Using Centrify's DirectControl with Mac OS X - Cerberis

CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS X• Each DirectControl-managed UNIX, Linux or Mac system can be placed into aDirectControl Zone, typically directly mapping to an existing logical securityboundary or administrative grouping such an organizational department or lab.• A user (Joan Smith in Figure 3) is configured in Active Directory with her normalWindows information, such as name, password, group membership and so on. Inaddition, the “Centrify Profiles” that Centrify adds to her Active Directory accountindicates which Zones she can access.• For each Zone, Joan’s UNIX/Mac profile in Active Directory stores accountinformation specific to that Zone: UNIX user name, user ID, shell, and homedirectory for example. Thus, a single Active Directory account can be mapped to anynumber of UNIX/Mac identities.• Joan can log in to computers only in the Zones to which she has been granted access.Whereas Joan has access to several Zones, another user – for example, a student in auniversity setting – could be given rights to access only Macs in a Zone set up for aclassroom lab, and not be given access to Macs or other systems in Zones set up forcomputers used in administrative or research departments.• As Figure 3 illustrates, Joan authenticates through Active Directory regardless ofwhich system she logs in to. The Zones are part of the same Active Directory domainwhere Joan’s account exists.Delegation and separation of duties is a critical component of any centralizedadministration solution where security is a concern. DirectControl Zones provide anenvironment with Active Directory that leverages native access control rules withinActive Directory to delegate UNIX profile management as well as UNIX/Mac systemaccess rights management to UNIX administrators without requiring domainadministrator rights. With DirectControl, UNIX and Mac administrators do not needrights to modify or create user objects, which is typically a privileged operation withinthe enterprise.Additionally, each Zone can have its own set of administrators, each with specificprivileges within the Zone. In our university example, Joan may be an IT administratorwho has the right to create and modify user accounts in Active Directory for students andemployees, and the right to create Zones and add users to Zones. However, a graduatestudent who runs a Macintosh lab could be given rights only to add or remove existinguser accounts to the Mac lab Zone. This added security feature means not only can usersand computers be compartmentalized into logical secure groups, but the administratorswho manage those systems can also be segregated. For many organizations, the ability tofinely control the elevated privileges for administrators is essential for maintainingappropriate levels of confidentiality and for complying with regulatory controls.© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 9