Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:manage_ad [2021/02/12 15:50] apeterova failover - multiple lines, removed misleading information |
tutorial:adm:manage_ad [2021/06/24 14:46] soval [Password mapping] |
||
---|---|---|---|
Line 1: | Line 1: | ||
====== Systems - AD: Manage users ====== | ====== Systems - AD: Manage users ====== | ||
- | |||
===== Introduction ===== | ===== Introduction ===== | ||
This tutorial will show you how to connect AD as a target system for users (their accounts) from CzechIdM. We will use an AD bundle connector from ConnId. | This tutorial will show you how to connect AD as a target system for users (their accounts) from CzechIdM. We will use an AD bundle connector from ConnId. | ||
+ | |||
+ | You can as well use [[tutorial: | ||
===== Before you start ===== | ===== Before you start ===== | ||
- | |||
==== Adding Active Directory connector ==== | ==== Adding Active Directory connector ==== | ||
- | |||
Since CzechIdM 9.2, the [[https:// | Since CzechIdM 9.2, the [[https:// | ||
Line 91: | Line 90: | ||
* **Uid Attribute** - this is one of the most important option. It defines the primary key/UID of the account. Attribute values will be stored in CzechIdM for each account. Must be unique and should not change. **It is strongly advised to use " | * **Uid Attribute** - this is one of the most important option. It defines the primary key/UID of the account. Attribute values will be stored in CzechIdM for each account. Must be unique and should not change. **It is strongly advised to use " | ||
* **Object classes to synchronize** - usually the same as "Entry object classes" | * **Object classes to synchronize** - usually the same as "Entry object classes" | ||
- | * **Specified attributes to be returned** - default " | + | * **Specified attributes to be returned** - default " |
<note warning> | <note warning> | ||
Line 165: | Line 164: | ||
* Entity attribute - false | * Entity attribute - false | ||
* Attribute with password - true | * Attribute with password - true | ||
+ | |||
+ | ==== Forced password change ==== | ||
+ | When mapping AD attributes, it is sometimes useful to be able to set a forced password change option. | ||
+ | |||
+ | This requirement is often set for two different cases: | ||
+ | |||
+ | * We need to change the password when logging into AD **for a new user account** | ||
+ | * We need to force a password change but **only after a password reset** | ||
+ | |||
+ | 1/ To force a password change for newly created users, map the **" | ||
+ | |||
+ | |||
+ | 2/ If we need to force password change every time password is reset, map attribute pwdLastSet too, but **with checkbox " | ||
Line 178: | Line 190: | ||
From now on, every time user gets the role, it is provisioned into the connected system AD. You can see that on users detail menu tab " | From now on, every time user gets the role, it is provisioned into the connected system AD. You can see that on users detail menu tab " | ||
+ | |||
+ | <note important> | ||
Line 188: | Line 202: | ||
* **Group members reference attribute** - usually **member**. This represents the name of the attribute in AD that is present in Group. Its value is usually a DN of the user in the group. | * **Group members reference attribute** - usually **member**. This represents the name of the attribute in AD that is present in Group. Its value is usually a DN of the user in the group. | ||
- | Then continue to AD - users Mappings and edit provisioning mapping. Add there a **ldapGroups** attribute. It is not filled from any identity attribute and has no transformation. (It will be filled from the role). Since the attribute is multivalued, | + | Then continue to AD - users Mappings and edit provisioning mapping. Add there a **ldapGroups** attribute. It is not filled from any identity attribute and has no transformation. (It will be filled from the role). Since the attribute is multivalued, |
- | Get back to your role CRM basic user. In the tab **Systems** add a system **AD - users and roles**, save it. Then add an attribute that will be filled by this role - **ldapGroups**. Again choose the filling strategy **MERGE or AUTH.MERGE**. Then **add a transformation** that is the value of DN of the group in AD ' " ' sign on each side of the text. | + | Get back to your role CRM basic user. In the tab **Systems** add a system **AD - users and roles**, save it. Then add an attribute that will be filled by this role - **ldapGroups**. Again choose the filling strategy **MERGE** (or AUTH.MERGE, make sure to use the same as in the provisioning mapping). Then **add a transformation** that is the value of DN of the group in AD ' " ' sign on each side of the text. |
Thus every user that has the role assigned is added to the group with provided DN via ldapGroups attribute. | Thus every user that has the role assigned is added to the group with provided DN via ldapGroups attribute. | ||
Line 215: | Line 229: | ||
If you are running on a Windows server, the ' | If you are running on a Windows server, the ' | ||
+ | |||
+ | ===== Mapping extensionAttributes ===== | ||
+ | |||
+ | AD enables additional attributes named extensionAttribute1 - extensionAttribute10. If you want to fill these attributes by IdM, you must do following steps in the configuration of the connected system: | ||
+ | * Go to **Configuration** -> **Specified attributes to be returned (multi)**, add **extensionAttribute1** to a new line under existing values. | ||
+ | * Go to **Scheme** -> **\_\_ACCOUNT\_\_** -> use the button **Add**, fill in the name **extensionAttribute1**, | ||
+ | * Go to **Mapping** -> **Provisioning mapping** -> use the button **Add** and map the attribute according to your choice. The following example can be used when you want to fill the extensionAttribute1 by personal numbers of identities | ||
+ | * Attribute in schema - extensionAttribute1 | ||
+ | * Name - extensionAttribute1 | ||
+ | * Entity attribute - true | ||
+ | * Entity field - Personal number | ||
===== Connection via SSL not working ===== | ===== Connection via SSL not working ===== | ||
Line 224: | Line 249: | ||
===== LdapErr: DSID-0C0907C5 ===== | ===== LdapErr: DSID-0C0907C5 ===== | ||
If you see this error when reconciliating AD groups: | If you see this error when reconciliating AD groups: | ||
- | < | + | < |
the likely cause is that some groups have many members. AD has a property MaxPageSize which is probably set to lower than necessary (default is 1000). Increasing the value to an arbitrary large number (30000) helped in our case but only AD admin can change this. | the likely cause is that some groups have many members. AD has a property MaxPageSize which is probably set to lower than necessary (default is 1000). Increasing the value to an arbitrary large number (30000) helped in our case but only AD admin can change this. | ||
Line 246: | Line 271: | ||
The value of this property must be a proper URL, e.g. ''< | The value of this property must be a proper URL, e.g. ''< | ||
+ | |||
===== Video Guide ===== | ===== Video Guide ===== | ||
[[https:// | [[https:// |