Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
tutorial:adm:ad_groups_sync [2019/08/22 20:22] apeterova tips |
tutorial:adm:ad_groups_sync [2024/02/16 15:31] (current) kotynekv [Connector configuration] msDS-parentdistname info |
||
---|---|---|---|
Line 3: | Line 3: | ||
This tutorial is intended as a guide for administrators that want to load AD groups into CzechIdM (either one time or as a scheduled job). | This tutorial is intended as a guide for administrators that want to load AD groups into CzechIdM (either one time or as a scheduled job). | ||
- | You will learn | + | <note important> |
+ | |||
+ | You will learn | ||
* how to connect an AD system for groups synchronization | * how to connect an AD system for groups synchronization | ||
* how to use a groups sync workflow | * how to use a groups sync workflow | ||
Line 9: | Line 12: | ||
===== Before you start ===== | ===== Before you start ===== | ||
- | First of all, you need to download the connector from Connid (e.g. [[http:// | ||
- | Then add the jar file into the CzechIdM folder inside the application server. In case you installed CzechIdM into tomcat by standard installation, | ||
- | <note tip>To preserve the connector | + | ==== Adding Active Directory |
- | < | + | |
- | ln -s / | + | |
- | </ | + | |
- | </ | + | |
- | Then restart the application server. If you had CzechIdM already running in the web browser, refresh also the web browser window (e.g. Ctrl+F5). | + | Since CzechIdM 9.2, the [[https:// |
+ | ==== System for managing AD users ==== | ||
- | Then with tutorial [[.eav|]], | + | Loading AD groups to IdM is usually done when you want to manage the group membership of the AD users by IdM. So connecting |
+ | If you followed the [[.: | ||
+ | |||
+ | * the attribute '' | ||
+ | * the attribute '' | ||
+ | |||
+ | However, it's a common request to do **initial** | ||
+ | |||
+ | ==== Automatic creation of automatic roles ==== | ||
+ | |||
+ | The synchronization of AD groups can also create some automatic roles based on the position of the groups in AD. These are specific options of the [[..: | ||
===== Create system ===== | ===== Create system ===== | ||
- | * Go to **Systems** in the left menu and then click on **Add**. | + | * Go to **Systems** |
- | {{ : | + | {{ .: |
* Fill in name of a system. And click on **Save and continue**. | * Fill in name of a system. And click on **Save and continue**. | ||
- | * In tab **Configuration** choose AD connector (net.tirasa.connid.bundles.ad.ADConnector) | + | * In tab **Configuration** |
- | {{ : | + | {{ .: |
===== Connector configuration ===== | ===== Connector configuration ===== | ||
+ | |||
On this page fill in these important values: | On this page fill in these important values: | ||
- | | + | |
- | * **Server port** - on this port will server listen | + | |
- | * **Principal** - with this username connector will connect to the AD system, this user has to have enough rights to reads groups | + | * **Server port** |
- | * **Principal password** - password of the " | + | * **Principal** |
- | * **Root suffixes** - there should be DNs of **Base contexts**, groups outside of these " | + | * **Principal password** |
- | * **Entry object classes** - List of all objectClasses groups have in AD. It is necessary to find just groups. With wrong settings, it could find even users. | + | * **Root suffixes** |
- | * **Group search scope** - Choose | + | * **Entry object classes** |
- | * **Custom group search filter** - this enables additional filter for groups, which will be searched for. You can use it e.g. to filter out roles with some specific substrings in their CN by using LDAP filter '' | + | * **Group search scope** |
- | * **Base contexts for group entry searches** - list of distinguished names (paths), where it will search for groups. | + | * **Custom group search filter** |
- | * **Group members reference attribute** - a name of the attribute, which indicates membership. It contains whole DNs of users. | + | * **Base contexts for group entry searches** |
