Ad Client For Mac

Mac OS X Active Directory, Group Policy & Single Sign-On. ADmitMac ® turns a Mac into a true Active Directory client. Today, a decade after becoming the world's first non-Windows Active Directory integration product, ADmitMac is a one-stop solution for Mac-Windows management and security needs, ensuring compliance with standards such as SOX, PCI DSS, FFIEC, HIPAA or HITEC. Detection of and access to extended schema: If the Active Directory schema has been extended to include macOS record types (object classes) and attributes, the Active Directory connector detects and accesses them. For example, the Active Directory schema could be changed using Windows administration tools to include macOS managed client attributes.

Remote Desktop Client Mac
Ad Client For Mac Os

Authenticating or identifying Apple users for user or group-based filtering

Article Number: 000005102
Products: Forcepoint URL Filtering, Forcepoint Web Security, TRITON AP-WEB, Web Filter & Security, Web Security Gateway, Web Security Gateway Anywhere, Web Security and Web Filter
Version: 8.5, 8.4, 8.3, 8.2, 8.1, 8.0, 7.8, 7.7
Last Published Date: September 18, 2020

Problem Description

What configuration steps are needed to authenticate or identify users of Apple computers, IPhones, and iPads for user- or group-based filtering?

Resolution

The authentication or identification of Mac and iPhone/iPad users for user or group-based filtering is possible. However, Mac computers and iPhone/iPad devices use significantly different operating systems and therefore, configuration is explained as separate sections in this article. This article also includes an FAQ section below.

Mac computers

Limitations:

Authentication and identification require that the mac users belong to an Active Directory.
Protocol block messages cannot be displayed on Macs.
Remote Filtering Client and Web Endpoint are not supported on certain Mac OS X systems.

If your organization uses DC Agent for transparent user identification, see Enabling transparent identification of Mac users with DC Agent below.

If your organization uses Content Gateway to authenticate users, see Authenticating Mac users with Content Gateway below.

Manual authentication can also be used to enable user and group-based filtering of Mac users, provided the mac book is joined with your domain.

iPhones and iPads

User identification through DC Agent is not supported. Filtering can be provided to those devices based on source IP address or network range.
Proxy-based manual user authentication is supported and user or group-based filtering is possible.
Transparent authentication is not supported.

Content Gateway manual user authentication has the following features and restrictions:

Users must belong to the associated user directory.
Supports the Safari browser. Other browsers may not work as expected.
The user is always prompted for credentials.
Works in transparent proxy and explicit proxy (Content Gateway) deployments.
Many iPhone and iPad apps do not work well with Content Gateway (or any Web proxy) because they are not well programmed to handle proxy user authentication.

Explicit proxy settings can be configured in the iOS Network settings area.

Enabling transparent identification of Mac users with DC Agent.

NOTE: The following instructions are valid for v8.3 and earlier. With v8.4 and later, Mac users must be domain users in Windows Active Directory but no further set up is required.
If the Mac user logs on to the machine with domain credentials without mounting a file share as stated below, DC Agent will not identify the user. In order for DC Agent to identify the user on a Mac workstation, one of the following options will need to be completed.

Configure the Mac to use a file share on the domain controller machine as the user’s home directory.
1. On the MacOS X, click System Preferences > Accounts > Network account server > Join > Open Directory Utility.
2. Make sure the active directory is enabled.
3. Click the pencil icon enable Use UNC path from Active Directory to derive network home location.
Mount a windows file share hosted in the domain controller onto the Mac computer. Enable that file share to reconnect at logon. Refer to Apple documentation for the detailed procedure.

Configuration summary:

Ensure that each participating Mac user is a member of a common Active Directory. See your Active Directory documentation.
Create a home folder for each Mac user, and make sure that it is accessible to the user.

When the user logs on to the properly configured MacOS X system, the Mac mounts a network directory as the user’s home directory. Then the DC Agent user map is populated and user and group-based policies can be applied to user requests. When requests are blocked, browser-based block pages are displayed normally.

Authenticating Mac users with Content Gateway

Content Gateway is the web proxy component of Forcepoint Web Security.

