Active Directory Plugin

Active Directory plugin for Keeper Commander rotation

Keeper has also launched a zero-trust Password Rotation feature with KeeperPAM. This new capability is recommended for most password rotation use cases. The Documentation is linked below:

• Password Rotation with KeeperPAM

• Commander KeeperPAM commands

This plugin provides IT Admins with the ability to rotate the password of an Active Directory user account. This plugin can be run on any system that has network access to the AD server.

Prerequisites

Install the ldap3 module

pip3 install ldap3

Prepare Record for Rotation

Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Password' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

See the Troubleshooting section for more information on legacy vs typed records

Set the Password Field

In the Keeper record, put the user's current password in the "Password" field

Set the Hostname and Port

If using an untyped record, the host and port can be set to custom fields. See below.

TIP: If no rotation plugin is specified, Commander will use the port number to guess which rotation to use. Port 389 will use AD rotation

Add the following required fields

The following fields are required for AD rotation. Create each field with the label indicated and supply the required information.

Label	Value	Comment
cmdr:use_ssl	True or False	Whether or not to use SSL connection to AD Server
cmdr:userdn		Distinguished name of the AD user you want to rotate the password on.

Additional Rotation Settings

The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.

Label	Value	Comment
cmdr:plugin	adpasswd
cmdr:host		Host name or IP address of your AD Server
cmdr:port		Optional: Port number of your AD Server. Default value: 389
cmdr:rules		Optional password complexity rules

Rotate Record

To rotate Active Directory passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)

rotate "AD Password Rotator" --plugin adpasswd

The plugin can be supplied to the command as shown here, or added to a record field (see options above). Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.

Notes and Troubleshooting:

The Keeper "Login" field is not used for this plugin. The user is identified with the cmdr:userdn custom field.

If you get the error "Error during connection to AD server" try the following:

• Ensure your AD supports secure bind via TLS. The certificate can be self-signed if needed.

• Disable 'Minimum password age’ group policy. It is set to one day by default.

• Verify connectivity to the host server, make sure it is accessible. Download a tool such as the Softerra LDAP Browser to test if you're able to connect to Active Directory.

• Check that your Distinguished Name cmdr:userdn is set correctly. It needs to be exactly right or else the connection will fail. You can check the value of this from within the Softerra LDAP browser software or you can run the below command prompt utility on the AD Server:

C:\Users\craig>dsquery user -name Craig*
"CN=Craig Lurey,CN=Users,DC=keeper,DC=test,DC=keepersecurity,DC=com"

For connecting as Craig in this scenario, make sure the cmdr:userdn custom field contains this exact string (without the quotes).

Connecting to Active Directory

Microsoft Active Directory requires SSL connection in order to change the password. The following link explains how to setup a secure connection to Active Directory

https://blogs.msdn.microsoft.com/microsoftrservertigerteam/2017/04/10/step-by-step-guide-to-setup-ldaps-on-windows-server/