I believe your expectations are wrong - IBM Support can clarify the situation - but not fix it as the problem is lying within your own organization and the Windows AD product.
But let me clarify what I do in projects when resolving this problem. You need to find the AD Security/User Management responsible in your organization (you will need to talk to them anyhow to get the integration right from a process perspective) . Then you need to ask them what is needed if you cannot use a Domain Admin - this is their job to guide in most normal organizations.
Also - be aware that certain operations in the adapter may need to have some elevated user rights available (I remember that at one customer they have setup the AD Domain such that we needed not only Domain Admin to manage Exchange account - but Enterprise Admin - no so good...) - so you need to prepared to take these discussion with both your internal security department as some of these restrictions may not be something that can just be resolved (and the security department also needs to be aware of so that can remedy the situation e.g. give guidelines on segmentation of network/firewalling so that even if you need Domain Admin it can be remedied).
One way to solve this is to have a very secure network segment/domain (not AD domain...) where your IGI solution resides together with a dedicated AD domain controller - this also solves a lot of performance issues you may get into - but again - you need to discuss this with the AD responsible.
HTH
------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs
------------------------------
Original Message:
Sent: Fri November 05, 2021 04:09 AM
From: Andrea Martone
Subject: Installing IGI Active Directory Standard Adapter
Many thanks Franz,
Indeed we were forced by IT Security to not use Domain Admin, and this led us to try to find a standard configuration for the AD account to be used for IGI AD Standard adapter.
We indeed raised a ticket to IBM Support some days ago, but still not valid answers from them...
------------------------------
Andrea Martone
Original Message:
Sent: Fri November 05, 2021 03:47 AM
From: Franz Wolfhagen
Subject: Installing IGI Active Directory Standard Adapter
Let me add a few comments to this - and yes - this is basically the answer.
That said - we should never recommend to use a Domain Admin these days for obvious reasons (think Zero Trust and lateral movement..) - but this is actually the recommendation that you historical got from Microsoft IIRC (I definitely hope that has changed :-)).
A had this discussion internally some time ago - and I believe the right approach is that the authorizations rights used for user management is a problem that resides in the managed systems domain - we can give some advice - but the final arbiter is the supplier of the solution - and of course what custom additions that is added locally.
Be aware that this is my PERSONAL opinion - I am not able to speak IBM on this - so if you need an official answer you may want to raise it through IBM Support or you IBM representative.
HTH
------------------------------
Franz Wolfhagen
IAM Technical Architect for Europe - Certified Consulting IT Specialist
IBM Security Expert Labs
Original Message:
Sent: Thu November 04, 2021 04:05 PM
From: Tim TamDude
Subject: Installing IGI Active Directory Standard Adapter
I would assume any role that has c r u d permissions to users in the domain and group membership permissions would be least amount of permissions as those are the operations you will be performing on the domain accounts/groups.
------------------------------
Tim TamDude
Original Message:
Sent: Wed November 03, 2021 06:23 AM
From: Andrea Martone
Subject: Installing IGI Active Directory Standard Adapter
Dear experts,
Looking at the official IBM guide for installing the IGI Active Directory Standard Adapter the requirements related to the AD user account to be embedded within the IGI AD Adapter are fairly vague:
The Active Directory Adapter requires administrator authority. IBM Security Identity Governance and Intelligence requests might fail if the adapter is not given sufficient authority to perform the requested task. The Active Directory Adapter can be installed within the managed domain or in a different domain. If the adapter is installed in a different domain, trusts must be configured on both the domain that is managed and the domain where the adapter is installed. For more information about configuring trusts for domains, see the Microsoft documentation that corresponds to your operating system.
We tried to avoid assigning Domain Admins to the account, so we followed what mentioned within the guide granting the user account with the "Account Operators" group (Active Directory Security Groups - Windows security) Unfortunately this didn't work (e.g. Error: 0x80070005 - Access is denied.)
Do you know, if there is a more detailed instruction about what should be the valid standard rights/permissions to be assigned to the AD user account for the IGI AD Adapter? I know that probably it depends on how AD was configured, but assuming to have a standard AD environment, what should be the right configuration of the AD Account? Are we really forced to assign Domain Admins rights?
Thanks in advance.
------------------------------
Andrea Martone
------------------------------