- | * **useVlvControls** - have to be enabled - this is only supported option | + | * **Group members reference attribute** |
- | * **pageSize** - number, it should be greater | + | * **useVlvControls** |
- | * **vlvSortAttribute** - this should be identifier with sorting properties. Recommended is sAMAccountName. | + | * **pageSize** |
- | * **Uid Attribute for groups** - unique identifier, recommended is sAMAccountName or objectGUID. | + | * **vlvSortAttribute** |
- | * **Object classes to synchronize** - Based on this filled object classes, groups to synchronized will be found. Content is usually same as **Entry object classes**. | + | * **Uid Attribute for groups** |
+ | * **Object classes to synchronize** | ||
+ | <note tip> | ||
+ | |||
+ | <note tip> In user provisioning system' | ||
+ | |||
+ | workaround/ | ||
+ | |||
+ | * OU=001OU, | ||
+ | * OU=002OU, | ||
+ | * OU=003OU, | ||
+ | * OU=004OU, | ||
+ | * OU=005OU, | ||
+ | |||
+ | Another way to solve this problem is by using " | ||
===== Connector' | ===== Connector' | ||
- | * Firstly in **Scheme** tab generate a schema with a green button. If there is some exception, you have probably mistake in the configuration of the connector. | ||
- | {{ : | + | * Firstly in **Scheme** |
- | * Then in **Mapping** tab create new mapping | + | {{ .:systems_-_ad: |
- | {{ : | + | * Then in **Mapping** |
- | * Now we will map just 3 attributes. Click on green add button like on picture below and this fill in: | + | {{ |
+ | * Now we will map just 4 attributes. Click on green add button like on picture below and this fill in: | ||
< | < | ||
+ | |||
| Attribute in schema | Name | Attribute | | Attribute in schema | Name | Attribute | ||
- | | __Name__ | + | | __NAME__ |
- | | name (__GROUP__) | + | | name (__GROUP__) |
- | | __UID__ (__GROUP__) | __UID__ | + | | name (__GROUP__) |
+ | | __UID__ (__GROUP__) | __UID__ | ||
</ | </ | ||
- | {{ :tutorial: | + | {{ .:systems_-_ad:mapping_ad_groups_2.png? |
- | * In **Synchronization** tab create new synchronization. | + | * In **Synchronization** |
- | {{ : | + | {{ .: |
- | * Enable **Allowed** and **Reconcillation**. Fill **Name, Set of mapped attributes** and then **Correlation attribute** | + | * Enable **Allowed** |
* Bellow there are 4 possibilities on state when synchronization starts (Linked, Not linked, Missing entity, Missing account). | * Bellow there are 4 possibilities on state when synchronization starts (Linked, Not linked, Missing entity, Missing account). | ||
- | | + | |
- | * **Not Linked** - this means the group is in the AD and also in IdM, but in IdM was not created by synchronization, | + | * **Not Linked** |
- | * **Missing entity** - in other words - create action - group is in the AD, but in IdM it is not. It could be newly created in the AD, so it is not yet in IdM or it could be already erased in IdM. But this situation only supports " | + | * **Missing entity** |
- | * **Missing account** - or " | + | * **Missing account** |
- | * In each of these possibilities there is a select box " | + | * In each of these possibilities there is a select box " |
- | {{ : | + | {{ .: |
- | {{ : | + | |
+ | ===== Synchronization of groups ===== | ||
- | ===== Synchronization ===== | ||
At this point configuring of synchronization is complete. Save this synchronization and run it. It should smoothly create a catalog, new roles and maybe even some automatic roles. If provisioning of memberships will fail do not forget to try " | At this point configuring of synchronization is complete. Save this synchronization and run it. It should smoothly create a catalog, new roles and maybe even some automatic roles. If provisioning of memberships will fail do not forget to try " | ||
- | <note tip> In user provisioning system' | ||
- | <note tip> In user provisioning system' | ||
+ | <note tip>If you synchronize groups with resolving users membership, the connector doesn' | ||
+ | |||
+ | ==== Editing groups in Active Directory ==== | ||
+ | |||
