Open Single Management Platform supports polling of a Microsoft Active Directory domain controller and a Samba domain controller. For a Samba domain controller, Samba 4 is used as an Active Directory domain controller.
When you poll a domain controller, Administration Server or a distribution point retrieves information about the domain structure, user accounts, security groups, and DNS names of the devices that are included in the domain.
We recommend using domain controller polling if all networked devices are members of a domain. If some of the networked devices are not included in the domain, these devices cannot be discovered by domain controller polling.
Prerequisites
Before you poll a domain controller, ensure that the following protocols are enabled:
Ensure that the following ports are available on the domain controller device:
Domain controller polling by using Administration Server
To poll a domain controller by using Administration Server:
The Domain controller polling settings window opens.
The following polling schedule options are available:
If you change user accounts in a security group of the domain, these changes will be displayed in Open Single Management Platform an hour after you poll the domain controller.
Domain controller polling by using a distribution point
You can also poll a domain controller by using a distribution point. A Windows- or Linux-based managed device can act as a distribution point.
For a Linux distribution point, polling of a Microsoft Active Directory domain controller and a Samba domain controller are supported.
For a Windows distribution point, only polling of a Microsoft Active Directory domain controller is supported.
Polling with a Mac distribution point is not supported.
To configure domain controller polling by using the distribution point:
If you use a Linux distribution point, in the Poll specified domains section, click Add, and then specify the address and user credentials of the domain controller.
If you use a Windows distribution point, you can select one of the following options:
Polling starts only according to the specified schedule. Manual start of polling is not available.
After the polling is completed, the domain structure will be displayed in the Domain controllers section.
If you set up and enabled device moving rules, the newly discovered devices are automatically included in the Managed devices group. If no moving rules have been enabled, the newly discovered devices are automatically included in the Unassigned devices group.
The discovered user accounts can be used for domain authentication in OSMP Console.
Authentication and connection to a domain controller
On initial connection to the domain controller the Administration Server identifies the connection protocol. This protocol is used for all future connections to the domain controller.
The initial connection to a domain controller proceeds as follows:
By default, certificate verification is not required. Set the KLNAG_LDAP_TLS_REQCERT flag to 1 to enforce certificate verification.
By default, the OS-dependent path to the certificate authority (CA) is used to access the certificate chain. Use the KLNAG_LDAP_SSL_CACERT flag to specify a custom path.
You can use the KDT command to configure flags. For example, you can enforce certificate verification. To do this, on the administrator host where the KDT utility is located, run the following command:
./kdt invoke ksc --action klscflag --param klscflag_param=" -fset -pv klserver -n KLNAG_LDAP_TLS_REQCERT -t d -v 1"
Page top