Secure Authentication between Zimbra and AD: Difference between revisions
Line 5: | Line 5: | ||
==Purpose== | ==Purpose== | ||
How to configure authentication with Active Directory using SSL. | '''How to configure''' authentication with Active Directory using SSL. | ||
---- | ---- | ||
=====Prerequisite===== | =====Prerequisite===== | ||
Line 17: | Line 17: | ||
[[File:3_ad_ssl.JPG]] | [[File:3_ad_ssl.JPG]] | ||
---- | ---- | ||
2. Convert the zimbra CA to .der, and copy it to the DC: | 2. '''Convert''' the zimbra CA to .der, and copy it to the DC: | ||
cd /opt/zimbra/ssl/zimbra/ca | cd /opt/zimbra/ssl/zimbra/ca | ||
openssl x509 -in ca.pem -outform der -out ad.der | openssl x509 -in ca.pem -outform der -out ad.der | ||
* Use tools such as [https://winscp.net/download/WinSCP-5.9.2-Setup.exe WinScp] to copy the /opt/zimbra/ssl/zimbra/ca/ad.der file to the DC. | * Use tools such as [https://winscp.net/download/WinSCP-5.9.2-Setup.exe WinScp] to copy the /opt/zimbra/ssl/zimbra/ca/ad.der file to the DC. | ||
---- | ---- | ||
3. Install the Zimbra certificate authority (CA) (ad.der) on the domain controller: | 3. '''Install''' the Zimbra certificate authority (CA) (ad.der) on the domain controller: | ||
* '''Start->Run''' > Type '''mmc''' > Right click on it > "Run as Administrator". This will open the '''Microsoft Management Console'''. | * '''Start->Run''' > Type '''mmc''' > Right click on it > "Run as Administrator". This will open the '''Microsoft Management Console'''. | ||
* Click "File" > "Add/Remove Snap-In..." to open the "Add Standalone Snap-in" dialog. | * Click "File" > "Add/Remove Snap-In..." to open the "Add Standalone Snap-in" dialog. | ||
Line 38: | Line 38: | ||
<br> | <br> | ||
---- | ---- | ||
4. Create a | 4. '''Create''' a CSR. For this purpose we will use Microsoft's '''certreq''' utility. To generate csr, we need to create a '''*.inf''' file. Below is a sample *.inf file you ca use. | ||
* Open a text editor (Notepad) and paste the following text into the file. Make sure no CR/LF character is added to the "Subject =" line when you copy and paste the text. Remove if any. | * Open a text editor (Notepad) and paste the following text into the file. Make sure no CR/LF character is added to the "Subject =" line when you copy and paste the text. Remove if any. | ||
* Update the Subject attributes with appropriate values. For example: CN=ad.example.com. The FQDN must be the name of the AD server. | * Update the Subject attributes with appropriate values. For example: CN=ad.example.com. The FQDN must be the name of the AD server. | ||
Line 72: | Line 72: | ||
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication | OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication | ||
---- | ---- | ||
5. Once you have a '''inf''' file, generate a Certificate Signing Request (CSR) using certreq. Open CMD and type: | 5. Once you have a '''inf''' file, '''generate''' a Certificate Signing Request (CSR) using certreq. Open CMD and type: | ||
certreq -new csr.inf ad.csr | certreq -new csr.inf ad.csr | ||
---- | ---- | ||
6. Create and Sign the certificate. | 6. '''Create and Sign''' the certificate. | ||
Copy the ad.csr file to the ZCS server (/tmp) and run as root: | Copy the ad.csr file to the ZCS server (/tmp) and run as root: | ||
Line 85: | Line 85: | ||
(If you are purchasing an SSL certificate, send the CSR to your vendor and they will generate and sign the certificate for you. If you have already purchased an SSL certificate, you can skip this step.) | (If you are purchasing an SSL certificate, send the CSR to your vendor and they will generate and sign the certificate for you. If you have already purchased an SSL certificate, you can skip this step.) | ||
---- | ---- | ||
7. Accept the Certificate. | 7. '''Accept''' the Certificate. | ||
After the ad.crt file has been copied to the AD server, run the following command to accept it, using the "certreq" utility: | After the ad.crt file has been copied to the AD server, run the following command to accept it, using the "certreq" utility: | ||
Line 92: | Line 92: | ||
This will accept the cert in the Windows certificate store and it will be available to those services and products that make use of the Windows certificate store. These products include but are not limited to: IIS, Exchange, Active Directory (LDAPS), Terminal Services and Microsoft Management Console (MMC). | This will accept the cert in the Windows certificate store and it will be available to those services and products that make use of the Windows certificate store. These products include but are not limited to: IIS, Exchange, Active Directory (LDAPS), Terminal Services and Microsoft Management Console (MMC). | ||
---- | ---- | ||
8. Install the certificate. | 8. '''Install''' the certificate. | ||
From Step 3, open the "Certificates snap-in", expand the "Certificates" node under "Personal". Right-click on the "Certificates" node, select "All Tasks" -> "Import...", and import the "ad.crt". | From Step 3, open the "Certificates snap-in", expand the "Certificates" node under "Personal". Right-click on the "Certificates" node, select "All Tasks" -> "Import...", and import the "ad.crt". | ||
Line 98: | Line 98: | ||
[[File:5_ad_ssl.jpg]] | [[File:5_ad_ssl.jpg]] | ||
---- | ---- | ||
9. Restart AD server | 9. '''Restart''' AD server | ||
After installing the certificate you must restart the AD server. | |||
=Check= | =Check= |
Revision as of 01:59, 24 October 2016
Secure Authentication between Zimbra and AD (self-signed certificate)
Purpose
How to configure authentication with Active Directory using SSL.
