Active Directory (on-premises)

How it works

People sign in to Cloudraw Connect with their normal Windows domain username and password. Cloudraw checks the password against your domain controller (DC) through the Cloudraw connector that already runs in your network. The connector only makes outbound connections, so you do not open any port to the internet and your DC is never exposed.

After the AD password, Cloudraw sends a one-time code to the e-mail address in the user's AD account. The user types it to finish signing in. See Two-factor authentication.

Before you start

Prepare Active Directory

1. Create the service account

1. Create a dedicated userIn Active Directory Users and Computers, create a user such as svc-cloudraw. Give it a long random password (25+ characters).
2. Keep it unprivilegedLeave it only in Domain Users. It needs to read users and groups, which every authenticated domain user can do by default. Do not add it to Domain Admins or any admin group.
3. Lock it downTick Account is sensitive and cannot be delegated. Optionally use Log On To to stop it from signing in to workstations interactively.
4. Note its nameCloudraw accepts a DN (CN=svc-cloudraw,OU=Service Accounts,DC=corp,DC=local), a UPN (svc-cloudraw@corp.local) or CORP\svc-cloudraw.

2. Create the sign-in group

Create a security group such as Cloudraw Users and add the people who should use Cloudraw. Copy its distinguished name. In Active Directory Users and Computers, turn on View→Advanced Features, open the group, and copy distinguishedName from the Attribute Editor tab. In PowerShell you can run:

3. Check that LDAPS works (recommended)

LDAPS needs a certificate on the DC, usually issued by your AD Certificate Services or another CA. From the connector machine you can test the port:

If the DC's certificate comes from your own internal CA, export that CA's certificate in Base-64 (PEM) format. You will paste it into Cloudraw so it can verify the DC.

Connect Active Directory in Cloudraw

1. Open the settingsIn the Cloudraw admin console go to Settings→Active Directory. You can also get there from onboarding step 3, Sign-in for your users, by choosing Active Directory.
2. Fill in the formUse the table below.
3. SaveClick Save. The service account password is stored encrypted and is never shown again.
4. TestRun the connection test and read the result. See The connection test.

The connection test

The test runs step by step and stops at the first problem. Each step reports passed, failed or not run. You can run it up to 20 times an hour.

When all steps pass, the status changes to Connected and Active Directory sign-in is ready for your users.

How your users sign in

1. Open Cloudraw ConnectThey choose Sign in and type your workspace name.
2. Enter the AD username and passwordA browser window opens. They enter the username in the form you chose (for example jsmith) and their normal Windows password.
3. Enter the e-mail codeCloudraw e-mails a one-time code to the address in their AD account. They type it in the browser.
4. DoneThe computer is registered to that person. Depending on your device trust settings it may have to be trusted before it can reach anything. See Install Cloudraw Connect.

Send your users the guide Install Cloudraw Connect and enroll your computer together with your workspace name.

Domain and workgroup computers in access rules

Every computer running Cloudraw Connect reports whether it is joined to an AD domain. In an access rule you can use this as a device condition:

• Any: the computer type does not matter.
• Domain computers: only computers joined to your domain.
• Workgroup computers: only computers that are not joined to a domain. Computers joined only to Microsoft Entra ID or managed only by an MDM count as workgroup computers.
• Domain or workgroup: either kind, as long as the computer has reported it.

For example, allow the accounting app only from domain computers, and allow the file share from both.

Security recommendations

• Use LDAPS (port 636), or at least StartTLS. Plain LDAP sends the service account and user passwords unencrypted between the connector and the DC. The traffic stays inside your network, but it should still be encrypted.
• Least privilege. The service account only reads. Keep it out of every admin group and use it for nothing else.
• Rotate the service account password on your normal schedule, for example every 6 to 12 months, and when an admin who knew it leaves. Change it in AD first, then enter the new password in Settings→Active Directory, save, and run the test.
• Keep the sign-in group small. Add only people who need remote access, and remove leavers as part of offboarding.
• Make sure every user has a correct e-mail address in AD. The sign-in code goes there. A wrong address means someone else's inbox receives the code.
• Run two connectors that can reach a DC, so sign-in keeps working when one machine is down for maintenance.

Troubleshooting

To disconnect Active Directory, remove the configuration in Settings→Active Directory. Cloudraw deletes the private path through your connector.