Limiting shared account use in Active Directory

Posted by TreeBug33@reddit | sysadmin | View on Reddit | 18 comments

I have many clients requiring us to have named accounts for all of our techs, and I don’t want to manually create accounts with the same password in each client Is there a solution (like some sort of Idp?) that allows me to have a centralized solution that creates the accounts for me and lets me disable them when the techs leave(for example) My only requirements is that it’s cloud based and agent based. Pricing isn’t that important I contacted jumpcloud, they said it’s not the right tool. From reading about okta I also understood it’s not a fit. Would love to hear how other people deal with this requirement

Reply to Post

18 Comments

[-]

KStieers@reddit

Centrify?

[-]

justmirsk@reddit

Secret Double Octopus may be able to help with this very soon (Release is imminent). Specifically, it will allow you to use a single account as the MSP, but authenticate into the named accounts at your customers. We do a lot with Secret Double Octopus and can help you out, if you would like (once this feature is released). In addition, a PAM platform tailored towards MSPs may be a good fit as well. Something like Evo Security might do the trick. I think that SDO will still require you to create the user object on the customers directory, but it will handle the password rotation, etc. I \*think\* Evo Security will do a just-in-time provisioning of the user object (although I am not certain of that). Let me know if I can be of any assistance. \*Disclaimer - If it wasn't clear, I am an MSP and we use Secret Double Octopus. I don't work for either of the vendors I mentioned above, but I do resell, host and implement the SDO platform.

[-]

justmirsk@reddit

I am not sure why I am being downvoted for proposing potential solutions, but that is fine I guess. You may also want to look at Idemeum and Auto Elevate, they may be able to handle this and allow for tech provisioning centrally in their consoles.

[-]

TrippTrappTrinn@reddit

What you describe is Active Directory....

[-]

TreeBug33@reddit (OP)

Maybe I don’t explain myself well, but what I’m looking for is creating Active Directory accounts, with external authentication, in different environments. Does that make sense?

[-]

Cormacolinde@reddit

That would require a trust with another AD forest.

[-]

TreeBug33@reddit (OP)

I’m afraid I will not do a trust between our own environment and each client environment. I’ve never heard of this as best practice and seems like very intense maintenance, just for the network aspect

[-]

Cormacolinde@reddit

It definitely would not be a good idea. I was just pointing out what the requirement would be for what you’re asking. The only solution that might satisfy the requirements would be a full PAM solution, with check-out and automated password rotation. This way, you could provide audit logs as to which tech used which account and password along with timeframes, without needing separate accounts for every tech in every environment.

[-]

Fake_Cakeday@reddit

That's the point I think. What you're asking is creating a trust between a lot of environments in order to create accounts with elevated access, which I doubt is good practice. Could you create a script for the most common parts of the account creation, so you only have to do the niche things that are independent for each tech?

[-]

TrippTrappTrinn@reddit

Then you would need to get the clients to trust that entity which the client has no control. Does not sound very likely their security people would permit it. What you describe is Identity management. There exist lots of products.

[-]

TreeBug33@reddit (OP)

That’s exactly my question, I’m asking which identity management product fits my requirement

[-]

OpacusVenatori@reddit

Some RMMs will be able to do this. Maybe ask over in r/msp.

[-]

Defconx19@reddit

I would ask if you implemented an automated password rotation if this fixes the issue, combined with auditing ability to see who accessed the password last. I know Passportal supports password rotation. However they still may want visibility on which of your techs is actively working/has worked in their environment.

[-]

TreeBug33@reddit (OP)

If I need to manage multiple environments, how can I track all the rotations? It feels like such manual work, doesn’t it?

[-]

TreeBug33@reddit (OP)

Not really possible I think. We’re talking about tens of environments

Limiting shared account use in Active Directory

Reply to Post

18 Comments

KStieers@reddit

justmirsk@reddit

justmirsk@reddit

TrippTrappTrinn@reddit

TreeBug33@reddit (OP)

Cormacolinde@reddit

TreeBug33@reddit (OP)

Cormacolinde@reddit

Fake_Cakeday@reddit

TrippTrappTrinn@reddit

TreeBug33@reddit (OP)

OpacusVenatori@reddit

Defconx19@reddit

TreeBug33@reddit (OP)

Defconx19@reddit

kona420@reddit

iceph03nix@reddit

TreeBug33@reddit (OP)