Configure LDAPS for Active Directory connections in Cayosoft Guardian

This article describes how to configure Cayosoft Guardian and the Forest Recovery Agent to connect to Active Directory over LDAPS (LDAP over SSL/TLS). LDAPS is required in environments where plaintext LDAP traffic on port 389 has been disabled or where security policy requires TLS-encrypted directory traffic.

Prerequisites

Before enabling LDAPS in Cayosoft Guardian, confirm the following on each domain controller that you intend to manage:

• A valid server authentication certificate is installed in the domain controller's Personal certificate store. The certificate Subject or Subject Alternative Name must include the fully qualified domain name (FQDN) of the domain controller.

• The LDAPS listener on the domain controller is reachable on TCP port 636. To test connectivity from the Guardian server, run the following command:

  Copy

  Test-NetConnection dc01.contoso.com -Port 636

• Global Catalog over SSL is reachable on TCP port 3269 on Global Catalog servers.

• If you plan to use strict certificate validation, the issuing CA chain is installed in the Trusted Root Certification Authorities and Intermediate Certification Authorities stores on every Guardian and Forest Recovery Agent host.

Step 1. Decide on a connection mode

Cayosoft Guardian supports the following LDAPS configuration options:

Step 2. Configure the Cayosoft Guardian service

1. Open the Cayosoft Guardian web portal.

2. Go to System Settings > Active Directory.

3. Set Use LDAPS as required for your environment.

4. Set Skip LDAPS certificate validation as required for your environment.

5. Save the settings.

6. Restart the Cayosoft Guardian service if prompted.

Step 3. Configure the Forest Recovery Agent

If the Forest Recovery Agent runs on a separate host, repeat the LDAPS configuration in the agent settings.

For more information, see Forest Recovery Settings.

Step 4. Verify the configuration

1. In the Cayosoft Guardian web portal, go to Active Directory >Domain Controllers.

2. Confirm that every expected domain controller is reachable.

3. Perform a low-impact management operation against a domain controller that accepts only LDAPS. For example, view the properties of a test user.

4. Open the Cayosoft Guardian service log and confirm that one of the following entries is present:

   Copy

   LDAPS connection to {dc}:636 established
                   LDAPS fallback to {dc}:636 succeeded

NOTE: The LDAPS fallback to {dc}:636 succeeded entry applies to the default mode when Cayosoft Guardian falls back to LDAPS because LDAP on port 389 is unavailable.

Decision guidance

• If you are enabling LDAPS one domain controller at a time, leave useLdaps = false and rely on automatic fallback while you roll out LDAPS across the forest. After LDAPS is available on every domain controller, set useLdaps = true to enforce LDAPS-only connections.

• Use ldapsSkipCertificateValidation = true only as a temporary measure. For long-term operation, deploy the correct CA chain to every Cyaosoft Guardian and Forest Recovery Agent host, and set ldapsSkipCertificateValidation = false.

Related articles

• Security guide, section 3.5, LDAP connection security

• Required Ports for Cayosoft Guardian

• Forest Recovery Settings

• Troubleshooting LDAPS connections in Cayosoft Guardian