Directory Sync Pro for Active Directory 20.11.2 - Requirements and Installation Guide

Additional Information

Microsoft SQL Server 2012 Database Security Technical Implementation Guide (stigviewer.com)

Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide (stigviewer.com)

MS SQL Server 2016 Instance Security Technical Implementation Guide (stigviewer.com)

MS SQL Server 2016 Database Security Technical Implementation Guide (stigviewer.com)

Directory Sync Pro for Active Directory 20.11.2 can be successfully deployed in a FIPS environment by following the procedure described in this document.

The audience for this section is technical implementation consultants deploying Directory Sync Pro for Active Directory.

Appendix D. Deployment in FIPS Environment

Additional Information

Microsoft SQL Server 2012 Database Security Technical Implementation Guide (stigviewer.com)

Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide (stigviewer.com)

MS SQL Server 2016 Instance Security Technical Implementation Guide (stigviewer.com)

MS SQL Server 2016 Database Security Technical Implementation Guide (stigviewer.com)

Directory Sync Pro for Active Directory 20.11.2 can be successfully deployed in a FIPS environment by following the procedure described in this document.

The audience for this section is technical implementation consultants deploying Directory Sync Pro for Active Directory.

Cryptographic usage

Directory Sync Pro for Active Directory relies on the following Third-Party cryptographic libraries for its cryptographic needs.

Background

To execute in a FIPS compliant mode, a Windows environment requires the Microsoft Policy “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing” setting enabled.

Microsoft states that “This policy is only advisory to applications. Therefore, if you enable the policy, it does not make sure that all applications will comply”.

Directory Sync Pro for Active Directory leverages Microsoft’s CryptoAPI (CAPI) and CryptoAPI Next Generation (CNG) for its cryptographic needs.

Microsoft Product Relationship with CNG and CAPI libraries is documented here: https://technet.microsoft.com/en-us/library/cc750357.aspx

“Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services.