+ | CzechIdM managing membership of users in Active Directory groups, editing of groups is controlled by administrators directly in AD, you need to link these edits with IDM. If you will don't follow correct steps, you will end with following error in provisioning of users with incorrectly edited AD group: | ||
+ | |||
+ | <note tip> | ||
+ | < | ||
+ | |||
+ | org.identityconnectors.framework.common.exceptions.ConnectorException: | ||
+ | [LDAP: error code 32 - 0000208D: NameErr: DSID-03100288, | ||
+ | remaining name ' | ||
+ | |||
+ | </ | ||
+ | |||
+ | This error means that CzechIdM can not find DistinguishedName set in assigned role for any group in Active Directory. This group could be renamed, moved or deleted. If you come across a mentioned error, just delete items in provisioning queue for users, go through the specified tutorial and resave stuck users when it's finished. </ | ||
+ | |||
+ | ==== 1) Rename or move group in Active Directory ==== | ||
+ | |||
+ | Synchronization must be started after each time you **rename** | ||
+ | |||
+ | ==== 2) Delete group in Active Directory or move group from CzechIdM scope ==== | ||
+ | |||
+ | If you want to delete role or move it from IDM scope: | ||
+ | |||
+ | * Make sure that no users have assigned role for this group and that the role is not used as automatic role. | ||
+ | * Then you can remove group from AD and **remove role from managed attributes**. | ||
+ | |||
+ | If you deleted groups or moved from IDM scope and you will try provisioning of users with linked role before synchronization of roles, provisioning will not be successful. | ||
+ | |||
+ | You will recognize this situation by error mentioned in the note above and also if you will run synchronization of groups, in log of synchronization you will have some items in the state **Missing account**. | ||
+ | |||
+ | **To correctly remove group and role:** | ||
+ | |||
+ | * Open synchronization item with **Missing account** | ||
+ | * Go to **Account on system** | ||
+ | * Make sure that you remove this role from all users. | ||
+ | * Remove the role from IDM. | ||
+ | * Remove group from AD. | ||
+ | * Go to system for AD User → Attributes mapping → Mapping for provisioning and click on attribute **ldapGroups** | ||
+ | |||
+ | <note warning> If you will not perform last step and role was just moved from scope of IDM, because you want to manage this role without IDM → **IDM will still remove group managed users!** | ||
===== Tips ===== | ===== Tips ===== | ||
+ | |||
+ | ==== CREATE NEW GROUP IN ACTIVE DIRECTORY ==== | ||
You can create a new security group in Active Directory with the Apache Directory Studio by following these steps: | You can create a new security group in Active Directory with the Apache Directory Studio by following these steps: | ||
- Select an existing group | - Select an existing group | ||
- | - Right click on the group name -> New -> New entry | + | - Right click on the group name → New → New entry |
- Check the "Use existing entry as template" | - Check the "Use existing entry as template" | ||
- | - Object classes: Write " | + | - Object classes: Write " |
- | - Distinguished Name: Set the value of RDN to your choice | + | - Distinguished Name: Set the value of RDN to your choice |
- A warning is displayed - click Cancel | - A warning is displayed - click Cancel | ||
- Set instanceType = 4 | - Set instanceType = 4 | ||
- | - Set sAMAccountName to your choice (right click -> Edit values) | + | - Set sAMAccountName to your choice (right click → Edit values) |
- | - Delete values (right click -> Delete values) of these attributes: | + | - Delete values (right click → Delete values) of these attributes: |
- | - nTSecurityDescriptor | + | - nTSecurityDescriptor |
- | - objectCategory | + | - objectCategory |
- | - member (if you don't want to copy members) | + | - member (if you don't want to copy members) |
- | - sAMAccountType | + | - sAMAccountType |
- | {{: | + | {{.: |
Finally, click Finish | Finally, click Finish | ||