JumpCloud recently held a webinar to discuss how password management fits within an organization’s Identity and Access Management (IAM) stack.
Our host, JumpCloudian Allison Casto, was joined by Antoine Jebara, co-founder and GM of MSP Business, and Rob McGrath, product manager, in discussing the relevance of password management and how JumpCloud Password Manager helps organizations build a comprehensive identity strategy. Below is a recap of the key points discussed during the webinar.
Passwords have long been heralded to be on their way out. With several authentication methods now available to organizations, passwords no longer enjoy the center stage of their identity access management strategy.
However, no thanks to a combination of factors, it doesn’t appear that passwords are going away completely, forever — just yet.
So, what’s an organization to do?
Should they focus solely on their other authentication methods and hope that passwords die a quicker death? Or should they face the inevitable fact that passwords are sticking around a bit longer than we thought and must be effectively managed?
This post discusses why password management is relevant today and how organizations can include it in their access management strategy.
Password Management: Why Bother?
Almost two decades after Bill Gates first predicted the end of passwords, passwords no longer form the core of most organizations’ access management strategy. But here’s why organizations must pay attention to password management:
Ubiquity
Passwords are the most common authentication method, and for good reason. First, they’ve been around for far longer. Second, passwords are a right-out-of-the-box feature in almost all devices. This is more than can be said for other modes of authentication such as biometric recognition or smart cards.
The net effect is, despite organizations’ less reliance on them, passwords are likely to hang on till, at least, other authentication methods become as commonplace.
Weakness
Organizations must have a password management strategy to protect themselves from the vulnerabilities that passwords pose. From phishing to physical theft, and even dumpster diving, passwords pose the most risk of enabling authorized access.
In developing their IAM strategy, many IT teams have had SSO play a significant role in their strategy. SSO enables users to log in once to all the company resources they need to get their work done.
This is mostly done by coupling SSO with push authentication, biometric recognition, and other authentication modes.
Sometimes, however, users will not be able to use SSO to get into some paywalled web-based apps. Or sometimes, they may have to use some shadow IT tools which aren’t part of the company’s infrastructure.
In such instances, password usage creates a gap which password management must bridge, or organizations risk security exposure.
Password Managers + Types
Password managers are software that securely stores and protects users’ login information. Although they typically maintain records of usernames and relevant passwords, they also offer additional storage options. This includes addresses, card details, etc.
There are three major types of password managers:
Offline Password Managers
These password managers store and encrypt passwords locally on a user’s endpoints but don’t sync the password across different devices. Thus, users can only use the password manager on one device outside the box.
Offline password managers are rather unfit for enterprise use cases because they don’t grant admins with centralized visibility and control. What they lack in convenience however, they make up for in security. Offline password managers are not susceptible to network or server attacks since they store and encrypt passwords on the user’s device.
Cloud-Based Password Managers
Cloud-based password managers store passwords in a vault which is itself located on the password manager servers. The passwords are encrypted with a key called the “Master Password.” The user is tasked with creating, remembering, and protecting this master password.
Users access the information in cloud-based password managers using a combination of their email and the master password.
These are more convenient since users can access them on multiple devices. Plus, they give a high level of visibility and control to admins. However, they make a huge trade-off in security as their effectiveness depends on the user’s ability to create and protect a strong master password.
A hybrid password manager, such as JumpCloud Password Manager, works by combining the best traits of the first two types of password manager.
It uses a decentralized storage architecture where passwords are stored locally on the user’s endpoints. Next, it generates a key for encrypting the passwords in a vault.
This vault then syncs across other devices on JumpCloud’s network, thereby making simultaneous login possible.
It also allows users to share passwords with other users in the organization. What’s more? A hybrid password manager facilitates an environment where admins have visibility and control but without being able to see the user’s password unless where it is shared with them.
An inherent advantage of JumpCloud’s password manager is that reliance is not placed on a user’s ability to create and protect a master password. Thus, users can authenticate access to this vault using biometrics, Windows Hello, or other local authentication means.
JumpCloud Password Manager: Fitting Into a Larger Ecosystem
JumpCloud developed its sophisticated password manager in response to growing demand from organizations. The password manager provides a single-point solution for IAM needs, reducing tool sprawl and lowering IT costs.
