You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-arc/data/active-directory-introduction.md
+34-45Lines changed: 34 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,25 +7,28 @@ ms.subservice: azure-arc-data
7
7
author: cloudmelon
8
8
ms.author: melqin
9
9
ms.reviewer: mikeray
10
-
ms.date: 04/05/2022
10
+
ms.date: 04/15/2022
11
11
ms.topic: how-to
12
12
---
13
13
14
14
# Azure Arc-enabled SQL Managed Instance with Active Directory authentication
15
+
Azure Arc-enabled data services support Active Directory (AD) for Identity and Access Management (IAM). The Arc-enabled SQL Managed Instance uses an existing on-premises Active Directory (AD) domain for authentication.
15
16
16
-
This article describes how to enable Azure Arc-enabled SQL Managed Instance with Active Directory (AD) Authentication. The article demonstrates two possible integration modes:
17
-
-Bring your own keytab mode
18
-
-Automatic mode
17
+
This article describes how to enable Azure Arc-enabled SQL Managed Instance with Active Directory (AD) Authentication. The article demonstrates two possible AD integration modes:
18
+
-Customer-managed keytab (CMK)
19
+
-System-managed keytab (SMK)
19
20
20
-
In Active Directory, the integration mode describes the management the keytab file.
21
+
The notion of Active Directory(AD) integration mode describes the process for keytab management including:
22
+
- Creating AD account used by SQL Managed Instance
23
+
- Registering Service Principal Names (SPNs) under the above AD account.
24
+
- Generating keytab file
21
25
22
26
## Background
23
-
24
-
Azure Arc-enabled data services support Active Directory (AD) for Identity and Access Management (IAM). The Arc-enabled SQL Managed Instance uses an existing on-premises Active Directory (AD) domain for authentication. Users need to do the following steps to enable Active Directory authentication for Arc-enabled SQL Managed Instance:
27
+
To enable Active Directory authentication for SQL Server on Linux and Linux containers, use a [keytab file](/sql/linux/sql-server-linux-ad-auth-understanding#what-is-a-keytab-file). The keytab file is a cryptographic file containing service principal names (SPNs), account names and hostnames. SQL Server uses the keytab file for authenticating itself to the Active Directory (AD) domain and authenticating its clients using Active Directory (AD). Do the following steps to enable Active Directory authentication for Arc-enabled SQL Managed Instance:
25
28
26
29
-[Deploy data controller](create-data-controller-indirect-cli.md)
27
-
-[Deploy a bring your own keytab AD connector](deploy-byok-active-directory-connector.md) or [Deploy an automatic AD connector](deploy-automatic-active-directory-connector.md)
-[Deploy a customer-managed keytab AD connector](deploy-customer-managed-keytab-active-directory-connector.md) or [Deploy a system-managed keytab AD connector](deploy-system-managed-keytab-active-directory-connector.md)
The following diagram shows how to enable Active Directory authentication for Azure Arc-enabled SQL Managed Instance:
31
34
@@ -34,53 +37,39 @@ The following diagram shows how to enable Active Directory authentication for Az
34
37
35
38
## What is an Active Directory (AD) connector?
36
39
37
-
In order to enable Active Directory authentication for SQL Managed Instance, the managed instance must be deployed in an environment that allows it to communicate with the Active Directory domain.
38
-
39
-
To facilitate this, Azure Arc-enabled data services introduces a new Kubernetes-native [Custom Resource Definition (CRD)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) called `Active Directory Connector`, it provides Azure Arc-enabled managed instances running on the same data controller the ability to perform Active Directory authentication.
40
+
In order to enable Active Directory authentication for SQL Managed Instance, the instance must be deployed in an environment that allows it to communicate with the Active Directory domain.
40
41
42
+
To facilitate this, Azure Arc-enabled data services introduces a new Kubernetes-native [Custom Resource Definition (CRD)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) called `Active Directory Connector`. It provides Azure Arc-enabled SQL managed instances running on the same data controller the ability to perform Active Directory authentication.
41
43
42
44
## Compare AD integration modes
43
45
44
-
What is the difference between the two AD integration modes?
45
-
46
-
To enable Active Directory Authentication for Arc-enabled SQL Managed Instances, you need an Active Directory (AD) connector where you determine the mode of the AD deployment. The two modes are:
47
-
48
-
- Bring your own keytab
49
-
- Automatic
50
-
51
-
The following sections describe the compare these modes.
52
-
53
-
### Bring your own keytab mode
54
-
55
-
In this mode, you provide:
56
-
57
-
- An Active Directory account
58
-
- Service Principal Names (SPNs) under that AD account
59
-
- Your own [keytab file](/sql/linux/sql-server-linux-ad-auth-understanding#what-is-a-keytab-file)
60
-
61
-
When you deploy the bring your own keytab AD connector, you need to create the AD account, register the service principal names (SPN), and create the keytab file. You can create the account using [Active Directory utility (`adutil`)](/sql/linux/sql-server-linux-ad-auth-adutil-introduction).
46
+
What is the difference between the two Active Directory integration modes?
