imper.ai

Appearance

ZTNA Connector Model

Overview ​

Active Directory is reachable by the ZTNA Connector deployed on a secure host within your network.

imper.ai requires secure, encrypted connectivity to your domain controllers in order to perform directory verification and identity validation operations.

This document describes the secure connectivity model used to establish that integration while maintaining strict network boundaries and minimizing exposure.

The design is based on the following principles:

  • Connectivity is restricted to the domain controllers you designate

  • Communication is limited to encrypted LDAP transport only

  • No general network access into the VPC is introduced

  • No access is provided to other systems or connected networks

  • All directory activity remains auditable within the domain controller

The integration leverages a ZTNA Connector deployed inside your VPC to initiate secure, outbound communication with Imper.ai, ensuring that no inbound access to your network is required.

This approach ensures that the integration is secure, narrowly scoped, and aligned with enterprise network security best practices.

What This Integration Does ​

The ZTNA Connector enables secure communication between Imper.ai and your Active Directory domain controllers:

  • Connects only to the domain controllers you designate — one per domain you manage

  • Reaches each on its private IP within your network

  • Uses LDAPS (TCP 636) for directory reads and writes, and the Global Catalog over SSL (TCP 3269) on the primary domain controller for forest-wide user lookups

It does not provide:

  • General access into your VPC

  • Access to other internal systems

  • Access to additional networks connected to your VPC

Architecture ​

The ZTNA Connector is deployed on a secure host within your network.

Key aspects of the design:

  • The connector initiates outbound TLS connectivity to Imper.ai on TCP 443

  • The connector communicates locally with your domain controllers over LDAPS (TCP 636), and with the primary domain controller's Global Catalog over SSL (TCP 3269)

  • No inbound connectivity is established from Imper.ai into your network

All traffic remains encrypted and scoped to the required endpoints.

Network Restrictions ​

The permitted connectivity flows for the connector are:

  • Connector → your domain controllers over LDAPS (TCP 636), and the primary domain controller's Global Catalog (TCP 3269)

  • Connector → Imper.ai service endpoints on TCP 443

No other internal IP addresses or ports are reachable from the connector. Your domain controllers are not directly reachable from Imper.ai networks.

Access Control ​

  • Imper.ai authenticates and authorizes all requests before they reach the connector

  • The connector accepts requests only over a mutually authenticated TLS channel

  • Each request is validated against an explicit authorization decision before initiating a connection to a domain controller

  • The connector does not provide general TCP proxying, port forwarding, or arbitrary destination access

Firewall Configuration ​

Your firewall policy should allow:

  • Connector → your domain controllers over LDAPS (TCP 636) and the primary domain controller's Global Catalog (TCP 3269)

  • Connector → Imper.ai service endpoints on TCP 443

All other inbound and outbound traffic from the connector to internal systems is denied.

DNS and Addressing ​

  • The connector resolves Imper.ai service endpoints for outbound TCP 443

  • If a domain controller is addressed by hostname, internal DNS must resolve that name within your network.

No additional DNS configuration is required for direct IP connections to the domain controllers.

Encryption and Certificate Validation ​

All directory communication is encrypted:

  • LDAPS (TCP 636) and the Global Catalog over SSL (TCP 3269): each domain controller presents a valid TLS certificate, and the connector validates the certificate chain

Certificate validation ensures protection against man-in-the-middle attacks.

Security and Audit ​

  • Each request produces an auditable record tied to the connector identity, target domain controller, timestamp, and outcome

  • Domain controller security logs remain the authoritative record of any directory changes

  • No standing administrative access is granted to Imper.ai

This design ensures all activity is auditable and confined to the intended scope.

Why This Design Is Secure ​

This architecture provides:

  • Scoped exposure - only the domain controllers you designate are reachable

  • Scoped ports - only LDAPS (TCP 636) and the Global Catalog (TCP 3269) are allowed

  • Encrypted communication only

  • No lateral network access - Imper.ai cannot reach other VPC systems

  • No public internet exposure - all internal access is outbound via the connector

  • Full auditability

Copyright © Imper AI