SafeNet Synchronization Agent has been enhanced to sync LDAP users within nested groups, where users may be members of a group that is a member of another group.

STA synchronizes all users in nested groups that are visible in LDAP. STA is not directly aware of trust relationships in Active Directory. For additional information, refer to the question: Can SafeNet Synchronization Agent sync multiple domains to STA using Active Directory Global Catalog?, in the General section.

Before updating SafeNet Synchronization Agent, it is recommended to verify that LDAP groups configured for syncing do not contain nested groups with users you do not intend to sync. After upgrading, all users of nested groups will be synced automatically.

Auto-provisioning can now be enabled for users in nested groups. This is controlled by a new Provisioning Policy in the POLICY > Automation Policies module. This is enabled by default for newly created accounts, and disabled by default for existing accounts. For additional information, refer to Apply provisioning rules to nested groups.

Domain password Synchronization is an optional feature that enables synchronizing user’s domain passwords to STA. STA can authenticate users based on a valid domain password instead of or together with OTP.

Requirements are: STA Cloud v3.5.1 (or later), STA PCE v.3.5.4 (or later), Sync Agent v3.5.1 (or later), and Active Directory use source. The machine running SafeNet Synchronization Agent must be part of the Active Directory domain, and must have “Replicating Directory Changes” and “Replicating Directory Changes All“ Active Directory permissions. For additional information, refer to Add replication permissions.

Users can authenticate into STA using their existing Active Directory password (their domain password), without the requirement of a token or other password to be provisioned. Operators manage this functionality by synchronizing the users’ Active Directory passwords into STA, which allows users to temporarily authenticate with their Active Directory password until a token is activated by the user. This functionality requires SafeNet Synchronization Agent version 3.5.1 (or later).

Additionally, in STA Cloud v3.5.1 (or later), or STA PCE v.3.5.4 (or later), Active Directory password synchronization and authentication is available through the use of the LDAP/AD Password Validation filtering attribute, located in COMMS > Authentication Processing > Pre-authentication Rules. Pre-authentication rules with LDAP/AD Password Validation can be used in STA only when Active Directory password synchronization is enabled.

Pre-authentication rules allow conditional Challenge/Response type of authentication after AD password validation. This can be used to automatically trigger SMS Quicklog or GrIDsure authentication after the user enters their domain password.

SafeNet Synchronization Agent obtains passwords directly from Active Directory through a separate connection. An LDAP connection to Active Directory continues to be used for all other user data that is synchronized. SafeNet Synchronization Agent sends domain passwords together with the other user data to STA.

Yes. Active Directory passwords are double-hashed and encrypted in all stages of transmission and storage between Active Directory, SafeNet Synchronization Agent, and in the STA database.

Additional information can be found in the SafeNet Authentication Service Security White Paper, which can be requested from Thales Customer Support.

In SafeNet Synchronization Agent (version 3.5.1 or later), on the LDAP Schema window, select Enable password synchronization, and then enter the Active Directory Administrator Credentials.

Failover configuration in SafeNet Synchronization Agent applies only to LDAP connections. Active Directory manages failover internally. It is recommended to configure only a primary LDAP host name in SafeNet Synchronization Agent to the Active Directory entry point, which supports failover. If Active Directory and DNS are not set up to handle failover, SafeNet Synchronization Agent will cancel and stop the synchronization process regardless of the existence of a secondary LDAP host.

Yes, with LDAP schemas that are Active Directory enabled, provided that the LDAP server is an Active Directory server.

Not with STA. Password synchronization is not available for generic LDAP or SQL user stores, and is only supported with Active Directory.

STA PCE/SPE offers direct integration with any LDAP user store, which enables the same authentication use cases in STA PCE/SPE as password synchronization does for STA cloud. In addition, password synchronization is available in STA PCE v.3.5.4 (or later).

SafeNet Synchronization Agent uses a separate direct connection to Active Directory for passwords, in addition to the LDAP connection used for the other user data. This can result in noticeably longer time overall for synchronization activity to complete, but the amount of additional data transmitted to STA is marginal.

In particular, the first sync after enabling password synchronization can take longer than expected, depending on the number of synced users.

Yes. To disable the use of Active Directory passwords, in SafeNet Synchronization Agent, on the LDAP Schema window simply de-select the Enable password synchronization check box. After successful synchronization, the Active Directory passwords are removed from STA, and they can no longer be used for authentication into STA. The passwords will still appear as assigned, but they can no longer be used for authentication.

If the domain password was assigned to the user, STA operators can manually unlock it in the user’s token list like other tokens. However, operators cannot manually unlock domain passwords that were not assigned but used in preauthentication rules. Domain passwords will be automatically unlocked after the account lock duration, like other tokens.

SafeNet Synchronization Agent does not sync password renewal requests or expiration. STA treats the password as a cached credential, which can be used until it is updated in Active Directory and synced to STA. If the account gets locked in Active Directory, STA will fail authentication attempts.

Yes, in STA PCE v.3.5.4 (or later). In addition, STA PCE/SPE supports direct LDAP integration for password validation. Direct LDAP password validation can be used in STA in the same way as Active Directory password synchronization (that is, for assigned passwords and pre-authentication rules).