The password manager integrates with the JumpCloud open directory platform and greatly complements other tools such as multi-factor authentication (MFA), SSO, conditional access, etc.
Besides its benefits as an important part of a larger ecosystem, JumpCloud Password Manager is also a superior option because it eliminates the dilemma of choosing between convenience and security.
The manager increases users’ productivity and generally makes for a better experience. It saves users’ time and effort that would otherwise have been spent writing out passwords of shadow IT resources on Post-it Notes and Google Sheets. It does this by storing and auto-filling passwords across websites, mobile apps, and desktop apps.
The password manager also enables users or teams to share passwords with other colleagues without compromising security.
JumpCloud Password Manager also provides a seamless experience for admins as it is deployed and managed through one console. Plus, it gives them a high level of visibility and control over user passwords. For example, the password manager gives admins insight into users’ password strength and reuse cases without revealing the passwords themselves.
Leverage JumpCloud’s Password Manager Today
As passwords continue to stick around, IT admins must understand how to fit password managers into their organizations’ IAM strategies.
With JumpCloud’s hybrid password manager being the perfect mix of security, visibility, control, and convenience, password management just became less of a pick-your-poison dilemma.Learn more about JumpCloud’s password manager and watch a demonstration of it in this webinar.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
JumpCloud recently held a webinar to discuss how MSPs can expand their Identity Access Management (IAM) offering with password management.
Our host, JumpCloudian Dakota Hippern, was joined by Antoine Jebara, co-founder and GM of MSP Business, and Rob McGrath, product manager, in discussing the relevance of password management and how JumpCloud Password Manager is poised to help MSPs bolster their IAM offering. Below is a recap of the key points discussed during the webinar.
Passwords might soon become an endangered species. With the uptick in biometric recognition, smart pins, and push notifications as the preferred method of authentication, password management is no longer at the center of organizations’ IAM approach.
More companies now use LDAP and RADIUS-based authentication to log people into resources like VPN, Wi-Fi, on-prem infrastructure, etc.
Despite this, password management constitutes a vital component in most organizations’ infrastructure, and MSPs must take this into consideration when assessing their identity and access management offering.
This post discusses why password management is still relevant today and how MSPs can make the most of JumpCloud’s password manager to deliver excellent service to their clients.
Password Management: Why Bother?
Almost two decades after Bill Gates first predicted the death of passwords, passwords no longer form the core of most organizations’ access management strategy. Why then should MSPs bother with password management?
Ubiquity
Passwords are the most common authentication method, and for good reason. First, they’ve been around for far longer. Second, passwords are a right-out-of-the-box feature in almost all devices. This is more than can be said for other modes of authentication such as biometric recognition or smart cards.
The net effect is, despite organizations’ less reliance on them, passwords are likely to hang on till, at least, other authentication methods become as commonplace.
Weakness
MSPs must have a password management strategy to protect their clients from the vulnerabilities that passwords pose. From phishing to physical theft, and even dumpster diving, passwords pose the most risk of enabling authorized access.
In developing their IAM offerings, most MSPs have had single sign-on (SSO) play a significant role in their strategy. SSO enables users to log in once to all the company resources they need to get their work done.
This is mostly done by coupling SSO with push authentication, biometric recognition, and other authentication modes.
Sometimes, however, users will not be able to use SSO to get into some paywalled web-based apps. Or sometimes, they may have to use some shadow IT tools which aren’t part of the company’s infrastructure.
In such instances, password usage creates a gap which password management must bridge, or organizations risk security exposure.
Password Managers + Types
Password managers are software that securely stores and protects users’ login information. Although they typically maintain records of usernames and relevant passwords, they also offer additional storage options. This includes addresses, card details, etc.
There are three major types of password managers:
Offline Password Managers
These password managers store and encrypt passwords locally on a user’s endpoints but don’t sync the password across different devices. Thus, users can only use the password manager on one device outside the box.
Offline password managers are rather unfit for enterprise use cases because they don’t grant admins with centralized visibility and control. What they lack in convenience however, they make up for in security. Offline password managers are not susceptible to network or server attacks since they store and encrypt passwords on the user’s device.
Cloud-Based Password Managers
Cloud-based password managers store passwords in a vault which is itself located on the password manager servers. The passwords are encrypted with a key called the “Master Password.” The user is tasked with creating, remembering, and protecting this master password.
