Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Active Directory offers a feature called Service Connection Points to publish information to applications so they can discover the relevant server; however the documentation is sparse and I have trouble understanding

  • Where the information is stored (Configuration partition?)
  • What information is shared?
  • How is it secured?
  • What applications use it (Outlook Autodiscover does, perhaps SCOM too?)

This is especially interesting for situations where we have LDAP sync going or a DSML endpoint exposed.

Any additional information on SCP is appreciated

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

SCPs should be put in the Domain partition, under the host that provides the service, so that it is correctly replicated.

The SCP contains whatever information the service wants it to. Typically it has some identifiers for the service (so the client can find it) and then connection details for the service (like an IP and port number). But the service can put anything it wants in there, and can even extend the schema if need be - Microsoft don't know what some random service might need, so they kept it general. See http://msdn.microsoft.com/en-us/library/windows/desktop/ms677947%28v=vs.85%29.aspx

It's secured exactly like any other Active Directory client lookup.

Lots and lots of applications use it: it's the way you do service discovery in AD. Certainly all the Microsoft apps will use it, so yes, Exchange and SCOM do. And so do lots of 3rd party vendors.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.