Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
devel:documentation:adm:systems:winrm_ad_connector [2019/10/08 13:11]
fiserp [Installation] 		devel:documentation:adm:systems:winrm_ad_connector [2023/11/08 13:46] (current)
kotynekv [Configuration] wwarning
Line 1: Line 1:
 ====== WinRM + AD Connector ====== ====== WinRM + AD Connector ======
 +
 This connector is combining WinRM and [[https://connid.atlassian.net/wiki/spaces/BASE/pages/360482/Active+Directory+JNDI|AD connector]] into one. The main advantage of this is you can execute operation by AD connector or by WinRM connector or with both together in specified order. This connector is combining WinRM and [[https://connid.atlassian.net/wiki/spaces/BASE/pages/360482/Active+Directory+JNDI|AD connector]] into one. The main advantage of this is you can execute operation by AD connector or by WinRM connector or with both together in specified order.
  
Line 5: Line 6:
  
 Typical use cases for this combined connector are: Typical use cases for this combined connector are:
-  * Management of home directories - User is created via AD connector and home directory is created by WinRM Connector (powershell)+ 
 +  * Management of home directories - User is created via AD connector and home directory is created by WinRM Connector (powershell). Owner of home directory can be set only locally.
   * Management of o365   * Management of o365
   * Management of Exchange   * Management of Exchange
   * Management of OpenLims via special client which is on the windows servers and is executed from powershelll   * Management of OpenLims via special client which is on the windows servers and is executed from powershelll
-  * Basically you use this to connect to system which can be controlled via powershell and is dependent on AD. +  * Basically you use this to connect to system which can be controlled via powershell and is dependent on AD.
  
-Schema: +Schema: {{  ..:..:systems:dev:winrm_ad_schema.png?nolink&  }}
-{{ :devel:documentation:systems:dev:winrm_ad_schema.png?nolink |}}+
  
-When you use this connector then in IdM you will has only one system and every user who is managed via this system will have only one account. For example if you want to manage home directories together with AD then user will have only one account and so when you create user, directory will be created to. +When you use this connector then in IdM you will has only one system and every user who is managed via this system will have only one account. For example if you want to manage home directories together with AD then user will have only one account and so when you create user, directory will be created to.
  
 Theoretically you can use WinRM connector for home directories and AD connector for user management separately. You will have two system in IdM and user will have two accounts. But then you will have no control over the order of execution. And when you need to set some ACL permissions to the home directory the user must be created before. Theoretically you can use WinRM connector for home directories and AD connector for user management separately. You will have two system in IdM and user will have two accounts. But then you will have no control over the order of execution. And when you need to set some ACL permissions to the home directory the user must be created before.
  
-When you want to execute some operation via both connectors and the first connector execution will failed then the execution by the second connector is not executed. You will see error in provisioning in IdM. +When you want to execute some operation via both connectors and the first connector execution will failed then the execution by the second connector is not executed. You will see error in provisioning in IdM. In case where the second execution will fail you will see error in IdM again. Then when retry provisioning will kick in, IdM perform search to the end system again that mean if you want for example assign role in AD to user and then execute powershell for Exchange and the powershell execution will fail for some reason. Retry provisioning will know that the role is already assigned so nothing will happen via AD connector and only powershell will be executed.
-In case where the second execution will fail you will see error in IdM again. Then when retry provisioning will kick in, IdM perform search to the end system again that mean if you want for example assign role in AD to user and then execute powershell for Exchange and the powershell execution will fail for some reason. Retry provisioning will know that the role is already assigned so nothing will happen via AD connector and only powershell will be executed.+
  
 ====== WinRM Connector ====== ====== WinRM Connector ======
 +
 This part is only what is supported by WinRM connector. AD connector has the same functionality as if you use the standalone version. This part is only what is supported by WinRM connector. AD connector has the same functionality as if you use the standalone version.
  
