Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
Next revision Both sides next revision
tutorial:adm:ad_groups_sync [2020/03/17 07:55]
kubicar [Connector configuration] 		tutorial:adm:ad_groups_sync [2021/03/04 11:01]
apeterova tips and corrections
Line 42: Line 42:
   * **Principal password** - password of the "principal" account   * **Principal password** - password of the "principal" account
   * **Root suffixes** - there should be DNs of **Base contexts**, groups outside of these "paths" will be ignored. Content of **Root suffixes** could be same as **Base contexts** or just put in domain.   * **Root suffixes** - there should be DNs of **Base contexts**, groups outside of these "paths" will be ignored. Content of **Root suffixes** could be same as **Base contexts** or just put in domain.
-  * **Entry object classes** - List of all objectClasses groups have in AD. It is necessary to find just groups. With wrong settings, it could find even users. +  * **Entry object classes** - List of all objectClasses groups have in AD. It is necessary to find just groups. With wrong settings, it could find even users. Usual values: top, group (every value on a single line) 
-  * **Group search scope** - Choose object, onlevel or subtree. It means where it will search for groups. As a **subtree**, a search will start on paths in **Base context** and it will search in every **Organization Unit** in this path. **onlevel** will search just one **OU**, where distinguished names of **Base context** points to and the last **object** means, in **Base context** there are DNs of groups we want to synchronize. +  * **Group search scope** - Default subtree. Options: object, onelevel or subtree, however, all behave the same on the current version. It means where it will search for groups. As a **subtree**, a search will start on paths in **Base context** and it will search in every **Organization Unit** in this path. **onelevel** ("onlevel" is a typo) will search just one **OU**, where distinguished names of **Base context** points to and the last **object** means, in **Base context** there are DNs of groups we want to synchronize. 
-  * **Custom group search filter** - this enables additional filter for groups, which will be searched for. You can use it e.g. to filter out roles with some specific substrings in their CN by using LDAP filter ''(&(!(cn=\*Administrator\*))(!(cn=\*Auditor\*)))''+  * **Custom group search filter** - this enables additional filter for groups, which will be searched for. You can use it e.g. to filter out roles with some specific substrings in their CN by using LDAP filter ''(&(!(cn=\*Administrator\*))(!(cn=\*Auditor\*)))''. However, you can't use a filter by whole distinguishedName.
   * **Base contexts for group entry searches** - list of distinguished names (paths), where it will search for groups.   * **Base contexts for group entry searches** - list of distinguished names (paths), where it will search for groups.
   * **Group members reference attribute** - a name of the attribute, which indicates membership. It contains whole DNs of users.   * **Group members reference attribute** - a name of the attribute, which indicates membership. It contains whole DNs of users.
   * **useVlvControls** - have to be enabled - this is only supported option   * **useVlvControls** - have to be enabled - this is only supported option
   * **pageSize** - number, it should be lower than maximum page size limit in AD, which is by default 1000. Recommended: 100.   * **pageSize** - number, it should be lower than maximum page size limit in AD, which is by default 1000. Recommended: 100.
-  * **vlvSortAttribute** - this should be identifier with sorting properties. Recommended for groups is cn. **DO NOT** user **distinguishedName** or any other unindexed attribute or you'll end up with "[LDAP: error code 12 - 0000217A: SvcErr: DSID-03140414, problem 5010 (UNAVAIL_EXTENSION), data 0];" error!+  * **vlvSortAttribute** - this should be identifier with sorting properties. Recommended for groups is cn. **DO NOT** use **distinguishedName** or any other unindexed attribute or you'll end up with "[LDAP: error code 12 - 0000217A: SvcErr: DSID-03140414, problem 5010 (UNAVAIL_EXTENSION), data 0];" error!
   * **Uid Attribute for groups** - unique identifier, recommended is objectGUID.   * **Uid Attribute for groups** - unique identifier, recommended is objectGUID.
   * **Object classes to synchronize** - Based on this filled object classes, groups to synchronized will be found. Content is usually same as **Entry object classes**.   * **Object classes to synchronize** - Based on this filled object classes, groups to synchronized will be found. Content is usually same as **Entry object classes**.
Line 58: Line 58:
 <note tip> In user provisioning system's schema and mapping should have attribute memberOf/ldapGroups and **Strategy** as "Merge".</note> <note tip> In user provisioning system's schema and mapping should have attribute memberOf/ldapGroups and **Strategy** as "Merge".</note>
 <note warning> <note warning>
-There are more than 10000 groups in AD and "Base contexts for group entry searches" is set for DC=AD,DC=AGEL,DC=CZ(root OU). +If there are more than 10000 groups in AD and "Base contexts for group entry searches" is set for DC=AD,DC=FIRMA,DC=CZ(root OU). 
-Error appeared in project AGEL: LDAP: error code 12 - 000020EF: SvcErr: DSID-03140552, problem 5010 (UNAVAIL_EXTENSION), data 0+LDAP: error code 12 - 000020EF: SvcErr: DSID-03140552, problem 5010 (UNAVAIL_EXTENSION), data 0
  
