Planning an Enterprise Identity Mapping domain controller

Plan domain controller access

You need to plan how you and EIM-enable applications and operating systems will access the directory server that hosts the EIM domain controller. To access an EIM domain you must:

1. Be able to bind to the EIM domain controller
2. Make sure that the bind subject is a member of an EIM access control group, or is the LDAP administrator. Refer to Manage EIM access control for more information.

Select type of EIM binding

EIM APIs support several different mechanisms for establishing a connection, also known as binding, with the EIM domain controller. Each type of binding mechanism provides a different level of authentication and encryption for the connection. The possible choices are:

Simple Binds

A simple bind is an LDAP connection where an LDAP client provides a bind distinguished name and a bind password to the LDAP server for authentication. The bind distinguished name and password are defined by the LDAP administrator in the LDAP directory. This is the weakest form of authentication and the least secure as the bind distinguished name and password are sent unencrypted and are vulnerable to eavesdropping. You use CRAM-MD5 (challenge-response authentication mechanism) to add an additional level of protection for the bind password. With the CRAM-MD5 protocol, the client sends a hashed value instead of the clear text password to the server for authentication.

Server authentication with Secure Sockets Layer (SSL) - server side authentication

An LDAP server can be configured for SSL or Transport Layer Security (TLS) connections. The LDAP server uses a digital certificate to authenticate itself to the LDAP client and establishes an encrypted communications session between them. Only the LDAP server is authenticated by means of a certificate. The end user is authenticated by means of a bind distinguished name and password. The strength of the authentication is the same as for a simple bind, but all data (including the bind distinguished name and password) is encrypted for privacy.

Client authentication with SSL

An LDAP server can be configured to require that the end user be authenticated by means of a digital certificate rather than a bind distinguished name and password for SSL or TLS secure connections to the LDAP server. Both client and server are authenticated and the session is encrypted. This option provides a stronger level of user authentication and protects the privacy of all data transmitted.

Kerberos authentication

An LDAP client can be authenticated to the server by using a Kerberos ticket as an optional replacement for a bind distinguished name and password. (Kerberos), which is a trusted third-party network authentication system, allows a principal (a user or service) to prove its identity to another service within an unsecured network. Authentication of principals is completed through a centralized server called a key distribution center (KDC). The KDC authenticates a user with a Kerberos ticket. These tickets prove the principal's identity to other services in a network. After a principal is authenticated by these tickets, the principal and service can exchange encrypted data with a target service. This option provides a stronger level of user authentication and protects the privacy of authentication information.

The choice of a bind mechanism is based on the level of security required by the EIM-enabled application and the authentication mechanisms supported by the LDAP server that hosts the EIM domain.

Also, you might have to perform additional configuration tasks for the LDAP server to enable the authentication mechanism that you choose to use. Check the documentation for the LDAP server that hosts your domain controller to determine what other configuration tasks you may need to perform.

Example planning work sheet: domain controller information

After making your decisions about your EIM domain controller, use the planning worksheets to record the EIM domain controller information that your EIM-enabled operating systems and applications need. The information that you gather as part of this process can be used by the LDAP administrator to define the bind identity of the application or operating system to the LDAP directory server that hosts the EIM domain controller.

The following sample portion of the planning work sheets shows the type of information that you need to gather. It also includes sample values that you could use when you configure the EIM domain controller.

If your EIM configuration and administration team consists of multiple team members, you will need to determine the bind identity and mechanism that each team member should use for accessing the EIM domain based on their role. Also, you need to determine the bind identity and mechanism for EIM application end users. You may find the following work sheet helpful as an example for gathering this information.