Line 29: Line 30:
  
 We implemented some features which were missing. We implemented some features which were missing.
 +
   * It contains more configuration fields for connecting to WinRM, which is the main purpose of this connector.   * It contains more configuration fields for connecting to WinRM, which is the main purpose of this connector.
-  * Password for WinRM user is GuardedString in connector but we send is as plain text in to bash script. (This behavior is same in CMD connector for \_\_PASSWORD\_\_ attribute)+  * Password for WinRM user is GuardedString in connector but we send is as plain text in to bash script. (This behavior is same in CMD connector for <nowiki>__PASSWORD__</nowiki> attribute)
   * If script return exit code other then 0 exceptions is thrown.   * If script return exit code other then 0 exceptions is thrown.
   * Item In folder scripts/NameOfSystem you can find python scripts for each supported operation method:   * Item In folder scripts/NameOfSystem you can find python scripts for each supported operation method:
-    * Create +      * Create 
-    * Update +      * Update 
-    * Delete +      * Delete 
-    * Test +      * Test 
-    * Search+      * Search
  
-Where "NameOfSystem" is one of these following values Exchange, OpenLims, o365, homeDir (More systems will maybe come in future). If you want use this connector for another +Where "NameOfSystem" is one of these following values Exchange, OpenLims, o365, homeDir (More systems will maybe come in future). If you want use this connector for another system you can just implement scripts yourself. As a template you can use existing python + ps scripts.
-system you can just implement scripts yourself. As a template you can use existing python + ps scripts.+
  
 Powershell scripts are in subfolders. It's not only "normal" powershell script which contains the commands which we want to execute, but it must handle exceptions and in the case of search scripts the response should be in json format, so we can parse in connector a forward it to IdM. The risk of not catching exceptions can be that IdM will show operation as successful but it failed or the other way around. Powershell scripts are in subfolders. It's not only "normal" powershell script which contains the commands which we want to execute, but it must handle exceptions and in the case of search scripts the response should be in json format, so we can parse in connector a forward it to IdM. The risk of not catching exceptions can be that IdM will show operation as successful but it failed or the other way around.
  
-All of these scripts logging into connector server log+All of these scripts logging into connector server log. All log messages are shown after powershell script is executed and the control is returned into connector. So it can see that the log is frozen if the powershell script will run some time. Disadvantage is, if your powershell script froze for real you will not see any log. This can happen for example if you execute some command which will wait for user input, but you can prevent this one by using [[..:..:systems:dev:how_to_write_scripts_for_winrm_ad_connector|special parametr]]
  
-Then in folder "scripts" you can find python script, which is wrapper for pywinrm client - https://github.com/diyan/pywinrm +Then in folder "scripts" you can find python script, which is wrapper for pywinrm client - [[https://github.com/diyan/pywinrm|https://github.com/diyan/pywinrm]] which is used for connecting and executing PS scripts in windows server. You need to install first. In the link above there is a tutorial.
-which is used for connecting and executing PS scripts in windows server. You need to install first. In the link above there is a tutorial.+
  
 It's better to run it in connector server instead of directly adding dependency to your application(IdM). The reason for this is simple - better security. You can choose user with some limited permissions which will be used as the owner of connector server and then give him access to run only the scripts which you want. It's better to run it in connector server instead of directly adding dependency to your application(IdM). The reason for this is simple - better security. You can choose user with some limited permissions which will be used as the owner of connector server and then give him access to run only the scripts which you want.
  
-It supports basic, ntlm, kerberos and credssp authentication schema for WinRM+It supports basic, ntlm, kerberos and credssp authentication schema for WinRM. To use Kerberos, you need to have properly-configured ''/etc/krb5.conf'' in your system.
  
