What is the Portnox LDAP Broker?

In this topic, you will learn what is the Portnox™ LDAP Broker software and how it works.

Note:
Portnox LDAP Broker was previously called Portnox Active Directory Broker (AD Broker).

Portnox LDAP Broker is a lightweight software agent for installation on user devices. LDAP Broker is not necessary to use Portnox Cloud but it is necessary for the following purposes:

Installation requirements

LDAP Broker is only available for Microsoft Windows. If you need to use LDAP Broker functionality on other platforms, you need a virtual machine with Windows to install and run the broker. The virtual machine must be able to connect via LDAP to the domain controller.

The following are the minimum requirements for installing LDAP Broker on a Windows machine:

  • CPU: minimum: 1.4 GHz (x64 processor)
  • RAM: minimum: 8 GB, recommended: 16 GB
  • Free disk space: minimum: 1 GB
  • Connection to the internet on ports 443 and 8081
  • Connection to the corporate Active Directory or OpenLDAP
  • For AD integration: domain-joined (member of the Active Directory domain)
Warning:
The Portnox LDAP Broker must be treated as a Tier 0 asset. Only Tier 0 admins may manage it, it must be accessed only from PAWs, and it must follow Tier 0 network and security policies.
Note:
LDAP Broker authenticates with the on-premises Active Directory server using the Windows LsaLogonUser API, which simulates native authentication routines. LDAP Broker does not natively support Kerberos authentication, but in case a higher level of security is required, it supports NTLMv2. You can turn NTLMv2 on for each LDAP Broker deployment separately by going to Settings > Authentication Repositories > DIRECTORY INTEGRATION SERVICE > Directory domains > Edit > Support NTLMv2 (Experimental).

Troubleshooting the installation

If you need help troubleshooting the installation of LDAP Broker, look for answers in the Troubleshooting section for LDAP Broker.

Multiple LDAP Broker instances

You can install any number of LDAP Broker instances on any number of machines. For domains with multiple brokers, Portnox Cloud load-balances authentication requests across all configured instances. Note that if a request is routed to a malfunctioning broker, the authentication attempt will fail.