Enabling Centrify Identity Service and Privilege Service for Smart Card Authentication

Background
Many governmental and commercial organizations have implemented smart cards as their preferred method for Multi-factor Authentication.  This post explains how to configure Centrify Identity Service (CIS) or Centrify Privilege Service (CPS) to provide authentication using Smart Cards.  This article provides the configuration steps to enable Smartcard (certificate)-based authentication for CIS or CPS.

How it works
Generally, cryptographic credentials (user certificates) are stored in the smart card (PIV or CAC card) and the system has a dedicated reader.   Upon successful authentication (credentials verified and PIN submitted) the operating system or application will use a standard protocol (like Kerberos) or a one-time-code to grant access to the system or application.

For example, Centrify Server Suite allows the user of Kerberos for SSO to applications like Secure Shell (SSH).  Our DirectAuthorize can enforce if the user is allowed to log in with a password or with Kerberos/GSSAPI only.

In the case of Identity Service and Privilege Service, we use a Centrify capability called Zero Sign-on (SZO).  SZO provides a one-time token to use for authentication if the Authentication Profile that applies to the user is configured for Certificate-based Authentication.  All the user needs to do is navigate to the CIS/CPS site, select the smart card certificate and PIN.

This setup provides strong authentication to access Apps or for Privileged Identity Management scenarios.

What you'll need:

1. An instance of Centrify Identity Service App+ or Privilege Service  (CPS can be SaaS or On-Prem)
2. Public Key Infrastructure Infrastructure  (Enterprise CA, Revocation Infrastructure, well-configured PKI clients) and understanding of how the subject name is being provisioned.
3. A copy of the Certificate Chain (or Root CA) for your PKI infrastructure.
4. A SmartCard or Yubikey configured for authentication into your environment.
   This post contains instructions to set up a lab. See "Lab - Base Setup"

Strong Disclaimer:  This is a PKI-related topic.  You should always be workign with your PKI SME with anything related to certificates, trust chains, revocations, etc.

Configuration Overview
The configuration depends on the deployment option of the service.

1. Configuring the Root CA in Identity Service App+ or Privilege Service
2. Configuring a Policy that allows for Integrated Windows Authentication
3. Testing the configuration
4. Appendix:  Configure Privilege Service On-Premises CNAME and Zero Sign-on SSL Certificate

Configuring the Root CA in Identity Service App+ or Privilege Service (SaaS)

1. Sign-in to Cloud Manager
2. Go to Settings > Authentication > Certificate Authorities
   Note:  If you can't see the Certificate Authorities option, you're not running the App+ edition or in the case of Privilege Service on-premises, you have to perform the activation steps (see below).
3. Press Add and complete the follwing information:
   
   Name:  descriptive name of the CA
   Extract login name from:  The options are
   a) Principal Name from Subject Alternate Name
   b) E-mail address field from Subject Alternate Name
   c) Username from Subject
4. Click Browse and select the location of the root ca certificate.
5. If you are confident that you have a highly-distributed (Internal & Internet facing) Certificate revocation infrastructure, check the "Enable Client Certificate Revocation Check" if you are not sure un-check the box for now.
   Note:  If you don't know what PKI certificate revocation is, it's time to find your in-house PKI expert and get him or her involved.  This is a serious topic.
6. Press Save

Configuring a Policy that allows for Integrated Windows Authentication

1. Sign-in to Cloud Manager
2. Go to Policies > [Select your Test Policy] > Expand User Security Policies > Login Authentication
3. Set the "Enable authentication policy controls" setting to Yes, if not selected.
4. Scroll down to "Other Settings" and make sure that the "Allow IWA connections..." is checked.  Then note the following:
   Note: Certificate-based authentication bypasses the login authentication rules set up for that profile.  The key settings are:
   
   The first setting "Use certificates for authentication..." is the main switch.  If you un-check this box, the users in scope for this policy won't be able to use smart cards for authentication.  This bypasses any controls set under "Login Authentication" in the preceding section.
   The second setting  "Set identity cookie..."  controls whether the cookie is set for the browser.   I would not set this flag if you expect users to access via non-managed systems.
   The third setting "Accept connections using certificate..." defines whether if users logging in with smart cards or certs are treated as "strongly-authenticated"
   
   Make your selections based on your desired security posture.
5. Press Save.

