Have AD User bind to AD instead of using a separate account to bind
Currently, Cerberus binds to Active Directory using either the service account running the application or the credentials configured in the AD Binding Options. This requires the use of a static account with directory access permissions.
We would like to request an option for Cerberus to perform Active Directory authentication using the credentials of the user attempting to authenticate, rather than a shared service account. This would provide several benefits:
- Eliminates the need for a static AD bind account.
- Aligns authentication with the user's existing Active Directory permissions.
- Improves auditing and accountability by associating directory access with the individual user.
- Reduces risk associated with credential exposure or misuse of a privileged service account.
An optional user-context bind mode would provide organizations with greater flexibility in meeting security and compliance requirements while leveraging existing Active Directory authentication mechanisms.
-
Hello Troy,
Currently, Cerberus actually does already use the AD user's credentials when trying to authenticate, as logins are impersonated. This is actually why you cannot reset active directory user passwords straight through the UI. That bind account serves as a link between Cerberus and AD, if a service account is not in place to do as much, and takes care of querying the domain controller.
From what it sounds like, are you looking to have each AD user able to query the domain controller, so a bind/service account does not need to do so?
0 -
That is correct.
Our security teams sees the service account that is in the Binding Options creating the connection to the AD doing the log into AD, then the user authenticating. However, they want to see the user being the one to connect to AD instead.
0 -
Hello Troy,
I am going to go ahead and formulate a ticket based on this request, as we may need to ask for a bit more specific information around this ask.
0
Please sign in to leave a comment.
Comments
3 comments