On-Premises Active Directory

You can integrate Harmony SASE with Active Directory/LDAP through the Active Directory/LDAP connector installed on your network. The Active Directory/LDAP connector serves as a bridge between Active Directory and the Harmony SASE service.

Note - For high availability and load balancing, you can install multiple instances of the connector. All connections are outbound from the connector to Harmony SASE Agent, so changes to your firewall are generally unnecessary.

Enabling Active Directory/LDAP Connection

1. Access the Harmony SASE Administrator Portal and click Settings > Identity Providers.

   The Identity Providers page opens.

   

2. Click Add Provider.

   

3. Select Active Directory / LDAP.

4. Click Continue.

   

5. In the List of domains names field, enter the domain name to allow log in to the Active Directory/LDAP connection. For example, quantumsase.com.

6. To find your domain name:

   1. Open Control Panel on your computer.

   2. Go to System and Security > System > Advanced system settings.

      The System Properties window appears.

   3. Go to the Computer Name tab to find your domain name.

7. Click Done.

   The Edit Active Directory / LDAP connection window appears.

   

8. To copy the Ticket URL, click Copy Link.

   This Ticket URL is required when you are linking to Harmony SASE.

9. Click Install Windows Agent and follow the instruction to download the Auth0 Active Directory/LDAP Connector for Windows file, see Download the Installer.

   The MSI file gets downloaded.

10. Locate the downloaded MSI file, run the installer, and follow the instructions.

    

    Note - The Connector can be installed on an existing server, even a Domain Controller. However, more often it is installed on virtual machines provisioned just for the Connector.

    The AD/LDAP connector is installed as a Windows Service.

    

    The Auth0 window appears, once the installation is complete.

    

Link to Harmony SASE and LDAP

1. To link Harmony SASE:

   1. In the Ticket URL field, enter the URL. See step 8 in Enabling Active Directory/LDAP Connection.

   2. Click Continue.

   

   Note - If you receive an Unable to get local issuer certificate error message, set an environment variable NODE_TLS_REJECT_UNAUTHORIZED with value 0 in your windows system, and then restart the two Auth0 services. For more information, see Creating and Modifying Environment Variable in Windows.

2. To link LDAP, enter these:

   1. LDAP Connection String - Domain name or IP address of your LDAP server. For example, Idap://<my company>.com/

      Note - Your LDAP server is the local domain controller where Active Directory is installed. The protocol can be either LDAP or LDAPS. To use LDAPS, make sure that the certificate is valid in the current server.

   2. Base DN - Base container for all the queries performed by the connector. For example, dc=<my company>,dc=com

   3. Username - Full name of the user with administrator rights to perform queries. For example, cn=<domain name>,dc=<my company>,dc=com

   4. Password - Password of the user.

      

3. Click Save.

   The connector performs a series of tests. Make sure all tests result appear OK.

   

4. Find the AD/LDAP connector's config.json file in this location:

   C:\Program Files (x86)\Auth0\AD LDAP Connector

5. Open the config.json file in a text editor and add this after the second line:

   "LDAP_USER_BY_NAME": "(mail={0})",

   

6. Go to File and then click Save to save the config.json file.

7. Go to Properties > General.

   

8. In the First name field, enter the user name.

   In the E-mail field, enter email id of the user.

9. Click OK.

10. Restart the AD/LDAP Connector service.

    

11. To prevent unauthenticated LDAP bind requests (unauthorized access to directory information and protecting sensitive data from potential exploitation):

    1. Open ADSI Edit (press Win + R, type adsiedit.msc, and press Enter).

    2. In ADSI Edit, right-click on ADSI Edit at the top of the left navigation pane and select Connect to.

    3. Connect to the Configuration Naming Context.

    4. In the left navigation pane, expand Configuration > Services > Windows NT.

    5. Right-click Directory Service and select Properties.

    6. In the Attributes list, find msDS-Other-Settings.

    7. Select msDS-Other-Settings and click Edit.

    8. In the Value to add field, enter DenyUnauthenticatedBind=True and click Add.

    9. Click OK to save your changes.