Using gMSA as a Service Account

Important

Ensure that the "PowerShell module for Active Directory" is installed on the IQService machine.

Important

Use Strong (SASL) authentication when you configure a group Managed Service Account (gMSA). You cannot use gMSA with simple bind, including simple bind with or without Transport Layer Security (TLS).

To configure IQService to use a Group Managed Service Account (gMSA):

Create a gMSA account:
1. Open PowerShell as an administrator on the domain controller.
2. Run the following command to create a gMSA user, if not already existing:
```
New-ADServiceAccount <gMSA-SAMAccountName> -DNSHostName domainFQDNName  -PrincipalsAllowedToRetrieveManagedPassword "<IQServiceHostComputerName$>"
```
  For example,
```
New-ADServiceAccount gMSAuser1 -DNSHostName Monday.weekday.lab -PrincipalsAllowedToRetrieveManagedPassword "IQSERVICE$"
```
  This command creates the gMSA account like gMSAuser1 and allows the domain controllers and read only domain controllers to retrieve the password.
  
  After you create the account, grant the IQService host permission to retrieve the managed password, as described later in this topic. IQService does not need to be installed on a domain controller.
Restart the domain controller or run klist purge -li 0x3e7 to refresh your credentials.
Grant the IQService host permission to retrieve the gMSA password by running the following command on the domain controller:
```
Set-ADServiceAccount -Identity <gMSA-SAMAccountName> -PrincipalsAllowedToRetrieveManagedPassword <gMSA-SAMAccountName> "<IQServiceHostComputerName$>"
```
For example,
```
Set-ADServiceAccount -Identity gMSAuser1$ -PrincipalsAllowedToRetrieveManagedPassword gMSAuser1$ "IQService$"
```
Note

Replace IQServiceHostComputerName$ with the NetBIOS name of the IQService host computer account. Include the trailing $.

If the gMSA account is also the Windows service logon account for IQService, include the gMSA account in PrincipalsAllowedToRetrieveManagedPassword, for example:
```
Set-ADServiceAccount -Identity myMSAAccount$ -PrincipalsAllowedToRetrieveManagedPassword "myMSAAccount$", "IQServiceServer$"
```
If a domain user or local user runs IQService instead of the gMSA account, add that logon user to PrincipalsAllowedToRetrieveManagedPassword rather than the gMSA account name.

On the IQService host, install the gMSA account by running the following command:

Install-ADServiceAccount -Identity '<distinguished_name_of_newly_created_gMSA_account>'

For example,

Install-ADServiceAccount -Identity 'CN=gMSAuser1,CN=Managed Service Accounts,DC=Weekday,DC=lab'

Add the User Principal Name (UPN) to the gMSA account. Strong (SASL) authentication requires a UPN. Use the following format:

<username>@<domainname>

For example: myMSAAccount@weekday.lab

Where:
- username is the name of the gMSA account, for example: myMSAAccount.
- domain name is the Active Directory domain, for example: weekday.lab.
On the domain controller, set the UPN in Active Directory Users and Computers under Managed Service Accounts by opening the gMSA account properties and entering the UPN.
On the IQService host, grant the gMSA account Full Control on the IQService instance folder and registry key, then configure the Windows service. If you skip folder and registry permissions, IQService might fail to start. For example, you might see error 551053.
1. Select the IQService instance folder, open Properties, and go to the Security tab.
2. Select Edit, add the gMSA account, and under Object Types, select Service Accounts.
3. Assign Full Control, and then select OK.
4. Open Registry Editor and go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\<IQService-InstanceName>.
5. Right-click the instance key, select Permissions, and add the gMSA account.
6. Under Object Types, select Service Accounts, assign Full Control, and then select OK.
7. Open Services.msc and locate the IQService instance.
8. Right-click the service and select Properties.
9. On the Log On tab, set the account name to myMSAAccount$.
10. Clear any values in the password fields.
11. Select Apply and then OK.
12. Restart IQService for the changes to take effect.

Configure Active Directory in SailPoint:

You cannot use the gMSA account as the IQService user during IQService Settings configuration for client authentication. Configure a domain or local user with a password for that purpose.

Ensure that you have added the necessary TLS certificate to the Virtual Appliance (VA) before creating the Active Directory connector.

Important

SailPoint recommends to add the necessary TLS certificate to the Virtual Appliance (VA) before creating the Active Directory connector to ensure a smooth configuration process.
Go to the Domain Settings in the Active Directory configuration.
Select Use gMSA as a Service Account.
Set Authentication Type to Strong (SASL).
Clear Use Transport Layer Security (TLS) for the domain LDAP connection and use a non-TLS port (for example, 389).
Provide the necessary domain details, such as Forest Name, Domain DN, Servers, and the gMSA account UPN.
Run a test connection to verify the configuration.

IQService can use TLS for communication with SailPoint. Domain LDAP authentication for gMSA still uses Strong (SASL) on a non-TLS port.

Here's an example of the configuration:

{
    "entry": {
        "value": {
            "List": {
                "Map": {
                    "entry": [
                        {
                            "key": "authorizationType",
                            "value": "strong"
                        },
                        {
                            "key": "forestName",
                            "value": "weekday.lab"
                        },
                        {
                            "key": "domainDN",
                            "value": "DC=weekday,DC=lab"
                        },
                        {
                            "key": "password"
                        },
                        {
                            "key": "port",
                            "value": "389"
                        },
                        {
                            "value": {
                                "Boolean": "true"
                            },
                            "key": "enablePasswordLessAuthenticationForDomain"
                        },
                        {
                            "value": {
                                "List": {
                                    "String": "myDC.weekday.lab"
                                }
                            },
                            "key": "servers"
                        },
                        {
                            "value": {
                                "Boolean": ""
                            },
                            "key": "useSSL"
                        },
                        {
                            "key": "user",
                            "value": "myMSAAccount@weekday.lab"
                        }
                    ]
                }
            }
        },
        "key": "domainSettings"
    }
}

Important

The GMSAPasswordData service is disabled by default. The gMSA password retrieval does not work unless IQService uses TLS and you enable GMSAPasswordData.

To enable GMSAPasswordData after upgrading from a previous version, refer to Configuring TLS and Client Authentication for IQService.

For other IQService service and service status, refer to Option to Enable/Disable Services.

Opening Port 88 for gMSA Communication

When you use a gMSA account, open port 88 on the firewall for communication between the Virtual Appliance (VA), the IQService server, and Active Directory. If this port is not open, the test connection fails with a timeout error.

Using Non-TLS LDAP Ports with Strong (SASL) Authentication

For domain and forest settings, use a non-TLS LDAP port. TLS is not supported for Strong (SASL) authentication with gMSA, so you cannot use gMSA with simple bind, with or without Transport Layer Security (TLS).

Note

This restriction applies only to the LDAP connection between SailPoint and Active Directory. IQService can still use TLS for its own communication.

Configuring Forest Settings for gMSA

After IQService runs under the gMSA account, configure the Active Directory source forest settings the same way as the domain settings: provide the gMSA account UPN, set the authentication type to Strong (SASL), and use a non-TLS port. For field-level guidance, refer to Forest Settings and Domain Settings.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.