fiza Posted December 2, 2020 Posted December 2, 2020 Since before I started here the internal domain name has been "domain.schoolname.borough.sch.uk". The external domain name was "schoolname.borough.sch.uk". We have now changed the external name to "schoolname.org.uk". Should I be looking at changing the internal domain name to match? The reason being I am looking at configuring LDAPS for the DCs and one of the pre-reqs is that the Active Directory fully qualified domain name of the domain controller (for example, DC01.DOMAIN.COM) must appear in one of the following places:The Common Name (CN) in the Subject field. DNS entry in the Subject Alternative Name extension. Looking at doing this with a Let's Encrypt SSL Certificate Is there a way to do this without changing the Internal domain name or am I looking at this in completely the wrong way?
localzuk Posted December 2, 2020 Posted December 2, 2020 Why aren't you simply using an internal CA? Are devices that don't have the ability to have a root certificate installed connecting to your AD server? We have LDAPS set up - as we have an Windows CA server. No need for Lets Encrypt at all. 2
fiza Posted December 2, 2020 Author Posted December 2, 2020 Why aren't you simply using an internal CA? Are devices that don't have the ability to have a root certificate installed connecting to your AD server? We have LDAPS set up - as we have an Windows CA server. No need for Lets Encrypt at all. We are using external services (Room Booking System and Parents Evening System) where I want to use LDAPS to authenticate users. Can I still use an internal CA for these?
FN-GM Posted December 2, 2020 Posted December 2, 2020 We are using external services (Room Booking System and Parents Evening System) where I want to use LDAPS to authenticate users. Can I still use an internal CA for these? Sorry to hijack. If you have Office 365 it and have it synced with AD it will probably be more secure to do the LDAPS against Azure AD than your internal domain controllers. 1
fiza Posted December 2, 2020 Author Posted December 2, 2020 Sorry to hijack. If you have Office 365 it and have it synced with AD it will probably be more secure to do the LDAPS against Azure AD than your internal domain controllers. Unfortunately no Office 365 here. We are Google Workspace users.
DavidYoung Posted December 2, 2020 Posted December 2, 2020 Unfortunately no Office 365 here. We are Google Workspace users. You can do LDAPS against Google Workspace, but if you are talking about School Cloud systems then we have them set up with SAML against G Suite which would be much easier to configure than LDAPS against AD as it doesn't require firewall access to your DCs and is more secure as Google handles the authentication and it is proper SSO as long as the teacher is authenticated in Google first. 1
fiza Posted December 2, 2020 Author Posted December 2, 2020 You can do LDAPS against Google Workspace, but if you are talking about School Cloud systems then we have them set up with SAML against G Suite which would be much easier to configure than LDAPS against AD as it doesn't require firewall access to your DCs and is more secure as Google handles the authentication and it is proper SSO as long as the teacher is authenticated in Google first. It is School Cloud Systems. Will have a look at SAML. Thanks
DavidYoung Posted December 2, 2020 Posted December 2, 2020 It is School Cloud Systems. Will have a look at SAML. Thanks https://support.parentseveningsystem.co.uk/article/444-g-suite-how-to-configure-teacher-logins 1
fiza Posted December 2, 2020 Author Posted December 2, 2020 https://support.parentseveningsystem.co.uk/article/444-g-suite-how-to-configure-teacher-logins Had a look at the info at that link. What did you do for the MetaData URL? While this propagation occurs, add the metadata file you downloaded in step 5 to a web accessible directory - i.e. a directory that is open to access via the internet from the IP addresses of our servers. If you do not have such a directory available to you we would suggest you try a web search for a provider using "direct link file hosting" or a similar query. Please note that Google Drive doesn't work for hosting metadata.
DavidYoung Posted December 3, 2020 Posted December 3, 2020 What did you do for the MetaData URL? It frustrated us, I did try Google drive with a direct download link but it didn't work. In the end I set up a GitLab account (I think Github would also work) and used their static pages feature to host the file. 1
localzuk Posted December 3, 2020 Posted December 3, 2020 Could you not host it on your school website? 1
fiza Posted December 3, 2020 Author Posted December 3, 2020 Could you not host it on your school website?We are looking at that
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now