How To: Encrypt Phone Number Fields in Active Directory

Version Affected: All

 

Overview

This article explains how to encrypt a phone number field so its value isn't stored in plain text in Active Directory (AD), when using AD account management, including inline.

1. The default AD phone attributes — telephoneNumber and mobile — cannot be encrypted, since AD does not allow enough space in those fields to store an encrypted value. Instead, map the phone field to an AD attribute that is large enough — a directory string attribute with at least 550 characters, such as one of the extensionAttributes. (The example below uses the Description attribute only to illustrate the result; extensionAttributes is the recommended field for production use, since Description is normally used for other purposes.)
   
2. In the realm's web.config, set the corresponding phone field's encryption level — phone1Encrypt, phone2Encrypt, phone3Encrypt, or phone4Encrypt — to one of:
   • 0 = No encryption
   • 1 = Standard encryption
   • 2 = Advanced encryption
   • 3 = Standard hash
   

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.