Active Directory - Windows Server

Overview

In this article, you’ll learn how to integrate your Windows Server Active Directory with an Acreto Ecosystem. This process involves the following steps:

1. Configuration of Windows Server Active Directory
2. Configuration of Acreto Ecosystem
3. Providing an Onboarding Portal link to users

The Purpose of Active Directory Integration

An Active Directory integration allows your Acreto Ecosystem to utilize the user credentials stored in your Active Directory to connect to the Ecosystem using Acreto TLS Client.

The LDAPS protocol is used to establish communication between the Acreto Ecosystem and the Active Directory.

Typically, an AD integration is also part of a single sign-on implementation.

How Does it Work?

The integration uses the LDAP service account credentials to retrieve the user’s distinguished name (DN) from the LDAP server. Given the user’s DN value, the integration then reconnects with LDAP using the user’s DN and password.

In the diagram below, you can see the communication flow between some Employee (trying to connect to the Ecosystem using Acreto TLS Client), Acreto Ecosystem and AD.

%%{init:{"fontFamily":"monospace", "sequence":{"showSequenceNumbers":true}}}%%
sequenceDiagram
    Employee->>Ecosystem:Here is my password.
    Ecosystem->>Azure AD: is Employee's password.
    Azure AD->>Ecosystem: Sure, let the Employee in!
    Ecosystem->>Employee: Welcome!

The integration uses a read-only connection that never writes to the Active Directory. The integration only queries for information.

Prerequisite

To complete this procedure, you should:

1. Have an active and configured Ecosystem.
2. Have an active Windows Server with installed Active Directory Domain Services.
3. Have basic knowledge of LDAP protocol.

Configuration of Windows Server Active Directory

Install the “Active Directory Certificate Services” role through Server Manager roles.

1. On your Windows Server Machine, click on Start –> Server Manager –> Add Roles and Features.
2. After selecting Add Roles and Features Click on Next.
3. Choose the Role-based or feature-based installation option and click on the Next button.
4. Choose Select a server from the server pool option & Select LDAP server from the server pool and click on the Next button.
5. Choose the Active Directory Certificate Services option from the list of roles and click on the Next button.
6. Choose nothing from the list of features and click on Next button.
7. In Active Directory Certificate Services (AD CS) choose nothing and Click on Next button.
8. Mark Certification Authority from the list of roles and Click on Next button.
9. Click on Install button to confirm installation.
10. Now, click on Configure Active Directory Certificate Services on Destination Server option and click on Close button.
11. We can use the currently logged on user to configure role services since it belongs to the local Administrators group. Click on Next button.
12. Mark Certification Authority from the list of roles and Click on Next button.
13. Choose Enterprise CA option and Click on Next.
14. Choose the Root CA option and Click on the Next button.
15. Choose to Create a new private key option and click on the Next button.
16. Choose most recent hasing alhorithm from the list of options. For minimum recommended configuration choose SHA256 as the hash algorithm and Click on Next.
17. Click on the Next button.
18. Specify the validity of the certificate choosing Default 5 years and Click on Next button.
19. Select the default database location and Click on Next.
20. Click on Configure button to confirm.
21. Once the configuration succeeded and click on Close button.

Create a certificate template

1. Go to Windows Key+R and run certtmpl.msc command and choose the Kerberos Authentication Template.
2. Right-click on Kerberos Authentication and then select Duplicate Template.
3. The Properties of New Template will appear. Configure the setting according to your requirements.
4. Go to the General tab and Enable Publish certificate in Active Directory option.
5. Go to the Request Handling Tab and Enable Allow private key to be exported option.
6. Go to the Subject Name tab and Enable the subject name format as DNS Name and click on Apply & OK button.

Issue certificate template

1. Go to Start –> Certification Authority –> Right-click on Certificate Templates –> select New –> Certificate Template to Issue.
2. Now, select your recently created Certificate Template and click on the OK button.

Request a new certificate for the created certificate template

1. Go to Windows Key+R –> mmc –> From top menu choose File -> Add/Remove snap-in.
2. Select Certificates, click on Add button, and then click on the OK button.
3. Select the Computer account option and click on the Next button.
4. Select the Local computer option and click on the Finish button.
5. Now, right click on Certificates select All Tasks and click on Request for new Certificate.
6. Click on the Next button.
7. Click on the Next button.
8. Select your certificate and click on Enroll button.
9. Click on the Finish button.

Export the created certificate

1. Right-click on the recently generated certificate and select All tasks –> Export.
2. Click on the Next button.
3. Select Do not export the private key option and click on the Next button.
4. Choose Base-64 encoded X .509 file format and click on Next.
5. Export the .CER file to your local system path and click on Next.
6. Click on the Finish button to complete the certificate export.

Configuration of Acreto Ecosystem

1. Login to New or Existing Ecosystem

2. Create Security Policy

   Create a Security Policy that allows users connecting through your Identity Provider to reach all destinations.

   Warning

   In beta mode, all users authenticated using Identity Providers belong to default profile group Profile Group 1. This will change in future versions.

   To simplify initial configuration, we will create a policy that allows all traffic to be passed through the Ecosystem.

   Info

   You should customize the Security Policy to fit your needs once the Identity Provider setup is complete. It should be configured to limit access to network resources for each group (Profile Group).

   

   

3. Add New Identity Provider

   To add a new Identity Provider, select Objects and Identity Providers from the left menu and then click on “Add New”.

   

4. Fill the settings with connection details

   

5. Save and commit your changes

Provide Onboarding Portal Link to Your Users

To allow users, employees or team members VPN usersto authenticate in Acreto Connect Client using AD credentials, Acreto offers unique andindividual URLs for every Ecosystem portal called Onboarding Portal.

1. To access the unique URL to that portal, please click on Edit next to previously added IdP and scroll down.
2. Then, click on the icon to copy the URL.
3. Now, provide the generated link to your users.

VPN User Experience

When the VPN user opens the Onboarding Portal, the Welcome Page will be presented.

The Ecosystem Admin(s) should share this URL with the VPN Users, ask them to open it and then follow instructions.

The first step of onboarding is to recognize the user’s operating system to provide platform-specified installers and profiles.

The second step allows you to download the latest version of Acreto Connect Client and the VPN profile.

Summary

Thanks to Acreto and Active Directory Identity Provider Integration, users can connect to an Acreto Ecosystem with the same credentials utilized for other internal resources on their network domain.

Also, Acreto Ecosystem Admin(s) can re-use any existing password and security policies that are already in place. For example, the Active Directory may already have account lockout and password expiration policies.