Microsoft Active Directory

Overview

This use case describes how to configure self-service password reset for accounts managed in Microsoft Active Directory.

Prerequisites

• Fortified ID Password Reset is installed and configured as a SAML Service Provider (SP) against a SAML Identity Provider (IdP), for example Fortified ID Access.
• Configuration of the SAML IdP is outside the scope of this use case and is therefore not covered.

This use case provides an example configuration for self-service reset of an Active Directory password after successful user authentication. The pre-configured SAML IdP must support an authentication method that does not rely on an Active Directory password, such as Swedish BankID, Freja eID, or username combined with a one-time password (OTP).

Configuration

Overview of the steps in this use case

1. Add an LDAPClient module
2. Add an ADResetClient module
3. Update the self-service password reset pipe

1. Add an LDAPClient module

1. Log in to Management Center for Password Reset

2. Click Configuration tab

3. Expand Modules and click + to add a new module

4. Click LDAPClient

   1. Click the JSON button for the LDAPClient module

   2. Copy the data below and overwrite all existing data

      {
        "id": "ldapclient_0",
        "name": "LdapClient",
        "enabled": true,
        "instances": 1,
        "config": {
          "name": "active_directory",
          "connection": {
            "host": "127.0.0.1",
            "port": 636,
            "bind_dn": "CN=admin,CN=Users,DC=company,DC=local",
            "bind_password": "admin_password",
            "use_ssl": true,
            "ssl_trust_all": true
          }
        },
        "display_name": "Active Directory"
      }

5. Only change the three properties below to match your environment:

   1. host
   2. bind_dn
   3. bind_password

   This example assumes that your domain controller has a server certificate for LDAPS.

6. Click Update and Deploy

You have now added an LDAP module that can be used by one or more objects, such as valves. To reference this LDAP module, use the value active_directory.
Note: The service account needs permissions to read and write the password-related attributes in Active Directory.

2. Add an ADResetClient module

1. Log in to Management Center for Password Reset

2. Click Configuration tab

3. Expand Modules and click + to add a new module

4. Click ADResetClient

   1. Click the JSON button for the ADResetClient module

   2. Copy the data below and overwrite all existing data

      {
        "name": "ADResetClient",
        "config": {
          "name": "active_directory_reset",
          "connection": {
            "host": "127.0.0.1",
            "port": 636,
            "bind_dn": "CN=admin,CN=Users,DC=company,DC=local",
            "bind_password": "admin_password",
            "use_ssl": true,
            "ssl_trust_all": true
          }
        }
      }

5. Only change the three properties below to match your environment:

   1. host
   2. bind_dn
   3. bind_password

   This example assumes that your domain controller has a server certificate for LDAPS.

6. Click Update and Deploy

You have now added an ADResetClient module that can be used by one or more objects, such as valves. To reference this ADResetClient module, use the value active_directory_reset.
Note: The service account needs permissions to read and write the password-related attributes in Active Directory.

3. Update the self-service password reset pipe

The default installation of Password Reset includes two pipes: one for self-service reset and one for delegated reset. Depending on your use case, each pipe may need to be updated based on the user store you use. In this use case, the user store is Active Directory.

1. Browse to Management Center for Password Reset

2. Click Configuration tab

3. Expand Password Reset

4. Expand Pipes

5. Click self_reset

6. Click JSON to open the JSON editor

7. Copy the data below and overwrite all existing data

   {
     "id": "self_reset",
     "display_name": "self_reset",
     "description": "Self Reset",
     "config": {
       "valves": [
         {
           "name": "DumpRequest",
           "config": {
             "label": "**********   DumpRequest for Self Reset   **********"
           }
         },
         {
           "name": "DumpSession",
           "config": {
             "label": "**********   DumpSession for Self Reset   **********"
           }
         },
         {
           "name": "LDAPSearch",
           "enabled": true,
           "config": {
             "destination": "active_directory",
             "base_dn": "DC=company,DC=local",
             "scope": "SUB",
             "filter": "sAMAccountName={{{request.user_name}}}",
             "attributes": [
               {
                 "name": "displayName",
                 "multivalue": false
               },
               {
                 "name": "distinguishedName",
                 "multivalue": false
               }
             ]
           }
         },
         {
           "name": "DumpState",
           "config": {
             "label": "**********   DumpState after LDAPSearch   **********"
           }
         },
         {
           "name": "ADPasswordReset",
           "config": {
             "destination": "active_directory_reset",
             "label": "**********   ADPasswordReset valve - Self service **********",
             "unlock_user": true,
             "change_password_next_logon": false,
             "pwd_last_set_allowed_days": 0
           }
         }
       ]
     }
   }

8. Click Update and Deploy