-It supports HTTP and HTTPS communication. HTTPS communication can be a little bit tricky to configure. You need the right +It supports HTTP and HTTPS communication. HTTPS communication can be a little bit tricky to configure. You need the right certificate which is used in WinRM listener on Win server. Store the crt to the on the machine where this connector is running and for: **WinRM < 1.0.5**  Edit <nowiki>winrm_wrapper.py</nowiki> to change the path to .pem certificate which is needed for HTTPS connection.
-certificate which is used in WinRM listener on Win server and then import crt to the trust store on machine where this connector is running or you can edit file winrm\_wrapper.py to change the path to .pem certificate which is needed for HTTPS connection.+
 <code> <code>
 +
 p = winrm.protocol.Protocol(endpoint=endpoint, p = winrm.protocol.Protocol(endpoint=endpoint,
                             transport=authentication,                             transport=authentication,
Line 61: Line 61:
                             password=password,                             password=password,
                             ca_trust_path='/opt/connid-connector-server/certs/winrm_ca.pem')                             ca_trust_path='/opt/connid-connector-server/certs/winrm_ca.pem')
 +
 </code> </code>
 +
 +**WinRM >= 1.0.5**  there is configuration field called <nowiki>"WinRM___CA trust path"</nowiki> - Path to certificate which will be used in HTTPS communication. E.g /path/to/file/crt.pem Be sure you are using up to date <nowiki>winrm_wrapper.py</nowiki> otherwise this new config property don't work and you will be forced to use previous solution.
 +
  
 ===== Schema generation ===== ===== Schema generation =====
 +
 Connector is supporting basic schema generation. You will get these attributes: Connector is supporting basic schema generation. You will get these attributes:
-  * \_\_NAME\_\_ + 
-  * \_\_UID\_\_ +  * <nowiki>__NAME__</nowiki> 
-  * \_\_PASSWORD\_\_+  * <nowiki>__UID__</nowiki> 
 +  * <nowiki>__PASSWORD__</nowiki> 
 You need to create other attributes manually based on the system which you want to connect and you needs. You need to create other attributes manually based on the system which you want to connect and you needs.
  
 ====== Requirements ====== ====== Requirements ======
  
-Here are some requirements needed in order to use winrm connector.+Here are some requirements needed in order to use WinRM connector.
  
   * Windows server with activated winrm service   * Windows server with activated winrm service
-  * User account (local when using basic authentication scheme, domain otherwise) with correct permissions for connecting wia winrm and executing powershell scripts +  * User account (local when using basic authentication scheme, domain otherwise) with correct permissions for connecting via WinRM and executing PowerShell scripts 
-  * Correctly set up network access and firewall rules to allow winrm communication from IdM server to desired server +  * Correctly set up network access and firewall rules to allow WinRM communication from IdM server to desired server 
-  * Allowed winrm ports - 5985 for HTTP and 5986 for HTTPS (by default) +  * Allowed WinRM ports - 5985 for HTTP and 5986 for HTTPS (by default) 
-  * Write powershell scripts, which will be performing desired operations on MS server (CREATE, UPDATE, ...) +  * Write PowerShell scripts, which will be performing desired operations on MS server (CREATE, UPDATE, …) 
-  * Write python scripts that transform data from ConId API to powershell script (examples in GIT repository)+  * Write Python scripts that transform data from ConnId API to PowerShell script (examples in GIT repository [[https://github.com/bcvsolutions/winrm-ad-connector|https://github.com/bcvsolutions/winrm-ad-connector]]) 
 + 
 +====== Version and compatibility ====== 
 + 
 +  * 1.0.0 - IdM 9.x and above 
 +  * 1.0.1 - IdM 9.x and above 
 +  * 1.0.2 - IdM 9.x and above 
 + 
 +Cross domain feature available: 
 + 
 +  * 1.0.3 - IdM LTS 9.7.x with Extras module 1.8.1 
 +  * 1.0.4 - IdM 10.3.0 and above 
 +  * 1.0.5 - IdM 10.3.0 and above 
 +  * 1.0.6 - IdM > 10.3.0 < 11.2.0 
 +  * 1.0.7 - IdM 11.2.0 and above = CzechIdM supports cross domain. No need for extras module 
 + 
 +If you want to use IdM 10.0.0, 10.1.0 or 10.2.0 and be able to use cross domain functions you need to update IdM to 10.3.0, if you don't need cross domain feature and don't want to update IdM you can try to use connector 1.0.2
  
