Adobe user-sync ad account and "read only" permissions

[Jaan]

Hey all,

 

Just wanted to ask you guys if you could help me clear the murky water that is AD read only permissions.

 

Long story short, we have (had) adobe sync, sync users to their console for account and licenses allocation. This worked fine, but i discovered the AD account that performs this task (we'll call it A.dobe) had admin domain level access........ big nope from me.

 

After reading Adobe's documentation it stats that a standard account should be fine as long as it has read only at base DN level.

https://helpx.adobe.com/uk/enterprise/using/user-sync.html

Armed with this new info, i removed the admin group membership and gave it group membership to just "domain users"

 

It now doesn't work as its unable to see users in the AD groups...... Adding Admin group membership restores functionality, but there's no way that's happening moving forwards.

 

I have raised a ticket with adobe here's their response;

 

----------------

Hello,

In default LDAP settings, standard accounts should have read rights over the entire base_dn.

Obviously the permissions are limited in your case and I would start looking into the permissions that the account is granted via its group(s) membership.

Read-only mode for the entire base_dn is what the tool needs at minimum.

If you want to do some tests with different accounts, please make sure '-t' argument is passed on to command line, next to user-sync.exe, or modify the 'test_mode: True' inside the user-sync-config.yml file, so you do not affect the users present in Admin Console.

----------------

 

Am i missing something here as i can't see the forest because the trees!

 

Anybody else been through this?

 

Cheers

Edited November 17, 2022 by Jaan

[chaplic]

Adobe are correct; but equally is possible for someone who doesnt know what they are doing to go nuts removing permissions. with any generic ldap browsig tool (e.g. softerra ldap administrator) you should be able to connect to AD with a standard user account and browse around. Presumably this won't work but it will tell you either way, then sharing the permissions from ADUC security properties would be enlightening.

[Jaan]

Can anybody using Adobe sync, confirm that the account account used to sync users, is just a member Domain Users please.

[Jaan]

I think we might have a GPO somewhere that limits non Admin AD queries to Null........ needle in a hay stack!

[Jaan]

Checked the GPOs can't see anything that standout...

 

I have managed to try and do a custom query in AD:

 

Source:

https://blog.expta.com/2008/02/create-saved-query-that-displays-group.html

 

As my administrator account, the query get results..... as my Domain user account, i get nothing! so there's defo an issue.

 

That being said, i can manually browse AD as a domain user and see group memberships...... but can't do queries.......

 

stumped

[Jaan]

Anybody using Adobe user sync, care to have a look at which AD groups its a member of please?

 

I think our "Domain users" group may have had its permissions changed at some point in the past.

 

Adobe had a look today on a remote session and pretty much confirmed that that was the more likely scenario. They said that the user sync tool needs read access as a minimum, Domain users allows that....... but not in my case. So that out of our support remit.........

[chaplic]

Checked the GPOs can't see anything that standout...

 

I have managed to try and do a custom query in AD:

 

Source:

https://blog.expta.com/2008/02/create-saved-query-that-displays-group.html

 

As my administrator account, the query get results..... as my Domain user account, i get nothing! so there's defo an issue.

 

That being said, i can manually browse AD as a domain user and see group memberships...... but can't do queries.......

 

stumped

 

Good grief. Some muppet has being going wild with permissions on OUs, you can permission them up like a fileshare. Can’t be an explicit deny on domain users, so must have permissions removed.

 

Turn on the advanced features of AD users and computers then look at the permissions of an OU. I should think the domain users will have the same read rights as a domain admin and hopefully it’s obvious what’s missing. I’d start with one OU near the bottom the of tree first.