Users access the information in cloud-based password managers using a combination of their email and the master password.
These are more convenient since users can access them on multiple devices. Plus, they give a high level of visibility and control to admins. However, they make a huge trade-off in security as their effectiveness depends on the user’s ability to create and protect a strong master password.
A hybrid password manager, such as JumpCloud Password Manager, works by combining the best traits of the first two types of password manager.
It uses a decentralized storage architecture where passwords are stored locally on the user’s endpoints. Next, it generates a key for encrypting the passwords in a vault.
This vault then syncs across other devices on JumpCloud’S network, thereby making simultaneous login possible.
It also allows users to share passwords with other users in the organization. What’s more? A hybrid password manager facilitates an environment where admins have visibility and control but without being able to see the user’s password unless where it is shared with them.
An inherent advantage of JumpCloud’s password manager is that reliance is not placed on a user’s ability to create and protect a master password. Thus, users can authenticate access to this vault using biometrics, Windows Hello, or other local authentication means.
JumpCloud Password Manager: Fitting Into a Larger Ecosystem
JumpCloud developed its sophisticated password manager in response to growing demand from organizations and MSPs. The password manager provides a single-point solution for IAM needs, reducing tool sprawl and lowering IT costs.
The password manager integrates with the JumpCloud open directory platform and greatly complements other tools such as multi-factor authentication (MFA), SSO, conditional access, etc.
JumpCloud Password Manager also provides a seamless experience for admins as it is deployed and managed through one console. Users also benefit from not having to log in to disparate apps through an external password manager.
Besides its benefits as an important part of a larger ecosystem, JumpCloud Password Manager is also a superior option because it eliminates the dilemma of choosing between convenience and security.
Leverage JumpCloud’s Password Manager Today
As passwords continue to hang on for the ride, MSPs must understand how to fit password managers into their IAM offering.
With JumpCloud’s hybrid password manager being the perfect mix of security, visibility, control, and convenience, password management just became less of a pick-your-poison dilemma.Learn more about JumpCloud’s password manager and watch a demonstration of it in this webinar.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
A domain describes a collection of users, systems, applications, networks, database servers, and any other resources that are administered with a common set of rules. Generally, a domain also encompasses a physical space like an office or multiple offices. If you are within the domain you are in a theoretically safe space and trusted. If outside, you are untrusted, so the domain would effectively be your castle with a moat around it.
A domain controller (DC) is a server that manages network and identity security, effectively acting as the gatekeeper for user authentication and authorization to IT resources within the domain. Domain controllers are particularly relevant in Microsoft directory services terminology, and function as the primary mode for authenticating Windows user identities to Windows-based systems, applications, file servers, and networks. They also host Active Directory services.
The popularity of Windows systems for enterprise solutions established the domain controller as a common term in networking architecture. However, recent trends have antiquated their use — especially for non-Windows systems. Domain controllers as they exist today don’t meet the requirements of small and medium-sized enterprises (SMEs). That has led many organizations to seek alternative cloud identity and access management (IAM) solutions and device management that works on systems beyond Windows. The domainless enterprise accomplishes what domain controllers did for Windows networks through cloud-based infrastructure. It treats identities as the perimeter and devices as a gateway to resources.
However, domain controllers remain a foundational technology for SMEs and can be extended and improved by cloud directories, including JumpCloud’s Open Directory Platform. This article provides an in-depth introduction to domain controllers, how they work, and how to use them.
Intro to Domain Controllers
The concept of the domain controller was first introduced by Microsoft to manage Windows NT-based networks. It provided IT admins a way to control access to resources within a domain — essentially an organization’s users and IT resources. In this environment, all user requests are sent to the domain controller for authentication and authorization. The domain controller then authenticates the user identity, typically by validating a username and password, then authorizes requests for access accordingly. Windows Server has evolved over the years with the inclusion of new features to support modern hosting paradigms and deployment options. Subsequent releases have added additional server roles, and can keep pace with newer hardware, authentication protocols, reporting, administration, and security requirements.
What Does a Domain Controller Do?
