Microsoft LAPS integration
Introduction
Microsoft provides the Local Administrator Password Solution (LAPS).
LAPS is a solution for the problem using a shared local account on each computer in the domain with an identical password.
LAPS solves this issue by setting a randomly chosen password on each computer in the domain for the shared local administrator account.
Domain administrators using this solution are able to determine, which users are authorized to read the passwords (e.g. Helpdesk-Administrators).
The passwords are arranged and saved randomly in Active Directory protected by Active Control Lists (ACL).
Only authorized users can read and request resetting these passwords.
Related Microsoft article: https://www.microsoft.com/en-us/download/details.aspx?id=46899
LAPS integration is also possible for Unix applications.
Implementation in VISULOX
Microsoft LAPS is addressed via VISULOX Resources for Windows and Unix applications.
Two types are available:
- vlxResource=@LAPS_GLOBAL
- vlxResource=@LAPS_USER
The resources are set via the Hints field of the application.
In case of @LAPS_USER, the password is querried with the user of the session.
Precondition is that the user is authorized.
In case of @LAPS_GLOBAL the password is querried with a VISULOX user.
This can either be the user, that is stored in the AD datasource or a user, which is depositted in an additional resource.
Configuration
The following VISULOX configuration parameters have to be adjusted:
| Parameter | Description |
|---|---|
| laps.datasource | Datasource of the LAPS Service AD (Needed to determine the LDAP server, where the LAPS passwords can be found. If different from the users, a datasource has to be created, which imports the users and groups.) |
| laps.adminuser | Adminuser for client access VISULOX Resources can be used, for example:
CODE
or if the Windows admin user is different:
CODE
|
| laps.audit | Successfull LAPS requests will be written to their session in VISULOX Audit |
| laps.filter | LDAP query string to determine the password |
| laps.resource | Alternate user authorized to read LAPS passwords (if not the user of the datasource) |
| laps.domain | Domain of the AD/LDAP server, that has the password |
For access to a Windows system via LAPS, the FQDN of the host has to be assigned to the application.
This is the same name, that can be found in the LAPS data in Active Directory, usually in the attribute dNSHostName.
Hostnames longer than 15 characters
Computer objects in Microsoft Active Directory can not be longer than 15 characters.
If a computer with a longer hostname is jopined, it will be registered with a different "short name".
In this case the filter can be adjusted.
Therefore additional placeholders have been added to the laps.filter string:
| regsub -all {%BASE%} | $filter $base |
| regsub -all {%HOST%} | $filter $host |
| regsub -all {%HOSTDOMAIN%} | $filter $hostdomain |
| regsub -all {%SHORTHOST%} | $filter $shorthost |
| regsub -all {%SHORTHOST_UPPERCASE%} | $filter $shorthost_upper |
| regsub -all {%NETBIOS%} |