Using the Integrated Windows Authentication feature of Content Gateway, Mac users can be transparently authenticated when the user is a member of an Active Directory domain and the Mac computer is joined to the Active Directory domain.

Configuration summary:

Ensure that each Mac computer is joined to the Active Directory domain. (See Typical steps for joining a Mac to an Active Directory domain)
Ensure that each participating Mac user is a member of a common Active Directory. See your Active Directory documentation.
Ensure that the Content Gateway is joined to the Active Directory domain.

NoteIf Content Gateway is not configured for Integrated Windows Authentication, open the Integrated Windows Authentication online help document. Apply the configuration instructions. If Content Gateway is already configured for Integrated Windows Authentication and your Mac users belong to the currently joined domain, there is nothing to do.

If Content Gateway is already configured for Integrated Windows Authentication and your Mac users belong to a different Active Directory domain, use the Rule-based Authentication method.

If Content Gateway is a transparent proxy, no additional Mac system or browser configuration is required.
Safari users may be prompted for credentials the first time they use their browser. They should enter their credentials and select the Remember password in keychain box. They should not be prompted again.

Typical steps for joining a Mac to an Active Directory domain

Using an account with Administrator privileges, log on to the Mac computer you want to join to an Active Directory domain.
Open the Directory Utility. On MacOS X, click system preferences > accounts > Network account server > Join > Open Directory Utility.
Select the box next to Active Directory to enable Active Directory support.

Highlight Active Directory and click the pencil icon to configure the Active Directory connection.
Under Domain, enter the Fully Qualified Domain Name (FQDN).
Under Computer ID, enter the computer name.

Click Bind. You are prompted for network credentials and a computer OU.
Type the OU admin account and password, and the computer OU location. For example:

Your machine will be bound to the specified Active Directory.

Click Apply in the Directory Utility to save your changes and restart the machine.

FAQs

Q: What Websense Web Security functionality is supported?
A: Monitoring, logging, and blocking of Internet requests. Note that protocol block messages cannot be displayed when users are prevented from accessing non-browser-based information (for example, chat tools or streaming media players). The requests are blocked as expected, but no explanatory message is displayed.
Q: Do Mac computers provide Websense log entries for normal logging and reporting?
A: Yes.
Q: What user identification and authentication methods work for users on Mac OS X systems?
A: Manual authentication, DC Agent transparent identification for macbook only, and Content Gateway Integrated Windows Authentication (Kerberos with Active Directory) work correctly on Macs for end-user identification and authentication.
Q: If an organization is using Macs within a Windows-based network, will DC Agent or Logon Agent work correctly for transparent user identification?
A: DC Agent can identify users on Mac clients. See Enabling transparent identification of Mac users with DC Agentfor details. Logon Agent is supported in Microsoft AD environment, however, it does not work with Mac clients running the Websense logon app versions prior to 8.x. Forcepoint 8.x supports logon Agent for different MacOS versions.
keywords:
mac; apple; safari; iphone; user identification; deployment; kerberos; dcagent; domain; AD; ipad; transparent; xid; logon agent

NOTE:

Between mid October 2019 and mid February 2020 everyone in the Army was migrated to use their PIV Authentication certificate for Email access. You no longer use the Email certificate for Enterprise Email or any CAC enabled websites

Mac users who choose to upgrade (or already have upgraded) to Mac OS Catalina (10.15.x) will need to uninstall all 3rd Party CAC enablers per https://militarycac.com/macuninstall.htm AND reenable the built in smart card ability (very bottom of macuninstall link above)

If you purchased your Mac with OS Catalina (10.15.x) already installed, you can skip the uninstall part above and follow the instructions below.

6 'high level' steps needed, follow down the page to make this a painless systematic process

1.	Is your CAC reader 'Mac friendly'?
2.	Can your Mac 'see' the reader?
3.	Verify which version of Mac OS you have
4.	Figure out which CAC (ID card) you have
5.	Install the DoD certificates
5a.	Additional DoD certificate installation instructions for Firefox users
6.	Decide which CAC enabler you want to use (except for 10.12-.15)

Step 1: Is your CAC reader Mac friendly?

