User Directory Accounts

Axidian Privilege interacts with end users through a service account that reads directory users and their attributes.

Account to Use with User Directory

Active Directory

1. Run the Active Directory Users and Computers snap-in.
2. Open the context menu of the organizational unit or container.
3. Select Create → User item from the menu.
4. Specify the user name, e.g, IPAMADReadOps.
5. Fill in the required fields and complete the account creation.

FreeIPA

1. Run the FreeIPA snap-in as a user with administrator privileges.
2. Create a user, for example, IPAMADReadOps.
3. Open the IPA Server tab.
4. From the Role-Based Access Control drop-down menu, select Permissions.
5. Create a permission with the following values:
   • Permission name: pam_attr_read.
   • Granted Rights: read, search.
   • Effective attributes: entryDn, entryUUID, ipaUniqueID, ipaNTSecurityIdentifier, memberOf, uid, givenName, krbPrincipalName, cn, sn, photo (or jpegPhoto), member, nsOsVersion, fqdn, initials, krbPasswordExpiration.
6. From the Role-Based Access Control drop-down menu, select Privileges.
7. Create a new privilege (e.g. pam_privilege_read) and add the created pam_attr_read permission to it.
8. From the Role-Based Access Control drop-down menu, select Roles.
9. Create a new role (for example, IPAMADReadOps_role) and add the created pam_privilege privilege to it.
10. Assign the created role to the IPAMADServiceOps user in one of the following ways:
    • assign a role to a user;
    • assign the role to a user group and add the user to that group.

OpenLDAP

1. Create a user, for example, IPAMADReadOps.
2. Grant the user read permissions to the following attributes:
   • entryUUID
   • entryDn
   • uid
   • cn
   • osVersion
   • groupOfUniqueNames
   • uniqueMember

Account for Service Operations in Active Directory

Active Directory

1. Run the Active Directory Users and Computers snap-in.
2. Open the context menu of the organizational unit or container.
3. Select Create → User item from the menu.
4. Specify the user name, e.g, IPAMADServiceOps.
5. Fill in the required fields and complete the account creation.
6. Open the context menu of organizational unit, container or domain root.
7. Select Properties.
8. Open Security tab.
9. Click Add.
10. Select an account IPAMADServiceOps and click Ok.
11. Click Advanced.
12. Select an account IPAMADServiceOps and click Edit.
13. Specify the value of the field Applies to to the Descendant User objects.
14. In the Permissions section check the Reset password checkbox.
15. Save.

FreeIPA

1. Run the FreeIPA snap-in as a user with administrator privileges.
2. Create a user, for example, IPAMADServiceOps.
3. Open IPA Server tab.
4. From the Role-Based Access Control drop-down menu, select Permissions.
5. Create a permission with the following values:
   • Permission name: pam_attr_read.
   • Granted Rights: read, search.
   • Effective attributes: entryDn, entryUUID, ipaUniqueID, ipaNTSecurityIdentifier, memberOf, uid, givenName, krbPrincipalName, cn, sn, photo (or jpegPhoto), member, nsOsVersion, fqdn, initials, krbPasswordExpiration.
6. Create another permission with the following values:
   • Permission name: pam_attr_write.
   • Granted Rights: write.
   • Effective attributes: userPassword, krbPasswordExpiration.
7. From the Role-Based Access Control drop-down menu, select Privileges.
8. Create a new privilege (e.g. pam_privilege_change_pswd) and add the two permissions pam_attr_read and pam_attr_write you just created to it.
9. From the Role-Based Access Control drop-down menu, select Roles.
10. Create a new role (for example, IPAMADServiceOps_role) and add the created pam_privilege_change_pswd privilege to it.
11. Assign the created role to the IPAMADServiceOps user in one of the following ways:
    • assign a role to a user;
    • assign the role to a user group and add the user to that group.

OpenLDAP

1. Create a user, for example, IPAMADServiceOps.
2. Grant the user read permissions to the following attributes:
   • entryUUID
   • entryDn
   • uid
   • cn
   • osVersion
   • groupOfUniqueNames
   • uniqueMember
3. Grant the user write permissions for the userPassword attribute.