What is the Portnox LDAP Broker?

In this topic, you will learn what is the Portnox™ LDAP Broker software and how it works.

Note:
Portnox LDAP Broker was previously called Portnox Active Directory Broker (AD Broker).

Portnox LDAP Broker is a lightweight software agent for installation on user devices. LDAP Broker is not necessary to use Portnox Cloud but it is necessary for the following purposes:

Installation requirements

LDAP Broker is only available for Microsoft Windows. If you need to use LDAP Broker functionality on other platforms, you need a virtual machine with Windows to install and run the broker. The virtual machine must be able to connect via LDAP to the domain controller.

The following are the minimum requirements for installing LDAP Broker on a Windows machine:

  • CPU: minimum: 1.4 GHz (x64 processor)
  • RAM: minimum: 8 GB, recommended: 16 GB
  • Free disk space: minimum: 1 GB
  • Connection to the internet on ports 443 and 8081
  • Connection to the corporate Active Directory or OpenLDAP
  • For AD integration: domain-joined (member of the Active Directory domain)
Warning:
The Portnox LDAP Broker must be treated as a Tier 0 asset. Only Tier 0 admins may manage it, it must be accessed only from PAWs, and it must follow Tier 0 network and security policies.
Note:
LDAP Broker authenticates with the on-premises Active Directory server using the Windows LsaLogonUser API, which simulates native authentication routines. LDAP Broker does not natively support Kerberos authentication, but in case a higher level of security is required, it supports NTLMv2. You can turn NTLMv2 on for each LDAP Broker deployment separately by going to Settings > Authentication Repositories > DIRECTORY INTEGRATION SERVICE > Directory domains > Edit > Support NTLMv2 (Experimental).

Troubleshooting the installation

If you need help troubleshooting the installation of LDAP Broker, look for answers in the Troubleshooting section for LDAP Broker.

Multiple LDAP Broker instances

You can install any number of LDAP Broker instances on any number of machines. If there is more than one LDAP Broker configured for your domain, and there is an authentication request for that domain, Portnox Cloud sends that request to all LDAP Brokers that you configured for that domain. The first LDAP Broker that responds is the one that is used for this specific request.