Domain controllers continued to enforce permissions and security policies for network resources while ensuring the overall security and reliability of the network. Then, inclusion of Microsoft’s Active Directory (AD) enabled network administrators to manage users accounts and entitlements for Window-based networks from a centralized location. AD sets policies such as password complexity requirements or account lockouts. It’s also possible to replicate data and user information to other domains on the network, whether on-premise or at another location.
AD has since played a critical role for many organizations for over two decades. Domain controllers remain relevant to the modern enterprise, but lock users into Windows networks without the inclusion of cloud services that federate identity and manage all device platforms.
How Is Active Directory Set Up on a Domain Controller?
Active Directory Domain Services (AD DS). This is the main service within the Active Directory protocol. Besides storing the directory information, it also controls which users can access each enterprise resource and group policies. AD DS uses a tiered structure comprising the domains, trees, and forests to coordinate networked resources.
Active Directory Lightweight Directory Services (AD LDS). It shares the same codebase and functionality as AD DS. However, unlike AD DS, AD LDS uses the Lightweight Directory Access Protocol (LDAP), allowing it to run on multiple instances on the same server.
Active Directory Federation Services (AD FS). As the name suggests, AD FS is a federated identity service that provides single sign-on (SSO) capabilities. It uses many popular protocols such as OAuth, OpenID, and Secure Assertion Markup Language (SAML) to pass credentials between different identity providers.
Active Directory Certificate Services (AD CS). This is a service that creates on-premises public key infrastructure (PKI), allowing organizations to create, validate, and revoke certificates for internal use.
Follow these steps to set up AD:
Install Windows Server: Designate a Windows Server instance to be your primary domain controller. Dedicate a virtualization platform or server that meets the minimum hardware requirements to run Windows Server and leave room for expansion.
It’s likely that you’ll need additional server instances and roles if you’re building an infrastructure around the DC infrastructure around the DC. Microsoft modified its licensing regime to function on a per core basis (not to mention every other Client Access License (CAL) you need). Keep these added costs in mind, because server core licensing may be more expensive than you realize.
Install Active Directory Domain Services: Install AD DS using the Server Manager or PowerShell. Have a contingency plan for backups and to address what happens if your DC goes down.
Promote the Server to a Domain Controller: Next, you’ll need to promote the server to a domain controller. The Active Directory Domain Services Installation Wizard will assist with specifying the appropriate settings for your network.
Configure Active Directory: Configure Active Directory to suit your network requirements. This involves creating organizational units, users, groups, and other network components. Meeting modern security standards can be a complex process that should only be attempted by experienced administrators who understand the risks involved.
Configure DNS: Active Directory relies heavily on DNS (Domain Name System) for name resolution. Configure DNS properly to ensure that Active Directory functions correctly. Have at least two internal DNS servers and consider using Active Directory integrated zones. It improves reliability, performance, and the DNS server will deny requests from hosts that aren’t authorized.
Configure Group Policy: Finally, configure Group Policy, which allows you to manage and enforce policies across the network. Group Policy settings can be applied at the domain, site, or organizational unit level. The default UIs can be challenging and laborious. GPO Templates make it easier to implement strong security postures for Windows such as CIS benchmarks.
Is a Domain Controller the Same as a DNS Server?
A DC functions as a gatekeeper for host access to domain resources and provides authentication into a domain using Kerberos and/or NTLM. It’s where policies are enforced and AD is hosted. The Domain Network System (DNS) protocol translates IPs into URLs that help users navigate the web. A DNS Server will strictly provide DNS services.
Other Domain Controller Implementation Options
The following deployment options can help admins to save money and meet their requirements.
Global Catalog (GC): The GC is an unofficial Flexible Single Master Operations (FSMO) role and AD feature that provides information about any object across all forest domains. Select attributes are replicated to GC servers, which allows admins to pull necessary information.
Read-Only Domain Controllers (RODC):An RODC is an option to host a read-only copy of Active Directory for branch offices when IT resources are limited. It serves as an economical alternative to establishing secure data center facilities at every branch of an organization. Authentication requests go to the RODC versus a WAN link to improve security. The RODC server holds limited data about the DC and credential caching is defined by policy. Local administrators can make changes that won’t affect the primary DC at headquarters.
Directory Services Restore Mode (DSRM): DSRM is a special boot mode to help admins recover AD databases and restore system state. This is a similar concept to “Safe Mode” in Windows. Hackers sometimes use pen-testing tools such as Mimikatz to activate and capture local DSRM admin credentials. They can obtain remote access using local admin accounts.
