Using Centrify's DirectControl with Mac OS X - Cerberis

More documents

Recommendations

Info

CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS XFigure 12. Once the user logs in with a smart card, PKI certificates are available via theKeychain for access to other PKI enabled applications.Active Directory enforces smart card access to Windows systems through the Accountoption “Smart card is required for interactive logon” policy. DirectControl enforces thispolicy on Mac OS X systems as well, giving you the ability to enforce smart card accessconsistently across your organization. An additional DirectControl Group Policy can alsobe used selectively (for example, through filtering) to protect high-security machinesfrom being accessed interactively without a smart card.Figure 13. Smart card login to Active Directory with DirectControl provides the user withKerberos tickets in order to support Single Sign-on to other applications and services.© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 25
CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS XDirectControl also provides Group Policies to enable centralized management of smartcard login. These Group Policies can be used to require a Macintosh system to go intoscreen lock or to force a logout when the smart card is removed from the reader during asession. This policy enforcement on Mac OS X systems enables organizations to easilyenable the secured usage of Mac systems within their Windows environments leveragingthe same tools, procedures and policies that they are already familiar with today.6 Customer Benefits of the Centrify DirectControl SolutionEach of the DirectControl features outlined in this white paper directly translates intotangible benefits for administrators and end-users. Some of the benefits for administratorsand IT managers include:• True centralized control over authentication, authorization and administration of MacOS X systems is possible using familiar Windows administration tools.• Zone-based access controls enable you to organize Macs (and UNIX or Linuxsystems if you so choose) into logical groups for departments, labs, etc., and grantaccess to the systems within a Zone based on a user’s role within the organization. .• Separation of duties enables Active Directory-based delegated administration formanaging user access to systems without having to grant domain admin rights toMac administrators.• Security policies are maintained across all systems, not just Windows, for bothcomputer-related security settings as well as end-user-specific settings.• User environments can now be centrally managed to ensure consistency.• Workstation mode and an automated installation program provide quick deploymentto hundreds or dozens of Mac systems.• Support for the most popular smart card formats and Group Policy-based controlover smart card settings mean organizations can quickly implement smart cardsecurity without the need for additional point products.End-users will notice few changes to their Mac OS X user experience (a good thing),while the systems are centrally managed, enabling IT to provide a much higher level ofservice to these users. Additional benefits for the end-users include:• No extra account or password information to remember – Active Directorycredentials can be used to log in to Mac OS X or Windows computers as required.• Single sign-on is maintained for access to Windows file shares and SPNEGOenabledweb sites, and additionally single sign-on is provided for access to Windowsprint queues.© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 26
Page 1 and 2: WHITE PAPERCENTRIFY CORP.OCTOBER 20
Page 3 and 4: CENTRIFY WHITE PAPERUSING CENTRIFY
Page 27: CENTRIFY WHITE PAPERUSING CENTRIFY
Page 31: CENTRIFY WHITE PAPERUSING CENTRIFY

Using Centrify's DirectControl with Mac OS X - Cerberis

Create successful ePaper yourself

Delete template?

Save as template?