Print Download PDF Send Feedback

Previous

Next

Active Directory Authentication

In This Section:

Endpoint Security Active Directory Authentication

Configuring Active Directory Authentication

UPN Suffixes and Domain Names

Configuring Alternative Domain Names

Troubleshooting Authentication in Server Logs

Troubleshooting Authentication in Client Logs

Endpoint Security Active Directory Authentication

When an Endpoint Security client connects to the Endpoint Security Management Server, an authentication process identifies the endpoint client and the user currently working on that computer.

The Endpoint Security system can function in these authentication modes:

The authentication process:

  1. The Endpoint Security client (1) requests an authentication ticket from the Active Directory server (2).
  2. The Active Directory server sends the ticket (3) to the client (1).
  3. The client sends the ticket to the Endpoint Security Management Server (4).
  4. The Endpoint Security Management Server returns an acknowledgment of authentication to the Endpoint Security client (1).

The default behavior after Security Management Server installation is Unauthenticated mode. It is recommended that you use this mode when you are evaluating Endpoint Security, in a lab environment. Change to Strong Authentication mode just before moving to a production environment. It is not recommended to continue to work in Unauthenticated mode after moving to production in a live environment.

Important - If you use Active Directory Authentication, then Full Disk Encryption and Media Encryption & Port Protection are only supported on endpoint computers that are part of Active Directory.

If you have endpoint computers in your environment that are not part of Active Directory, Full Disk Encryption and Media Encryption & Port Protection will not work on them.

Configuring Active Directory Authentication

Make sure you configure Strong Authentication for your production environment. Do not set up Strong Authentication before you are ready to move to production. When you are ready to move to production, follow this process.

Workflow for Configuring Strong Authentication:

  1. Configure the Active Directory Server for authentication.
  2. Configure the Authentication Settings in SmartEndpoint.
  3. Save you changes in SmartEndpoint.

Step 1 of 3: Configuring the Active Directory Server for Authentication

Endpoint Security Strong Authentication uses the Kerberos network authentication protocol.

To enable the Active Directory server to validate the identity of clients that authenticate themselves using Kerberos, run the ktpass.exe command on the Active Directory Server. By running the ktpass command, you create a user that is mapped to the ktpass service. This creates a Principal Name for the AD server. The Principal Name must have the following format: ServiceName/realm@REALM

Important - After you create the user that is mapped to the ktpass service, do not make changes to the user. For example, do not change the password. If you do change the user, the key version increases and you must update the Version Key in the New Authentication Principal Properties window in SmartEndpoint.

To prepare the Active Directory Server for authentication:

  1. On the Active Directory Server, go to C:\Windows\System32 and run ktpass.exe.
  2. Go to Start > All Programs > Administrative Tools > Active Directory Users and Computers.
  3. Create a domain user and clear the User must change password at next logon option.
  4. Run this command to map a service to a user:

    Syntax:

    ktpass princ ServiceName/realm@REALM mapuser <userName>@REALM pass <userPass> out <name of outFile>

    Example:

    ktpass princ tst/nac1.com@NAC1.COM mapuser auth-user@NAC1.COM pass 123456 out outfile.keytab

    Explanations:

    Syntax

    Example value

    Explanation

    ServiceName

    tst

    Name of the service.

    realm

    nac1.com

    Domain name of the Active Directory server. The first instance is in lower case. The second in upper case.

    <userName>

    auth-user

    The Active Directory domain user.

    <userPass>

    123456

    Password for user.

    <name of outFile>

    outfile.keytab

    Name of the encrypted keytab file.

  5. Save the console output to a text file. See the version number (vno) and encryption type (etype).

    sample output:

    Targeting domain controller: nac1-dc.nac1.com

    Successfully mapped tst/nac1.com to auth-user.

    WARNING: pType and account type do not match. This might cause problems.

    Key created.

    Output keytab to outfile.log:

    Keytab version: 0x502

    keysize 74 tst/nac1.com@NAC1.COM ptype 0 (KRB5_NT_UNKNOWN) vno 7 etype 0x17 (RC4-HMAC) keylength 16 (0x32ed87bdb5fdc5e9cba88547376818d4)

    Important - We recommend that you do not use DES-based encryption for the Active Directory Domain Controller server, as it is not secure. If you choose to use DES encryption and your environment has Windows 7 clients, see sk64300.

    Notes -

    • Make sure that the clock times on the Endpoint Security servers and the Kerberos server are less than 5 minutes apart. If difference in the clock times is more than 5 minutes, a runtime exception shows and Active Directory authentication fails. On Gaia, use NTP or a similar service.
    • To use Capsule Docs with Single Sign-on, disable User Access Control on Windows Active Directory Servers.

     

Step 2 of 3: Configuring Authentication Settings

Configure the settings in SmartEndpoint for client to server authentication.

Important - Use the Unauthenticated mode only for evaluation purposes. Never use this mode for production environments. Configure the authentication settings before moving to production.

How the Authentication Settings are Used in Deployment Packages

When you configure client package profiles, you choose an authentication account. The SSO Configuration details are included in the client deployment package, allowing the server to authenticate the client.

