The Agent is configured to monitor the specified LDAP containers (DNs) and groups for changes such as adding or removing a user, synchronizing and applying these changes at the Virtual Server.

Synchronization can be coupled with other workflow automation policies such as:

• Automatic provisioning of tokens to users
• Automatic revocation of tokens from users
• LDAP pre-authentication and authorization

SAS PCE supports manual creation of users concurrent with LDAP synchronization, bearing in mind that manually created users will not be modified in any way by an LDAP synchronization provided there is no overlap in UserID. If an overlap occurs, any tokens assigned to the manually created UserID are revoked and marked as lost with a comment, and the UserID is replaced by the overlapping LDAP UserID.

To configure your system for LDAP synchronization, refer to SafeNet Synchronization Agent section.