Skip to main content

Configure SASL and Kerberos for LDAP

Lightweight Directory Access Protocol (LDAP) domain connections in Netwrix Privilege Secure for Discovery can use the Simple Authentication and Security Layer (SASL) with Kerberos. This page covers the connection that the product uses to read the directory. For Kerberos authentication to Windows endpoints, set Windows Authentication Method to Kerberos in the same domain settings. See Add a domain.

Enable SASL​

  1. Select Configure > Server, and select the domain to open its settings.

  2. Set Directory Authentication Method to SASL: Kerberos.

    The Directory Authentication Method set to SASL: Kerberos

  3. In Kerberos User, which replaces Bind DN, enter the account as user@REALM.

  4. Enter the password, and select Save.

Requirements and limits​

  • Enter the Kerberos domain name in all capital letters, for example user@EXAMPLE.COM. It is usually the Active Directory domain name. For details, see the MIT Kerberos configuration documentation.
  • The product host must reach a domain controller for Kerberos on TCP and UDP port 88. See Ports and firewall.
  • SASL doesn't work with SSL. Use port 389 for SASL.
  • Kerberos is sensitive to DNS and depends on working reverse DNS lookup. This is a Kerberos requirement, not specific to Privilege Secure for Discovery.
  • The product doesn't support LDAP record referrals.
  • If you switch a domain from Kerberos to NTLM, the first scan after the switch doesn't update the last_scanned timestamps. The next scan updates them.

For more information, see the MIT Kerberos KDC installation guide and the Microsoft Kerberos KDC registry keys documentation.

Verify DNS and reverse DNS​

  1. Look up the LDAP server name.

    nslookup <ldap-server-name>

  2. Look up the IP address that the first lookup returned.

    nslookup <ip-address-from-first-lookup>

    The second lookup must return the LDAP server name.

  3. To show the DNS servers that the host uses, run the following command.

    resolvectl status <interface>

Troubleshoot SASL and Kerberos​

If you can't enable SASL, contact Netwrix Support.

  1. Open an SSH session to a swarm manager node. The logs for this feature run under the s1_internal_api service.

  2. Follow the service logs, then test the connection. The test should produce log entries.

    docker service logs s1_internal_api --follow

  3. Confirm that reverse DNS works for the LDAP server. See Verify DNS and reverse DNS.