How To: Choose the Correct Active Directory Attribute for Each IdP Datastore Profile Property

Version Affected: All

 

Overview

This article explains how to choose the correct Active Directory (AD) attribute for each SecureAuth Identity Provider (IdP) Datastore Profile Property, when configuring the Data tab to read from or write to AD.

Choose the Correct AD Attribute for a Profile Property

Each Profile Property listed on the Data tab must be mapped to an AD attribute that meets a specific set of requirements for that property — its Lightweight Directory Access Protocol (LDAP) Syntax, and the size of data it can hold, among others. An attribute that works for one Profile Property will not necessarily work for another. For example, the PIN Profile Property and the OATH Token Profile Property each require different AD attribute characteristics, and OATH Tokens stored in Plain Binary format require a different attribute syntax than OATH Tokens stored in JSON or Encrypted JSON format.

See SecureAuth's Active Directory Attributes Mapping to Profile Properties reference for the default recommended AD attribute for each Profile Property.

Using that reference, confirm the LDAP Syntax required for the Profile Property being configured. For example, the PIN Profile Property requires an AD attribute with an Attribute Syntax of Directory String, a Size (RangeUpper) of at least 1024 — to allow for longer PINs — and that holds only a single value:

A different AD attribute with a Directory String syntax could be used even if it does not meet the recommended size — but the PIN value would then be limited to however many characters that attribute allows. For example, the c AD attribute has a Directory String syntax, but its Size (RangeUpper) is only 3 characters, which is not recommended for a PIN:

The OATH Tokens Profile Property, when stored in Plain Binary format, requires an AD attribute with an Attribute Syntax of Octet and a Size (RangeUpper) of at least 4096:

Stored as JSON or Encrypted JSON instead, the OATH Tokens Profile Property requires an AD attribute with an Attribute Syntax of Directory String and the same minimum size:

A full list of AD attributes with a Directory String syntax is available at the same reference link above.

If an extended AD schema is in use and an attribute's syntax is not already known, or to find every AD attribute using a specific syntax, use PowerShell. The following example checks the otherLoginWorkstations attribute's Syntax, Length, and Single/Multi-value properties — replace it with the attribute being checked:

$att="otherLoginWorkstations";
([DirectoryServices.ActiveDirectory.ActiveDirectorySchema]::GetCurrentSchema()).FindClass("user").optionalProperties | Where {$_.Name -like "*$att*"} | Select Name, Syntax, IsSingleValued, RangeLower, RangeUpper;

The following example lists every AD attribute using the Octet String syntax — replace Octet with the syntax being searched for, such as Directory:

$syn="Octet";
([DirectoryServices.ActiveDirectory.ActiveDirectorySchema]::GetCurrentSchema()).FindClass("user").optionalProperties | Where {$_.Syntax -like "$syn*"} | FT Name, Syntax, IsSingleValued, RangeLower, RangeUpper;

Special Considerations

Confirm that any AD attribute selected is not already being used elsewhere in the organization before assigning it to an IdP Profile Property. If no Directory String syntax attribute is available for a given property, a Unicode String syntax attribute can be used instead, as long as it meets the property's other requirements.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.