Configure a Domain Using a Directory Server

LDAP Configuration

Cloud Connector 3.5 and later defaults to a list of commonly used attributes to prevent the issue from appearing as binary.

Do not configure the LDAP integration to query binary objects. Doing so may cause issues. Also, update the LDAP configuration so that it does not import other LDAP objects, such as computers and groups. This change will also decrease the leveldb store size, as Skyhigh CASB only imports attributes that are needed, instead of all binary attributes. 

Configure the Attributes field as follows:

• The Attributes field should contain only fields that are used, for example: dn,sAMAccountName,memberOf,name
• Add an LDAP filter to query ony for objects that actually have the attribute set that is used, for example: (&(sAMAccountName=*)(memberOf=*)(name=*))

With these two settings, the LDAP connection is correctly configured and will not fail. 

The new activeDirectory.json file in the .config directory looks like the following example:

{
     "activeDirectorySetups": [{
               "name": "Domain",
               "activeDirectoryDataSource": {
                     "host": "cs.msds.kp.org",
                     "port": 389,
                     "userName": "SvcSkyhigh",
                     "password": "%C3%90%C2%BFy%C3%9A%C3%8CI%C2%9B%1E",
                     "activeDirectoryQuery": {
                          "base": "DC=cs,DC=msds,DC=kp,DC=org",
                          "filter": (&(sAMAccountName=*)(memberOf=*)(name=*)),
                          "attributes": dn,sAMAccountName,memberOf,name
                     },
                     "activeDirectorySslSettings": null
               },
               "csvDataSource": null,
               "shadowActiveDirectorySettings": {
                     "enableIpToUserMapping": false,
                     "customAttributes": {
                          "uniqueUserAdAttribute": "sAMAccountName",
                          "customAttributeMappings": [{
                                    "displayName": "Firewall Host Name",
                                    "customAttributeId": "custom3",
                                    "mappedTo": null
                               }, {
                                    "displayName": "Display Name",
                                    "customAttributeId": "custom4",
                                    "mappedTo": "name"
                               }, {
                                    "displayName": "Firewall Serial",
                                    "customAttributeId": "custom1",
                                    "mappedTo": null
                               }, {
                                    "displayName": "usageType", 
                                    "customAttributeId": "custom2",
                                    "mappedTo": null
                               }, {
                                    "displayName": "Member of",
                                    "customAttributeId": "custom5",
                                    "mappedTo": "memberOf" 
                               }
                          ]
                     }
               },
               "sanctionedActiveDirectorySettings": null
          }
     ]
}

Virtual Attributes 

The goal of Virtual Attributes is to provide additional formatted attributes that can be used in policies instead of using the AD attribute directly. Virtual Attributes are formatted to prevent the Skyhigh CASB dashboard from presenting too many values.

The following Virtual Attributes are available.