Skip to content

Securing the Active Directory Application

Secure the Active Directory application by using the following communication paths based on the operations performed.

SailPoint recommends securing every communication path for the Active Directory application by following the configurations outlined below:

  • Source (VA) and Active Directory Domain Controller (for most of the read operations): TLS Configuration on Virtual Appliances is required to secure this path.
  • Source (VA) and IQService (for provisioning and read operations for Skype management): TLS Configuration Between VA and IQService is required to secure this path. For more information, refer to Configuring TLS and Client Authentication for IQService.
  • IQService and Active Directory Domain Controller (for provisioning and read operations for Skype management): TLS configuration between IQService and Active Directory Domain Controller is required to secure this path.

Securing Communication Path Between IQService and Active Directory Domain Controller / Target System

For IQService to connect using TLS and self-signed certificates, you must install the certificate in Trusted Root Certification Authorities on the IQService host.

To install a certificate, complete the following:

  1. Export the server certificate and copy the exported .cer file to the IQService host.
  2. Double-click the .cer file, select Install Certificate, and select Next.
  3. Choose Place all certificates in the following store and select Browse.
  4. Select Show physical stores.
  5. Expand Trusted Root Certification Authorities and select Local Computer.
  6. Select OK.
  7. Select Next, and then Finish.

Certification for Microsoft Advisory ADV190023

The Active Directory source is certified for the Microsoft ADV190023 Advisory. All source functionality works correctly when LDAP channel Binding and LDAP Signing configuration are enabled on Domain Controller. These settings are only applicable over secure channel using TLS protocol, ensure that TLS is configured.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.