Instructor Active Directory Configuration for Lab Configuring LDAP Authentication with SmartDirectory for NGX I

Transcription

1 Instructor Active Directory Configuration for Lab Configuring LDAP Authentication with SmartDirectory for NGX I

2 CONFIGURING ACTIVE DIRECTORY SERVER This document is provided for installation and configuration of the Active Directory Server, and is primarily for instructor reference in configuring CONFIGURE ACTIVE DIRECTORY SERVER Use the Active Directory Setup wizard, to configure Active Directory Server: 1. Launch the Active Directory Setup wizard, by running the dcpromo command from Start > Run. Or run the Active Directory Setup wizard, using the Manage Your Server applet from Start > Programs > Administrative Tools. 2. Follow the wizard s operating-system prompts, accepting the defaults and entering the Administrator password of the server. 3. When prompted for DNS information, choose to install and configure DNS. 4. When prompted for the FQDN of the domain, use yourcity.cp. 5. After the installation is completed, click I will Restart Later. 6. Select Start > Administrative Tools > DNS. 7. In the DNS Microsoft Management Console (MMC), right-click the DNS object, and select Properties. The yourcity Properties screen opens after a few minutes. 8. Select Root Hints, and add yourcity.cp and IP address. 9. Wait a few minutes, then remove all other root-server listings. Click Apply and wait. Do not do the above in a real-world environment. DNS is set up as part of the Active Directory installation process. Pointing your server back to itself for a DNS root will prevent the login window from taking an extremely long time on reboot. 2

3 10. Click Apply and OK. 11. Reboot the server. DELEGATE CONTROL OF ACTIVE DIRECTORY TREE Delegating control over the directory to a specific user or group is an important step. By default, the Security Administrator is not allowed to modify the schema, or even manage directory objects, through the LDAP protocol. To delegate control over the directory, follow these steps: 1. Open the Active Directory Users and Computers Control Microsoft Management Console (MMC). 2. Right-click the domain name displayed in the left pane, and choose Delegate Control from the menu. The Delegation of Control wizard appears. 3. Add the Administrator (or another user from the Security Administrators group) to the list of users who can control the directory. 4. Select the Join a computer to the domain and Manage Group Policy links, and click Next. 5. Click Finish, and reboot. VIEW ACTIVE DIRECTORY SCHEMA To change and modify the schema on the Windows Server 2003 machine with MMC, the file schmmgmt.dll must be registered in the system registry. 1. Run the following command from Start > Run: regsvr32 schmmgmt.dll The message that this DLL file was successfully registered appears. Add the Active Directory Schema snap-in to an MMC that allows you to view the Active Directory Schema: 2. From Start > Run, type mmc and press Enter. Do not modify the Active Directory Schema manually. Incorrect syntax can lead to misconfiguration. 3

4 3. Select Console from the MMC menu, and choose Add/Remove Snap-in. 4. Click Add, and choose Active Directory Schema. 5. Click Add, and click Close. 6. Click OK, to activate the Active Directory Schema MMC. 7. Right-click Active Directory Schema in the Console Root window, and choose Operations Master. 8. Verify that the FQDN of the system is defined as the current schema master, and set full control permissions to the Administrator account in the Permissions menu. In some cases, an additional modification to the Windows Registry is necessary. Add a new registry DWORD key named SchemaUpdateAllowed with a value of 1 to HKLM\System\CurrentControlSet\Services\NTDS\Parameters. ACTIVATE CERTIFICATE FOR SSL COMMUNICATIONS (OPTIONAL) The communication between SmartDirectory and the Active Directory server is SSL based. To activate strong SSL, you will add a Certificate to your Active Directory Server: 1. Add Certificate Services through the Add/Remove Windows Components. 2. Follow the prompts in the wizard, and select Enterprise Root CA. Click Next. 3. Use yourcity.cp and your personal information for the CA identification fields. Click Next. 4. Click Next at the default installation locations of the Certification database and database log. The installation finishes. 5. Select Start > Administrative Tools > Certification Authority. 6. Select Domain Controller Authentication from the templates list. At this point, the server will work with Strong SSL. 4

5 CREATE ACTIVE DIRECTORY USERS FOR EACH CITY SITE Active Directory is used to store user-login information. This section describes how to use Active Directory wizards to create city-site user objects, so each city can test Client Authentication. 1. From Start > Applications > Administrative Tools, open the Active Directory Users and Computers Tool. 2. Right-click Users in the yourcity.cp tree in the left of the MMC frame, and select New > User. The New Object - User wizard starts. 3. Create user objects for each city site, by populating the referenced fields in the wizard with the following information: First Name User Login Name Password webdallas dallas abcd1234 webrome rome abcd1234 webtoronto toronto abcd1234 weboslo oslo abcd1234 webmadrid madrid abcd1234 webzurich zurich abcd1234 webcambridge cambridge abcd1234 websydney sydney abcd1234 websingapore singapore abcd1234 The password abcd1234 is used instead of abc123, due to the default minimum password-length settings in the Windows Server 2003 Active Directory domain-controller setup. 5

6 EXTEND ACTIVE DIRECTORY SCHEMA The following information is for extending the schema in Microsoft Active Directory, if SmartDirectory is to be used to actively manage user information there. The definitions of all NGX attributes in LDIF format are contained in the schema_microsoft_ad.ldif file, located in the $FWDIR/lib/ldap directory. Do the following: 1. Edit schema_microsoft_ad.ldif, and replace all instances of DOMAINAME with the specific domain root of your organization. Check Point recommends using an editor that will not modify the formatting of this file, such as vi or the set command. For example if your domain is oslo.cp, replace DOMAINAME with DC=oslo,DC=cp. SCHEMA_MICROSOFT_AD.LDIF FILE EXAMPLE dn:cn=fw1auth-method, CN=Schema,CN=Configuration, DOMAINAME changetype: add admindisplayname: fw1auth-method attributeid: attributesyntax: cn: fw1auth-method distinguishedname: CN=fw1auth-method,CN=Schema,CN=Configuration, DOMAINAME instancetype: 4 issinglevalued: FALSE ldapdisplayname: fw1auth-method name: fw1auth-method objectcategory: CN=Attribute-Schema, CN=ConfigurationCN=Schema,CN=Configuration, DCROOT objectclass: attributeschema omsyntax: 20 rangeupper: 256 6

7 2. After modifying the file, run ldapmodify on the SmartCenter Server (not the Active Directory server), to load the LDIF into the Active Directory. For example, if you use the Administrator account of the DC=oslo,DC=cp domain, the syntax is as follows: ldapmodify -c -h <Full Domain Controller DNS Name or DC IP address> -D cn=administrator,cn=users,dc=oslo,dc=cp" -w <Administrator s password> f c:\windows\r60\fw1\lib\ldap\schema_microsoft_ad.ldif On SecurePlatform, use this directory: $FWDIR/lib/ldap/schema_microsoft_ad.ldif 3. In the Active Directory Schema MMC on the Domain Controller, reload the schema, by selecting Action > Reload the Schema. Verify that the new NGX classes are added to the Active Directory schema: fw1person fw1template 7

8 8