Configuring Active Directory Authentication

Make sure you configure Strong Authentication for your production environment. Do not set up Strong Authentication before you are ready to move to production. When you are ready to move to production, follow this process.

Workflow for Configuring Strong Authentication:

Step 1 of 3: Configuring the Active Directory Server for Authentication

Endpoint Security Strong Authentication uses the Kerberos network authentication protocol.

To enable the Active Directory server to validate the identity of clients that authenticate themselves through Kerberos, run the ktpass.exe command on the Active Directory Server. By running the ktpass command, you create a user that is mapped to the ktpass service. This creates a Principal Name for the AD server. The Principal Name must have this format: ServiceName/realm@REALM

Important:

After you create the user that is mapped to the ktpass service, do not make changes to the user. For example, do not change the password. If you do change the user, the key version increases and you must update the Version Key in the New Authentication Principal window in the Endpoint Web Management Console.

To prepare the Active Directory Server for authentication:

  1. Go to Start menu > All Programs > Administrative Tools > Active Directory Users and Computers.
  2. Create a domain user and clear the option User must change password at next logon.
  3. Open an elevated Windows Command Prompt.
  4. In Windows Command Prompt, go to this folder: 
    cd %WinDir%\System32\
  5. Map a service to a user with this command: 
    ktpass princ <Service Name>/<realm name>@<REALM NAME> mapuser <Username>@<REALM NAME> pass <Password> out <Name of Output File>

    Example:

    ktpass princ tst/nac1.com@NAC1.COM mapuser auth-user@NAC1.COM pass 123456 out outfile.keytab

    Parameters:

    Syntax Example Value Explanation
    Service Name> tst Name of the service.
    realm name>

    REALM NAME>

    		 nac1.com

    NAC1.COM

    Domain name of the Active Directory server.

    The first instance is in lower case.

    The second instance in upper case.
    Username> auth-user The Active Directory domain user.
    Password> 123456 Password for user.

    Name of Output File>

    outfile.keytab

    Name of the encrypted keytab file.
  6. Save the console output to a text file.

    See the version number (vno) and encryption type (etype).

    Sample output:

    Targeting domain controller: nac1-dc.nac1.com
Successfully mapped tst/nac1.com to auth-user.
WARNING: pType and account type do not match. This might cause problems.
Key created.
Output keytab to outfile.log:
Keytab version: 0x502
keysize 74 tst/nac1.com@NAC1.COM ptype 0 (KRB5_NT_UNKNOWN) vno 7 etype 0x17 (RC4-HMAC) keylength 16 (0x32ed87bdb5fdc5e9cba88547376818d4)
    Important:

    We recommend that you do not use DES-based encryption for the Active Directory Domain Controller server, as it is not secure. If you choose to use DES encryption and your environment has Windows 7 clients, see sk64300

    Notes:

    • Make sure that the clock times on the Endpoint Security servers and the Kerberos server are less than 5 minutes apart. If the difference in the clock times is more than 5 minutes, a runtime exception shows and Active Directory authentication fails. On Gaia, use NTP or a similar service.

    • To use Capsule Docs with Single Sign-On, disable the User Access Control (UAC) on Windows Active Directory Servers.

Step 2 of 3: Configuring Authentication Settings

Configure the settings in the Endpoint Web Management Console for client to server authentication.

Important:

Use the Unauthenticated mode only for evaluation purposes. Never use this mode for production environments. Configure the authentication settings before moving to production.

How the Authentication Settings are Used in Deployment Packages

When you configure client package profiles, you select an authentication account. The SSO Configuration details are included in the client deployment package, which allows the server to authenticate the client.

To configure authentication settings:

  1. In the Endpoint Web Management Console, click Manage > Endpoints Authentication Settings.

    The Authentication Settings Properties window opens.

  2. Click Add.

    The New Authentication Principal window opens.

  3. Enter the details from the output of ktpass.exe, that you configured in Step 1.

    Field

    Description

    Domain name

    Active Directory domain name.

    For example: nac1.com

    Principle Name

    Authentication service name in the format: ServiceName/realm@REALM

    This value must match the name that was configured in Active Directory > New Object.

    For example: tst/nac1.com@NAC1.COM

    Version Key

    Enter the version number according to the Active Directory output in the vno field.

    For example: 7

    Encryption method

    Select the encryption method according to the Active Directory output in the etype field.

    For example: RC4-HMAC

    Password

    Enter (and confirm) the password of the Active Directory Domain Admin user you created for Endpoint Security use.

    For example: 123456
  4. Click OK.
  5. When you are ready to work in Strong Authentication mode, select Work in authenticated mode in the Authentication Settings Properties window.
  6. Click OK.
Important:

After you turn on Strong Authentication, wait one minute before you initiate any client operations.

It takes time for the clients and the Endpoint Security Management Server to synchronize. During this time, the environment remains unauthenticated, and some operations fail. The exact amount of time depends on the Active Directory scanner.

Step 3 of 3: Save Changes

After you finished configuring strong authentication for Active Directory, save your changes.

  1. In the Endpoint Web Management Console, go to the Policy tab.
  2. In the Policy Toolbar, click Save All Changes.