If you want to integrate an ApsaraDB RDS for SQL Server instance with the identity authentication system of your enterprise, you can follow the instructions in this topic to deploy a domain controller server on an Elastic Compute Service (ECS) instance and connect the RDS instance to a self-managed domain. This helps you manage resource permissions and verify identities in a centralized manner.
Background information
Microsoft Active Directory (AD) is a directory service that is provided for specific Microsoft services, such as Windows Server Standard, Windows Server Enterprise, and Microsoft SQL Server. A directory is a hierarchical structure that stores information about the objects on the same LAN. For example, AD stores information about user accounts, such as names, passwords, and phone numbers, and allows other authorized users on the same LAN to access the information.
AD is an important part of the Windows ecosystem. A number of large enterprises rely on the domain control mechanism that is provided by Windows to plan and implement centralized access management. If you migrate all your workloads from an on-premises environment to the cloud or use a hybrid cloud architecture, make sure that the cloud supports AD for global management. AD support is a key factor to determine whether you can migrate on-premises SQL Server databases to the cloud.
ApsaraDB RDS for SQL Server enables you to connect an RDS instance to a self-managed domain to improve your business systems.
After the AD domain feature is enabled and configured, you can create an account by using a self-managed AD domain and grant the account the permissions to log on to your RDS instance and perform operations on the RDS instance.
However, the system admin account or the host account has the permissions that are beyond the management scope of ApsaraDB RDS. The system does not provide the service availability that is specified in Alibaba Cloud service level agreement (SLA) for the RDS instances for which the accounts are created by using a self-managed AD domain. For more information, see SLA.
Prerequisites
The RDS instance meets the following requirements:
The RDS instance belongs to the general-purpose or dedicated instance family. The shared instance family is not supported. For more information, see Instance families.
The billing method of the RDS instance is pay-as-you-go or subscription. Serverless RDS instances are not supported. For more information, see Serverless ApsaraDB RDS for SQL Server instances.
NoteYou can go to the Basic Information page of your RDS instance to view the preceding information.
The logon account is an Alibaba Cloud account.
The RDS instance and the ECS instance that hosts your domain controller server reside in the same virtual private cloud (VPC).
The security group to which the ECS instance belongs is configured to allow access from the private IP address of your RDS instance. For more information, see Add a security group rule.
The private IP address of the RDS instance is allowed by the firewall of the ECS instance. The firewall is disabled by default. If you have enabled the firewall, you must configure the firewall to allow access from the private IP address of your RDS instance.
The domain account that is used belongs to the Domain Admins group because high permissions are required for a client to proactively add a domain.
The domain controller server uses the same IP address as the Domain Name System (DNS) server.
Usage notes
The Windows operating system must be restarted when you add an RDS instance to or remove an RDS instance from the AD domain. To avoid interruptions to ongoing services, we recommend that you perform these operations during off-peak hours.
Limits
If you add your RDS instance to the AD domain, you cannot upgrade the major engine version, update the minor engine version, or migrate the RDS instance across zones. For more information, see Upgrade the major engine version, Update the minor engine version, and Migrate an ApsaraDB RDS for SQL Server instance across zones.
Select a Windows version
You must deploy a domain controller server on an ECS instance that runs Windows Server. The ECS instance must run Windows Server 2012 R2 or later. We recommend that you use Windows Server 2016 or later and select English as the display language. In the following sections, an ECS instance that runs Windows Server 2016 is used to describe how to deploy a domain controller server for an RDS instance.
Step 1: Deploy a domain controller server on an ECS instance
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region and resource group to which the resource belongs.
On the Instances page, find the required ECS instance and click the ID of the ECS instance.
Log on to the ECS instance.
Search for and open Server Manager.
Click Add roles and features and configure the following parameters.
Parameter
Description
Installation Type
Retain default settings.
Server Selection
Retain default settings.
Server Roles
Select Active Directory Domain Services. In the dialog box that appears, click Add Features.
Select DNS Server. In the dialog box that appears, click Add Features. Make sure that your computer uses a fixed IP address. If the IP address dynamically changes, the DNS server becomes unavailable.