Visit the USB Readers page to verify the CAC reader you have is Mac friendly.

Visit the USB-C Readers page to verify the CAC reader you have is Mac friendly.

'Some, not all' CAC readers may need to have a driver installed to make it work.

NOTE: Readers such as: SCR-331 & SCR-3500A may need a firmware update (NO OTHER Readers need firmware updates).

Information about these specific readers are in Step 2

Step 2: Can your Mac 'see' the reader?

Plug the CAC reader into an open USB port before proceeding, give it a few moments to install

Step 2a: Click the Apple Icon in the upper left corner of the desktop, select 'About This Mac'

Step 2b: Click 'System Report...' (button)

Step 2c: Verify the CAC reader shows in Hardware, USB, under USB Device Tree. Different readers will show differently, most readers have no problem in this step. See Step 2c1 for specific reader issues.

Step 2c1: Verify firmware version on your SCR-331 or GSR-202, 202V, 203 CAC, or SCR-3500a reader. If you have a reader other than these 5, Proceed directly to step 3

Step 2c1a-SCR-331 reader

If your reader does not look like this, go to the next step.

In the 'Hardware' drop down, click 'USB.' On the right side of the screen under 'USB Device Tree' the window will display all hardware plugged into the USB ports on your Mac. Look for “SCRx31 USB Smart Card Reader.” If the Smart Card reader is present, look at 'Version' in the lower right corner of this box: If you have a number below 5.25, you need to update your firmware to 5.25. If you are already at 5.25, your reader is installed on your system, and no further hardware changes are required. You can now Quit System Profiler and continue to Step 3.

Step 2c1b-SCR-3500A reader

If you have the SCR3500A P/N:905430-1 CAC reader,you may need to install this driver, as the one that installs automatically will not work on most Macs. Hold the control key [on your keyboard] when clicking the .pkg file [with your mouse], select [the word] Open

Step 3: Verify which version of MacOS do you have?

(You need to know this information for step 6)

Step 3a: Click the Apple Icon in the upper left corner of your desktop and select 'About This Mac'

Step 3b: Look below Mac OS X for: Example: Version 10.X.X.

Step 4: Figure out which CAC (ID Card) you have

(You need to know this information for step 6)

Look at the top back of your ID card for these card types. If you have any version other than the six shown below, you need to visit an ID card office and have it replaced. All CACs [other than these six] were supposed to be replaced prior to 1 October 2012.

Find out how to flip card over video

Step 5: Install the DoD certificates (for Safari and Chrome Users)

Go to Keychain Access

Click: Go (top of screen), Utilities, double click Keychain Access.app

(You can also type: keychain access using Spotlight (this is my preferred method))

Select login (under Keychains),and All Items (under Category).

Download the 5 files via links below (you may need to <ctrl> click, select Download Linked File As... on each link) Save to your downloads folder

Please know... IF You have any DoD certificates already located in your keychain access, you will need to delete them prior to running the AllCerts.p7b file below.

Remote Desktop Client Mac

https://militarycac.com/maccerts/AllCerts.p7b,

https://militarycac.com/maccerts/RootCert2.cer,

https://militarycac.com/maccerts/RootCert3.cer,

https://militarycac.com/maccerts/RootCert4.cer, and

Double click each of the files to install certificates into the login section of keychain

Select the Kind column, verify the arrow is pointing up, scroll down to certificate, look for all of the following certificates:

DOD EMAIL CA-33 through DOD EMAIL CA-34,

DOD EMAIL CA-39 through DOD EMAIL CA-44,

DOD EMAIL CA-49 through DOD EMAIL CA-52,

DOD EMAIL CA-59,

DOD ID CA-33 through DOD ID CA-34,

DOD ID CA-39 through DOD ID CA-44,

DOD ID CA-49 through DOD ID CA-52,

DOD ID CA-59

DOD ID SW CA-35 through DOD ID SW CA-38,

DOD ID SW CA-45 through DOD ID SW CA-48,

DoD Root CA 2 through DoD Root CA 5,

DOD SW CA-53 through DOD SW CA-58, and

DOD SW CA-60 through DOD SW CA-61

NOTE: If you are missing any of the above certificates, you have 2 choices,

1. Delete all of them, and re-run the 5 files above, or

2. Download the allcerts.zip file and install each of the certificates you are missing individually.

Errors:

