Configuring integration with Active Directory for responding to alerts

Integration with Active Directory enables you to perform response actions for Active Directory users affected by or involved in the alert.

The integration with Active Directory for responding to alerts, the ADFS integration, and the settings for scanning the Active Directory domain controller (the address and user credentials of the domain controller) you specify when configuring a domain controller polling, are different settings. Since you need to ensure that the user for whom a response action is to be performed has an Active Directory account, you must configure both the integrations: for scanning and for responding. The order is not significant.

The integration settings are not inherited and are applied only to the Administration Server (physical or virtual) on which you configure these settings.

To configure integration with Active Directory for responding to alerts:

1. In the main menu, click the settings icon () next to the name of the Administration Server.

   The Administration Server properties window opens, with the General tab selected.

2. Select the Distribution points section, and then click the name of the required distribution point.
3. In the properties window that opens, select the Active Directory section.
4. In the right pane, enable the Active Directory integration toggle switch.

   Later, if you want to turn off the integration, you can only do it for all connections by disabling the Active Directory integration toggle switch. You cannot turn off the integration for a separate connection. Instead, you can delete the connection.

5. Create a connection to the Active Directory domain controller by clicking the Add connection button.
6. In the window that opens, specify the following parameters for the connection:
   • Domain controller address

     Computer name or IP address, for example: server.mycompany.com. You can specify several addresses. All domain controllers whose addresses you specify must belong to the same domain.

   • Active Directory domain name

     DNS fully qualified domain name, for example: mycompany.com

     Use lowercase letters. If you create several connections for the Administration Server or a distribution point, specify different names for each connection.

   • Login

     Login of the Active Directory account with administrator rights under which the response actions are to be performed.

   • Password

     Password of the Active Directory account with administrator rights under which the response actions are to be performed.

7. If you want to check the connection status, click the Check connection button.

   If the connection is successfully established, the Connected status is displayed. Otherwise, the status is Failed, and an error message is displayed with the domain controllers to which you failed to connect.

   You must take into account the way you connect to Active Directory: from a Linux device or from a Windows device.

   Connecting from a Linux device

   By default, when connecting and authenticating to a domain controller from a Linux device, the logic is the following:

   1. A distribution point attempts to connect to the domain controller over LDAPS.

      The strong verification of the LDAP server certificate is performed.

   2. You place the public part of the domain controller certificate into the system certificate repository to validate the certificate.

      The OS-dependent path to the system certificate authority (CA) is used to access the certificate chain.

      For example:

      • /etc/ssl/certs/ca-certificates.crt—Path for Debian-based operating systems (Debian, Ubuntu, Astra).
      • /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem—Path for CentOS or Red Hat.
   3. If the LDAPS connection fails, an error occurs, and no other connection protocol is used.

      In case of issues with LDAPS, you can contact Kaspersky Technical Support.

   If you do not want to install the certificate into the system certificate repository, you can use the KLNAG_LDAP_SSL_CACERT flag to set the path to the domain controller certificate. To do it, run the command:

   klscflag -fset -pv klnagent -n KLNAG_LDAP_SSL_CACERT -t s -v "</path/to/domain-controller/cert>"

   where </path/to/domain-controller/cert> is the path to the public part of the domain controller certificate.

   For example, if the path is "/var/opt/kaspersky/ldap_cert.crt", the command is klscflag -fset -pv klnagent -n KLNAG_LDAP_SSL_CACERT -t s -v "/var/opt/kaspersky/ldap_cert.crt"

   Connecting from a Windows device

   When connecting and authenticating to a domain controller from a Windows device, the connection settings are defined by the domain.

   You only have to ensure that:

   • LDAPS is enabled and port 636 is available on the device.
   • You allow connections to the domain controller through a firewall or a proxy server.
8. Click the Create button.

The window is closed, and the connection is displayed in the table of connections.

In the table of connections, you can do the following:

• Edit connection parameters.

  To do this, click the link with the Domain controller address parameter for the required connection. In the window that opens, change the required settings, and then click the Save button.

  You can edit only the Login and Password parameters.

• Delete connections.

  To do this, select the check box next to the connection you want to delete, click he Delete button in the toolbar, and then confirm the deletion of the connection.

Page top