Prevent account creation on a different AD source when assigning cross-domain AD groups

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi everyone,
I’m working with two Active Directory domains that have a two-way trust between them:

  • AD - Domain1

  • AD - Domain2

In Identity Security Cloud (ISC), I have created two sources — one for each domain.
External users are created on one of these sources based on the value of a specific attribute (companyID).

During the creation process, users are assigned AD groups depending on their companyID.
Currently, all AD groups exist only in AD - Domain1.

When a user belonging to companyY is created on AD - Domain2, they also need to be assigned the group related to companyY, which is currently located in AD - Domain1.
However, I don’t want an additional account to be created in AD - Domain1 — the user should only exist in AD - Domain2.

When ISC tries to assign a group that exists on AD - Domain1 to a user that resides in AD - Domain2, the platform automatically provisions a new account in AD - Domain1, since that’s where the group is managed.

Is there any way in Identity Security Cloud to prevent account creation on a different AD source when assigning a group that belongs to another domain (in a trusted setup)?

Unfortunately, replicating or syncing groups across both domains is not possible in my scenario.

Would really appreciate any suggestions or best practices to handle this case.
Thanks in advance!

Antonio

2

Hi @Antonio1

What’s your forest set-up?

Assuming multi-forest you’re going to need to manage Foreign Security principals in Domain1 for users in Domain2. It is included in supported features (see Foreign Security Principals Permissions ), but I’m afraid I haven’t implemented this functionality, so I’m just posting this to give you a pointer.

4

Having said that why is

this the case? It would be MS best practice to create groups in Domain2 which are members of groups in Domain1, this avoids large numbers of FSPs in Domain1. Admittedly the Groups in Domain1 would need to be Domain Local and the groups in Domain2 preferably Global.

5

Hi,

Thanks for your reply.

In our scenario, we have multiple forests. Based on your recommendation, the ideal setup would be:

  • Global groups in the user domain (e.g., Domain2)

  • Domain local groups in the resource domain (e.g., Domain1)

  • Add the global groups as members of the domain local groups

However, in our case it’s not possible to replicate or create the corresponding groups in Domain2.
Is there any alternative approach or best practice to handle this scenario?

Thanks in advance,
Antonio

6

Hi @Antonio1 Like I said in my first post, you should have a look at managing Foreign Security Principals in Domain1 for users in Domain2.

7

Hi @j_place

Thank you for the feedback, we will review the suggested documentation: https://documentation.sailpoint.com/connectors/active_directory/help/integrating_active_directory/foreign_security_principals.html

Thanks

Antonio