To integrate your Code42 cloud environment with a directory service, you must configure User Directory Sync. This means installing the User Directory Sync tool to a dedicated server within your organization's environment as well as configuring the administration console. For directions, see Configure Code42 User Directory Sync.
The steps below provide best practices for implementing additional layers of security when deploying this tool in your environment.
- To successfully run the User Directory Sync on a dedicated host, the computer must meet system requirements.
- Ensure your User Directory Sync installation is upgraded to the latest version.
- For help with User Directory Sync, contact your Customer Success Manager (CSM) to engage the Professional Services team.
Code42 recommends deploying the Code42 User Directory Sync tool to a virtual server. Not only will this reduce your resources requirements, but then the tool is also abstracted from a physical machine. The virtualization hypervisor can be from any vendor so long as it supports:
- Network-based communication
- Java runtime
- 64-bit execution environment
Alternatively, the Code42 User Directory Sync tool can be deployed to a stand-alone, dedicated, minimal-resource server. We strongly recommend that the Code42 User Directory Sync tool is deployed to a different server than your Active Directory or LDAP server.
This tool does not need to receive inbound connections from any service in order to run. As a result, inbound connections that are not necessary for management should be blocked using the operating system's firewall or a third party networking tool.
The UDS tool will need to make outbound connections to Code42 and your directory server. We recommend using encrypted ports whenever setting up these connections. The tool requires the following outbound connections are open:
|636 (LDAPS)||Your directory server|
For any permission controls, we recommend following the security principle of least privilege. This means that a person or process is given only the minimum level of access rights to complete an assigned operation.
LDAP bind user
We recommend the directory bind user has read-only permissions to your directory, specifically within the search base for your target set of users.
OS service user
The operating system user account that will run the Code42 User Directory Sync tool should be given lowest-level permissions possible. The tool does not require administrative privileges to run.
Remote access user
It is recommended that no other users are able to remotely access this server (SSH or RDP) other than an admin if required.