To configure authentication settings:

  1. In SmartEndpoint open Manage > Endpoints Authentication Settings.

    The Authentication Settings Properties window opens.

  2. Click Add.

    The New Authentication Principal Properties window opens.

  3. Enter the details from the output of ktpass.exe, that you configured in Step 1 of 3: Configuring the Active Directory Server for Authentication:

    Field

    Description

    Domain name

    Active Directory domain name.

    For example: nac1.com

    Principle Name

    Authentication service name in the format: ServiceName/realm@REALM

    This value must match the name that was configured in Active Directory > New Object.

    For example: tst/nac1.com@NAC1.COM

    Version Key

    Enter the version number according to the Active Directory output in the vno field.

    For example: 7

    Encryption method

    Select the encryption method according to the Active Directory output in the etype field.

    For example: RC4-HMAC

    Password

    Enter (and confirm) the password of the Active Directory Domain Admin user you created for Endpoint Security use.

    For example: 123456

  4. Click OK.
  5. When you are ready to work in Strong Authentication mode, select Work in authenticated mode in the Authentication Settings Properties window.
  6. Click OK.

Important - After turning on Strong Authentication, wait one minute before initiating any client operations.

It will take time for the clients and the Endpoint Security Management Server to synchronize. During this time, the environment will remain unauthenticated, and some operations will fail. The exact amount of time depends on the synchronization interval.

Step 3 of 3: Save Changes

After you have finished configuring strong authentication for Active Directory, save your changes.

  1. Go to the Policy tab of SmartEndpoint.
  2. In the Policy Toolbar, click Save

UPN Suffixes and Domain Names

The User Principal Name (UPN) is the username in "email format" for use in Windows Active Directory (AD). The user’s personal username is separated from a domain name by the "@" sign.

UPN suffixes are part of AD logon names. For example, if the logon name is administrator@ad.example.com, the part of the name to the right of the ampersand is known as the UPN suffix. In this case ad.example.com

When you configure a new user account in AD, you are given the option to select a UPN suffix, which by default will be the DNS name for your AD domain. It can be useful to have a selection of UPN suffixes available. If your AD domain name is ad.example.com, it might be more convenient to assign users a UPN suffix of example.com. To make additional UPN suffixes available, you need to add them to AD.

Configuring Alternative Domain Names

When configuring Strong Authentication for Active Directory communication between the Endpoint Security client and the Endpoint Security Management Server, you can configure multiple UPN suffixes for the Active Directory domain name.

To Configure Additional UPN Suffixes for Active Directory Authentication

  1. In SmartEndpoint open Manage > Endpoints Authentication Settings.

    The Authentication Settings Properties window opens.

  2. Click Add.

    The New Authentication Principal Properties window opens.

  3. In the Domain name field, enter the alternative Active Directory domain name. For example, if the previously configured domain name is nac1.com add an alternative domain name such as ad.nac1.com
  4. Configure the other fields with the same values as the previously configured authentication settings:
    • Principle Name
    • Version Key
    • Encryption Method
    • Password
  5. Click OK.
  6. Save the changes. Go to the Policy tab of SmartEndpoint, and in the Policy Toolbar, click Save

Troubleshooting Authentication in Server Logs

To troubleshoot problems related to Active Directory Authentication, use the Authentication log on the Endpoint Security Management Server or Endpoint Policy Server in $UEPMDIR/logs/Authentication.log.

To see full debugging information in the Authentication.log file on a Gaia server:

  1. On the Endpoint Security server, run: export TDERROR_ALL_KERBEROS_SERVER=5.
  2. Restart the Endpoint Security server. Run

    uepm_stop
    uepm_start

Results in Authentication.log

To turn off full debugging information on the Gaia server:

  1. On the Endpoint Security server, unset the debug variable:

    unset TDERROR_ALL_KERBEROS_SERVER

  2. Make sure that the output is empty:

    echo $TDERROR_ALL_KERBEROS_SERVER

  3. Restart the Endpoint Security server. Run

    uepm_stop
    uepm_start

Troubleshooting Authentication in Client Logs

The Authentication.log file for each Endpoint Security client is on the client computer at %DADIR%/logs.

A normal log is:

[KERBEROS_CLIENT(KerberosLogger_Events)] : Credentials acquired for John@ACME-DOM.COM
[KERBEROS_MESSAGE(KerberosLogger_Events)] : Message is Empty.
[KERBEROS_CLIENT(KerberosLogger_Events)] : Security context is not yet established.continue needed.

If the Authentication.log file on the client shows:

No authority could be contacted for authentication.

The Endpoint Agent cannot find a Domain Controller to supply credentials. To fix this:

  1. Make sure that the client is in the domain and has connectivity to your Domain Controller.
  2. To authenticate with user credentials, log off and then log in again.

    To authenticate with device credentials, restart the computer.

If the Authentication.log file on the client shows:

The specified target is unknown or unreachable.

Check the service name. Make sure that there are no typing errors and that the format is correct. If there was an error, correct it in the Check Point Endpoint Security Management.