Using a remote user domain in a multi-domain Active Directory forest
If your Active Directory (AD) forest has more than one domain, you can let users and groups from any domain in the forest sign in to the Flex Appliance Console. You do not need a separate remote user domain for each AD domain. One remote user domain that is connected to a global catalog server covers the whole forest.
Forest-wide access is available when the remote user domain meets the following requirements:
The directory type is Active Directory (AD). Forest-wide access is not available for OpenLDAP.
The server that you connect to is an AD global catalog server. The appliance asks the server whether it is a global catalog when you save the remote user domain. It does not decide this from the port number.
You connect to the Global Catalog port of the server. By default, AD uses port 3268 for LDAP and port 3269 for LDAPS.
Users and groups belong to the same AD forest as the global catalog server. Users from a different forest cannot sign in.
Universal groups are used for access across domains. Universal groups are required only when a group grants access to users or groups from other domains. Within the domain of the base DN, you do not need Universal groups.
The NetBIOS name of each domain corresponds to its domain name.
See Operational notes.
Note:
The port remains admin-configured. Ports 3268 and 3269 are the default Global Catalog ports in AD, and this section uses them in examples. If your AD environment uses different port numbers for the Global Catalog, enter those port numbers instead.
If the server is not a global catalog, the remote user domain is saved and works with the domain of the base DN only, as in earlier releases, even if you entered a Global Catalog port number.
One remote user domain covers the whole forest. The appliance still connects to one remote user domain at a time, so you do not add a separate remote user domain for each AD domain.
The following table describes how the Global Catalog ports differ from the standard LDAP ports.
Table: Standard LDAP ports and Global Catalog ports
Default port | Connection type | Users and groups that you can import | Nested groups |
|---|---|---|---|
389 (LDAP) | Plain text or Plain text + TLS (encrypted) | The domain of the base DN only | Not resolved. Users get roles only from groups that they directly belong to. |
636 (LDAPS) | SSL (encrypted) | The domain of the base DN only | Not resolved. Users get roles only from groups that they directly belong to. |
3268 (Global Catalog) | Plain text or Plain text + TLS (encrypted) | Any domain in the forest | Resolved |
3269 (Global Catalog over SSL) | SSL (encrypted) | Any domain in the forest | Resolved |
The port numbers in the table are defaults. The port have to be configured by the administrators, so your environment can use different numbers.
If you connect to a global catalog server on its standard LDAP port (by default 389 or 636) rather than its Global Catalog port, the appliance uses only the domain of the base DN and does not resolve nested groups.
To connect a remote user domain to a global catalog server
- On the Flex Appliance Console, click the Access management icon in the left-side navigation bar.
- Click Connect remote user domain. If a remote user domain is already connected, click Edit remote user domain instead.
- Enter the following parameters:
Server name or IP address: The host name or IP address of a domain controller that is a global catalog server in the forest.
Connection type: Plain text or Plain text + TLS (encrypted) for the Global Catalog port (by default 3268), or SSL (encrypted) for the Global Catalog SSL port (by default 3269).
Port: The Global Catalog port of the server. By default, this is 3268 for LDAP or 3269 for LDAPS.
Note:
The ports have to be configured by the administrator, so if your AD administrator has configured the Global Catalog on a different port, enter that port. Enter the port explicitly. If you leave the field empty, the standard LDAP port for the connection type (389 or 636) is used, and forest-wide access is not available.
Username and Password: An AD account that can read the directory, in the format
domain\username.Base DN: The distinguished name of the domain that the appliance belongs to. For example,
DC=emea,DC=example,DC=com. Names that you import or enter without a domain are looked up in this domain.
- Select Active Directory (AD) as the directory type.
- Click Save. If you selected SSL (encrypted), review the certificate in the Trust the certificate window and click Trust.
- To confirm that forest-wide access is available, click Add user > Import remote users. The page displays the following message:
Connected to a multi-domain Active Directory forest. Enter DOMAIN\name to import from any domain, or enter a name to import from the configured domain.
If the message does not appear, either the server is not a global catalog or the port that you entered is not its Global Catalog port. The Global Catalog ports are 3268 and 3269 by default, or the ports that your AD administrator configured.
See Connecting a remote user domain to the Flex Appliance Console.
Note the following information when you import or specify users and groups:
To import a user or a group from any domain in the forest, enter it in the format DOMAIN\name. For example,
EMEA\user1orEMEA\FlexAdmins.If you enter a name without a domain, the appliance searches only the domain of the configured base DN. To import an account that has the same name in another domain, enter it with its domain in the format
DOMAIN\username, for exampleEMEA\user1.You cannot import the same account twice, for example as user1 and as
DOMAIN\user1.Users from other domains sign in to the Flex Appliance Console with DOMAIN\username and their AD password.
The DOMAIN part must be the NetBIOS name of the domain, and the NetBIOS name must correspond to the domain name.
When the remote user domain is connected to the Global Catalog port of a global catalog server (by default 3268 or 3269), group membership is resolved through nested groups. A user who belongs to a nested group can sign in when you import the parent group, and the user receives the roles of the parent group. You do not have to import each group in the chain. Changes to group membership in AD take effect the next time the user signs in.
For example, if HR\user1 is a member of HR\PayrollAdmins, and HR\PayrollAdmins is a member of CORP\FlexAdmins, import CORP\FlexAdmins. HR\user1 can then sign in with the roles of CORP\FlexAdmins.
When you use forest-wide access, the scope of an AD group determines whether it can grant access to users from other domains:
Universal groups work across domains. Use Universal groups for any group that contains users or groups from more than one domain, and for any group in the nesting chain between them. Universal groups are required only for this cross-domain use.
Global groups work only within the domain of the configured base DN. You can import a Global group from another domain, but its members cannot sign in through it.
Domain Local groups do not grant access when the appliance is connected on a Global Catalog port, because the global catalog does not hold their membership.
Note:
If you change the scope of a group from Universal to Global, users from other domains who receive access through that group can no longer sign in.
A remote user domain that you connected in an earlier release continues to work after the update, and the users and groups that you imported remain. To use forest-wide access, edit the remote user domain, change the port to the Global Catalog port of the server, and save it. The Global Catalog port is 3268 for LDAP or 3269 for LDAPS by default, but the port remains admin-configured. If global catalog is enabled on the AD server after you connected the remote user domain, edit and save the remote user domain so that the appliance detects the change.
See Editing a remote user domain in the Flex Appliance Console.