1 Overview
SoftwareCentral has a module for controlling active directory; this module provides the functionality to delegate tasks to manage the active directory based on SoftwareCentral’s security roles, so they have limited access.
This guide describes how to delegate the permissions in the Active Directory so that the SoftwareCentral service account can perform the needed operations on the Active Directory objects on behalf of the SoftwareCentral users.
The security roles decide what each SoftwareCentral user may do. The Active Directory rights decide what the service account is allowed to do in the directory. Both are needed: a user with a role that allows an action still fails if the service account has no right to it.
2 Which account is used
SoftwareCentral uses one of two identities for an Active Directory change, depending on the domain.
| The domain is | SoftwareCentral uses |
|---|---|
| The server’s own domain, or a domain that is marked as trusted in SoftwareCentral | The identity the SoftwareCentral application pool runs as. See Configure the application pool. |
| A different domain, where the server’s domain or that domain is marked as not trusted | The account stored for that domain in SoftwareCentral. |
In both cases the account needs the rights in the next section and in the delegation guides. For an untrusted domain, delegate the rights to the stored account, not to the application pool identity.
3 What the account does
These are the operations the module performs in Active Directory. Each needs the matching right on the organizational unit where the object is.
| Object | Operations |
|---|---|
| User | Create a user in the chosen organizational unit, set its password, enable and disable the account, and change its group memberships. |
| Group | Create a group in the chosen organizational unit, change its properties, and add and remove members. |
| Computer | Create a computer account in the chosen organizational unit, and enable or disable it. |
The list covers the operations that create, change or disable objects.
4 Delegation guides
The rights for each object type are described in its own guide.
| Object type | Guide |
|---|---|
| User objects | Delegation for User objects |
| Group objects | Delegation for Group objects |
| Computer objects | Delegation for Computer objects |
5 Best practice
- Delegate only on the organizational units that SoftwareCentral manages. Do not delegate on the whole domain when a few units are enough.
- Do not add the service account to Domain Admins. The rights listed in the delegation guides are enough for the module.
- Give the account the rights of the object types you use, and nothing more. If you do not use computer objects, you do not need the computer delegation.
- Keep the stored account for an untrusted domain up to date. Its password is kept in SoftwareCentral, so change it there when you change it in Active Directory.
- Test each function after you change the rights. Use a test user and a test organizational unit, and check each operation you use.
6 Troubleshooting
| Symptom | Cause | What to do |
|---|---|---|
| “This function is only available with the Active Directory Module.” | The Active Directory module is not part of the licence of this installation, or its licence date has passed. | Check the licence with your vendor. |
| “Failed to create group 'name' in OU 'OU'.” in the SoftwareCentral log | The service account has no right to create group objects in that organizational unit, or the domain cannot be reached. | Give the account the right to create group objects in that unit, as described in Delegation for Group objects. |
| “Failed to create AD user by name 'name'” in the SoftwareCentral log | The service account has no right to create user objects in the chosen organizational unit, or the domain cannot be reached. | Give the account the right to create user objects in that unit, as described in Delegation for User objects. |