1. Using Active Directory for Authorizations
CSG, September 2002

2. MIT uses of AD Domain Services for Windows users
Management of Windows 2000 machines
Group Policies
Software Distribution

3. Software Distribution
Assignment vs. Advertising
Users
Machines

4. Identity Management Users Machines
Computer class is a sub class of user

5. Implications of Identity Management of Machines
What determines the identity of a machine?
IP address?
MAC address?
Hostname?
Possession of a token? (keytab, certificate, …)
How does an administrator manage the identity?

6. An AD Limitation
How do you grant access to an SMB share to all of the objects within an OU?
No AD triggers to create a security group that represents the membership as it changes over time.
Moira incremental used to do this
Used to deploy MS Office to licensed machines

7. Authorization by SID vs. Name
ACLs made directly in AD will contain the SIDs of the objects.
ACLs defined in Moira and propagated to AD will make references by name.
Reinstallation of machines does not force a re-ACL

8. Other AD auth issues Privacy and data hiding
AD supports ACLs on almost everything
ACL processing can have a high overhead
Almost undocumented dsHeuristics attribute
List Object permission type