Error 100001 Solution

Error 100013 Solution

You may notice some of the certificates will have a red circle with a white X . This means your computer does not trust those certificates

You need to manually trust the DoD Root CA 2, 3, 4, & 5 certificates

Double click each of the DoD Root CA certificates, select the triangle next to Trust, in the When using this certificate: select Always Trust, repeat until all 4 do not have the red circle with a white X.

You may be prompted to enter computer password when you close the window

Once you select Always Trust, your icon will have a light blue circle with a white + on it.

The 'bad certs' that have caused problems for Windows users may show up in the keychain access section on some Macs. These need to be deleted / moved to trash.

The DoD Root CA 2 & 3 you are removing has a light blue frame, leave the yellow frame version. The icons may or may not have a red circle with the white x

or	DoD Interoperability Root CA 1 or CA 2	certificate
DoD Root CA 2 or 3 (light blue frame ONLY)	certificate
or	Federal Bridge CA 2016 or 2013	certificate
or	Federal Common Policy CA	certificate
or	or	SHA-1 Federal Root CA G2	certificate
or	US DoD CCEB Interoperability Root CA 1	certificate

If you have tried accessing CAC enabled sites prior to following these instructions, please go through this page before proceeding

Clearing the keychain (opens a new page)

Please come back to this page to continue installation instructions.

Step 5a: DoD certificate installation instructions for Firefox users

NOTE: Firefox will not work on Catalina (10.15.x), or last 4 versions of Mac OS if using the native Apple smartcard ability

Download AllCerts.zip, [remember where you save it].

double click the allcerts.zip file (it'll automatically extract into a new folder)

Option 1 to install the certificates (semi automated):

From inside the AllCerts extracted folder, select all of the certificates

<control> click (or Right click) the selected certificates, select Open With, Other...

In the Enable (selection box), change to All Applications

Select Firefox, then Open

You will see several dozen browser tabs open up, let it open as many as it wants..

You will eventually start seeing either of the 2 messages shown next

If the certificate is not already in Firefox, a window will pop up stating 'You have been asked to trust a new Certificate Authority (CA).'

Check all three boxes to allow the certificate to: identify websites, identify email users, and identify software developers

'Alert This certificate is already installed as a certificate authority.' Click OK

Once you've added all of the certificates...
• Click Firefox (word) (upper left of your screen)
• Preferences
• Advanced (tab)
• Press Network under the Advanced Tab
• In the Cached Web Content section, click Clear Now (button).
• Quit Firefox and restart it

Option 2 to install the certificates (very tedious manual):

Click Firefox (word) (upper left of your screen)

Preferences

Advanced (tab on left side of screen)

Certificates (tab)

View Certificates (button)

Authorities (tab)

Import (button)

Ad Client For Mac Os

Browse to the DoD certificates (AllCerts) extracted folder you downloaded and extracted above.

Note: You have to do this step for every single certificate

Note2: If the certificate is already in Firefox, a window will pop up stating: 'Alert This certificate is already installed as a certificate authority (CA).' Click OK

Note3: If the certificate is not already in Firefox, a window will pop up stating 'You have been asked to trust a new Certificate Authority (CA).'

Check all three boxes to allow the certificate to: identify websites, identify email users, and identify software developers

Step 6: Decide which CAC enabler you can / want to use

Only for Mac El Capitan (10.11.x or older)

After installing the CAC enabler, restart the computer and go to a CAC enabled website

NOTE: Mac OS Sierra (10.12.x), High Sierra (10.13.x), Mojave (10.14.x) or Catalina (10.15.x) computers no longer need a CAC Enabler.

Try to access the CAC enabled site you need to access now

Mac support provided by: Michael Danberry