 ===== Provisioning ===== ===== Provisioning =====
Line 93: Line 116:
 ===== Supported operations ===== ===== Supported operations =====
  
-^ Object           ^ Operations            ^ +^Object  ^Operations  | 
-| \_\_ACCOUNT\_\_  | CREATE, UPDATE, DELETE, SEARCH  | +|<nowiki>__ACCOUNT__</nowiki>  |CREATE, UPDATE, DELETE, SEARCH  | 
-| \_\_GROUP\_\_    | NONE                  |+|<nowiki>__GROUP__</nowiki>  |NONE  |
  
 ===== Managing users groups ===== ===== Managing users groups =====
-When you use this connector for some system where you need to manage groups for users (OpenLims). Attribute for roles must be called "roles" is schema definition. Then it's work in the same way as roles for AD. That's mean you need to create role in IdM which will have assigned this system and in mapping override attribute "roles" with value which the system accept. Strategy should be Merge or Authoritative merge + 
 +When you use this connector for some system where you need to manage groups for users (OpenLims). Attribute for roles must be called "roles" is schema definition. Then it's work in the same way as roles for AD. That's mean you need to create role in IdM which will have assigned this system and in mapping override attribute "roles" with value which the system accept. Strategy should be Merge or Authoritative merge
  
 ===== Scripts ===== ===== Scripts =====
 +
 +For more information about how to write scripts, follow [[..:..:systems:dev:how_to_write_scripts_for_winrm_ad_connector|]]
 +
 ==== python ==== ==== python ====
 +
 Python scripts should start with these two lines: Python scripts should start with these two lines:
-<code>#!/usr/bin/env python +<code> 
-# -*- coding: utf-8 -*-</code>+ 
 +#!/usr/bin/env python 
 +# -*- coding: utf-8 -*- 
 + 
 +</code> 
 + 
 +The second line is important because in python 2.x default encoding is ASCII so if don't specify the encoding in python file then we will have problems with using diacritics. Then if we need to load powershell script into python and replace some params, It's recommended to open with encoding.
  
-The second line is important because in python 2.x default encoding is ASCII so if don't specify the encoding in python file then we will have problems with using diacritics. 
-Then if we need to load powershell script into python and replace some params, It's recommended to open with encoding. 
 <code> <code>
 import codecs import codecs
Line 113: Line 145:
 command = f.read() command = f.read()
 command = command.replace("$firstName", winrm_wrapper.getParam("firstName")) command = command.replace("$firstName", winrm_wrapper.getParam("firstName"))
 +
 </code> </code>
 +
 For getting parameter from environment you can use method in winrm_wrapper which will return value or empty string if the variable is not in environment. It will return value as unicode with utf-8 encoding For getting parameter from environment you can use method in winrm_wrapper which will return value or empty string if the variable is not in environment. It will return value as unicode with utf-8 encoding
  
 We are using encoding otherwise you will have problem with diacritics in powershell when you want to encode the powershell script before sending it via WinRM. We are using encoding otherwise you will have problem with diacritics in powershell when you want to encode the powershell script before sending it via WinRM.
  
 +<note important>When connector server is running on Windows all powershell scripts need to you Write-Output function instead of Write-Host</note> <note important>In windows system python was running in encoding cp1252 and I had to use command below to reconfigure to utf8. This command is available from python version 3.7</note>
 +
 +<code>
 +sys.stdout.reconfigure(encoding='utf-8')
 +
 +</code>
 +
 +<note tip>Update operation is a little bit trickier. In this script it'll be needed implementation of both create and update operations. Because of some reason there could be user, which already has account on AD, but does not have home directory. And if you need some additional attributes to create a home directory (e.g. for each department different folder), in update operation an attribute will not be normally send if value of the attribute was not changed.</note> <note tip>For search and delete operations IdM only sends uid. So in this scripts you cannot use any other attributes. For example someone would want to rename home directory in delete script and leave it there for period of time as backup. But in this situation you can only add to home directory's name some static text</note>
  
