StrongDM New Tenant Setup Guide

RDP Server Types

Adding an RDP (Password) Server

1. Add the resource
   Resources > Managed Resources > Add Resource > RDP (Password). Enter name, hostname/IP, port (default 3389), username (DOMAIN\user or user@domain format for AD), and password.
2. Verify
   Healthcheck confirms network reachability (not credential validity). Connect from the StrongDM desktop app using your RDP client to fully verify.

Adding an RDP (Certificate) Server

1. Configure the CA
   Every org gets a Strong CA for RDP automatically. For Enterprise: you can use third-party CAs (AD CS, AWS Private CA, Keyfactor EJBCA, etc.). The CA's public certificate must be trusted by Active Directory.
2. Add the resource
   Select RDP (Certificate Based). Choose Leased Credentials or Identity Aliases. For leased: enter AD username (DOMAIN\user), password, and optionally SID (required for Full Enforcement mode). For Identity Aliases: select Identity Set and enter AD service account for healthchecks.
3. If using NLA (on-prem AD only)
   Enter Domain Controller Hostnames (comma-separated) and Server FQDN. Nodes must have outbound access to Kerberos port 88 on domain controllers. NLA is NOT supported for Entra ID environments.

# Add RDP (Password) via CLI
sdm admin servers add rdp win-server-01 --hostname 10.0.2.10 --port 3389 --username 'CORP\admin' --password 'P@ssw0rd'

# Add RDP (Certificate) via CLI
sdm admin servers add rdp-cert win-server-02 --hostname 10.0.2.11 --port 3389 --username 'CORP\svc-sdm' --password 'P@ssw0rd'

Adding Databases

The pattern is the same for all database types: Resources > Managed Resources > Add Resource, select the type, fill in hostname, port, credentials, and optionally select a proxy cluster and secret store.

Common Database Properties

Per-Type Examples (CLI)

# PostgreSQL
sdm admin resources add postgres prod-pg --hostname pg.internal.co --port 5432 --username sdm_user --password 'secret' --database myapp

# MySQL
sdm admin resources add mysql prod-mysql --hostname mysql.internal.co --port 3306 --username sdm_user --password 'secret' --database myapp

# Microsoft SQL Server
sdm admin resources add sqlserver prod-mssql --hostname mssql.internal.co --port 1433 --username sa --password 'secret' --database master

# MongoDB (Replica Set)
sdm admin resources add mongo prod-mongo --hostname mongo1.internal.co --port 27017 --username admin --password 'secret' --auth-database admin

# Redis
sdm admin resources add redis prod-redis --hostname redis.internal.co --port 6379

# DynamoDB (IAM - no creds needed, uses instance profile)
sdm admin resources add amazonEksiamProfile prod-dynamo --hostname dynamodb.us-east-1.amazonaws.com --region us-east-1

Kubernetes Clusters

StrongDM supports EKS, AKS, GKE, and generic Kubernetes. Key features:

• Resource Discovery: Auto-scan groups, roles, bindings, service accounts. Enable with the "Enable Resource Discovery" checkbox when adding the cluster.
• Privilege Levels: Map K8s groups to StrongDM privilege levels. Users get different access tiers on the same cluster without creating separate resources.
• Identity Aliases: Map each user to a K8s identity for native audit logging. Requests include impersonation headers with the user's alias.
• Leased Credentials: Default mode. All users connect using the same base credential. StrongDM handles auth.

# Add EKS cluster
sdm admin clusters add amazon-eks prod-eks \
  --cluster-name my-cluster \
  --endpoint https://ABCDEF.gr7.us-east-1.eks.amazonaws.com \
  --region us-east-1 \
  --certificate-authority "$(cat ca.pem)" \
  --access-key-id AKIAXXXXXXXX \
  --secret-access-key "secret" \
  --discovery-enabled

# Add EKS with Instance Profile (no static creds)
sdm admin clusters add amazon-eks-instance-profile prod-eks-iam \
  --cluster-name my-cluster \
  --endpoint https://ABCDEF.gr7.us-east-1.eks.amazonaws.com \
  --region us-east-1 \
  --certificate-authority "$(cat ca.pem)" \
  --discovery-enabled

Okta SSO via SAML

1. Create an Okta SAML app
   In Okta Admin Console: Applications > Applications > Browse App Catalog. Search for "StrongDM" and select the SAML variant. Add the app and configure the SAML settings as directed by the StrongDM docs.
2. Get SAML metadata
   From the Okta app's Sign On tab, copy the Identity Provider metadata URL or download the metadata XML.
3. Configure in StrongDM
   Settings > User Management > Single Sign-on. Select SAML as provider. Upload or paste the metadata URL. Set the entity ID and ACS URL as shown in the StrongDM UI. Click Activate.

Microsoft Entra ID SSO via OIDC

1. Register an app in Azure
   Azure portal > App registrations > New registration. Set name, supported account types, and redirect URI: https://app.strongdm.com/auth/return (or regional equivalent). Click Register.
2. Copy values
   From the app Overview: copy the Application (client) ID and Publisher Domain. Under Certificates & secrets: create a client secret and copy the value (not the secret ID). Shown once only.
3. Configure in StrongDM
   Settings > User Management > Single Sign-on. Select Azure. Enter: SSO URL (https://login.microsoftonline.com/<PUBLISHER_DOMAIN>), Client ID, Client Secret. Click Activate.

Microsoft Entra ID SSO via SAML

1. Create an Enterprise app
   Azure portal > Enterprise Applications > New application > Create your own. Select "Integrate any other application". Set up SAML-based sign-on.
2. Configure SAML settings
   In the SAML configuration: set Entity ID and Reply URL (ACS) as shown in the StrongDM Admin UI's SAML settings page. Download the Federation Metadata XML from the Entra app.
3. Configure in StrongDM
   Settings > User Management > Single Sign-on. Select SAML. Upload the metadata XML or paste the metadata URL. Click Activate.

Entra ID SCIM Provisioning

1. Get a SCIM token from StrongDM
   Settings > User Management > Provisioning. Set SCIM Provider to Azure. Click Activate SCIM. Copy the token (shown once).
2. Create an Enterprise app in Azure
   Azure portal > Enterprise Applications > New application. Create a new app for SCIM (separate from your SSO app).
3. Configure provisioning
   In the app: Provisioning > Get started. Set Mode to Automatic. Under Admin Credentials: Tenant URL = https://app.strongdm.com/provisioning/azure/v2, Secret Token = your SCIM token. Click Test Connection, then Save.
4. Set scope and sync
   Under Settings > Scope: choose "Sync all users and groups" (entire directory) or "Sync only assigned users and groups" (only entities listed in Users and Groups for this app). Start provisioning.