Difference between revisions of "Bxp and Active Directory for Single Sign On (SSO)"
From All n One's bxp software Wixi
Philip Lacey (talk | contribs) (Created page with "This article and feature of bxp are in development Category:To Be Revised Category:Topic:Security") |
Philip Lacey (talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | + | = Introduction = | |
| + | |||
| + | |||
| + | Often a client will want to save users the hassle of having to log into multiple systems. There is a mechanism called Single Sign On, where as the user logs into the machine, credentials are available to other solutions to save a log in process. | ||
| + | |||
| + | There is some set up to this process and this Wixi describes this process | ||
| + | |||
| + | |||
| + | = Process Overview = | ||
| + | |||
| + | |||
| + | |||
| + | = Server Setup = | ||
| + | |||
| + | |||
| + | == Setting up LDAPS == | ||
| + | |||
| + | |||
| + | Active Directory is the primary security engine of Windows Server. [http://en.wikipedia.org/wiki/Active_Directory Wikipedia Active Directory] [https://msdn.microsoft.com/en-us/library/aa746492(v=vs.85).aspx Microsoft Active Directory] | ||
| + | |||
| + | |||
| + | The simplest way of interacting with the server for bxp is through LDAPS. [[http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol LDAPS]] | ||
| + | |||
| + | |||
| + | Once you have a Windows Server set up with Active Directory and your users logging into a domain you can make the service available through a number of means. | ||
| + | |||
| + | * [https://technet.microsoft.com/en-us/library/ee411009(WS.10).aspx Event ID 1220 — LDAP over SSL] | ||
| + | * [https://www.petri.com/enable-secure-ldap-windows-server-2008-2012-dc Enabling Secure LDAP on Windows Server 2008/2012 Domain Controllers] | ||
| + | * [http://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx LDAP over SSL (LDAPS) Certificate] | ||
| + | * [https://support.microsoft.com/en-us/kb/321051 How to enable LDAP over SSL with a third-party certification authority] | ||
| + | |||
| + | |||
| + | |||
| + | == Securing your LDAPS server for use with bxp == | ||
| + | |||
| + | |||
| + | Making your AD available to the public is a potential security risk. So there are a number of things you can do to shore up the risk. | ||
| + | |||
| + | |||
| + | Firstly, bxp will only connect with you from specific IP addresses. You can restrict access to your AD through your router to the bxp IP addresses | ||
| + | |||
| + | * 82.195.138.167 | ||
| + | * 82.195.138.174 | ||
| + | |||
| + | |||
| + | bxp starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP and UDP port 389, or on port 636 for LDAPS.[8] | ||
| + | |||
| + | |||
| + | Global Catalog is available by default on ports 3268, and 3269 for LDAPS. | ||
| + | |||
| + | |||
| + | So restricting the firewall to only allow for the specific IPs, the specific ports and may those ports directly to the DC. | ||
| + | |||
| + | |||
| + | |||
| + | == Testing your router configuration == | ||
| + | |||
| + | |||
| + | So testing that your router configuration and LDAPS is working you can log into bxp and use a special page. Please change the client_demo to your system. This will allow you test domain, user and password tests. | ||
| + | |||
| + | |||
| + | https://ww3.allnone.ie/client/client_demo/main/userAD_Test.asp | ||
| + | |||
| + | |||
| + | A successful connection shows your configuration is working. | ||
| + | |||
| + | |||
| + | = Configuring bxp = | ||
| + | |||
| + | |||
| + | |||
| + | |||
[[Category:To Be Revised]] | [[Category:To Be Revised]] | ||
[[Category:Topic:Security]] | [[Category:Topic:Security]] | ||
Revision as of 15:13, 21 May 2015
Contents
1 Introduction
Often a client will want to save users the hassle of having to log into multiple systems. There is a mechanism called Single Sign On, where as the user logs into the machine, credentials are available to other solutions to save a log in process.
There is some set up to this process and this Wixi describes this process
2 Process Overview
3 Server Setup
3.1 Setting up LDAPS
Active Directory is the primary security engine of Windows Server. Wikipedia Active Directory Microsoft Active Directory
The simplest way of interacting with the server for bxp is through LDAPS. [LDAPS]
Once you have a Windows Server set up with Active Directory and your users logging into a domain you can make the service available through a number of means.
- Event ID 1220 — LDAP over SSL
- Enabling Secure LDAP on Windows Server 2008/2012 Domain Controllers
- LDAP over SSL (LDAPS) Certificate
- How to enable LDAP over SSL with a third-party certification authority
3.2 Securing your LDAPS server for use with bxp
Making your AD available to the public is a potential security risk. So there are a number of things you can do to shore up the risk.
Firstly, bxp will only connect with you from specific IP addresses. You can restrict access to your AD through your router to the bxp IP addresses
- 82.195.138.167
- 82.195.138.174
bxp starts an LDAP session by connecting to an LDAP server, called a Directory System Agent (DSA), by default on TCP and UDP port 389, or on port 636 for LDAPS.[8]
Global Catalog is available by default on ports 3268, and 3269 for LDAPS.
So restricting the firewall to only allow for the specific IPs, the specific ports and may those ports directly to the DC.
3.3 Testing your router configuration
So testing that your router configuration and LDAPS is working you can log into bxp and use a special page. Please change the client_demo to your system. This will allow you test domain, user and password tests.
https://ww3.allnone.ie/client/client_demo/main/userAD_Test.asp
A successful connection shows your configuration is working.