 ===== Installation ===== ===== Installation =====
 +
 For using WinRM part of this connector you need to install a few things which is needed, otherwise you can skip these steps. For using WinRM part of this connector you need to install a few things which is needed, otherwise you can skip these steps.
-  * Install python, tested version is 2.7+ 
 +  * Install python, tested versions are 3.6 and 3.9
   * Install pip for managing Python packages - for linux use package managers based on you distribution and install package python-pip. If you are using windows pip will be installed together with python if you use official installator.   * Install pip for managing Python packages - for linux use package managers based on you distribution and install package python-pip. If you are using windows pip will be installed together with python if you use official installator.
-  * Install pywinrm and dependencies. You can follow official guide https://github.com/diyan/pywinrm Just don't forget to install additional packages if you want use Kerberos or CredSSP authentication. If you are using windows you need to execute only the commands for pip, you don't need to install other system dependencies.+  * Install pywinrm and dependencies. You can follow official guide [[https://github.com/diyan/pywinrm|https://github.com/diyan/pywinrm]] Just don't forget to install additional packages if you want use Kerberos or CredSSP authentication. If you are using windows you need to execute only the commands for pip, you don't need to install other system dependencies.
  
-<note tip>Better way to install python packages through ''pip'' is to **not** install them system-wide. Create user for the connector server (see later on this page) and install packages only for this user. This ensures stability (system-wide updates do not change versions, thus cannot break your connector) and isolation from the rest of the OS (''pip'' does not accidentally break OS-provided libraries). To install what you need, just issue:+<note tip>Better way to install python packages through ''pip''  is to **not**  install them system-wide. Create user for the connector server (see later on this page) and install packages only for this user. This ensures stability (system-wide updates do not change versions, thus cannot break your connector) and isolation from the rest of the OS (''pip''  does not accidentally break OS-provided libraries). To install what you need, just issue:
 <code> <code>
 +
 su - connector-server su - connector-server
 pip install --user pywinrm pip install --user pywinrm
  
 #those only if you need them #those only if you need them
-pip install --user pywinrm[kerberos]+pip install --user pywinrm[kerberos] python-krb5ticket
 pip install --user pywinrm[credssp] pip install --user pywinrm[credssp]
-</code> 
-</note> 
- 
-Now we have prepared the tool which is used by our connector. Next you need to install java connector server. Connector server is not mandatory but as we wrote in the first section it's recommended to use it. 
- 
-<note>Configure log rotation for connector server log file</note> 
-You can download whole bundle with prepared and tested connector server https://git.bcvsolutions.eu/modules/connector-server/tree/develop 
-<note important>It's private at this time</note> 
- 
-Or you can follow this guide and prepare the connector server yourself if you want. 
-This connector is tested in java connector server 1.4.5.1 https://connid.atlassian.net/wiki/spaces/BASE/pages/360458/Downloads#Downloads-JavaConnectorServer 
-and with connector-framework 1.4.3.0 
- 
-Next you will need to add these libraries into lib folder of the connector server: 
-  * jackson-annotations-2.9.8 
-  * jackson-core-2.9.8 
-  * jackson-databind-2.9.8 
-You will probably need to add these libs into classpath in ConnectorServer.sh or ConnectorServer.bat it depends on your OS. 
  
-Next it's good to do some more configuration as setting new password for connector server and create new user under which the connector server will be started. 
- 
-For setting new password for you remote connector use 
-<code> 
-./bin/ConnectorServer.sh -setKey -key yourKey -properties conf/connectorserver.properties 
 </code> </code>
  
 +</note>
  
-If you want to be able to run connector server as a service follow next steps+Now we have prepared the tool which is used by our connector. Next you need to install java connector server. Connector server is not mandatory but as we wrote in the first section it is strongly recommended.
  
