Using Active Directory for Authorizations CSG, September 2002

MIT uses of AD Domain Services for Windows users Management of Windows 2000 machines –Group Policies –Software Distribution

Software Distribution Assignment vs. Advertising –Users –Machines

Identity Management Users Machines –Computer class is a sub class of user

Implications of Identity Management of Machines What determines the identity of a machine? –IP address? –MAC address? –Hostname? –Possession of a token? (keytab, certificate, …) How does an administrator manage the identity?

An AD Limitation How do you grant access to an SMB share to all of the objects within an OU? –No AD triggers to create a security group that represents the membership as it changes over time. –Moira incremental used to do this Used to deploy MS Office to licensed machines

Authorization by SID vs. Name ACLs made directly in AD will contain the SIDs of the objects. ACLs defined in Moira and propagated to AD will make references by name. –Reinstallation of machines does not force a re- ACL

Other AD auth issues Privacy and data hiding –AD supports ACLs on almost everything –ACL processing can have a high overhead Almost undocumented dsHeuristics attribute –List Object permission type