Domain Controller Environment Setup

Set up your Domain Controller enabled Active Directory or LDAP environment to work with KeeperPAM

Domain Controller Environment Overview

Resources in your environment attached to a domain controller can be managed by a Keeper Gateway using a specified administrator credential configured in the PAM Configuration record. This guide provides step-by-step instructions for configuring the PAM Configuration for your tenant, enabling the Keeper Gateway to manage users and groups within it.

Prerequisites

1. Prior to proceeding with this guide, make sure to install and configure your Keeper Gateway.

2. A Domain Controller (Active Directory or LDAP) needs to be running and accessible by the Keeper Gateway.

3. Create a service user which has administrative privileges to manage users and groups in the domain controller

   1. This user can be the administrator user, or a specific service user with proper permissions

   2. In the following example, the PAM Configuration is set to use the administrator user

Setting up Domain Controller PAM Configuration

In order to integrate a domain controller into Keeper and manage the users and groups through KeeperPAM, the following information is needed:

1. Administrative Credential

2. Hostname or IP Address

3. Host Port

4. Domain ID

5. (Optional) User Match Query

The Domain ID tenant in our example will be "KEEPERPAMLAB" and the administrative credential will be set to the NETBIOS username "KEEPERPAMLAB\Administrator".

Create a PAM User for Administrative Credentials

In the application folder, create a new PAM User for the administrative credential. This will be in the NETBIOS format "KEEPERPAMLAB\Administrator" (or whatever the username is in the tenant). In the example below, the Distinguished Name is also being set as it would be used in the domain controller.

Create the PAM Configuration

In the PAM Configurations page, create a new configuration and set the following options:

• Environment: Domain Controller

• Gateway: the gateway from above

• Application Folder: app folder created for application

• Administrative Credential: domain user created above ("KEEPERPAMLAB\Administrator")

• Hostname / IP: the hostname or IP relative to the gateway

• Port: 636 (typical LDAPS port)

• Domain ID: keeperpamlab.com

Validation Test

In order to validate that the PAM Configuration attaches correctly, you can run a Discovery job. Navigate to Discovery, and click "Create a Discovery Job". Select the correct gateway and start the discovery job. It can take a few attempts to get correct, since the configuration needs to be correct. In the following example, the discovery job finds two users in the domain controller instance.