6.4 Microsoft Windows

Transcription

1 CRYPTO-Server 3 rd Party Integration 6.4 Microsoft Windows ACTIVE DIRECTORY APPLICATION MODE (ADAM) Implementation Guide

2 Solution Overview Summary Product Name Vendor Site ADAM Server Side Software ADAM Client Side Software Active Directory Application Mode Active Directory Application Mode with SP1 N/A - Solution is server based only Pre-Requisites Download Location Reference ADAM Installer downloaded from Microsoft Visit above vendor site address, and browse to the downloads section. CRYPTOCard Product Requirements CRYPTOCard Server software 6.4 build 69 Supported Token types Server OS Server Type KT-1, RB-1, ST-1, ST-A, SC-1,SC-3, SC-4 Windows 2003 SP1 x86 Member Server Active Directory Application Mode (ADAM) 2

3 Proprietary Notice License and Warranty Information CRYPTOCard Inc. and its affiliates retain all ownership rights to the computer program described in this manual, other computer programs offered by the company (hereinafter called CRYPTOCard) and any documentation accompanying those programs. Use of CRYPTOCard software is governed by the license agreement accompanying your original media. CRYPTOCard software source code is a confidential trade secret of CRYPTOCard. You may not attempt to decipher, de-compile, develop, or otherwise reverse engineer CRYPTOCard software, or allow others to do so. Information needed to achieve interoperability with products from other manufacturers may be obtained from CRYPTOCard upon request. This manual, as well as the software described in it, is furnished under license and may only be used or copied in accordance with the terms of such license. The material in this manual is furnished for information use only, is subject to change without notice, and should not be construed as a commitment by CRYPTOCard. CRYPTOCard assumes no liability for any errors or inaccuracies that may appear in this document. Except as permitted by such license, no part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic, mechanical, recording or otherwise, without the prior written consent of CRYPTOCard. CRYPTOCard reserves the right to make changes in design or to make changes or improvements to these products without incurring the obligation to apply such changes or improvements to products previously manufactured. The foregoing is in lieu of all other warranties expressed or implied by any applicable laws. CRYPTOCard does not assume or authorize, nor has it authorized any person to assume for it, any other obligation or liability in connection with the sale or service of these products. In no event shall CRYPTOCard or any of its agents be responsible for special, incidental, or consequential damages arising from the use of these products or arising from any breach of warranty, breach of contract, negligence, or any other legal theory. Such damages include, but are not limited to, loss of profits or revenue, loss of use of these products or any associated equipment, cost of capital, cost of any substitute equipment, facilities or services, downtime costs, or claims of customers of the Purchaser for such damages. The Purchaser may have other rights under existing federal, state, or provincial laws in the USA, Canada, or other countries or jurisdictions, and where such laws prohibit any terms of this warranty, they are deemed null and void, but the remainder of the warranty shall remain in effect. Customer Obligation Shipping Damage: The purchaser must examine the goods upon receipt and any visible damage should immediately be reported to the carrier so that a claim can be made. Purchasers should also notify CRYPTOCard of such damage. The customer should verify that the goods operate correctly and report any deficiencies to CRYPTOCard within 30 days of delivery. In all cases, the customer should notify CRYPTOCard prior to returning goods. Goods returned under the terms of this warranty must be carefully packaged for shipment to avoid physical damage using materials and methods equal to or better than those with which the goods were originally shipped to the purchaser. Charges for insurance and shipping to the repair facility are the responsibility of the purchaser. CRYPTOCard will pay return charges for units repaired or replaced under the terms of this warranty. Copyright Copyright 2007, CRYPTOCard Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of CRYPTOCard Inc. Trademarks CRYPTO-Server 6.4 Administrator s Manual viii CRYPTOCard, CRYPTO-Server, CRYPTO-Web, CRYPTO-Kit, CRYPTO-Logon, CRYPTO- VPN, CRYPTO-Shield, CRYPTO-MAS, are either registered trademarks or trademarks of CRYPTOCard Inc. Java is a registered trademarks of Sun Microsystems, Inc.; Microsoft Windows and Windows XP/2000/2003/NT are registered trademarks of Microsoft Corporation. SecurID is a registered trademark of RSA Security. All other trademarks, trade names, service marks, service names, product names, and images mentioned and/or used herein belong to their respective owners. Active Directory Application Mode (ADAM) 3

