Sync Janssen Server with AD Microsoft

[danmb315]

Hi,
i have a question with Jenssen server.
I wanna sync my Jennsen server with my ad microsoft server for my users, but i can not found if it is possible.

Some one was do it? how can i do it?
thx everyone

[nynymike]

You can use Link to sync users from AD: https://docs.jans.io/v1.1.4/admin/link/jans-link/

But remember that you cannot sync AD passwords, so you'll have to use LDAP authentication. The best way to do this is by using the Agama LDAP Project: https://github.com/GluuFederation/agama-ldap

[danmb315]

Sorry my fault, i forgot to say i wanna use a USB Key FIDO2 with de jennsen server to authenticate mi users or at least to block some apps with second factor authentication with fido2 with jans link and agama LDAP it is possible? thx for your help

[nynymike]

Sorry for the delayed response! To "block some apps" it sounds like you will need some authorization solution. Ideally, the app would look at the id_token, and say "This is not sufficient". Then the app can ask for a different authentication send an OpenID Authn request with the promt=login paramater to force re-authentication, and specify the acr it requires.

If you want to enforce this kind of security on the IDP, you could perhaps do it in the post-authn interception script, but its really not advisable to do this on the backend. You really need a PDP to express your policies--like what authn is required for which resources. In general, don't use hack an authn server for authz. Jans Auth Server authenticates both people and workloads (i.e. OAuth clients). These assertions are input to authorization.

In the not too distant future, Gluu will be introducing some new authz tools... like the "Cedarling". Previous of the docs is here