62
47
63
-
For more information, see [deploy a bring your own keytab Active Directory (AD) connector](deploy-automatic-active-directory-connector.md)
48
+
To enable Active Directory authentication for Arc-enabled SQL Managed Instance, you need an Active Directory connector where you specify the Active Directory integration deployment mode. The two Active Directory integration modes are:
64
49
65
-
### AD automatic integration mode
50
+
- Customer-managed keytab
51
+
- System-managed keytab
66
52
67
-
In automatic mode, you need an automatic Active Directory (AD) connector. You will bring an Organizational Unit (OU) and an AD domain service account has sufficient permissions in the Active Directory.
|**Use cases**|Small and medium size businesses who are familiar with managing Active Directory objects and want flexibility in their automation process |All sizes of businesses - seeking to highly automated Active Directory management experience|
58
+
|**User provides**|An Active Directory account and SPNs under that account, and a [keytab file](/sql/linux/sql-server-linux-ad-auth-understanding#what-is-a-keytab-file) for Active Directory authentication |An [Organizational Unit (OU)](../../active-directory-domain-services/create-ou.md) and a domain service account has [sufficient permissions](deploy-system-managed-keytab-active-directory-connector.md?#prerequisites) on that OU in Active Directory.|
59
+
|**Characteristics**|User managed. Users bring the Active Directory account, which impersonates the identity of the managed instance and the keytab file. |System managed. The system creates a domain service account for each managed instance and sets SPNs automatically on that account. It also, creates and delivers a keytab file to the managed instance. |
60
+
|**Deployment process**| 1. Deploy data controller <br/> 2. Create keytab file <br/>3. Set up keytab information to Kubernetes secret<br/> 4. Deploy AD connector, deploy SQL managed instance<br/><br/>For more information, see [Deploy a customer-managed keytab Active Directory connector](deploy-customer-managed-keytab-active-directory-connector.md)| 1. Deploy data controller, deploy AD connector<br/>2. Deploy SQL managed instance<br/><br/>For more information, see [Deploy a system-managed keytab Active Directory connector](deploy-system-managed-keytab-active-directory-connector.md)|
61
+
|**Manageability**|You can create the keytab file by following the instructions from [Active Directory utility (`adutil`)](/sql/linux/sql-server-linux-ad-auth-adutil-introduction). Manual keytab rotation. |Managed keytab rotation.|
62
+
|**Limitations**|We do not recommend sharing keytab files among services. Each service should have a specific keytab file. As the number of keytab files increases the level of effort and complexity increases. |Managed keytab generation and rotation. The service account will require sufficient permissions in Active Directory to manage the credentials. |
70
63
71
-
- Creates a domain service AD account for each managed instance.
72
-
- Sets SPNs automatically on that AD account.
73
-
- Creates and delivers a keytab file to the managed instance.
64
+
For either mode, you need a specific Active Directory account, keytab, and Kubernetes secret for each SQL managed instance.
74
65
75
-
The mode of the AD connector is determined by the value of `spec.activeDirectory.serviceAccountProvisioning`. Set to either `manual` for bring your own keytab, or `automatic`. Once this parameter is set to automatic, the following parameters become mandatory:
## Enable Active Directory authentication in Arc-enabled SQL Managed Instance
78
67
79
-
When you deploy SQL Managed Instance with the intention to enable Active Directory Authentication, the deployment needs to reference the Active Directory Connector instance to use. Referencing the Active Directory Connector in managed instance specification automatically sets up the needed environment in the SQL Managed Instance container for the managed instance to authenticate with Active Directory.
68
+
When you deploy SQL Managed Instance with the intention to enable Active Directory authentication, the deployment needs to reference an Active Directory connector instance to use. Referencing the Active Directory connector in managed instance specification automatically sets up the needed environment in the SQL Managed Instance container for the managed instance to authenticate with Active Directory.
80
69
81
70
## Next steps
82
71
83
-
*[Deploy and bring your own keytab Active Directory (AD) connector](deploy-byok-active-directory-connector.md)
84
-
*[Deploy an automatic Active Directory (AD) connector](deploy-automatic-active-directory-connector.md)
85
-
*[Deploy Azure Arc-enabled SQL Managed Instance in Active Directory (AD)](deploy-active-directory-sql-managed-instance.md)
86
-
*[Connect to AD-integrated Azure Arc-enabled SQL Managed Instance](connect-active-directory-sql-managed-instance.md)
72
+
*[Deploy a customer-managed keytab Active Directory (AD) connector](deploy-customer-managed-keytab-active-directory-connector.md)
73
+
*[Deploy a system-managed keytab Active Directory (AD) connector](deploy-system-managed-keytab-active-directory-connector.md)
74
+
*[Deploy an Azure Arc-enabled SQL Managed Instance in Active Directory (AD)](deploy-active-directory-sql-managed-instance.md)
75
+
*[Connect to Azure Arc-enabled SQL Managed Instance using Active Directory authentication](connect-active-directory-sql-managed-instance.md)
title: Deploy Azure Arc-enabled data services in Active Directory authentication - prerequisites
3
+
description: Deploy Azure Arc-enabled data services in Active Directory authentication - prerequisites
4
+
services: azure-arc
5
+
ms.service: azure-arc
6
+
ms.subservice: azure-arc-data
7
+
author: cloudmelon
8
+
ms.author: melqin
9
+
ms.reviewer: mikeray
10
+
ms.date: 04/21/2022
11
+
ms.topic: how-to
12
+
---
13
+
14
+
# Azure Arc-enabled SQL Managed Instance in Active Directory authentication with system-managed keytab - prerequisites
15
+
16
+
This document explains how to prepare to deploy Azure Arc-enabled data services with Active Directory (AD) authentication. Specifically the article describes Active Directory objects you need to configure before the deployment of Kubernetes resources.
