Thycotic Secret Sever Cloud – Distributed Engine

All interaction between the SSC tenant and your on premises network uses our distributed engine service to communicate. The work tasks that distributed engine completes includes Active Directory authentication, password changing, and heartbeat. The machine where the engine is installed must be able to communicate outbound on ports 443 and 9354.

SS Cloud Architecture:

Install the Distributed Engine

1. Navigate to Admin > Distributed Engine

2. Click the Download Engine Installer button for either 64-bit or 32-bit.

   Note: You can install distributed engine on your workstation or laptop for testing purposes, but for production installs, the distributed engine server should be installed on a server. SS uses the distributed engine to communicate with your domain, so if your machine is turned off, users cannot log on with their domain accounts, and heartbeat and remote password changing will fail.

3. Run setup.exe as an administrator to install the engine service. This will install into Thycotic Software Ltd\Distributed Engine.

4. Go to Admin > Distributed Engine.

5. Click Manage Sites.

6. Click Manage New Engines. There should be a new engine available.

7. Click the Assigned Site dropdown list and select Default.

8. Approve it by clicking the check box to the right.

9. Validate the engine’s connectivity:

   1. Go to Admin > Distributed Engine > Manage Sites.

   2. Click the Default site.

   3. Click the Validate Connectivity button to test the communication between the engine and SS. It may take several minutes for the engine to register. If it does not immediately validate wait a few minutes and try again.

Configure Active Directory Integration

Active Directory integration allows users to log in with their domain credentials. Connections to your domain are routed through the distributed engine service running in your network.

1. On the dashboard, create a new Active Directory secret from the create secret widget in the upper right hand corner.

   Note: The domain account should be able to read users and groups from the domain you want to sync. For detailed information on the rights required, please see Active Directory Rights for Synchronization Account (KB).

2. Type the domain, username, and password in the Create Secret form.

3. Save the secret.

4. Navigate to Admin > Active Directory.

5. Click Edit and check the boxes for Enable Active Directory Integration and Enable Synchronization of Active Directory.

6. Click the Save button.

7. Click the Edit Domains button.

8. Click the Create New button.

9. Type your FQDN and a friendly domain name that users will see on the login page.

10. Click Sync Secret to select the secret you just created.

    Note: The domain site is set to default. This means that the Active Directory authentication and synchronization will run through the distributed engine service installed on your network.

    Note: Do not select “Enable Login from AD.” If you do, you cannot set the domain groups later in this instruction.

11. Click the Save and Validate button.

12. Click the Back button.

    

13. Click the Edit Synchronization button. The Synchronization Edit page appears.

14. In the Available Groups list, click each domain group that you want to log on in the SSC instance and click the the < button to move the group to the Synchronized Groups list.

15. Click the Save button.

16. Click the Synchronize Now button to start the user and group synchronization immediately. The synchronization process runs automatically, but to get immediate results, you can start it manually.

Test Heartbeat and Remote Password Changing

from Blogger http://blog.51sec.org/2021/07/thycotic-secret-sever-cloud-distributed.html