4 Table of Contents SOLUTION OVERVIEW... 2 ACTIVE DIRECTORY APPLICATION MODE IMPLEMENTATION OVERVIEW... 5 ACTIVE DIRECTORY APPLICATION MODE INSTALLATION... 6 INSTALLATION... 6 CREATING AN INSTANCE... 6 PREPARING ADAM SCHEMA FOR SYNCHRONIZATION ACTIVE DIRECTORY SCHEMA ANALYZER OVERVIEW LAUNCHING AND USING THE 'SCHEMAANALYZER' UTILITY LOADING ACTIVE DIRECTORY/ADAM SCHEMA LDF FILES LOADING ADAM SYNCHRONIZATION SCHEMA LDF FILE EDITING/CUSTOMIZING ADAM SYNCHRONIZATION CONFIG XML FILE CREATING THE ADAM SYNCHRONIZATION CONFIG XML FILE SAMPLE ADAM SYNCHRONIZATION CONFIG XML FILE MODIFYING THE SAMPLE ADAM SYNCHRONIZATION CONFIG XML FILE INSTALLING THE SAMPLE ADAM SYNCHRONIZATION CONFIG XML FILE RUNNING THE SYNCHRONIZATION FOR THE FIRST TIME USING CONFIG XML FILE DISABLING SSL AUTHENTICATION IN ADAM CREATING ADAM LDAP USER FOR CRYPTO-SERVER CONFIGURING ADAM TO AUTO SYNCHRONIZE ADAM MULTI DOMAIN SUPPORT CREATING AN OU FOR ADDITIONAL DOMAINS DISPLAYING CURRENTLY LOADED CONFIGURATIONS BATCH FILE EXAMPLE INSTALLING THE CRYPTO-SERVER USING ADAM PROXY USER CAVEATS Active Directory Application Mode (ADAM) 4

5 Active Directory Application Mode Implementation Overview This document presents an overview and necessary steps in implementing ADAM to act as a directory service and enable the CRYPTO-Server to take advantage of increased query speeds and multi domain user repositories. Active Directory Application Mode (ADAM) is part of Microsoft s fully integrated directory services available with Windows Server 2003, and is built specifically to address directory-enabled application scenarios. ADAM runs as a non-operating-system service, and as such does not require deployment on a domain controller. An ADAM server is installed and is configured to create a new instance (new domain). The ADAM server contacts the Active Directory server which houses all of your users. ADAM then synchronizes all users into the ADAM instance. Particular LDAP attributes for users are transferred and synchronized to your newly installed ADAM instance. During the installation of the CRYPTO-Server, the administrator selects to join the server to an LDAP server. He/She then provides all necessary connection information to the local ADAM installation. When the administrator accesses the CRYPTO-Console they are assigning tokens to users which reside within the local ADAM server installation. By using ADAM you can increase the speed at which users appear within the CRYPTO-Console. This is only a greater problem with organizations that have users which belong to many groups within Active Directory. Active Directory Application Mode (ADAM) 5

6 Active Directory Application Mode Installation Installation Note You must have downloaded the installer for ADAM from the Microsoft vendor website. Please reference the vendor address provided in the solution overview summary table. 1. Launch the ADAM installation application 2. At the initial installation screen, click 'Next' 3. At the license agreement screen, click the 'I agree' radio button followed by clicking 'Next' 4. The installer will now continue installing ADAM and should complete briefly. 5. Click 'Finish' to close the installer. Creating an instance The following instructions are used to create an instance (virtual LDAP domain) which your CRYPTO- Server will use to query the user information.. This user information is populated into your instance from the main LDAP server (Active Directory). 1. Browse to Start Menu a) Click Programs b) Click ADAM c) Click 'Create ADAM Instance' 2. On the Welcome to the Active Directory Application Mode Setup Wizard dialogue, click 'Next'. Figure 1.0 Active Directory Application Mode (ADAM) 6