Domain Controller Setup and Best Practices
Attackers employ several common methods to elevate privileges and create persistence. The following steps take those into consideration and can help to prevent breaches from happening:
Disable the default administrator user. This is a primary attack vector.
Limit the use of domain admin privileges. Don’t run as an admin user and consider time-based privileged elevation. When AD is installed, consider having administrative accounts reside within a separate forest (Red Forest model) from other users by implementing authentication policy silos. This configuration may require external experts, training, and add-on tools to implement. It’s extremely important to plan out the design and configuration and to implement monitoring and logging.
Implement new Active Directory enhanced features such as protected groups, restricted RDP, time-based group membership, and testing. Consider an intrusion detection system, because AD contains all of your “keys to the kingdom.”
Use different servers for RDP and MMC access. This writer encountered a DC that hosted the RDP role service directly on it and my team (in a previous role) had to reprovision it for a “clean” baseline.
Be judicious and trust the supplier when you install third-party applications on DCs.
Restrict internet access to DCs through network filtering and consider using a defense in-depth approach. Microsoft recommends using Defender for Identity, which requires deploying sensors and obtaining licensing. It’s a standalone subscription that’s also bundled into premium SKUs including Enterprise Mobility + Security 5 suite (EMS E5).
Admins should establish a program to harden their DCs, patch and remediate, and maintain an appropriate security baseline. For instance, prevent web browsing from a DC. Microsoft recommends these actions to secure DCs from attack.
Use Local Administrator Password Solution (LAPS) to manage local admin passwords on domain-joined computers. It will randomize local administrators’ passwords.
Why Are Domain Controllers Important?
Domain controllers prevent unauthorized access to resources while ensuring that local domain identities/resources are managed and authorized through directory services. They can also scale to support large and complex networks and customized directory requirements.
What Are the Benefits of a Domain Controller?
Domain controllers centralize user lifecycle management for local domains. They can help to deploy Windows applications to groups of users while establishing the prerequisite security settings for files and programs. Windows DCs are a mature technology that’s widely supported, extensible with third-party solutions, and can be used to federate identities to the cloud.
What Are the Limitations of a Domain Controller?
DCs don’t provide high availability or security best practices out of the box. Organizations may require several domain controllers at different physical locations in order to ensure that there’s no single point of failure. The load on DCs increases as environments grow, which can impact the performance of applications and network services that are dependent on it. This weakness may require additional hardware resources or modifications to your infrastructure to remediate.
This aspect of DCs increases the overheads for maintaining data centers beyond standard configurations and patching. New servers require extending infrastructure and security, and some specialized knowledge and skills are necessary to do it correctly. This increases the costs of training and staffing. DCs will require careful planning, management, and monitoring.
Your domain controllers will always be at risk of zero-day Windows vulnerabilities. Constant vigilance and diligent entitlement management are essential.
Enabling remote work can also be a challenge. IT teams that are AD centric must connect remote users to their LANs through VPNs or alternatives including a software-defined WAN (SD-WAN) and secure access service edge (SASE). Otherwise, purpose-driven cloud services can more easily manage remote endpoints and identities with less infrastructure and overhead. There’s also no potential to extend SSO to web apps, no multi-factor authentication (MFA), and no conditional access rules for privileged users without add-on cloud or software solutions.
Modern Domain Controllers
JumpCloud’s Open Directory Platform is cloud directory service that eliminates the need for an on-prem domain controller by shifting IAM and device management to the cloud. It connects users to whatever IT resources they need, regardless of platform, protocol, provider, and location. All of the secure identity validation still occurs, but you don’t need to manage a server. You can keep Active Directory and use cloud services other than Azure Active Directory and Intune for single sign-on (SSO) and mobile device management (MDM) for your entire fleet.
Cloud-delivery reduces infrastructure costs, simplifies deployment, and maximizes what you already have. Additionally, attribute-based access control and HR system integrations can enable advanced user lifecycle management scenarios to lower overall management overhead. These capabilities are driven by your workflows versus being parceled off as premium features.
