From 6b3c8639b991c593d56f1bc954625fdde961c0a0 Mon Sep 17 00:00:00 2001 From: Alejandro Rosales Date: Tue, 27 Jan 2026 03:11:20 +0000 Subject: [PATCH] =?UTF-8?q?A=C3=B1adir=20Just-In-Time=20(JIT)=20user=20pro?= =?UTF-8?q?visioning=20into=20Active=20Directory?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...ser provisioning into Active Directory.-.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 Just-In-Time %28JIT%29 user provisioning into Active Directory.-.md diff --git a/Just-In-Time %28JIT%29 user provisioning into Active Directory.-.md b/Just-In-Time %28JIT%29 user provisioning into Active Directory.-.md new file mode 100644 index 0000000..9c6c96e --- /dev/null +++ b/Just-In-Time %28JIT%29 user provisioning into Active Directory.-.md @@ -0,0 +1,18 @@ + + +

That flow is technically valid, but it’s important to be very precise about what is being authenticated, when, and with which security guarantees. I’ll break it down rigorously and then tell you when it’s a good idea and when it’s a trap.

Proposed flow (restated precisely)

PC
+ → HTTP Auth Service (username/password)
+ → Service validates credentials
+ → Service creates / updates user in LDAP (AD)
+ → PC authenticates user against LDAP
+ → Windows session is considered authenticated
+

This is essentially “AD as a just-in-time identity cache”.

1. Is this possible?

Yes. Windows + AD fully support this pattern.

This is known as:

Just-In-Time (JIT) user provisioning into Active Directory

It is used in:

2. What “PC is authenticated” actually means (critical)

There are three different authentication layers that people often conflate:

+Layer | Meaning +-- | -- +Windows logon | LSASS validates credentials (Kerberos/NTLM) +Identity authority | Who decides the user is legit +Authorization | What the user is allowed to do + +

Your flow makes this true:

✔ Windows logon is authenticated by AD
✔ Identity authority is your HTTP service
✔ Authorization comes from AD groups / GPO

That separation is clean and valid.

3. How this is implemented correctly

Step A — External auth (HTTP)

At this point, Windows is NOT logged in yet.

Step B — JIT provisioning into LDAP / AD

Your service:

This must be done using:

Step C — Windows logon (real authentication)

Now Windows:

At this moment:

The PC is cryptographically authenticated by AD

4. Advantages of this model

This is the strongest model you’ve discussed so far.

You gain:

✔ Native Windows logon
✔ Kerberos / NTLM
✔ User-based GPO
✔ NTFS ACLs
✔ Full auditing (who did what)
✔ No local users
✔ No kiosk hacks

This is enterprise-grade.

5. The hidden costs (very important)

⚠️ 1. You are now running an Identity Bridge

This is not trivial.

You must handle:

⚠️ 2. Password handling risk

You now:

This increases:

A breach here is catastrophic.

⚠️ 3. Kerberos timing & replication

If:

Then:

Mitigation:

⚠️ 4. Account lifecycle management

You must define:

Otherwise AD becomes polluted.

6. When this architecture is the RIGHT choice

This model is ideal if:

✔ You need real Windows sessions
✔ You need per-user ACLs
✔ You need full audit trails
✔ Users are semi-persistent
✔ You can operate AD securely

Typical environments:

7. When this is the WRONG choice

Avoid this if:

❌ Users are ultra-ephemeral (minutes only)
❌ You want zero password handling
❌ You don’t need per-user ACLs
❌ You want kiosk-style behavior

In those cases:
➡ Computer-only AD + external auth is cleaner.

8. Best-practice refinements (recommended)

🔐 Use random AD passwords

⏱ Use account expiration

🧱 Use dedicated OU

9. Architectural verdict

Yes — this is a correct, professional, enterprise-grade design, but:

It is identity infrastructure, not “just glue code”.

If implemented sloppily, it becomes a security nightmare.
If implemented correctly, it’s the best possible solution.

If you want next-level help

I can:

Tell me:

  1. Are users persistent or ephemeral?

  2. Single DC or multiple?

  3. Password storage allowed or forbidden?

  4. Windows Pro or Enterprise?

Then we go from possible → correct.

+ + \ No newline at end of file