-<code> +  - Follow [[.:connectors:remote_server|this howto]] to install remote connector server as a service. 
-# create user which we run the connector server +  - Put ''winrm-ad-connector-1.0.1.jar''  to the ''bundles''  folder inside connector server installation and restart the connector server. 
-useradd connector-server+  - Put WinRM server's CA certificate in this file inside connector server installation - ''certs/winrm\_ca.pem''. It is necessary to supply CA certificate, not the server's certificate. For certificates, use PEM format. 
 +  - Put CA certificate to AD servers in the [[.:connectors:remote_server#configuring_ssl_truststore|Java truststore]] created in this file in the connector server - ''conf/truststore.jks''. (How to get CA to AD server? [[https://proj.bcvsolutions.eu/kb/doku.php?id=operacni_systemy:skripty#stazeni_certifikatu_serveru_a_vlozeni_do_idm|Internal guide]]FIXME  move to wiki)
  
-#create file +  - Configure WinRM on windows server or check if WinRM is accessible. You can follow steps from our [[:tutorial:adm:configuration_-_winrm|tutorial]].
-/etc/systemd/system/java-connector-server.service+
  
-# content of the file, change path according where you have your connector server +===== Configuration =====
-[Unit] +
-Description=Java Connector Server Service +
-[Service] +
-User=connector-server +
-WorkingDirectory=/opt/connid-connector-server +
-ExecStart=/bin/bash /opt/connid-connector-server/bin/ConnectorServer.sh -run -properties /opt/connid-connector-server/conf/connectorserver.properties +
-SuccessExitStatus=143 +
-[Install] +
-WantedBy=multi-user.target+
  
-# Reload and enable deamon +In configuration you have the option to configure AD connector and WinRM connector. So follow WinRM configuration below and [[:tutorial:adm:manage_ad#connector_configuration|AD]] configuration.
-systemctl daemon-reload +
-systemctl enable java-connector-server +
- +
-# Use this to start/stop/status +
-systemctl start java-connector-server +
-systemctl stop java-connector-server +
-systemctl status java-connector-server +
-</code> +
- +
-Now you can put winrm-ad-connector-1.0.1.jar to the bundles folder inside connector server and you can start it. +
- +
-Next thing which you need to do is configure WinRM on windows server or check if WinRM is accessible. You can follow steps from out [[tutorial:adm:configuration_-_winrm|tutorial]] +
- +
-===== Configuration ===== +
-In configuration you have the option to configure AD connector and WinRM connector. +
-So follow WinRM configuration below and [[tutorial:adm:manage_ad#connector_configuration|AD]] configuration.+
  
 Connector has few settings which need to be configured before you used it. Connector has few settings which need to be configured before you used it.
Line 203: Line 201:
  
 === Create script === === Create script ===
 +
 Path to Python create script Path to Python create script
  
 === Powershell create script === === Powershell create script ===
 +
 Path to powershell create script which will be loaded into python and executed on Windows Path to powershell create script which will be loaded into python and executed on Windows
  
 === Update script === === Update script ===
 +
 Path to Python update script Path to Python update script
  
 === Powershell update script === === Powershell update script ===
 +
 Path to powershell update script which will be loaded into python and executed on Windows Path to powershell update script which will be loaded into python and executed on Windows
  
 === Search script === === Search script ===
 +
 Path to Python search script Path to Python search script
  
 === Powershell search script === === Powershell search script ===
 +
 Path to powershell search script which will be loaded into python and executed on Windows Path to powershell search script which will be loaded into python and executed on Windows
  
 === Delete script === === Delete script ===
 +
 Path to Python delete script Path to Python delete script
  
 === Powershell delete script === === Powershell delete script ===
 +
 Path to powershell delete script which will be loaded into python and executed on Windows Path to powershell delete script which will be loaded into python and executed on Windows
  
 === Test script === === Test script ===
 +
 Path to Python test script Path to Python test script
  