7 3. On the Setup Options dialogue, you can choose whether to install a unique ADAM instance or join an existing configuration. Because you are installing the first ADAM instance, click 'A unique instance' (as shown in the following), and then click 'Next'. Later, you will create additional ADAM instances and join them in a configuration set. Figure Within the Instance Name dialogue, name your instance something similar to 'cryptoserver'. Note The 'instance name' will be used when creating the Windows service, so it is best to create something easily recognizable. Figure Within the Ports dialogue, select the 'LDAP port number'. Type in an unoccupied SSL port number. Note These instructions are designed not to use an SSL connection from LDAP to the CRYPTO-Server. You are only required to assign an unoccupied SSL port number to satisfy the service start up requirements. Selecting defaults of 389 and 636 are acceptable. If installation is performed on a domain controller, it will default to and respectively. Figure 1.3 Active Directory Application Mode (ADAM) 7

8 6. On the 'Application Directory Partition' dialogue; select 'Yes, create an application directory partition'. Create a partition with the name in the following syntax. : DC=cryptoserver,dc=YourForest,dc=com Example : DC=cryptoserver,dc=intel,dc=com Figure On the File Locations dialogue, verify the default file location is correct. After verifying, click 'Next'. Figure On the 'Service Account Selection' dialogue, select the 'Network service account' radio button. Click the 'Next' button. Figure 1.6 Active Directory Application Mode (ADAM) 8

9 9. On the 'ADAM Administrators' dialogue, select to use 'Currently logged on user SPARKS/Administrator'. Click on the 'Next' button. Note SPARKS also means Domain. Figure Within the 'Importing LDIF Files' dialogue, select the 'Import the selected LDIF files for this instance of ADAM'. Select the following file names from the 'Available Files' list: a) gg MS-InetOrgPerson.LDF b) MS-User.LDF c) MS-UserProxy.LDF Click the 'Add' button'. Figure 1.8 Click the 'Next' button. 11. On the 'Ready to Install' page, click the 'Next' button. Figure 1.9 Active Directory Application Mode (ADAM) 9

10 12. Upon the installer completing the installation, you will see a message that indicates that 'You have successfully completed the Active Directory Application Mode Setup Wizard'. Click the 'Finish' button. Section Finish You have now successfully created an ADAM instance. Active Directory Application Mode (ADAM) 10

11 Preparing ADAM Schema for Synchronization Active Directory Schema Analyzer Overview By completing the steps on page 4-9, you will have created and prepared your ADAM instance to accept LDAP information. During the setup of the ADAM instance, you told it to load 3 LDF files. These 3 LDF files provide the ADAM instance information pertaining to particular LDAP object classes, and attributes and help it understand as to what its default schema should look like. However, the three provided LDF files do not provide ALL needed information. You are required to use a utility provided by Microsoft called 'adschemaanalyzer' (Ad Schema Analyzer), which analyzes your current LDAP schema and what is currently in the local ADAM schema. It will create an LDF file with all the missing object classes and attributes in ADAM so that your synchronization can be successfully performed. Launching and using the 'Schemaanalyzer' utility 1. Launch the ADAM Tools Command Prompt by browsing to : Start Menu > Programs > ADAM > ADAM Tools Command Prompt Figure The schema analyzer tool will now appear, and will start with a blank white screen. 3. Within the AD Schema Analyzer, click on 'File' from the drop down menu select 'Load target schema...' Figure 2.1 Figure 2.2 Active Directory Application Mode (ADAM) 11

