Using Centrify's DirectControl with Mac OS X - Cerberis

CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS X• Locates the relevant domain controllers based on the Active Directory forest and sitetopology, also known as being site-aware.• Maintains time synchronization with Active Directory domain controllers if desired.• Maintains an MIT-based Kerberos environment so that existing Kerberosapplications will work seamlessly with Active Directory to provide users with singlesign-on access to network resources such as Windows file servers and print queues.• Ensures network security by resetting the password on its machine account at regularintervals according to Active Directory domain policies.• Enables logins using users’ Active Directory credentials. Logging on in this contextmeans not only logging into the Mac OS X graphic interface, but also connecting tothe Macintosh through a remote SSH or Apple Remote Desktop interface.• Enables authentication with smart cards, including PIV, CAC and .Net cards.• Updates a user’s last login time upon Active Directory login to ensure that passwordexpiration policies are being enforced properly.• Stores user credentials and profiles so that users can log on when the computer isdisconnected from the network, which is especially useful for laptop computerswithout requiring a locally defined mobile user.• Caches responses from Active Directory information queries to reduce the load onthe domain controllers.• Validates that the user has appropriate permissions to log in to the Macintosh systembased on account policies. For example, Active Directory provides a set of accountspecificcontrols enabling the administrator to activate or disable a user’s ActiveDirectory account as well as to control the time of day the user is allowed to log in.• When the Mac is a member of a DirectControl Zone, validates that the user hasappropriate permissions to log in based on Zone memberships and allowed groupmembership.• Determines a user’s full UNIX-enabled Active Directory group membership(including nested groups) the first time the user logs on.• Supports users managing their Active Directory passwords from Macintosh systemsboth for the ad hoc password change as well as for expired password at login.• Validates privileged account logins centrally from Active Directory when neededwithout requiring previously defined local administrator accounts.• Dynamically creates home directories locally on the computer for users whoseprofile defines a local home directory path. DirectControl also supports seamlesslymounting network-based home directories from Windows servers or AFP servers as© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 7