17
+
18
+
[The introduction](active-directory-introduction.md#compare-ad-integration-modes) describes two different integration modes:
19
+
-*System-managed keytab* mode allows the system to create and manage the AD accounts for each SQL Managed Instance.
20
+
-*Customer-managed keytab* mode allows you to create and manage the AD accounts for each SQL Managed Instance.
21
+
22
+
The requirements and recommendations are different for the two integration modes.
|Active Directory domain service account (DSA) for Active Directory Connector |Not required|Required |
29
+
|Active directory account for SQL Managed Instance |Created for each managed instance|System creates AD account for each managed instance|
30
+
31
+
### DSA account - system-managed keytab mode
32
+
33
+
To be able to create all the required objects in Active Directory automatically, AD Connector needs a domain service account (DSA). The DSA is an Active Directory account that has specific permissions to create, manage and delete users accounts inside the provided organizational unit (OU). This article explains how to configure the permission of this Active Directory account. The examples call the DSA account `arcdsa` as an example in this article.
34
+
35
+
### Auto generated Active Directory objects
36
+
37
+
An Arc-enabled SQL Managed Instance deployment automatically generates accounts in system-managed keytab mode. Each of the accounts represents a SQL Managed Instance and will be managed by the system throughout the lifetime of SQL. These accounts own the Service Principal Names (SPNs) required by each SQL.
38
+
39
+
The steps below assume you already have an Active Directory domain controller. If you don't have a domain controller, the following [guide](https://social.technet.microsoft.com/wiki/contents/articles/37528.create-and-configure-active-directory-domain-controller-in-azure-windows-server.aspx) includes steps that can be helpful.
40
+
41
+
## Create Active Directory objects
42
+
43
+
Do the following things before you deploy an Arc-enabled SQL Managed Instance with AD authentication:
44
+
45
+
1. Create an organizational unit (OU) for all Arc-enabled SQL Managed Instance related AD objects. Alternatively, you can choose an existing OU upon deployment.
46
+
1. Create an AD account for the AD Connector, or use an existing account, and provide this account the right permissions on the OU created in the previous step.
47
+
48
+
### Create an OU
49
+
50
+
System-managed keytab mode requires a designated OU. For customer-managed keytab mode an OU is recommended.
51
+
52
+
On the domain controller, open **Active Directory Users and Computers**. On the left panel, right-click the directory under which you want to create your OU and select **New**\>**Organizational Unit**, then follow the prompts from the wizard to create the OU. Alternatively, you can create an OU with PowerShell:
53
+
54
+
```powershell
55
+
New-ADOrganizationalUnit -Name "<name>" -Path "<Distinguished name of the directory you wish to create the OU in>"
56
+
```
57
+
58
+
The examples in this article use `arcou` for the OU name.
59
+
60
+
61
+
62
+
63
+
64
+
### Create the domain service account (DSA)
65
+
66
+
For system-managed keytab mode, you need an AD domain service account.
67
+
68
+
Create the Active Directory user that you will use as the domain service account. This account requires specific permissions. Make sure that you have an existing Active Directory account or create a new account, which Arc-enabled SQL Managed Instance can use to set up the necessary objects.
69
+
70
+
To create a new user in AD, you can right-click the domain or the OU and select **New** > **User**:
71
+
72
+
73
+
74
+
This account will be referred to as *arcdsa* in this article.
75
+
76
+
### Set permissions for the DSA
77
+
78
+
For system-managed keytab mode, you need to set the permissions for the DSA.
79
+
80
+
Whether you have created a new account for the DSA or are using an existing Active Directory user account, there are certain permissions the account needs to have. The DSA needs to be able to create users, groups, and computer accounts in the OU. In the following steps, the Arc-enabled SQL Managed Instance domain service account name is `arcdsa`.
81
+
82
+
> [!IMPORTANT]
83
+
> You can choose any name for the DSA, but we do not recommend altering the account name once AD Connector is deployed.
84
+
85
+
1. On the domain controller, open **Active Directory Users and Computers**, click on **View**, select **Advanced Features**
86
+
87
+
1. In the left panel, navigate to your domain, then the OU which `arcou` will use
88
+
89
+
1. Right-click the OU, and select **Properties**.
90
+
91
+
> [!NOTE]
92
+
> Make sure that you have selected **Advanced Features** by right-clicking on the OU, and selecting **View**
93
+
94
+
1. Go to the Security tab. Select **Advanced Features** right-click on the OU, and select **View**.
0 commit comments