Testing your configuration

1.  Navigate to your Identity Service or Privilege Service URL
2. Depending if your browser is configured correctly, you'll see any of the following pop-ups will come up:
   
3. After selecting the Certificate on the Smart Card, you'll be prompted for the PIN:
   
4. Once you type-in the PIN, you'll be redirected to the appropriate portal (User | Cloud Manager | Privilege Manager).

Quick Setup Video


Appendix 1:  Enabling Certificate Authorities for Centrify Privilege Service (On-Premises)
Background:  Centrify Privilege Service can be deployed on premises on a Windows Server 2012 R2 system.  You need a CNAME record for the Zero Sign-On website and a x.509 certificate with that DNS name.

Pre-requisite tasks:
a) Set-up a DNS CNAME record to with the name hostname[zso].domain.name pointing to the hostname.domain.name.  E.g. if your system name is app1.corp.contoso.com, create a CNAME record to app1zso.corp.contoso.com and point it to the original host name.
b) You need an SSL Certificate with the DNSname for the SZO special host.

1. Log in to the server hosting Centrify Privilege Service
2. Open an Administrative PowerShell and navigate to %Programfiles%\Centrify\Centrify Identity Platform\Scripts
3. Run the setup_certauth.ps1 script.   The program will ask if the pre-requisites have been met.
   
4. Confirm and you'll be prompted to provide the x.509 (SSL) cert for the SZO site.
5. Once completed, you can return to Cloud Manager and perform the steps outlined above in the:  "Configuring the Root CA in Identity Service App+ or Privilege Service (SaaS)" section.

Other Resources and Related Topics
Documentation:  https://stage-docs.centrify.com/en/centrify/adminref/index.html?version=141#page/cloudhelp%2FCloud_Policy.13.html
Centrify's support for Derived Credentials: 
- Blog: https://www.centrify.com/products/identity-service/emm/derived-credentials/
- Docs:  https://docs.centrify.com/en/centrify/adminref/index.html?version=141#page/cloudhelp%2FderivedCreds.html

This article was originally written as a Centrify Tech Blog.

[Labs] Centrify+AD+Yubikey - Implement Strong Authentication for UNIX/Linux using Smart Card

Background
This is the the second lab in the series around Strong Authentication.  In the previous lab we focused on StrongAuth for Windows access and privilege elevation with YubiKey.
We will be focusing on UNIX/Linux system access leveraging strong authentication to Windows (or Mac) systems via smart card or YubiKey.  Centrify Server suite allows definitions of roles that only allow non-password authentication to be enforced.   YubiKeys are full-fledged personal identity verification (PIV) cards that work very well with AD and Certificate Services.

The challenges

• Recent advanced threats leverage the collection of passwords and poor security practices to exploit systems.
• The variability (heterogeneity) of systems (Windows, UNIX, Linux, Macs) poses a big challenge for organizations
• The proliferation of "best of breed" solutions promotes IT fragmentation and limits organizational flexibility.
• The "jumpbox" or proxy approach combined with additional controls like workflow can help as long as connections are centralized, however many organizations are getting audit comments due to circunvention of these mechanisms.
• Although there are different multifactor providers in the market and most of them provide Pluggable Authentication Modules for their solutions, the implementation requires a high-degree of expertise and translating the capability to hundreds or thousands of servers with heterogeneous OSs can be quite complex.

The opportunity
Although Centrify can accommodate the "jump box and shared account" model using Centrify Privilege Service, organizations should complement their security strategy with the least access model:

• Users shall only access the systems they need to based on business need-to-know with strong authentication
• Users shall be limited to the minimum privileges required for their functions:  this is accomplished by providing users roles with the rights that they need.
• Rights shall be assigned and limited to the business function with a privilege elevation mechanism (e.g. sudo) that has the flexibility to provide strong authentication.
• In sensitive systems, access and privilege elevation shall be supplemented with session capture and replay.
• Active Directory and Centrify provide a stack that can secure systems and eliminates complexity across the different UNIX/Linux platforms

Lab Goals

• Limit privileged users to a subset of UNIX/Linux systems based on their needs (AD and Centrify Zones enable this)
• Require strong authentication for local or remote (SSH) access  (this is enabled by Centrify DirectAuthorize)
• Require strong authentication on privilege elevation if needed (OTP, SMS, E-mail, phonefactor, etc)
• Reproduce privileged sessions (session capture, transcription, replay).