 === Endpoint === === Endpoint ===
-URL to the endpoint, where is WinRM accessible. Usually https://HOST:5986/wsman for HTTPS and http://HOST:5985/wsman for HTTP+ 
 +URL to the endpoint, where is WinRM accessible. Usually [[https://HOST:5986/wsman|https://HOST:5986/wsman]] for HTTPS and [[http://HOST:5985/wsman|http://HOST:5985/wsman]] for HTTP
  
 === Authentication schema === === Authentication schema ===
 +
 One from supported values - basic, ntlm, kerberos, credssp One from supported values - basic, ntlm, kerberos, credssp
  
 === User === === User ===
 +
 Username for user which will be used for authentication to WinRM Username for user which will be used for authentication to WinRM
  
 === Password === === Password ===
 +
 Password for this user Password for this user
-   + 
-Then there are some other options which can be configured. You can configure which connector will be used for which operation. +=== CA trust path === 
-For example you can use AD + WinRM for create and only WinRM for delete, etc. + 
-{{ :devel:documentation:systems:dev:winrm_ad_config.png?nolink&400 |}} +Path to certificate which will be used in HTTPS communication. E.g /path/to/file/crt.pem 
-You can configure the order of connectors. Default behavior is that AD connector is first. + 
-{{ :devel:documentation:systems:dev:winrm_ad_order.png?nolink&400 |}}+=== Ignore CA validation === 
 + 
 +If you want to connect to WinRM without CA validation - Don't use in production, only for testing! 
 + 
 +Then there are some other options which can be configured. You can configure which connector will be used for which operation. For example you can use AD + WinRM for create and only WinRM for delete, etc. {{  ..:..:systems:dev:winrm_ad_config.png?nolink&400  }}You can configure the order of connectors. Default behavior is that AD connector is first. {{  ..:..:systems:dev:winrm_ad_order.png?nolink&400  }}<note>Note that when you check both the AD and WinRM options for the Create / Update / Delete operation, the same type of operation is called in both connectors. For example, if one connector creates an object, the other connector tries to create it as well, then the operation ends up with an error because the object already exists (but the first connector does not rollback!).</note> 
 + 
 +=== Cross domain configuration === 
 + 
 +**<WRAP center round important 60%>\\ 
 +Adding or removing too many groups at once is not supported. Lenght limitation of environment variable on Windows is 8 191 characters so if combination of all added and removed group's DNs plus comas, doublequotas and the script itself is longer than that cmd.exe just ignores it. The result is no script is being run and no error or exception ocures. Relatively safe is to add or remove about 50-100 groups at once.\\ 
 +</WRAP>** 
 + 
 +IdM 11.2.0 has support for cross domain. You need connector version 1.0.7 
 + 
 +Do the following configuration in IdM: 
 + 
 +  * <nowiki>Additional___Use</nowiki> only WinRM for groups - true 
 +  * <nowiki>Config___Update</nowiki> via WinRM connector (Powershell) - true 
 +  * <nowiki>Config___Create</nowiki> via WinRM connector (Powershell) - true 
 + 
 +Scripts can be found on [[https://github.com/bcvsolutions/winrm-ad-connector/tree/develop/scripts_python3/ad|GitHub]] 
 + 
 +=== Send attributes only to WinRM === 
 + 
 +In some cases, when you are using AD and WinRM for same operation, you want to use some attributes only in WinRM (powershell). 
 + 
 +The reason is that is some attribute for script and AD has no clue about this attribute and the AD part will fail. 
 + 
 +To achieve this, you can specify, which attributes should be send only to WinRM. 
 + 
 +  * Go to system detail - Configuration 
 +  * Go to tab Additional connector configuration 
 +  * Click on Manage attributes 
 +  * Add new attribute with code attributesForWinRM 
 +      * Attribute is Short text and multivalued 
 +  * Save it and go back to Additional connector configuration 
 +  * Fill attribute names which should be send only to WinRM 
 +  * Each name on it's own lane 
 +  * Names should be the ones which are in schema. 
 + 
  • by fiserp