-workaround/solution: separate ldap search with Base context for group entry searches and divide it into smaller searches(each line with one OU): +workaround/solution: separate ldap search with "Base context for group entry searches" and divide it into smaller searches(each line with one OU): 
-  * OU=001AGL,OU=AGEL,DC=ad,DC=agel,DC=cz +  * OU=001OU,OU=FIRMA,DC=ad,DC=FIRMA,DC=cz 
-  * OU=002NPO,OU=AGEL,DC=ad,DC=agel,DC=cz +  * OU=002OU,OU=FIRMA,DC=ad,DC=FIRMA,DC=cz 
-  * OU=003NCT,OU=AGEL,DC=ad,DC=agel,DC=cz +  * OU=003OU,OU=FIRMA,DC=ad,DC=FIRMA,DC=cz 
-  * OU=004NNJ,OU=AGEL,DC=ad,DC=agel,DC=cz +  * OU=004OU,OU=FIRMA,DC=ad,DC=FIRMA,DC=cz 
-  * OU=005HPO,OU=AGEL,DC=ad,DC=agel,DC=cz +  * OU=005OU,OU=FIRMA,DC=ad,DC=FIRMA,DC=cz 
-atd... + 
 +Another way to solve this problem is by using "Custom group search filter" in the system configuration.
 </note> </note>
  
Line 80: Line 81:
 {{ :tutorial:adm:wfad04.png |}} {{ :tutorial:adm:wfad04.png |}}
  
-  * Now we will map just 3 attributes. Click on green add button like on picture below and this fill in: +  * Now we will map just 4 attributes. Click on green add button like on picture below and this fill in: 
  
 <code> <code>
 | Attribute in schema | Name               | Attribute          | IdM key            | | Attribute in schema | Name               | Attribute          | IdM key            |
 | __Name__ (__GROUP__)| Distinguished name | extended           | distinguished_name | | __Name__ (__GROUP__)| Distinguished name | extended           | distinguished_name |
-| name (__GROUP__)    | name               | identifier, entity | name               | +| name (__GROUP__)    | name               | entity             | name               | 
-| __UID__ (__GROUP__) | __UID__            |                    |                    |+| code (__GROUP__)    | name               | entity             | code               | 
 +| __UID__ (__GROUP__) | __UID__            | identifier         |                    |
 </code> </code>
  
Line 95: Line 97:
 {{ :tutorial:adm:wfad06.png |}} {{ :tutorial:adm:wfad06.png |}}
  
-  * Enable **Allowed** and **Reconcillation**. Fill **Name, Set of mapped attributes** and then **Correlation attribute** as  '\_\_UID\_\_'.+  * Enable **Allowed** and **Reconcilation**. Fill **Name, Set of mapped attributes** and then **Correlation attribute** as  '\_\_UID\_\_'.
   * Bellow there are 4 possibilities on state when synchronization starts (Linked, Not linked, Missing entity, Missing account).   * Bellow there are 4 possibilities on state when synchronization starts (Linked, Not linked, Missing entity, Missing account).
     * **Linked** - it's like update, group is in the AD and also in IdM, but it is possible in the AD could be some change, so usually **Action** is "Update entity"     * **Linked** - it's like update, group is in the AD and also in IdM, but it is possible in the AD could be some change, so usually **Action** is "Update entity"
Line 131: Line 133:
 Otherwise provisioning of any user who is a member of the modified group will fail with following error in provisioning queue. Otherwise provisioning of any user who is a member of the modified group will fail with following error in provisioning queue.
  
-==== 2) Delete group in Actvive Directory or move group from CzechIdM scope ====+==== 2) Delete group in Active Directory or move group from CzechIdM scope ====
  
  
 If you want to delete role or move it from IDM scope: If you want to delete role or move it from IDM scope:
-  * Make sure that no users have assigned role for this group and than delete role from IDM and that role is not used as automatic role.+  * Make sure that no users have assigned role for this group and that the role is not used as automatic role.
   * Then you can remove group from AD and **remove role from managed attributes**.   * Then you can remove group from AD and **remove role from managed attributes**.
  
-If you deleted groups or moved from IDM scope and you will try provisioning of users with linked role before synchronization of roles, provisionong will not be successful.  +If you deleted groups or moved from IDM scope and you will try provisioning of users with linked role before synchronization of roles, provisioning will not be successful.  
-You will recognize this situation by error mention in begining of chapeter and also if you will run synchronization of groups, in log of synchronization you will have some items in state **Missing account**.+ 
 +You will recognize this situation by error mentioned in the note above and also if you will run synchronization of groups, in log of synchronization you will have some items in the state **Missing account**.
  
 **To correctly remove group and role:** **To correctly remove group and role:**
  • by kotynekv