What you'll need

• Active Directory with Certificate Services
• A domain joined member server with Centrify Server Suite 2016 (DirectControl) a
• One or two UNIX/Linux systems with Centrify DirectControl and Centrify-Enhanced OpenSSH
  Because we will be relying on SSO, Centrify OpenSSH comes compiled with Centrify methods that simplify the process in simple and complex AD environments.
• For SSO to work, the system has to be resolvable by name (shortname or FQDN) by the Kerberized clients.
• SSH client that supports SSO; e.g. stock PuTTY (GSSAPI) or Centrify-enhanced (Kerberos)
• Access to Centrify Standard Edition (evaluation or licensed)
• Yubikey PIV Manager  (download link)
• Yubikey 4, NANO or NEO
• You need working knowledge of Active Directory and Centrify Zones

 Tip:  To set up a base configuration, you can build on the Microsoft Test Lab Guide or use the Announcement Post.

Scenario Description: 
We will use the Yubikey/Smart Card with the Certificate provisioned to the user in the base lab.  With Centrify Access Manager, we will create a role that allows her to access a system (locally and via SSH) and we will prove:

• That the user can only log in to her Windows station with her Smart Card
• That the user cannot sign-in to UNIX/Linux system locally or remotely (via SSH) with a password
• That the user is only allowed to log in remotely via SSH to UNIX/Linux systems  via SSO (Kerberos or GSSAPI)
• That these rights can be assigned to groups of systems, or groups of users in a temporary or permanent basis
• Minimal to zero configuration at the system level.  Once the system is joined to AD, the security measures should just work.

Note:  We will not focus on privilege elevation.  We have covered this exhaustively, including with MFA/2FA in previous labs.


Centrify Setup
In this instance we are setting up a Web Admin role that contains the pre-defined "login-all" PAM right.  We are not breaking down the rights to prove that we can stop the user from logging in via console or via SSH with a password.
The privileged user assigned the role must have authenticated with her YubiKey or SmartCard to obtain a Kerberos TGT from Active Directory, subsequently, Centrify DirectAuthorize will be in charge of denying access to the user if they don't use SSO for access (via Kerberos or GSSAPI).  All we're going to need is a zone and a role.

To set up using PowerShell

Import-Module ActiveDirectory
Import-Module Centrify.DirectControl.PowerShell

$user = Get-ADUser -Identity Maggie.Simpson  # substitute for your test user
$cont = "cn=zones,ou=unix,dc=centrify,dc=vms"  # substitute for your container DN
$zone = New-CdmZone -Name "Yubikey-Demo" -Container $cont

$cmd1 = New-CdmCommandRight -Zone $zone -Name "Edit http config file" -Pattern "vi /etc/httpd/conf/httpd.conf" -Authentication none
$cmd2 = New-CdmCommandRight -Zone $zone -Name "Httpd service control" -Pattern "service httpd*" 
$cmd3 = Get-CdmPamRight -Zone $zone -Name "login-all"

$role = New-CdmRole -Zone $zone -Name "UNIX Webadmin - StrongAuth" -UnixSysRights ssologin, nondzsh, visible

Add-CdmCommandRight -Right $cmd1 –Role $role 
Add-CdmCommandRight -Right $cmd2 –Role $role 
Add-CdmPamRight  -Right $cmd3 –Role $role 

New-CdmUserProfile -Zone $zone –User $user –login $user.SamAccountName -UseAutoUid -AutoPrivateGroup –HomeDir "%{home}/%{user}" –Gecos "%{u:displayName}" –Shell "%{shell}"
New-CdmRoleAssignment -Zone $zone -Role $role -TrusteeType ADUser -ADTrustee $user | Out-Null

To perform the steps for the script above manually
Create, Configure and Assign the Demo role
 In Access Manager > Open they Yubikey-Demo zone > Authorization > Right Click Role Definitions > Select Add Role

1. Name:  UNIX WebAdmin - StrongAuth
   System Rights:
   - Non-password (SSO) login is allowed  (checked)
   - Login with non-Restricted shell (checked)
   
2. Create two UNIX commands.  
   Since this will be our "Web Admin" we'll allow the role to manipulate the httpd daemon and edit the config file for the Apache server.  The commands are:
   Glob expression vi /etc/httpd/conf/httpd.conf from the standard user path /usr/bin no reauthentication required.
   Glob expression service httpd* from the standard user system path /usr/sbin no reauthentication required.
   
3. Add the rights to the role.  Right click the "UNIX WebAdmin - StrongAuth"  role and select "Add Right"
   
4. The role is ready to be assigned.  Now press OK and right-click the Authorization > Role Assignments > Select Assign Role
5. Press the Add AD account > type the name of your test user, select it and press OK.
   
   Note: This is a permanent direct assignment to a user principal at the zone level.  This is not the best practice, typically you grant role assignments temporarily (for attestation), in a subset of systems and to AD groups for better administration.

 Install DirectControl and join the system to the Centrify Zone

1. Use your preferred software distribution method to copy the Centrify software
   In my case I already have a local repo for RHEL and derivatives.  (Read how to set up here)
2. Log in to your UNIX/Linux system and use your favorite package manager to install Centrify DirectControl and Centrify-enhanced OpenSSH
   
   

   $ sudo yum install CentrifyDC CentrifyDC-openssh
   [truncated]
   Installed:
     CentrifyDC.x86_64 0:5.3.0-213   CentrifyDC-openssh.x86_64 0:7.1p1-5.3.0.208
   Complete!
   
   

3. Now Join the Centrify zone and you'll be ready for testing.  Use the adjoin command and an authorized user:
   
   

   $ sudo adjoin -z Yubikey-Demo -c "ou=servers,ou=unix" -u dwirth centrify.vms
   [sudo] password for centrifying:
   dwirth@CENTRIFY.VMS's password:
   Using domain controller: dc.centrify.vms writable=true
   Join to domain:centrify.vms, zone:Yubikey-Demo successful
   
   Centrify DirectControl started.
   [truncated]
   
   

4. If your system was not resolvable by Windows DNS, you can use the addns command to register automatically with dynamic updates (if your DNS zone allows):
   

   $ sudo /usr/sbin/addns --update --machine
   Updating both HOST and PTR record for: centos67.centrify.vms
   Deleting old reverse lookup records for centos67.centrify.vms on 192.168.81.10.
   No old reverse records deleted because no host records found for centos67.centrify.vms on 192.168.81.10.
   
   

5. Verify that your users are correctly UNIX-enabled and with the expected rights (use adquery user and dzinfo)
   

   $ adquery user maggie.simpson
   maggie.simpson:x:1040191002:1040191002:Maggie Simpson:/home/maggie.simpson:/bin/bash
   
   $ sudo  dzinfo maggie.simpson --roles
   User: maggie.simpson
   Forced into restricted environment: No
   Centrify Cloud Authentication: Supported
   
     Role Name        Avail Restricted Env
     ---------------  ----- --------------
     UNIX Webadmin -  Yes   None
     StrongAuth/Yubi
     key-Demo
   
       Effective rights:
           Non password login
           Allow normal shell
           Visible
   
       Centrify Cloud Authentication:
           Not Required
   
       Audit level:
           AuditIfPossible
   
       Always permit login:
           false
   

   
   All set on the Centrify side.

Configure your Test user for Smart Card Authentication

1. In ADUC, find and double-click the test user.
2. Account Tab > Account Options > Check the box for "Smart Card is required for interactive logon"
   
3. Press OK. You are ready to start testing.

Test Plan:

1. Try to access the system with any other AD user than test user - expected result:  Access Denied
   This is because users need to be explicitly be granted access a UNIX identity and a Centrify role in the zone for the computer.

   login as: dwirth
   -----------------------------------------------------------------
   CENTRIFY DEMO -
   -----------------------------------------------------------------
   WARNING: This is a PRIVATE system exclusively for Centrify demos
   Your actions will be monitored and recorded.
   -----------------------------------------------------------------
   Using keyboard-interactive authentication.
   Password:
   Access denied
   Using keyboard-interactive authentication.

   
   
2. Try to access the system with your test user (Maggie) with her password (Console or SSH) - expected result:  Access Denied
   This is because the test user was defined with "Smart card required for interactive logon"

   login as: maggie.simpson
   -----------------------------------------------------------------
   CENTRIFY DEMO -
   -----------------------------------------------------------------
   WARNING: This is a PRIVATE system exclusively for Centrify demos
   Your actions will be monitored and recorded.
   -----------------------------------------------------------------
   Using keyboard-interactive authentication.
   Demo Password:
   Using keyboard-interactive authentication.
   Account cannot be accessed at this time.
   Please contact your system administrator.
   
   

3. Log in to Windows system (you are forced to smartcard login) - Launch PuTTY (configured for SSO)
   Expected result:  Access Granted
   

 Video

Other Considerations:

• When forcing strong authentication, you must have a plan for other shared non-human accounts.  This is where Centrify Privilege Service shines.
• Don't underestimate the need for good process around the lifecycle of PKI and smart cards.  PKI is serious business.

[Labs] Centrify+AD+Yubikey - Implement Strong Authentication for Windows Server Access and Privilege Elevation

Background
This is the first lab in the series around Strong Authentication.  We will be focusing on Windows systems and providing strong authentication for privileged users using Yubikeys.   Yubikeys are full-fledged personal identity verification (PIV) cards that work very well with Active Directory and Certificate Services.

Note:  This lab covers topics related to Public Key Infrastructure.  As previously advised, PKI should be implemented with strong adherence to Security policy, and a well balanced People-Process-Technology triad.

The challenges

• The Windows security model lends itself for organizations to grant additional privileges to users by way of the local Administrators group.  In Active Directory environments organizations struggle with excessive memberships on privileged groups like Domain Admins.
• In Active Directory, a common mitigation strategy is to provision each privileged user an "administrative" account (e.g. joe/joe-a).  This strategy can be supplemented by having the "-a" account password stored securely.
• Unfortunately, advanced attacks like password mining, pass-the-hash and others have become more ubiquitous, this makes a member of a privileged group ("-a" or not) more susceptible to exposure.
• The "dual account" model is often paired with PSM (jumpbox) to provide session brokering and recording.  Unfortunately, this model can be circumvented by bypassing the jumpbox, and since the "-a" account is very powerful, that means that the privileged user can go anywhere.

The opportunity
Although Centrify can accommodate the "dual account" model using Centrify Privilege Service, ideally organizations would implement the least privilege model:

• Users shall only access the systems they need to based on business need-to-know with strong authentication
• Users shall be limited to the minimum privileges required for their functions:  this is accomplished by providing users roles with the rights that they need.
• Rights shall be assigned in the context of applications, desktops and network rights.  Strong authentication shall be required when using privilege elevation.
• In sensitive systems, access and privilege elevation shall be supplemented with session capture and replay.

Lab Goals

• Limit privileged users to a subset of Windows systems based on their needs (AD and Centrify Zones enable this)
• Require strong authentication for local or remote (RDP) access  (this is supported natively by Windows)
• Require strong authentication on Privilege Elevation (applications/desktops)  (DirectAuthorize is Smart Card ready)
• Reproduce privileged sessions (session capture, transcription, replay).

What you'll need

• Active Directory with Certificate Services
• A domain joined member server with Centrify Access Manager and Centrify PowerShell
• Access to Centrify Standard Edition (evaluation or licensed)
• Yubikey PIV Manager  (download link)
• Yubikey 4, NANO or NEO
• You need working knowledge of Active Directory and Centrify Zones

 Tip:  To set up a base configuration, you can build on the Microsoft Test Lab Guide.

Scenario Description: 
We will provision the proper certificate to a test user (lisa) on her Yubikey.  In Active Directory we'll require smart card authentication for the user.  (This can be done at a group of systems level using OUs and GPOs).
We will grant the test user a Centrify DirectAuthorize role that allows her to:

• Run Disk Management as administrator and requires strong authentication
• Use an administrative desktop  (as local administrator) and requires strong authentication

Optional: We will record her actions using DirectAudit.


Lab Setup
Create Test Users and AD Group

1. Open Active Directory Users and Computers and navigate to your desired OU
2. Right click and select New > User  and follow the wizard until the user is created.
3. Right click the newly-created user and select properties.  In the general tab, update the Email to match the user principal name.
   e.g. user@corp.contoso.com and press OK.
4. Right click the OU and select New > Group and make it a Global/Security group.  Call it "Smart Card Users"
5. Right click the Group, select properties, go to the Members tab, press Add and add the user created in step 2.
6. On the member server, grant the group or user the ability to log on remotely. 
   Computer > Properties > Remote Settings > Remote Desktop > Select Users  > Add > [select user or group] press OK twice.

Certificate Services
Modify the Smart Card User (or Smart Card logon) template

1. Open the Certification Authority console  (Start > Search > Certification Authority)
   If you get an error, retarget the console to the appropriate server (e.g. DC1)
2. On the left pane, right click "Certificate Templates" and select Manage.  This will open the Certificate Templates console.
3. In the template list, right-click the SmartCard User template and select "Duplicate Template"
4. In the General tab, give the template a descriptive name.  I used "Smart card User V2"  (this is the display name, the actual template name is SmartcardUserV2)
5. Click on the Security tab, press Add, select the newly-created Smart Card Users group, check the Enroll and Autoenroll boxes, then press OK and close the Certificate Templates console.

Publish the Newly-Created Template

1. In the Certification Authorities console, on the left pane, right click "Certificate Templates" and select New > Certificate Template to Issue
2. Select the newly-created version of the Smart Card User template  (e.g. Smart Card User v2) and press OK.

Provision the Smart Card User Certificate into your Yubikey

1. Log on to your member system with the test user.
2. Open the Yubikey PIV manager tool with the Test User  (shift+right click > run as different user)
3. If you're using a VM, connect the Yubikey to your virtual machine.
   Note:  If you're using VMWare, you need to add the parameter below for the Yubikey to be available to your VM.
   

   usb.generic.allowHID = "TRUE"

   This step is performed by editing the .vmx file and editing it with your current text editor while the VM is off.
4. Initialize the Yubikey if brand new.  Do not forget the PIN.
   
5. In Yubikey PIV manager, press Certificates > Generate New Key and make sure you type the Certificate Template name (not the display name).  The subject will match the credential that you launched the Yubikey PIV Manager (e.g. your test user).
6. Type the PIN when challenged, and select your existing CA.  In my case I use the non HTTP link.
   
   
7. To test the smart card authentication, either lock your screen or logoff.  If you can unlock or login successfully, you should be ready for the next steps.
   

Lab Pre-check Video


Centrify Setup
To Create the Zone, Role, Rights and Assignments using PowerShell:

Import-Module ActiveDirectory
Import-Module Centrify.DirectControl.PowerShell
$user = Get-ADUser -Identity Lisa.Simpson  # substitute for your user
$cont = "cn=zones,ou=unix,dc=centrify,dc=vms"  # substitute for your container DN
$zone = New-CdmZone -Name "Yubikey-Demo" -Container $cont

$criteria1 = New-CdmMatchCriteria -Description "Disk Management - Direct" -FileType "msc" -FileName "diskmgmt.msc" -Argument " "   -Path "C:\Windows\System32\"
$criteria2 = New-CdmMatchCriteria -Description "Disk Management - MMC" -FileType "exe" -FileName "mmc.exe" -Argument "C:\Windows\system32\diskmgmt.msc"  -Path "C:\Windows\System32\"
$cmd1 = New-CdmApplicationRight -Zone $zone -Name "Disk Management Combo" -MatchCriteria @($criteria1, $criteria2) -RunasSelfGroups "Builtin\Administrators" -RequirePassword $true
$desktop1 = New-CdmDesktopRight -Zone $zone -Name "Admin Desktop" -RunasSelfGroups "Builtin\Administrators" -RequirePassword $true

$role = New-CdmRole -Zone $zone -Name "Demo Role" -WinSysRights remote
Add-CdmApplicationRight -Right $cmd1 -Role $role 
Add-CdmDesktopRight -Right $desktop1 -Role $role

New-CdmRoleAssignment -Zone $zone -Role $role -TrusteeType ADUser -ADTrustee $user | Out-Null

To perform the steps for the script above manually
Create the Zone

1. Open Access Manager and right-click Zones > Create New Zone
   Name:  Yubikey-Demo
   Container:  Browse to your container.
2. Press Next and Finish

Create the Disk Management Application

1. Launch Disk Management (e.g. Start > Run > diskmgmt.msc)
2. Open Access Manager > Open they Yubikey-Demo zone > Authorization > Windows Right Definitions > Right Click Applications > New Windows Application
   Name: Disk Management ComboMatch Criteria:  Press Add > Import Process and Select Disk Management and Press OK
   
   Press Add > Import File > Browse to c:\Windows\System32 and select diskmgmt.msc, press OK.
   This will add another way to launch the application.
   RunAs:  Self with added group privileges > Press Add Builtin Groups > Select Administrators, press OK and check the box for Authentication Required and press OK.
   

Create the Admin Desktop Right

1. In Access Manager > Open they Yubikey-Demo zone > Authorization > Windows Right Definitions > Right Click Desktops > New Windows Desktop
   Name: Admin Desktop
   Runas:  Press Add Builtin Groups > Select Administrators, press OK and check the box for Authentication Required and press OK.
   

Create, Configure and Assign the Demo role
 In Access Manager > Open they Yubikey-Demo zone > Authorization > Right Click Role Definitions > Select Add Role

1. Name:  Demo Role
   System Rights:  "Remote Login is allowed"  <  this will allow the user only to access via RDP
2. Press OK and right-click the newly created role and select "Add Right"
   
3. The role is ready to be assigned.  Now press OK and right-click the Authorization > Role Assignments > Select Assign Role
4. Press the Add AD account > type the name of your test user, select it and press OK.
   
   Note: This is a permanent direct assignment to a user principal at the zone level.  This is not the best practice, typically you grant role assignments temporarily (for attestation), in a subset of systems and to AD groups for better administration.

 Install DirectAuthorize for Windows and join the system to the Centrify Zone

1. In your domain-joined test systems, browse to the path for the Centrify Standard Edition software.
2. Go to  Agent > and Run "Centrify Windows Agent.exe"
3. Follow the Wizard, you will select the "Access" components.  If you have DirectAudit, also select Audit.
   
4. When the installation ends, you need to configure the client to join your desired zone.
   
5. The system will ask to reboot when complete.

Important Notes:

• When a Windows system is added to the Centrify Zone, the security model changes.
• In order to access a Centrified Windows system, users must be explicitly granted logon rights.  This means that even Domain Admins won't be able to access those sytsems.
• The type of access is based on the Windows setup (Remote/Log on Locally) and the Centrify Role definition (Console/Remote)
• When adding your first system to a zone, you will have an opportunity to explicitly add Domain Admins, otherwise you may completely lock the system
  

Configure your Test user for Smart Card Authentication

1. In Active Directory Users and Computers, find and double-click the test user.
2. Account Tab > Account Options > Check the box for "Smart Card is required for interactive logon"
   
3. Press OK

 You are ready to start testing.

Test Plan:

1. Try to access the system with any other AD user than test user - expected result:  Access Denied
   This is because users need to be explicitly be granted access using a Centrify role.
   
2. Try to access the system with Lisa with her password - expected result:  Access Denied
   This is because the test user was defined with "Smart card required for interactive logon"
   
3. Try to access the system via the console with Smart Card - expected result:  Access Denied
   This is because the role created in Centrify does not grant console login.
4. Try to access the system via RDP with smart card PIN - expected result:  Access Granted
5. Try to run application "disk management" normally - expected result:  Error: "You don't have access rights to logical Disk Manager on [Server]"
   
   This is because when the user launches the app, they are doing so without any privileges.
6. Launching App or Privileged Desktop:
   Right click App > Run with Privilege >  Challenge with Password - Expected result:  Access Denied
   
   Right click App > Run with Privilege >  Challenge smart card PIN - Expected result:  Access Granted

 Video Playlist