Identity Stack Agent

Identity Stack Agent connects Identity Stack to your on-premises Active Directory. You install it on Windows servers in your domain. See Install Identity Stack Agent for the installation procedure.

Services

Identity Stack Agent installs two Windows services on each host:

Service	Account	Function
Identity Stack Agent	LocalSystem	Holds the connection to Identity Stack. Installs updates. Starts and stops the connector.
Identity Stack Agent AD Connector	Your Group Managed Service Account (gMSA)	Reads and changes objects in Active Directory.

The two services communicate through a local named pipe. The pipe is not available on the network. Only LocalSystem can connect to it. The agent service verifies that the connector runs as the configured gMSA.

This design separates the privileges:

• The agent service has no permissions in Active Directory.
• The connector has only the permissions that you give the gMSA. It cannot change the program files, the host key, or the service configuration.

Operations

The agent service accepts only operations from a fixed list. It rejects all other operations. The connector never receives them.

The connector performs these Active Directory operations:

• Read users, their attributes, and organizational units (OUs).
• Set a new password.
• Unlock a locked account.

Each operation uses the permissions of the gMSA. See Grant permissions to the gMSA for the permissions to grant.

Network requirements

Identity Stack Agent makes outbound connections only. It needs no inbound ports.

Destination	Port	Purpose
The control plane URL that you entered at installation, for example api.identitystack.dk	TCP 443 (HTTPS)	Enrollment, authentication, and the connection to Identity Stack
*.service.signalr.net	TCP 443 (HTTPS)	The connection to Identity Stack
identitystacksharedst.blob.core.windows.net	TCP 443 (HTTPS)	Download of updates
Your domain controllers	TCP 636 (LDAPS)	Active Directory operations

The connection to Identity Stack stays open. If the connection breaks, the agent connects again automatically.

Hosts

Install Identity Stack Agent on two or more hosts. Then you can install operating system updates on one host while the other host operates.

One host is the primary host. Identity Stack sends all operations to the primary host. An Identity Stack administrator can make a different host the primary host.

Enrollment and authentication

The installer enrolls the host with an enrollment token:

• The token is valid for one host only.
• The token expires after 7 days.
• The token is not stored on the host.

At enrollment, the agent creates a key pair on the host. The private key cannot be exported. When the host has a TPM 2.0 chip, the TPM stores the key. The agent stores a self-signed certificate with the name Identity Stack Agent in the local computer certificate store (LocalMachine\My). Identity Stack stores only the certificate.

The private key never leaves the host. To authenticate, the agent signs a single-use challenge from Identity Stack with the private key. Identity Stack then issues a session token that is valid for 60 minutes. The agent gets a new session token before the old one expires.

An Identity Stack administrator can disable a host. A disabled host disconnects immediately and cannot get a new session token.

Updates

Identity Stack sends updates to the agent. You do not need to install updates on the host. Before the agent installs an update, it verifies the installer:

• The SHA-256 hash must match the value from Identity Stack.
• The Authenticode signature must be valid.
• The signer must be Identity Stack A/S.

The installer updates both services together. To go back to an earlier version, Identity Stack sends the signed installer of that version.

Logs

Each service writes logs to a logs folder in the installation folder. Only the service accounts and local administrators have access to the logs.