KB-1683: How does Centrify work with Microsoft RODC (Read only Domain Controller)

Home >

KB-1683: How does Centrify work with Microsoft RODC (Read only Domain Controller)

Product:

Authentication Service ,

Published:

12 April,16 at 11:12 AM

Rating:

Applies to: All versions of Centrify DirectControl on Microsoft RODC (Read Only Domain Controller).

Question:

Does Centrify product work with Microsoft's Read Only Domain Controller (RODC) located in the DMZ?

Answer:

The short answer is not "out of the box". In the current release of Centrify which is 5.0 at the time of writing this KB, Centrify (adclient) requires RWDC (ReadWrite Domain Controller) to do adjoin/adleave and also do the machine password change (this defaults to 28 days). So, customer needs to open the relevant ports to RWDC (Read/Write DC) for the Unix servers (Please follow KB-0029: Firewall port settings for Centrify Direct Control).

The alternative is to do an adjoin with RWDC, then move the machine into DMZ, and then disable machine password change (In /etc/centrifydc/centrifydc.conf, the following parameter adclient.krb5.password.change.interval can be made 0; the default is 28 days; centrify must be started or adreload must be run).

There are other things that will not work like updating machine profile (like OS level) in CDC console, but these are NOT really critical for the product to work.

Centrify realizes that this is a critical problem, and we addressed this issue in the 4.4.4 release but for customers who have moved to 5.0.2 release, can upgrade to 5.1 release and follow these steps.

The fix is that adclient will execute all the necessary changes/updates of AD through RODC to RWDC.

For 2012 (4.4.4)

http://www.centrify.com/downloads/products/documentation/suite2012/ga/centrify-dc-deployment-guide.pdf

For 2013 (5.1/Page 190)

http://www.centrify.com/downloads/products/documentation/suite2013/centrify-unix-deployment-guide.pdf

Notes:

For more explanation on what RODC means, please check the below links.

http://technet.microsoft.com/en-us/library/cc732801(WS.10).aspx

http://technet.microsoft.com/en-us/library/cc772234(WS.10).aspx

Centrify does not take any responsibility for the content and availability of these links and they were provided as a courtesy only.