Domain Controllers in an Open Directory
JumpCloud is an Open Directory Platform that unifies identity, access, and device management capabilities, regardless of the underlying authentication method or device ecosystem. It can extend both AD and the free tier of AAD to accomplish more, with a lower TCO. JumpCloud authenticates users whether they use biometrics, digital certificates, passwords, or SSH keys. JumpCloud ensures that every resource has a “best method” to connect to it, including LDAP, OIDC, RADIUS, and SAML. Like the original concept of a DC, users can employ a single set of credentials to access systems, applications, networks, file servers, and cloud apps.
Access is secured via environment-wide MFA with optional conditional rules for privileged users. A password manager is also available to support non-SSO applications. It delivers secure, frictionless access, from managed (or trusted) devices running any platform. JumpCloud treats identities as the new perimeter. This is made possible through positioning every device as a gateway to your resources through identities. There are no add-ons for device management or consuming external identities: JumpCloud produces value lock-in versus vendor lock-in.
Try JumpCloud
If you would like to learn more about the future of domain controllers and why the domainless enterprise may be the future approach for your organization, drop us a note. Alternatively, sign up for a JumpCloud Free account and see what a true cloud directory platform could be for you. Your first 10 users and 10 systems are free and you can leverage our 24×7 premium in-app chat support for the first 10 days as well.
Sometimes self-service doesn’t get you everything you need. If that’s how you’re feeling, schedule a 30-minute consultation to discuss options for implementation assistance, migration services, custom scripting, and more.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
Microsoft and Google have been locked in a battle for the heart of the IT community for years now. This technological arms race has brought about a number of cloud innovations, including in identity and access management (IAM). Both contenders understand that by controlling user identities, they can lock you into their respective ecosystems and sell you additional services.
In one corner, we have Microsoft Azure Active Directory (AAD), a cloud-based IAM solution for hybrid or cloud-only implementations. In the other corner, we have Google Cloud Identity, a cloud-based solution for managing user identities and access to Google resources. Both organizations seek to control your identities. The interesting problem is that if you are looking to replace your on-prem Active Directory instance or leverage directory services, then neither of these options can provide a solution. In this article, we’ll compare Google Cloud Identity and Azure Active Directory, before explaining why neither is the best replacement for on-prem solutions.
What is Google Cloud Identity?
If you have ever used Google Workspace, you’re already familiar with Google cloud identities. Google identity management services enable users to connect to various applications and platforms delivered through Google. Google identity management allows for easy integrations to Google’s catalog of SaaS services and SSO applications but it does not offer support for legacy applications or on-prem resources. It also offers some authentication services via OAuth and SAML. An organization’s systems, on-prem applications, and network are outside of the scope of G Suite directory.
Unfortunately, this means that a lot of users will remain locked into their on-prem identity provider instance, namely Active Directory. While Google IDaaS is an excellent cloud user management system for Google Workspace, it is not a stand alone cloud-delivered directory service.
What is Azure Active Directory?
Microsoft’s version of the user management system is called Azure Active Directory (also called AAD, or Azure AD). The name confuses many people, because it makes it seem like Microsoft has moved their on-prem directory to the cloud. But that’s not the case.
Rather, Azure AD works on top of Active Directory to provide single sign-on (SSO) access to a variety of SaaS applications like Office 365, Salesforce, DropBox, and many others. In essence, it is designed as a bridge between your existing legacy Active Directory instance and Microsoft’s catalog of compatible cloud-delivered services. While it is possible to sync your Active Directory instance with Azure AD, in of itself Azure AD is not a complete cloud-based directory service.
This is because Azure AD does not act as the authoritative source of truth of user identities (unless you are just using Office 365 or Azure resources). This role is still within the domain of Active Directory for many organizations, thus requiring traditional on-prem devices and dedicated IT staff to create and maintain. While Azure AD is meant to be a cloud identity platform, unfortunately, the true source of identity management is still firmly grounded with the legacy directory service, Active Directory.
The Problem with Google Cloud Identity and AAD
As hinted above, the most glaring weakness of both of these platforms is that neither can truly function as the core identity provider for an organization. Instead, they’re user management systems designed only for their respective platforms.
Google Cloud Identity only organizes identities for Google Workspace and other Google cloud-hosted applications. It isn’t designed to be used for on-prem systems, AWS cloud servers, Azure, Office 365, and a wide range of other web and on-prem applications and networks.
Azure Active Directory isn’t an Active Directory replacement, either. It’s a user management system for Azure, Office 365, and a web application SSO platform. If you want a core directory service, you won’t find it with either Google Cloud Identity or Azure Active Directory.
Instead, both of these platforms leave it to the IT department to figure out how to build a central, authoritative directory service for the organization. Having multiple user management platforms can create a significant amount of work and a great deal of security risk.
Thankfully, there’s a better solution. An open directory platform can be your single authoritative source for user identities and authentication – across all platforms and operating systems.
Open Directory Platform – the best Active Directory Replacement
A new generation of cloud identity management is here. This independent solution, called an open directory platform, doesn’t rely on a single vendor, but works across platforms and operating systems to support authentication on Windows, Mac, Linux, Google Workspace, and more – all from the cloud, all at the same time.
JumpCloud’s open directory platform provides the stability and authentication of Azure Active Directory and the flexibility and cloud nativity of Google workspace. You’ll also get many features, like SSO, multi-factor authentication (MFA), and password management you typically have to get from a third-party provider.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
JumpCloud delivers single sign-on (SSO) to everything, including RADIUS authentication and authorization for network devices. Multi-factor authentication (MFA) is environment wide, delivering Push MFA for RADIUS. RADIUS is a core network protocol that’s widely used for Wi-Fi authentication, and it provides authentication, authorization, and accounting (AAA).
JumpCloud Cloud RADIUS simplifies and secures privileged administrative access for network admins. It’s also an option to configure access to LANs for all of your SSL VPN users. JumpCloud eliminates the need to use Fortinet’s FortiTokens for MFA.
This two-part blog series explores two use cases with FortiGate next-generation firewall:
Option 1: Use existing local FortiGate groups that contain FortiGate remote users. This approach is ideal for existing appliances that already have settings and users.
Option 2: Use remote groups (JumpCloud) and attribute mapping to set up access control on a new Fortinet device. This approach spares admins the work of having to establish local groups using ACLs on the Fortinet appliance.
This article focuses on Option 1.
We’ll demonstrate how to bind the local user to the JumpCloud RADIUS server that is configured inside your FortiGate so that JumpCloud becomes the authentication authority without changing anything in the way the appliance is configured for network posture.
Note: It’s also possible to accomplish this using a different brand of network appliance.
Configuring JumpCloud RADIUS and Groups
Follow this guide to get started with JumpCloud groups. You may also refer back to this previous tutorial on how to configure SAML access for Fortinet devices if it better suits your requirements. However, RADIUS has the advantage of also mapping groups and authorizations/permissions.
Establishing Groups and MFA
You may have MFA required for individual users or leverage groups with conditional access. Skip this step if you’ve already configured your access control policies.
To require MFA factors for the User Portal on an individual user account:
In the User Security Settings and Permissions section, select Require Multi-Factor Authentication for User Portal option. Note: The enrollment period only affects TOTP MFA. See Considerations.
Click save user.
To require MFA factors for the User Portal on existing users from the more actions menu:
Select any users you want to require MFA for.
Click more actions, then select Require MFA on User Portal.
Specify the number of days the user has to enroll in MFA before they are required to have MFA at login. You can specify a number of days between 1 and 365. The default value is 7 days.
Click require to add this requirement to the selected users.
To require MFA factors with a Conditional Access Policy:
If you don’t want the policy to take effect right away, toggle the Policy Status to OFF and finish the rest of the configuration. When you’re ready to apply the policy, you can toggle the Policy Status to ON.
For users, choose one of the following options:
Select All Users if you want the policy to apply to all users.
Select Selected User Groups if you want the policy to apply to specific user groups, then search for those user groups and select them. If you need to create user groups, see Getting Started: Groups.
If there are User Groups you want to exclude from the policy, search for the user groups and select them in the search bar under Excluded User Groups.
Optionally, set the conditions a user needs to meet. Note: Conditions is a premium feature available in the Platform Plus plan. Learn more about conditions in Getting Started: Conditional Access Policies.
In Action, select Allow authentication into selected resources, then select the Require MFA option.
Click create policy.
Two JumpCloud groups were created for the purpose of this tutorial:
Enter a name for the server. This value is arbitrary.