For synchronized passwords, STA validates the user’s passcode against the synchronized Active Directory password. More precisely, a secure representation of the password is compared, not the password itself. STA PCE/SPE direct LDAP integration requests the LDAP server to validate the user’s passcode against the LDAP password.

In earlier versions of STA (up to v3.3.2), a full sync of all user records was performed for each and every sync event. With differential synchronization, only “changed” user records, including additions and deletions, are synchronized since the last successful sync, resulting in less network traffic and reduced sync time. This also reduces system load, helping to increase the reliability of sync services.

User records are sent in “batches” to the STA User Store. With differential synchronization, the initial sync may take longer to complete as it builds up its local information store, but subsequent syncs typically complete much faster.

Differential syncing occurs in parallel with scanning the User Store. This means that new users can typically start using authentication before all users are synchronized. If the agent cannot connect to the server, the sync is retried with the next User Store scan.

As mentioned previously, only “changed” user records, including additions and deletions, are synchronized since the last successful sync, resulting in less network traffic and reduced sync time. Reduced system load also increases the reliability of sync services. Refer to the next question for additional benefit information.

STA Cloud and STA PCE/SPE v3.4 and later limit syncing to once every 60 minutes with older versions of SafeNet Synchronization Agent that don’t use differential synchronization. Agent versions 3.3.3 and newer recognize the Scan Interval setting, and restarting the sync service in the agent initiates scanning and synchronization.

In support of differential synchronization, the User’s Total column heading has been changed to Processed Users and the Group’s Total column heading has been changed to Processed Groups. The Processed Groups column displays the number of changed groups that were processed during the sync batch. The Processed Users column displays only the number of users in this batch sent to be synced since the last successful sync. Each batch contains up to 40 users or groups.

The Sync History Report is viewed by navigating to COMMS > Authentication Processing > LDAP Sync Agent Hosts and clicking View Sync History. User changes appear in the report incrementally as they occur.

Earlier versions of SafeNet Synchronization Agent will continue to work with STA. It is recommended to update the agent in order to enjoy the benefits of differential synchronization. It is also recommended as a best practice to run the latest version of the agent.

This is not supported. Mixing newer agents that use differential synchronization with older agents that don’t negates the benefits of differential synchronization. All older agent versions should be upgraded to the latest version, as described in previous answer.

The STA server should be upgraded first to v3.4 (or later). Existing SafeNet Synchronization Agents will continue to work but the scan interval is limited now to once every 60 minutes (instead of every 20 minutes), even if the agent is manually stopped and restarted.

It is recommended to upgrade the SafeNet Synchronization Agent to at least v3.5.1 (or later) in order to obtain the benefits of differential synchronization and regain a scan interval of every 20 minutes. Restarting the sync service in the agent will initiate scanning and synchronization.

Testing should normally not be necessary since differential synchronization does not change scanning or what is synchronized. Testing the latest agent version is possible with a separate virtual subscriber that can be created under Service Provider accounts. It is not possible to use full sync agents (up to v3.3.2) and differential sync agents (v3.3.3 or later) together in the same virtual subscriber.

Differential synchronization does not introduce new functionality and results in the same user data in STA. In case of unforeseen issues, it is possible to revert to the last agent version (3.03.20178) that does not use differential synchronization.

Stop all agents, except one. Launch the installer for version 3.03.20178 to upgrade this agent (which can still be running), and start the service. Continue upgrading additional agents.

Yes, it is generally recommended as a best practice to run the latest version of the agent.

Launch the installer to upgrade the agent. It is not necessary to stop the service or uninstall the agent.

STA supports syncing a Virtual Server through multiple agents that are configured with the same groups and attribute mappings. All agents must be upgraded at the same time. To upgrade, stop all agents except one. Upgrade this agent (which can still be running) and start, upgrade another agent and start, until all agents have been upgraded.

No. SafeNet Synchronization Agent v3.4 (or later) is only supported with STA v3.4 or later. SafeNet Synchronization Agent v3.03.20178 can still be used with STA PCE/SPE v3.3.2.

Yes. Although SafeNet Synchronization Agent does not directly support Active Directory (except for domain passwords), it can be configured to sync with a Global Catalog for LDAP searches. To enable this functionality in SafeNet Synchronization Agent, you must set the Port field on the User Source Configuration window to 3268, which is the port to which Global Catalog queries are directed.

In addition to the above configuration changes, note the following steps that may need to be performed:

1. The selected Sync Groups must be set as “universal” groups.
2. In SAS, under Authentication Processing > LDAP Sync Agent Settings, it is recommended to enable the Use Delayed Sync Removal option.
3. In SafeNet Synchronization Agent, under User Source Configuration, select Manually edit searched containers, and then add the containers from the sub-domains.
4. In order for SafeNet Synchronization Agent to scan and sync Global Catalog groups to SAS, you must bind to DC=,DC= to search over all sub-domains. Then, you will need to do one of the following: – In SafeNet Synchronization Agent, under User Source Configuration, select Manually edit searched containers, and then add the containers from the sub-domains. – If the above procedure does not produce the intended results (all domain groups are not displayed), enter a NULL value (" ") for Manually edit searched Containers to instruct the Agent to search the entire Active Directory tree.

The Microsoft TechNet article entitled Global Catalog and LDAP Searches provides additional information and can be found at the following link: http://technet.microsoft.com/en-us/library/cc978012.aspx