12 4. Enter in the following connection information for your Active Directory LDAP server. a) Server IP & Port number b) Administrative Username c) Password for that username d) FQDN of your domain (example: intel.com) Select the 'Secure' radio button in the 'Bind type' section. Select 'Active Directory' in the 'Server type' section. Figure 2.3 After entering in all needed information, click the 'Ok' button. Note After clicking the 'Ok' button, you will notice it analyze your LDAP target schema. You should see something similar to the following. You may have differing attributes, classes, and property set values. Figure Within the AD Schema Analyzer, click on the 'File' menu, and then select 'Load base schema...' Figure 2.5 Active Directory Application Mode (ADAM) 12

13 6. Enter in the following connection information to connect to the LOCAL ADAM server. a) IP & Port of the network loopback Select the 'Secure' radio button in the Bind type section. Select 'Active Directory' in the Server type section. Click the 'Ok' button, after entering in all needed information. Figure 2.6 Note I. For the local ADAM instance, no other credentials are needed in order to connect. The server & port are the only requirements. After clicking the 'Ok' button, you will notice the application display how many attributes, classes and property sets it found. Figure Within the AD Schema Analyzer, click on the 'Schema' menu, and then select 'Mark all nonpresent elements as included' Figure Within the AD Schema Analyzer, click on the 'File' menu, and select 'Create LDIF file...' Figure 2.9 Active Directory Application Mode (ADAM) 13

14 9. In the 'Save As' window, name the LDF file something recognizable because this file is used later on in this guide. Section Finish You have now created a custom schema LDF file to load into ADAM. This file will be used in the next section. Active Directory Application Mode (ADAM) 14

15 Loading Active Directory/ADAM Schema LDF Files 1. Loading custom created LDF File 2. Launch the ADAM Command Prompt and issue the following command: ldifde -i -s localhost -c CN=Configuration,DC=X #ConfigurationNamingContext -f adschema.ldf After executing the command, it will show the following text output: Connecting to "localhost" Logging in as current user using SSPI Importing directory from file "adschema.ldf" Loading entries... Note adschema.ldf is the filename used from the previous section when we created a custom LDF file with all schema differences. If you used a different name, please change the filename used in the command listed above. After running the command, you will receive a message in the command line as follows: (Number of entries modified may be different) Figure 3.0 Loading ADAM Synchronization Schema LDF File 1. Launch the ADAM Command Prompt and issue the following command: ldifde -i -s localhost -c CN=Configuration,DC=X #ConfigurationNamingContext -f MS- AdamSyncMetaData.ldf After executing the command, it will show the following text output: Connecting to "localhost" Logging in as current user using SSPI Importing directory from file "MS-AdamSyncMetaData.ldf" Loading entries... After it loads its entries for the Adam Sync Meta Data, it should indicate to you exactly like the previously loaded custom LDF file that 'The command has completed successfully' Note The MS-AdamSyncMetaData.LDF is located in the C:\Windows\ADAM by default and is provided with the installation of ADAM. Section Finish You have now loaded in the 2 needed LDF files to allow ADAM to synchronize with your Active Directory LDAP server. Active Directory Application Mode (ADAM) 15

