Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
tutorial:adm:ad_groups_sync [2020/03/17 08:40] kubicar [Connector configuration] |
tutorial:adm:ad_groups_sync [2021/07/16 12:52] stekld [Systems - AD: Groups synchronization] |
||
|---|---|---|---|
| Line 2: | Line 2: | ||
| This tutorial is intended as a guide for administrators that want to load AD groups into CzechIdM (either one time or as a scheduled job). | This tutorial is intended as a guide for administrators that want to load AD groups into CzechIdM (either one time or as a scheduled job). | ||
| + | |||
| + | <note important> | ||
| You will learn | You will learn | ||
| Line 7: | Line 9: | ||
| * how to use a groups sync workflow | * how to use a groups sync workflow | ||
| * how to prepare users to be able to assign them IdM roles by their AD groups | * how to prepare users to be able to assign them IdM roles by their AD groups | ||
| + | |||
| ===== Before you start ===== | ===== Before you start ===== | ||
| - | First of all, you need to download the connector from Connid (e.g. [[http:// | ||
| - | Then add the jar file into the CzechIdM folder inside the application server. In case you installed CzechIdM into tomcat by standard installation, | ||
| - | <note tip>To preserve the connector | + | ==== Adding Active Directory |
| - | < | + | |
| - | ln -s / | + | |
| - | </ | + | |
| - | </ | + | |
| - | Then restart the application server. If you had CzechIdM already running in the web browser, refresh also the web browser window (e.g. Ctrl+F5). | + | Since CzechIdM 9.2, the [[https:// |
| + | ==== System for managing AD users ==== | ||
| - | Then with tutorial [[.eav|]], you should | + | Loading AD groups to IdM is usually done when you want to manage the group membership of the AD users by IdM. So connecting the system for managing AD users is a logical step before you start to synchronize the groups. |
| + | |||
| + | If you followed the [[.manage_ad|tutorial | ||
| + | * the attribute '' | ||
| + | * the attribute '' | ||
| + | |||
| + | However, it's a common request to do **initial** loading of the group membership from AD. This topic will be covered later. FIXME synchronization of AD users with mapped distinguishedName to EAV of identity, so the [[..dev: | ||
| + | |||
| + | ==== Automatic creation of automatic roles ==== | ||
| + | |||
| + | The synchronization of AD groups can also create some automatic roles based on the position of the groups in AD. These are specific options of the [[..dev: | ||
| Line 42: | Line 50: | ||
| * **Principal password** - password of the " | * **Principal password** - password of the " | ||
| * **Root suffixes** - there should be DNs of **Base contexts**, groups outside of these " | * **Root suffixes** - there should be DNs of **Base contexts**, groups outside of these " | ||
| - | * **Entry object classes** - List of all objectClasses groups have in AD. It is necessary to find just groups. With wrong settings, it could find even users. | + | * **Entry object classes** - List of all objectClasses groups have in AD. It is necessary to find just groups. With wrong settings, it could find even users. |
| - | * **Group search scope** - Choose | + | * **Group search scope** - Default subtree. Options: |
| - | * **Custom group search filter** - this enables additional filter for groups, which will be searched for. You can use it e.g. to filter out roles with some specific substrings in their CN by using LDAP filter '' | + | * **Custom group search filter** - this enables additional filter for groups, which will be searched for. You can use it e.g. to filter out roles with some specific substrings in their CN by using LDAP filter '' |
| * **Base contexts for group entry searches** - list of distinguished names (paths), where it will search for groups. | * **Base contexts for group entry searches** - list of distinguished names (paths), where it will search for groups. | ||
| * **Group members reference attribute** - a name of the attribute, which indicates membership. It contains whole DNs of users. | * **Group members reference attribute** - a name of the attribute, which indicates membership. It contains whole DNs of users. | ||
| * **useVlvControls** - have to be enabled - this is only supported option | * **useVlvControls** - have to be enabled - this is only supported option | ||
| * **pageSize** - number, it should be lower than maximum page size limit in AD, which is by default 1000. Recommended: | * **pageSize** - number, it should be lower than maximum page size limit in AD, which is by default 1000. Recommended: | ||
| - | * **vlvSortAttribute** - this should be identifier with sorting properties. Recommended for groups is cn. **DO NOT** user **distinguishedName** or any other unindexed attribute or you'll end up with " | + | * **vlvSortAttribute** - this should be identifier with sorting properties. Recommended for groups is cn. **DO NOT** use **distinguishedName** or any other unindexed attribute or you'll end up with " |
| * **Uid Attribute for groups** - unique identifier, recommended is objectGUID. | * **Uid Attribute for groups** - unique identifier, recommended is objectGUID. | ||
