Security Parameters

During installation, the driver gathers the necessary information and creates default security policies and parameters. Before you begin customizing your Active Directory driver, you should become familiar with the following:

• Default policies and parameters
• The topics discussed in Troubleshooting, to decide whether any of these issues apply to your environment

Understanding how the parameters work together and work with the operating system helps you define your approach to security for Nsure^TM Identity Manager data synchronization.

• Authentication ID: The account that the driver uses to access domain data.

  Format	Username	Method
  Domain name	user	Negotiate
  Fully Qualified Domain name	domain\user	Negotiate
  Distinguished name	cn=DirXML,cn=Users,DC=domain,dc=com	Simple

• Authentication Context: The context used to access domain data.

  Format	Example	Method
  The DNS name of the Active Domain controller	mycontroller.mydomain.com	Negotiate
  The DNS name of the Active Domain controller, or the IP address of your LDAP server	mycontroller.mydomain.com 137.65.134.83	Simple

• Application Password: The password for the Authentication ID account.

• Use Signing: This parameter is for use between the Active Directory driver and Active Directory, but not between the DirXML engine and the Remote Loader. Signing ensures that a malicious computer is not intercepting data. This flag enables signing of the Active Directory connection if you are not using the LDAP SSL port.

  This setting requires Windows 2003 or Windows 2000 with the most recent support pack, and Internet Explorer 5.5 SP2 or later on both servers. This enables signing on a Kerberos or NTLM v2 authenticated connection.

  Like SSL, this parameter is not available on initial import. You set it through the Driver Parameters page after installation is complete.

• Use Sealing: This parameter is for use between the Active Directory driver and Active Directory, but not between the DirXML engine and the Remote Loader. Sealing encrypts the data so that it cannot be viewed by a network monitor. This flag enables sealing of the Active Directory connection if you are not using the LDAP SSL port.

  This setting requires Windows 2003 or Windows 2000 with the most recent support pack, and Internet Explorer 5.5 SP2 or later on both servers. This setting enables encryption on a Kerberos or NTLM v2 authenticated connection.

  Like SSL, this parameter is not available on initial import. You set it through the Driver Parameters page after installation is complete.

• Use SSL: This parameter is for use between the Active Directory driver and Active Directory. This parameter controls encryption if you connect to Active Directory by using the LDAP SSL port. This parameter applies to both the Negotiate and Simple authentication methods.

  By default the parameter is set to No. If you set this value to Yes, the SSL pipe is encrypted for the entire conversation. An encrypted pipe is preferred because the driver typically synchronizes sensitive information. However, encryption slows the general performance of your servers.

  This parameter is configurable through the Driver Parameters page after the driver has been imported.