16 Editing/Customizing ADAM Synchronization Config XML File Creating the ADAM Synchronization Config XML File The following instructions show you how to create an ADAM Synchronization file. You will use this created file to indicate to ADAM what object types and attributes you would like it to synchronize from an LDAP server ADAM requires a special file in order to determine what information it should synchronize from Active Directory. This file contains Distinguished Name (DN's) locations as to where the information is coming from and where it should be going to. It also contains information as to what attributes it should synchronize. This file is loaded into ADAM using a special command, and is used by any subsequent automated synchronizations. 1. Open Notepad: (Start > All Programs > Accessories > Notepad) 2. Copy and paste the text below into a new notepad file 3. Save the file as AdamSyncConf.xml in C:\Windows\ADAM Sample ADAM Synchronization Config XML file <?xml version="1.0"?> <doc> <configuration> <description>cryptocard User Accounts</description> <security-mode>object</security-mode> <source-ad-name>ms-2k3-dc</source-ad-name> <source-ad-partition>dc=sparks,dc=com</source-ad-partition> <source-ad-account>administrator</source-ad-account> <account-domain>sparks.com</account-domain> <target-dn>dc=cryptoserver,dc=sparks,dc=com</target-dn> <query> <base-dn>dc=sparks,dc=com</base-dn> <object-filter>(objectclass=user)</object-filter> <attributes> <include>objectsid</include> <include>sourceobjectguid</include> <include>lastagedchange</include> <include>displayname</include> <include>description</include> <include>mail</include> <include>member</include> <include>memberof</include> <include>mobile</include> <include>samaccountname</include> <include>cn</include> <include>givenname</include> <include>sn</include> <include>telephonenumber</include> <include>ou</include> <include>objectclass</include> <include>objectcategory</include> <include>distinguishedname</include> <include>whenchanged</include> <include>whencreated</include> <include>objectguid</include> <include>usnchanged</include> <include>usncreated</include> <include>instancetype</include> <include>lastagedchange</include> <include>name</include> Active Directory Application Mode (ADAM) 16

17 <include>countrycode</include> <include>info</include> <include>pwdlastset</include> <include>userparameters</include> <include>badpasswordtime</include> <include>lastlogoff</include> <include>primarygroupid</include> <include>codepage</include> <include>logoncount</include> <include>useraccountcontrol</include> <include>badpwdcount</include> <include>lastlogon</include> <exclude></exclude> </attributes> </query> <schedule> <aging> <frequency>0</frequency> <num-objects>0</num-objects> </aging> <schtasks-cmd></schtasks-cmd> </schedule> </configuration> <synchronizer-state> <dirsync-cookie></dirsync-cookie> <status></status> <authoritative-adam-instance></authoritative-adam-instance> <configuration-file-guid></configuration-file-guid> <last-sync-attempt-time></last-sync-attempt-time> <last-sync-success-time></last-sync-success-time> <last-sync-error-time></last-sync-error-time> <last-sync-error-string></last-sync-error-string> <consecutive-sync-failures></consecutive-sync-failures> <user-credentials></user-credentials> <runs-since-last-object-update></runs-since-last-object-update> <runs-since-last-full-sync></runs-since-last-full-sync> </synchronizer-state> </doc> Modifying the sample ADAM Synchronization Config XML File 1. The synchronization file contains 6 lines which need to be edited a) Hostname of the Active Directory Server (ensure it is resolvable by DNS) <source-ad-name>ms-2k3-dc</source-ad-name> b) Instance path of your Active Directory tree (Ex. sparks.com translates into...) <source-ad-partition>dc=sparks,dc=com</source-ad-partition> c) Username of user who has Administrative privileges <source-ad-account>administrator</source-ad-account> d) Domain name of Active Directory (Step 2 translates into sparks.com) <account-domain>sparks.com</account-domain> e) Local ADAM LDAP Distinguished name (Reference step 6 during installation procedures) <target-dn>dc=cryptoserver,dc=sparks,dc=com</target-dn> f) Remote LDAP Distinguished Name your Active Directory Server <base-dn>dc=sparks,dc=com</base-dn> Active Directory Application Mode (ADAM) 17

