Microsoft Active Directory

Overview

This use case describes how to configure self-service password reset for accounts managed in Microsoft Active Directory.

Prerequisites

• Fortified ID Password Reset is installed and configured as a SAML Service Provider (SP) against a SAML Identity Provider (IdP), for example Fortified ID Access.
• Configuration of the SAML IdP is outside the scope of this use case and is therefore not covered.

This use case provides an example configuration for self-service reset of an Active Directory password after successful user authentication. The pre-configured SAML IdP must support an authentication method that does not rely on an Active Directory password, such as Swedish BankID, Freja eID, or username combined with a one-time password (OTP).

Configuration

Caution

Use these examples with synthetic test identities before deploying them. Replace example credentials and certificates with your own protected configuration. Keep TLS certificate validation enabled; install the required CA chain in the relevant truststore rather than enabling ssl_trust_all. Do not add request, session, or state dump valves to a password-reset flow: these objects can contain the new password, assertions, or access tokens. See Password Reset security configuration.

Overview of the steps in this use case

1. Add an LDAPClient module
2. Add an ADResetClient module
3. Update the self-service password reset pipe

1. Add an LDAPClient module

1. Log in to Management Center for Password Reset

2. Click Configuration tab

3. Expand Modules and click + to add a new module

4. Click LDAPClient

   1. Click the JSON button for the LDAPClient module

   2. Copy the data below and overwrite all existing data

      {
        "id": "ldapclient_0",
        "name": "LdapClient",
        "enabled": true,
        "instances": 1,
        "config": {
          "name": "active_directory",
          "connection": {
            "host": "127.0.0.1",
            "port": 636,
            "bind_dn": "CN=admin,CN=Users,DC=company,DC=local",
            "bind_password": "admin_password",
            "use_ssl": true,
            "ssl_trust_all": false
          }
        },
        "display_name": "Active Directory"
      }

5. Adapt the connection settings and certificate trust to your environment:

   1. host
   2. bind_dn
   3. bind_password

   The domain controller must present a valid LDAPS certificate. Its CA chain must be trusted by both the LDAP lookup connection and the ADResetClient connection. Keep ssl_trust_all set to false; use a configured truststore when the CA is not trusted by the JVM. Use the least-privileged accounts described under AD permissions.

6. Click Update and Deploy

You have now added an LDAP module that can be used by one or more objects, such as valves. To reference this LDAP module, use the value active_directory.
Note: The service account needs permissions to read and write the password-related attributes in Active Directory.

2. Add an ADResetClient module

1. Log in to Management Center for Password Reset

2. Click Configuration tab

3. Expand Modules and click + to add a new module

4. Click ADResetClient

   1. Click the JSON button for the ADResetClient module

   2. Copy the data below and overwrite all existing data

      {
        "name": "ADResetClient",
        "config": {
          "name": "active_directory_reset",
          "connection": {
            "host": "127.0.0.1",
            "port": 636,
            "bind_dn": "CN=admin,CN=Users,DC=company,DC=local",
            "bind_password": "admin_password",
            "use_ssl": true,
            "ssl_trust_all": false
          }
        }
      }

5. Adapt the connection settings and certificate trust to your environment:

   1. host
   2. bind_dn
   3. bind_password

   The domain controller must present a valid LDAPS certificate. Its CA chain must be trusted by both the LDAP lookup connection and the ADResetClient connection. Keep ssl_trust_all set to false; use a configured truststore when the CA is not trusted by the JVM. Use the least-privileged accounts described under AD permissions.

6. Click Update and Deploy

You have now added an ADResetClient module that can be used by one or more objects, such as valves. To reference this ADResetClient module, use the value active_directory_reset.
Note: The service account needs permissions to read and write the password-related attributes in Active Directory.

3. Update the self-service password reset pipe

The default installation of Password Reset includes two pipes: one for self-service reset and one for delegated reset. Depending on your use case, each pipe may need to be updated based on the user store you use. In this use case, the user store is Active Directory.

1. Browse to Management Center for Password Reset

2. Click Configuration tab

3. Expand Password Reset

4. Expand Pipes

5. Click self_reset

6. Click JSON to open the JSON editor

7. Copy the data below and overwrite all existing data

   {
     "id": "self_reset",
     "display_name": "self_reset",
     "description": "Self Reset",
     "config": {
       "valves": [
   
   
         {
           "name": "LDAPSearch",
           "enabled": true,
           "config": {
             "destination": "active_directory",
             "base_dn": "DC=company,DC=local",
             "scope": "SUB",
             "filter": "sAMAccountName={{{request.user_name}}}",
             "attributes": [
               {
                 "name": "displayName",
                 "multivalue": false
               },
               {
                 "name": "distinguishedName",
                 "multivalue": false
               }
             ]
           }
         },
   
         {
           "name": "ADPasswordReset",
           "config": {
             "destination": "active_directory_reset",
             "label": "**********   ADPasswordReset valve - Self service **********",
             "unlock_user": true,
             "change_password_next_logon": false,
             "pwd_last_set_allowed_days": 0
           }
         }
       ]
     }
   }

8. Click Update and Deploy

Test the configuration

Use an authorized synthetic AD account. Authenticate through the configured IdP, reset its password, and verify a new sign-in with that password. Also test an invalid password and an account outside the delegated scope. Confirm that failed certificate validation prevents the connection, and check that logs contain no password or assertion material. A successful HTTP response or UI message alone does not prove that the directory accepted a new password.