Managing Domains (Directories)

To edit the information in an Imprivata domain, click the domain name on Directories page to open a domain record editing form.

To search for a list of user accounts from an Imprivata domain:

1. Click the name of the domain to be searched.
2. From the domain record, click Find Domain Users. The Users page opens, displaying only the users from that domain.

Super Administrators can delete a domain from the domain record by clicking the trash can icon.

You cannot delete the domain in which you are a member.

At the bottom of the domain record is the Password Policy section for implementing a domain password policy. Imprivata applications permit password policies that automate the changing of strong passwords for domains.

A domain password policy is a security feature. When a domain password policy is in effect, the domain passwords change frequently and are never known by users.

Domains with users who authenticate to an Imprivata application by finger biometrics, Smart Card, or ID token AND who never authenticate by password can have the additional security of an automated password policy.

You can implement a password change policy by selecting Implement Password Change Policy? A password change policy changes the user’s passwords at an interval that you set. Users will not know their new passwords and be forced to authenticate by whatever strong authentication method you assigned in their user policies.

You need a certificate for any operation where users change passwords, including the Imprivata OneSign Self-Services option, which allows users to reset their primary authentication password (the password they use to authenticate to OneSign) and to view their application passwords.

To establish communication between the Imprivata appliance and an LDAP directory server, Imprivata must trust a TLS certificate from the directory server.

If Use TLS for secure connection is selected the first time you try to connect to a domain, then Imprivata queries the directory for a certificate and displays it for acceptance.

All subsequent connections to the directory use the first valid certificate accepted.

You can manually upload a different certificate if you have a third-party certificate to use for the TLS connection. To upload a different certificate, browse to it and upload it from the Directory Server Certificate line.

You can import certificates from every directory controller with which the Imprivata appliance communicates with, or you can import a root certificate to cover all appliances.

To use a presented or uploaded certificate to establish trust with the domain:

1. From the domain record, click the certificate link next to Directory server certificate to see the current list of trusted certificates.

2. As a best practice, we recommend using a root certificate. If this is not possible or desirable, you must add certificates from peer directories by editing the Host name field and clicking Save. Alternatively, you can use the Browse... and Upload feature.

   You can delete an unneeded certificate by clicking the trashcan icon beside it.

   NOTE:

   If a certificate expires, you need to upload a new certificate.

To set the connection parameters:

1. In the Domain name field, enter the directory server DNS name.

2. Fill in the Host name field with the fully qualified hostname or the IP address of the directory server.

3. Enter the Username and Password of a user with Administrator privileges on the domain.

4. Select Use TLS for secure communication to ensure you do not transmit credentials from the Imprivata appliance over the network in clear text.

5. In the NetBIOS name field, enter the NetBIOS form of the domain name. If you are unsure, you can use the Look-up feature to have Imprivata look it up for you.

   When you go to the next page or if you use the Look-up feature, the Imprivata appliance will automatically connect to the user directory and may present a certificate acceptance dialog box. Imprivata saves this connection information.

6. To enforce SSL connections when the primary directory is unavailable, import the certificates for all peer directories as well:

   1. In the same form, before continuing, delete the original hostname and enter the hostname of the peer.

   2. Click Look-up next to the NetBIOS Name field.

   3. When you are prompted with the certificate, accept it.

   4. Repeat for each peer.

7. Set the hostname back to the original user directory and continue by clicking Synchronize Users.

8. If you are using Kerberos security, then a Kerberos keytab file is required.

9. Click Next.

10. After you set connection parameters, the rest of the procedure is the same as the procedure for Synchronize to an Existing Domain.

11. You can configure a password policy for the domain; see Implementing a Domain Password Policy.

    The new domain appears on the Directories page.