| * **Object classes to synchronize** - Based on this filled object classes, groups to synchronized will be found. Content is usually same as **Entry object classes**. | * **Object classes to synchronize** - Based on this filled object classes, groups to synchronized will be found. Content is usually same as **Entry object classes**. | ||
| Line 61: | Line 69: | ||
| LDAP: error code 12 - 000020EF: SvcErr: DSID-03140552, | LDAP: error code 12 - 000020EF: SvcErr: DSID-03140552, | ||
| - | workaround/ | + | workaround/ |
| - | * OU=001AGL, | + | * OU=001OU, |
| - | * OU=002NPO, | + | * OU=002OU, |
| - | * OU=003NCT, | + | * OU=003OU, |
| - | * OU=004NNJ, | + | * OU=004OU, |
| - | * OU=005HPO, | + | * OU=005OU, |
| - | and so on... | + | |
| + | Another way to solve this problem is by using " | ||
| </ | </ | ||
| Line 74: | Line 83: | ||
| * Firstly in **Scheme** tab generate a schema with a green button. If there is some exception, you have probably mistake in the configuration of the connector. | * Firstly in **Scheme** tab generate a schema with a green button. If there is some exception, you have probably mistake in the configuration of the connector. | ||
| - | {{ : | + | {{ : |
| * Then in **Mapping** tab create new mapping - synchronization (\_\_GROUP\_\_ (Object name), Role (Entity type)). | * Then in **Mapping** tab create new mapping - synchronization (\_\_GROUP\_\_ (Object name), Role (Entity type)). | ||
| - | {{ : | + | {{ : |
| - | * Now we will map just 3 attributes. Click on green add button like on picture below and this fill in: | + | * Now we will map just 4 attributes. Click on green add button like on picture below and this fill in: |
| < | < | ||
| | Attribute in schema | Name | Attribute | | Attribute in schema | Name | Attribute | ||
| - | | __Name__ | + | | __NAME__ |
| - | | name (__GROUP__) | + | | name (__GROUP__) |
| - | | __UID__ (__GROUP__) | __UID__ | + | | name (__GROUP__) |
| + | | __UID__ (__GROUP__) | __UID__ | ||
| </ | </ | ||
| - | {{ : | + | {{ : |
| * In **Synchronization** tab create new synchronization. | * In **Synchronization** tab create new synchronization. | ||
| Line 95: | Line 105: | ||
| {{ : | {{ : | ||
| - | * Enable **Allowed** and **Reconcillation**. Fill **Name, Set of mapped attributes** and then **Correlation attribute** as ' | + | * Enable **Allowed** and **Reconcilation**. Fill **Name, Set of mapped attributes** and then **Correlation attribute** as ' |
| * Bellow there are 4 possibilities on state when synchronization starts (Linked, Not linked, Missing entity, Missing account). | * Bellow there are 4 possibilities on state when synchronization starts (Linked, Not linked, Missing entity, Missing account). | ||
| * **Linked** - it's like update, group is in the AD and also in IdM, but it is possible in the AD could be some change, so usually **Action** is " | * **Linked** - it's like update, group is in the AD and also in IdM, but it is possible in the AD could be some change, so usually **Action** is " | ||
| Line 121: | Line 131: | ||
| remaining name ' | remaining name ' | ||
| </ | </ | ||
| - | This error means that CzechIdM can not find DisniguishedName | + | This error means that CzechIdM can not find DistinguishedName |
| This group could be renamed, moved or deleted. | This group could be renamed, moved or deleted. | ||
| - | if you come across a mentioned error, just delete items in provisioning queue for users, go through the specified tutorial and resave stuck users when it's finished. | + | If you come across a mentioned error, just delete items in provisioning queue for users, go through the specified tutorial and resave stuck users when it's finished. |
| </ | </ | ||
| Line 131: | Line 141: | ||
| Otherwise provisioning of any user who is a member of the modified group will fail with following error in provisioning queue. | Otherwise provisioning of any user who is a member of the modified group will fail with following error in provisioning queue. | ||
| - | ==== 2) Delete group in Actvive | + | ==== 2) Delete group in Active |
| If you want to delete role or move it from IDM scope: | If you want to delete role or move it from IDM scope: | ||
| - | * Make sure that no users have assigned role for this group and than delete role from IDM and that role is not used as automatic role. | + | * Make sure that no users have assigned role for this group and that the role is not used as automatic role. |
| * Then you can remove group from AD and **remove role from managed attributes**. | * Then you can remove group from AD and **remove role from managed attributes**. | ||
| - | If you deleted groups or moved from IDM scope and you will try provisioning of users with linked role before synchronization of roles, | + | If you deleted groups or moved from IDM scope and you will try provisioning of users with linked role before synchronization of roles, |
| - | You will recognize this situation by error mention | + | |
| + | You will recognize this situation by error mentioned | ||
| **To correctly remove group and role:** | **To correctly remove group and role:** | ||
| Line 147: | Line 158: | ||
| * Remove the role from IDM. | * Remove the role from IDM. | ||
| * Remove group from AD. | * Remove group from AD. | ||
| - | * Go to system for AD User -> Attributes | + | * Go to system for AD User -> Attributes |
| <note warning> | <note warning> | ||