18 Note Here is Microsoft's explanation of the values in the event if the above explanation is not adequate or is not clear. The following is taken out of the ADAM quick start guide produced by Microsoft. Replace the value of <source-ad-name> with the name of the source Active Directory domain controller, for example, <source-ad-name>seattledc1</source-ad-name>. Replace the value of <source-ad-partition> with the distinguished name of the source domain, for example, <source-ad-partition>dc=fabrikam,dc=com</source-ad-partition>. Replace the value of <source-ad-account> with the name of an account in the Domain Admins group of the source domain, for example, <source-ad-account>administrator</source-ad-account>. Replace the value of <account-domain> with the fully qualified name of the source domain, for example, <account-domain>fabrikam.com</account-domain>. Replace the value of <target-dn> with the name of the partition of the target ADAM instance, in this case, <target-dn>o=microsoft,c=us</target-dn>. Replace the value of <base-dn> with the base distinguished name of the source domain, for example, <base-dn>dc=fabrikam,dc=com</base-dn>. Installing the sample ADAM Synchronization Config XML File The following instructions will show you how to install the configuration file you just created. You will use the file you created in the previous section named AdamSyncConf.xml file located in C:\Windows\ADAM. 1. ADAMSync /install localhost:389 %windir%\adam\adamsyncconf.xml 2. After running the command, it should move to the next line and display 'Done.' Optionally: If you have a second domain XML file, please use the same command above only and specify the appropriate file name. Running the Synchronization for the first time using config XML file The following instructions in this section will show you how to run the synchronization for the first time. 1. Create a directory on the C:\ drive named 'ADAMLogs'. This directory will hold all synchronization logs. 2. ADAMSync /fs localhost:389 "dc=cryptoserver,dc=sparks,dc=com" /log C:\ADAMLogs\sync.log Optional Additional Domain:... "OU=Domain2,dc=cryptoserver,dc=sparks,dc=com" /log C:\ADAMLogs\syncDomain2.log WARNING Synchronization of data from your current Active Directory to the newly created ADAM instance can take from 5 minutes to 5 hours depending on how many users you have within Active Directory. Please monitor your ADAM Sync log in C:\AdamLogs\sync.log as it can grow in size rapidly and cause low disk space. Active Directory Application Mode (ADAM) 18

19 Disabling SSL Authentication in ADAM The following section shows you how to disable SSL authentication into ADAM. This is needed to allow the CRYPTO-Server to bind (authenticate) to the ADAM instance without requiring a certificate. The CRYPTO-Server and ADAM instance reside on the same machine and will never be communicating outside of the server, so disabling SSL authentication is perfectly acceptable. In an environment where ADAM was a remote system, it would be recommended to use a certificate. 1. Open ADSI Edit by navigating to: Start Menu > Programs > ADAM > ADAM ADSI Edit 2. Click on the 'Action' menu, and then select 'Connect to...' 3. Give the connection a name. Chances are you will not have to use this utility again, but if you do, it is a good idea to keep a connection name. Connect to 'localhost'. Leave default port of 389, unless otherwise. Select 'Configuration' in the Well-known naming context drop down. Select the 'The account of the currently logged on user' radio button in the connect using these credentials section. Click the 'Ok' button. Figure 4.0 Figure 4.1 Active Directory Application Mode (ADAM) 19

20 4. Expand the Adam Instance and expand CN=Configuration,CN= Expand CN=Services, then CN=Windows NT 6. Right-click CN=Directory Service, and Click 'Properties'. Figure In the Attributes list, find msds-other- Settings, and click the 'Edit' button. Figure 4.3 Active Directory Application Mode (ADAM) 20

21 8. In Values, click RequireSecureProxyBind=1, and then click 'Remove'. 9. It will then move the text up to the Value to add box. Change the 1 to a 0, and then click the 'Add' button. Then click the 'OK' button, and then click the 'OK' button again. Figure 4.4 Section Finish You have now finished disabling SSL authentication for this ADAM instance. This is required to allow the CRYPTO-Server installer to connect to the ADAM instance without requiring a certificate. Active Directory Application Mode (ADAM) 21

22 Creating ADAM LDAP User for CRYPTO-Server 1. Launch the ADAM Tools command prompt from Start Menu ADAM ADAM Tools Command Prompt 2. Type in 'ldp' and then press enter. The LDP application will then appear. Figure Click the 'Connect' menu, and select 'Connect'. Figure In Server box, type in 'localhost', and then press the 'OK' button. Note After you hit the 'OK' button, you should see technical LDAP information appear on the right hand window Figure Active Directory Application Mode (ADAM) 22