Enter a public IP address from which your organization’s traffic will originate.
Provide a shared secret. This value is shared with the device or service endpoint you’re pairing with the RADIUS server.
Select an identity provider.
Now select an authentication method:
To use certificate authentication, select Passwordless.
Once Passwordless has been selected, the Save button will be disabled until a certificate has been successfully uploaded (or the authentication method has been changed back to Password).
If desired, select Allow password authentication as an alternative method.
If this checkbox is selected, admins can enable certificates for some users while allowing others to continue validating by username and password. Users will continue to have the option to validate by username and password, but once they choose to validate with certificates and a valid certificate is found, the password option will no longer be presented.
The MFA Configuration section will be available if using JumpCloud as the identity provider, and Passwordless is selected as the Authentication Method, and the Allow password authentication as an alternative method checkbox is selected.
Configuring multi-factor authentication (MFA).
Toggle the MFA Requirement option to “enabled” for this server. This option is disabled by default.
Select Require MFA on all users or Only require MFA on users enrolled in MFA.
If selecting Require MFA on all users, a sub-bullet allows for excluding users in a TOTP enrollment period, but this does not apply to JumpCloud Protect™ (users in a TOTP enrollment period who are successfully enrolled in Protect will still be required to complete MFA).
If JumpCloud Protect is not yet enabled, users can select the Enable Now link.
Uploading a Certificate Authority (CA).
To upload your certificate, click on the Choose a File button, navigate to the file location, and select it for uploading.
Once the file has uploaded successfully the file name will display on the screen and options will change to replacing or deleting the file. There is also an option to view the full CA chain.
Clicking Save will return the user to the main RADIUS screen, where the Certificate badge will display in the Primary Authentication column. Note: For more information about where and how to find trusted certificates outside of JumpCloud, see RADIUS-CBA Tools for BYO Certificates.
Select Users for Access to the RADIUS Server (User Groups tab):
To grant access to the RADIUS server, click the User Groups tab then select the appropriate groups of users you want to connect to the server.
Every user who is active in that group will be granted access.
Click save.
Note: Users who are being granted access to a RADIUS server and leveraging delegated authentication (with Azure AD as their identity provider) must be imported into JumpCloud and assigned to a User Group.
FortiGate Settings
Follow these instructions to configure the RADIUS server(s) in your FortiGate appliance. Next, we’ll make it possible for your existing users to use JumpCloud’s identity and access management (IAM).
Local Groups with Remote Users
You may enter more than one JumpCloud RADIUS server IP for redundancy. The next section uses the FortiGate command line interface (CLI) to convert your existing local users into RADIUS users. Then, you’ll match the usernames with the respective JumpCloud usernames. Significantly, there will be no changes made from an access control list (ACL) perspective. Yet, you’ll increase your network security and easily meet compliance requirements. The steps are simple, and will spare a small and medium-sized enterprise (SME) the time and expense of allocating/billing blocks of hours with a network technician or MSP partner.
Converting Local Users Into RADIUS Users
The first step is to launch your CLI to convert users that already exist in FortiGate.
An existing user and user group
This may be scripted to streamline the process for a group of users. The steps include:
# config user local (local # edit “USER NAME” # show # set type radius # set radius-server YOUR SERVER # end
Checking Your Work
You may verify these settings by entering:
# config user local (local) # edit USER NAME # show # end
The local user is looking at the remote RADIUS user for authentication
Ensure that the user is a member of the corresponding RADIUS group in JumpCloud with the exact same user name as on your appliance. JumpCloud now controls authentication, including enabling MFA without having to engage with FortiTokens or a third-party MFA solution.
This is an example of an existing FortiGate user:
This RADIUS user belongs to the appropriate JumpCloud Group
Reporting
JumpCloud’s Directory Insights captures and logs RADIUS authentications. It makes it possible to determine which user is attempting to access your resources and whether it was successful. Directory Insights is useful for debugging and testing your RADIUS configuration deployments.
Try JumpCloud RADIUS
JumpCloud’s full platform is free for 10 users and devices with premium chat support for the first 10 days to get your started. The open directory platform provides SSO to everything:
Need a Helping Hand? Reach out to professionalservices@jumpcloud.com for assistance to determine which Professional Service option might be right for you.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
