Active Directory & Multi-Level RBAC Overview

Home > Active Directory & RBAC

Model Context Gateway (MCG) provides enterprise-grade identity resolution and role-based access control across Active Directory (AD) domains, LDAP/LDAPS directory services, Windows Integrated Authentication (WIA), and multi-level policy evaluation.

This guide serves as the index for MCG's security architecture articles:

---

1. Modular Security Architecture Articles

• Active Directory & LDAPS Domain Integration Domain controller setup, LDAPS TLS configuration (port 636), service credentials (Ldap:BindDn, Ldap:BindPassword), and recursive group expansion via the Active Directory tokenGroups binary attribute.

• Multi-Level RBAC & Access Control Policies External group mappings (GroupMappings table), SID evaluation, role definitions (Administrator, Operator, Auditor), and multi-level policies protecting administrative APIs, servers, and individual tools.

• Windows Integrated Authentication & IIS Negotiate, Kerberos, and NTLM inbound handshakes on IIS, in-process hosting via ANCM, SCM Windows Service hosting with DPAPI master key encryption, and outbound S4U2Proxy Kerberos impersonation.

---

2. Inbound Identity & Resolution Flow

---

3. Related User & Administrator Guides

• User Guide: RBAC, Security & Policies
• AppKey Scopes & Authorization
• Downstream Auth & Identity Delegation
• Authentication Architecture