23 5. Click on the 'Connect' menu again, and select 'Bind'. Figure Under 'Bind type', select 'Bind as currently logged on user'. Click on the 'OK' button. Figure After you click the 'OK' button; on the right hand side bottom pane, the words 'Authenticated as: MACHINENAME/Username' appear. Figure Active Directory Application Mode (ADAM) 23

24 8. Click on the 'View' menu and select 'Tree'. Figure In the Base DN field, select the root of your domain. It will be the value you configured while creating your ADAM instance. Click the 'OK' button. Figure Click on the ADAM instance DN on the left PANE, and then select 'Browse'. From the drop down menu select 'Add child'. Figure In the Dn: field, enter in the following: CN=adamproxoy,DC=cryptoserver,DC=domain,DC =com Note The above Green text needs to match your ADAM instance name you created. 12. In attribute enter: ObjectClass 13. In Values enter: userproxy 14. Press the 'Enter' button. Figure Active Directory Application Mode (ADAM) 24

25 15. Open the ADAM command prompt. 16. Right click in the DOS screen, and select 'Properties' 17. Check the 'QuickEdit Mode' check box. Figure Click 'OK', and select to only apply this change to the current window. 19. In the current DOS window, type the following command in: whoami /user 20. Copy the SID number, by highlighting the number and then right click on the number so that the highlight then disappears. This will indicate you have copied this value to the clip board. 21. Returning back to the Add Child attribute/value dialogue, enter in the following new Attribute and Value 22. In attribute enter objectsid 23. In Value enter Ctrl-V (Paste In SID) 24. Click on the 'Run' button, followed by the 'Close' button. Note For the objectsid value, you are pasting in what you have copied from the DOS window in step 21. Section Finish You have now completed the steps needed to add a proxy user into ADAM. This user is used by LDAP applications (CRYPTO-Server) to bind to the LDAP server via a proxied SID from the user which was explicitly set as the Administrative user (Currently logged on user). Active Directory Application Mode (ADAM) 25

26 Configuring ADAM to auto synchronize To have ADAM auto synchronize based on a schedule, you will need to achieve this using a scheduled task within the Windows server and a batch file. Use the following command in your batch file to automate the sync: ADAMSync /sync localhost:389 "DC=cryptoserver,DC=Domain,DC=com" /log C:\adamlogs\autoSync.log Specify within the scheduled task when and how often you would like this command to run. You are specifying how often you want ADAM to synchronize your user information. [Optional Second Domain] ADAMSync /sync localhost:389 "OU=Domain2,DC=cryptoserver,DC=Domain,DC=com" /log C:\adamlogs\autoSync.log Note ADAMSync /sync localhost:389 "OU=Domain2,DC=cryptoserver,DC=Domain,DC=com" /log C:\adamlogs\autoSyncDomain2.log The above noted must have an associated XML synchronization file installed prior to telling it to sync pointing to the: OU=Domain2 as a <target-dn>. Active Directory Application Mode (ADAM) 26

27 ADAM Multi Domain Support There may be times where you want to pull users from more than 1 Active Directory domain. This can be achieved by manually loading in a separate synchronization XML file into the ADAM instance which is configured to pull information from a second domain. Creating an OU for additional Domains 1. Create an OU within your ADAM instance for the second domain information: a. Open ADAM ADSI Edit b. Connect to the Distinguished Name (DN) of your adam instance (ex. DC=cryptoserver,DC=sparks,DC=com) c. Right click the base DN (top of the domain) and select New Object d. Select OrganizationalUnit e. Give the OU a name of Domain2 2. In the second domain's XML synchronization file, edit: <target-dn>ou=domain2,dc=cryptoserver,dc=sparks,dc=com</target-dn> 3. Edit other settings within the second XML file as needed. For example, when you installed the XML file by using the command: ADAMSync /install localhost:389 %windir%\adam\adamsyncconf.xml It loads in what it should be synchronizing for one particular domain. You will need to create another AdamSyncConf.xml such as AdamSyncConf-domain2.XML with new settings pointed at a new domain referencing a <target-dn> of the new ADAM instance 'Domain2' OU. Active Directory Application Mode (ADAM) 27

