Legacy Windows integration
Guiding principle: BIAM is not installed on Windows servers. The existing Windows infrastructure (domain, applications) is not modified; BIAM governs it from the outside, over the network.
Active Directory
All BIAM needs from the domain:
- LDAPS connectivity (636) from the app VM to the domain controllers, with the domain CA certificate trusted on the app VM.
- A service account with minimal delegation over the managed OUs: create/move/disable users and reset passwords. Domain Admin is not required.
The connection is configured from the BIAM console and stored encrypted in the database. With that, BIAM creates users in the right OU, composes cn/sn according to the organization's rules, moves users between OUs (with four-eyes approval) and syncs attributes.
Legacy applications
Three paths, in order of preference:
- API connector: if the application exposes an API (REST/SOAP), use a packaged connector (
.biampkg) from the Hub or a custom-built one. - Script handler: a versioned script BIAM executes with a JSON contract (secrets travel only via stdin, evidence is redacted).
- RPA handler: for applications with no API or CLI. They run serialized (one active session per connector, like a human operator). If the automation requires a Windows GUI, use the dedicated AutoIt runner via WinRM.
Air-gapped environments
For networks with no internet egress: connector packages and licenses are installed offline — upload the .biampkg with its signature (local Ed25519 verification, no network). The Bayoex Hub is only needed for one-click remote installs.
Summary for the Windows team
| Question | Answer |
|---|---|
| Do we install agents on DCs or servers? | No |
| Do we open inbound ports to Windows? | Only 636 (LDAPS) on DCs; WinRM only if there is an RPA runner |
| Which account does BIAM use? | A service account with minimal per-OU delegation |
| Do end users touch BIAM? | Only administrators/operators; everyone else never sees it |