Features
Retain default settings.
AD DS
Retain default settings.
DNS Server
Retain default settings.
Confirmation
Click Install.
After the installation is complete, click Close.
In the left-side navigation pane, click AD DS. In the upper-right corner of the page, click More.
Click Promote this server to a domain and configure the following parameters.
Parameter
Description
Deployment Configuration
Select Add a new forest and specify the domain name.
Domain Controller Options
Configure the password for the Directory Services Restore Mode (DSRM).
DNS Options
Clear Create DNS delegation.
Additional Options
Retain default settings.
Paths
Retain default settings.
Review Options
Retain default settings.
Prerequisites Check
Click Install.
NoteAfter the installation is complete, the system restarts.
After the system restarts, search for and open Server Manager again.
In the left-side navigation pane, click AD DS. Right-click the required domain controller server and select Active Directory Users and Computers to go to the AD user management module.
Expand . Right-click Users and choose .
Specify a username and click Next.
Specify a password, select Password never expires, and then click Next. Then, click Finish.
Double-click the created user and add the user to the Domain Admins group.
Step 2: Configure a security group for the ECS instance
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region and resource group to which the resource belongs.
On the Instances page, find the required ECS instance and click the ID of the ECS instance.
On the page that appears, click the Security Groups tab. On the tab that appears, click Configure Rules in the Actions column.
On the Inbound tab, click Add Rule to create rules to allow your RDS instance to access the ECS instance over the following ports.
Protocol type
Port and port range
Description
TCP
88
The port for the Kerberos authentication protocol.
TCP
135
The port for the Remote Procedure Call (RPC) protocol.
TCP/UDP
389
The port for the Lightweight Directory Access Protocol (LDAP).
TCP
445
The port for the Common Internet File System (CIFS) protocol.
TCP
3268
The port for Global Catalog.
TCP/UDP
53
The port for the DNS service.
TCP
49152 to 65535
The default dynamic port range for connections. Enter a value in the following format: 49152/65535.
Step 3: Configure the AD domain service for the RDS instance
Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left-side navigation pane, click Accounts.
Click the AD Domain Services tab and click Configure AD Domain Services.
In the Configure AD Domain Services dialog box, configure the parameters and read and select I have read and understand the impact of AD Domain Services on the RDS Service Level Agreement.
WarningAfter the AD domain feature is enabled and configured, you can create an account by using a self-managed AD domain and grant the account the permissions to log on to your RDS instance and perform operations on the RDS instance.
However, the system admin account or the host account has the permissions that are beyond the management scope of ApsaraDB RDS. The system does not provide the service availability that is specified in Alibaba Cloud service level agreement (SLA) for the RDS instances for which the accounts are created by using a self-managed AD domain. For more information, see SLA.
Parameter
Description
Domain Name
The domain name that you specified when you create an AD on the Deployment Configuration page. In this example, testdomian.net is used.
Directory IP Address
The IP address of the ECS instance on which the domain controller server is deployed. You can obtain the IP address by running the
ipconfigcommand on the ECS instance or by using the ECS console.
Domain Account
The username of the account that you created.
Domain Password
The password of the account.
Click OK and wait until the domain is added.
What to do next
You can call the following operations to view or modify the information about the AD domain and remove your RDS instance from the AD domain:
FAQ
We recommend that you use an account with the domain administrator permissions. If you do not want to use an account with the domain administrator permissions, you can use an account with the least privilege by performing the following operations. However, if you use an account with the least privilege, you must manually remove your computer from the domain controller server when you disconnect your RDS instance from the domain. Otherwise, an error is reported when you reconnect your RDS instance to this domain.
After you create a user and confirm that the user belongs to the Domain Users group, choose to add the user that you created.
Right-click the user and select Create a custom task to delegate. Then, click Next.
Select Only the following objects in the folder and the red highlighted items that are shown in the following figure. Then, click Next.
Select the items that are shown in the following figure. Then, click Next until the procedure is complete.