28 Displaying Currently Loaded Configurations To display the currently loaded ADAM synchronization files perform the following: 1. Open the ADAM Command Prompt 2. Issue command AdamSync /list localhost:389 It should list something similar to this: C:\WINDOWS\ADAM>ADAMSync /list localhost:389 Listing configuration files: > "DC=cryptoserver,DC=sparks,DC=com": CRYTPOCard User Accounts -> "OU=Domain2,DC=cryptoserver,DC=sparks,DC=com": CRYTPOCard User Accounts Done. Note If you want ADAM to synchronize information from both domains at a given time interval, you will need to ensure that all needed XML files have been loaded and have been both told to do a full sync /fs. Batch File Example Example: Line 1 Line 2 ADAMSync /sync localhost:389 "DC=cryptoserver,DC=Domain,DC=com" /log C:\adamlogs\autoSyncDomain1.log ADAMSync /sync localhost:389 "OU=Domain2,DC=cryptoserver,DC=Domain,DC=com" /log C:\adamlogs\autoSyncDomain2.log Line Explanations: Line 1 Line 2 This line synchronizes changes from Domain 1 into ADAM top DN This line synchronizes changes from Domain 2 into ADAM Domain2 OU Section Finish You have now learned how to implement multi domain user repositories for an ADAM instance. Active Directory Application Mode (ADAM) 28

29 Installing the CRYPTO-Server using Adam proxy user Now that you have completed all the steps necessary to all the CRYPTO-Server to use ADAM, you need to install the CRYPTO-Server. During the install you will need to provide particular LDAP authentication information, and it differs slightly from using stand alone Active Directory. Note For more detailed installation instructions of the actual CRYPTO-Server, please follow section 2.4 (page 11) of the CRYPTO-Server 6.4 Administrators Manual. Step 7 of this guide is where we are going to be changing the syntax of authentication parameters slightly. 1. During step 7 of the CRYPTO-Server installation instructions, please enter the following information to successfully connect the server to ADAM. Please ensure you have selected the Base DN as the root of the newly created ADAM instance (Ex. intel.com, NOT CN=Configuration,DC=intel,DC=com) Hostname localhost Port 389 Base DN [Dependant on fetched DN of ADAM instance] User DN CN=adamproxy Password [Password of currently logged on Administrator] Figure Check the 'Append Base DN to User DN' check box. 3. You can now complete the remaining steps in the installation guide. Section Finish You have now finished the instructions on installing the CRYPTO-Server. Active Directory Application Mode (ADAM) 29

30 Caveats 1. Container names which you synchronize from one domain cannot be the same on subsequent domains if using ADAM for multi domain support within the same BASE DN. Example: Users and Users cannot exist within the same Container. Rename one of them to Users and Users2. When importing users within the same Container name, ADAM will rename the container to a random name. It is recommended that you create a separate Container within ADAM and when synchronizing data from the second domain to indicate within the synchronization XML file that the BASE DN is within the newly created container. This will allow you to have two completely separate sets of LDAP information easily stored within ADAM. Example: I create an OU within ADAM called 'Domain2'. In my second domain XML file, I indicate that the base DN is: CN=Domain2,DC=cryptoserver,DC=sparks,DC=com 2. A user that exists in ADAM can never be flagged to use a Static password as their token password. Example: 'Allow user to authenticate' will not function. 3. Usernames MUST be different throughout multiple domains globally within the CRYPTO-Server. Active Directory Application Mode (ADAM) 30