Prerequisite
Before everything else, make sure that the non-ssl (port 389) AD authentication is working, by following that article.
Resolution
1. Review the following article to familiarize yourself with the authentication with AD from Zimbra side in AdminUI. The only difference from the article, is that in the "Active Directory Settings", we need to check the "Use SSL:" tick box:
2. Convert the zimbra CA to .der, and copy it to the DC:
cd /opt/zimbra/ssl/zimbra/ca openssl x509 -in ca.pem -outform der -out ad.der
- Use tools such as WinScp to copy the /opt/zimbra/ssl/zimbra/ca/ad.der file to the DC.
3. Install the Zimbra certificate authority (CA) (ad.der) on the domain controller:
- Start->Run > Type mmc > Right click on it > "Run as Administrator". This will open the Microsoft Management Console.
- Click "File" > "Add/Remove Snap-In..." to open the "Add Standalone Snap-in" dialog.
- From the Available snap-ins on the left, select "Certificates" and press "Add".
- Select "Computer account" and press "Next".
- Select "Local computer" and press "Finish"
- Click "Ok" to close the "Add/Remove Snap-in" dialog.
Once the "Certificates snap-in" is open, click on the "Certificates" node under "Trusted Root Certification Authorities". Right-click on the "Certificates" node, select "All Tasks" -> "Import...", and import the Certificate Authority (in my case "ad.der") you copied from Zimbra. Accept the default location: Trusted Root Certification Authorities
Leave the Microsoft Management Console open for step 8
4. Create a CSR. For this purpose we will use Microsoft's certreq utility. To generate csr, we need to create a *.inf file. Below is a sample *.inf file you ca use.
- Open a text editor (Notepad) and paste the following text into the file. Make sure no CR/LF character is added to the "Subject =" line when you copy and paste the text. Remove if any.
- Update the Subject attributes with appropriate values. For example: CN=ad.example.com. The FQDN must be the name of the AD server.
;----------------- csr.inf ----------------- [Version] Signature="$Windows NT$" [NewRequest] Subject = "CN=ad.example.com, OU=Organizational_Unit, O=Organization, L=City, S=State, C=Country" ; Replace mail.example.com with the FQDN of your AD server's FQDN. ; Replace the remaining Subject attributes. KeySpec = 1 KeyLength = 2048 HashAlgorithm = SHA256 Exportable = TRUE MachineKeySet = TRUE SMIME = False PrivateKeyArchive = FALSE UserProtected = FALSE UseExistingKeySet = FALSE ProviderName = "Microsoft RSA SChannel Cryptographic Provider" ProviderType = 12 RequestType = PKCS10 KeyUsage = 0xa0 [EnhancedKeyUsageExtension] OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
5. Once you have a inf file, generate a Certificate Signing Request (CSR) using certreq. Open CMD and type:
certreq -new csr.inf ad.csr
6. Create and Sign the certificate. Copy the ad.csr file to the ZCS server (/tmp) and run as root:
openssl x509 -req -days 365 -in /tmp/ad.csr -CA /opt/zimbra/ssl/zimbra/ca/ca.pem -CAkey /opt/zimbra/ssl/zimbra/ca/ca.key -set_serial 01 -out ad.crt
That will create a file ad.crt. Copy the file (ad.crt) back to the AD server.
(If you are purchasing an SSL certificate, send the CSR to your vendor and they will generate and sign the certificate for you. If you have already purchased an SSL certificate, you can skip this step.)
7. Accept the Certificate. After the ad.crt file has been copied to the AD server, run the following command to accept it, using the "certreq" utility:
certreq -accept ad.crt
This will accept the cert in the Windows certificate store and it will be available to those services and products that make use of the Windows certificate store. These products include but are not limited to: IIS, Exchange, Active Directory (LDAPS), Terminal Services and Microsoft Management Console (MMC).
8. Install the certificate.
From Step 3, open the "Certificates snap-in", expand the "Certificates" node under "Personal". Right-click on the "Certificates" node, select "All Tasks" -> "Import...", and import the "ad.crt".
9. Restart AD server
After installing the certificate you must restart the AD server.
Check
- To check you can go back to that article, and check the SSL tick box (from step 1). Then proceed forward until you reach the window to test the authentication. The authentication should succeed.
- The next test includes the ldp.exe utility located on the DC. Click Start > Run > type ldp.exe and open it. At top left, click on "Connection" > "Connect...".
Make sure the port is 636, the SSL check box is ticked and you type the FQDN of the AD server.
If the "Connect" is successful, the following output is produced:
Then, you can Bind to AD.
You can choose any of the authentication methods. In my case I authenticated as "aduser" user: