Centrify Express is an Active Directory based authentication and single sign-on to cross-platform systems. It used to integrate Linux and Mac systems with Windows. Centrify Express installs a program called the DirectControl agent on a UNIX system so that computer can be a managed system and can be joined to Active Directory in the same manner as a Windows computer. When a computer is managed by DirectControl agent and connected to a domain, all users and groups defined in Active Directory for the forest automatically become valid users and groups on the UNIX machine unless configured to deny or allow specific users or groups access. These users can perform the following common tasks:

1. Centrify Express For Mac Smart Card
2. Centrify Express For Mac Smart Card

• Log on to the UNIX shell or desktop program and use standard programs and services such as telnet, ssh, and ftp.

Centrify Corporation, the leading provider of security and compliance solutions that centrally control, secure and audit access to cross-platform systems, mobile devices and applications, today announced. Centrify Express is a free software for integrating UNIX, Linux and macOS systems and users with Microsoft Active Directory that provides the ability to join a domain and authenticate users. Express is based on the vendor`s enterprise product Centrify Suite. Note: Support for Centrify Express for Mac has ended as of May 1, 2019. Install the Centrify Suite:./install-express.sh Don’t allow the installer reboot your system, do so after completing the other tasks in this document. Note that the Centrify OpenSSH package will replace your default SSH package. I opted to install it because of the ease of managing which Active Directory users and groups can login via SSH 8. Login to the Mac with an account that has administrative privileges. Insert the thumb drive and copy the CentrifyDC‐5.1.3‐mac10.7.dmg file to the desktop. Double click the CentrifyDC‐5.1.3‐mac10.7.dmg file to open the Centrify for Mac OS X NOTE: The Centrify screen will present two options. Jan 18, 2021 Centrify Express gives you free Active-Directory integration and single sign-on for Linux and OS X. You may want to check out more Mac applications, such as Centrify, Express DigiBooks or Dragon Express, which might be related to Centrify Express.

• Log on to a computer that is disconnected from the network or unable to access Active Directory, if they have successfully logged on and been authenticated by Active Directory previously.

• Manage their Active Directory passwords directly from the UNIX command line, provided they can connect to Active Directory.

Centrify Express consists of:

DirectControl Express
Joins Linux and Mac systems to Active Directory, giving users multi-platform single sign-on

DirectManage Express
Automates discovery, readiness, and deployment of Express agent for easy integration with Active Directory

Centrify-Enabled Open Source Tools
Use our free, enhanced versions of OpenSSH, PuTTY and Samba for painless integration

Installation.

DirectControl Express installation steps are simple:

1. On the Linux computer, log on as root.
2. If necessary, unzip the centrify-suite archive file.
3. Run the install-express.sh command to install the Express Agent and Centrify-enabled

./install-express.sh

The installation script begins by running the adcheck program to check the operating system, disk space, DNS resolution, network connectivity, Active Directory configuration and other requirements on the computer. If you receive errors or warnings, see the DirectControl Express Administrator’s Guide for information on how to correct them.

When you run the installation script, answer the prompts as follows:

How do you want to proceed? (E|S|X|C|Q) [X]: X

Type X (the default) for Express Mode. For most of the prompts, you can accept the default value by pressing Enter.

Be certain to specify Yes when prompted to join a domain. For an Express installation, the script automatically joins a computer in unlicensed mode. If you manually join a domain after installation, you must manually turn off licensed features. This process is covered in the Centrify DirectControl Express Administrator’s Guide.

Once installed the users can enter their username in the form that they are most comfortable with, saving time and not requiring them to remember or type a domain name. All of these examples work equally well:

• user.name
• user name
• user.name@domain.com
• domain.comuser.name

One of my favorite features other than the single login, is that you can authenticate Active Directory users accessing Samba shares at add an easier way to add users, keep track of who has access.

Centrify Express supports the following Operating Systems:

Linux

CentOS Linux: 3.8, 3.9, 4.4, 4.6, 4.7, 4.8, 5, 5.1, 5.2, 5.3, 5.4, 5.5 (32-bit & 64-bit)
Citrix XenServer: 4, 4.1, 5 (32-bit)
Debian: 3.1, 4, 5 (32-bit & 64-bit)
Mandriva Linux One: 2008, 2009, 2009.1, 2010, 2010.1 (32-bit)
Novell SUSE Linux: Server 8, 9, 10, 11 (32-bit); Desktop 9.2, 9.3, 10, 11 (32-bit)
Novell SUSE Linux PPC: 9, 10, 11 (64-bit)
Novell SUSE Linux Itanium: 9, 10, 11 (64-bit)
OpenSUSE Linux: 10.1, 10.2, 10.3, 11, 11.1, 11.2 (32-bit)
OpenSUSE Linux: 10.1, 10.2, 10.3, 11, 11.1, 11.2 (64-bit)
Oracle Enterprise Linux: 4, 5 (32-bit & 64-bit)
Red Hat Enterprise Linux: 3, 4, 4.8, 5, 5.1, 5.2 ,5.3, 5.4, 5.5 (32-bit & 64-bit)
Red Hat Enterprise Linux Itanium: 4, 4.8, 5, 5.1, 5.2, 5.3, 5.4, 5.5
Red Hat Fedora: 4, 5, 6, 7, 8, 9, 10, 11, 12, 13 (32-bit & 64-bit)
Scientific Linux: 3.0.8, 3.0.9, 4.4, 4.5, 4.6, 4.7, 4.8, 5, 5.1, 5.2, 5.3, 5.4, 5.5 (32-bit & 64-bit)
Ubuntu: 6.06 LTS, 7.04, 7.10, 8.04 LTS, 8.10, 9.04, 9.10, 10.04 LTS x86 (32-bit & 64-bit)
VMWare ESX Server: 3.0, 3.0.1, 3.0.2, 3.5 (32-bit)
VMWare ESX Server: 4 (64-bit)

MAC

Apple Mac OS X: 10.4.5+, 10.5.3+ on PPC, 10.4.5+, 10.5.3+ on Intel (32-bit)

Apple Mac OS X: 10.6 on Intel (32/64-bit)

There is a Centrify Suite that has more functionality but at a price. The Centrify Express is free and accomplishes exactly what I was looking for. If you want to intregrate Active Directory authentication into you Linux, Unix, or Mac machines check out Centrify Express it may be just what you are looking for. You can get more information at their website: www.centrify.com/default.asp

Background

Planning

• Centrify SMEs:
• Security Lead: The security lead can answer questions like these:
  a) What servers require step-up authentication for login?
  b) What users will be challenged for Multi-factor at login?
  c) What users will have the rights to log in without multi-factor or for troubleshooting purposes?
• IT/AD Infrastructure lead: This SME will help setting up a Windows Server to act as the cloud connector

• Active Directory
• A supported Centrify Express OS with Centrify DirectControl 5.3.1
• A Centrify Identity Service tenant (you can sign-up for a trial here) with a Cloud Connector
  Cloud Connectors run on 64-bit Windows Servers and require outbound HTTPS connectivity (can be behind a proxy)
• A user with a supported MFA or step-up method (Phone Number, Mobile Number (for SMS), Centrify Mobile Authenticator for Push MFA, OATH OTP (Google Authenticator, FreeOTP, YubiKey, DUO, etc).
• If using Centrify Mobile Authenticator or Google Authenticator you'll need an iOS or Android device

• adclient.legacyzone.mfa.enabled: This parameter turns on MFA and it is set to false by default.
• adclient.legacyzone.mfa.cloudurl: This is the Centrify Identity Service tenant URL that is configured to grant MFA to the system.
• adclient.legacyzone.mfa.required.groups (or users): These parameters specify which users (or members of the AD group) that will be challenged for multi-factor on login.
• adclient.legacyzone.mfa.rescue.users: These are the users that can access the system in case no tunnel can be established with the MFA service.

• adclient.cloud.connector: This parameter can be used to specify a proxy server if in use.

Implementation

1. In Cloud Manager, navigate to Settings > Network > Cloud Connectors
2. Click the 'Add Cloud Cloud Connector'
   
3. Download the bits and run setup. All you need is the cloud connector componetn.
4. You have to authorize the Cloud Connector following the steps on the wizard. Refer to the link below for a video detailed steps.

1. Role Creation
   Create a role that has the 'Server Login and Privilege Elevation' right and contains the computer accounts that will be requiring multifactor authentication.
   Cloud Manager > Roles > New Role > [Rights and Members]
   
2. Authentication Profile
   Create an authentication profile that specifies the MFA methods to be used.
   Cloud Manager > Settings > Authentication > Authentication Profiles
   Notes: It is important to make the distinction between step-up authentication and multi-factor authentication (sometimes used interchangeably). In addition to the login password challenge, an e-mail link delivered to your inbox qualifies as step-up, but Push MFA from a registered mobile device (something you have).
   Note that I've left out password and user-defined security question. Checking password will re-prompt the user for their AD password and the answer to a security question is just another secret that can be obtained by social-engineering.
3. Set up an Authentication profile for Server Suite Authentication
   Cloud Manager > Settings > Authentication Profiles > Server Suite Authentication
   For Centrify Express, only the Access Profile applies.
4. Verification of Methods
   Make sure your users have the step-up methods populated in AD:
   If looking to provide Step-up via email, the user has to have a valid e-mail address. For phone call, phone/mobile are required, for SMS mobile is required.

Verification

Centrify Express For Mac Smart Card

Centrify Express For Mac Smart Card

Enhancements

Video Playlist