Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:manage_ad [2019/11/20 12:14] doischert [Connector configuration] |
tutorial:adm:manage_ad [2020/01/14 13:35] apeterova Failover |
||
---|---|---|---|
Line 1: | Line 1: | ||
====== Systems - AD: Manage users ====== | ====== Systems - AD: Manage users ====== | ||
- | <note warning> | ||
===== Introduction ===== | ===== Introduction ===== | ||
- | This tutorial will show you how to connect AD as a target system for users (their accounts) from CzechIdM. We will use an AD bundle connector from Connid. | + | This tutorial will show you how to connect AD as a target system for users (their accounts) from CzechIdM. We will use an AD bundle connector from ConnId. |
===== Before you start ===== | ===== Before you start ===== | ||
==== Adding Active Directory connector ==== | ==== Adding Active Directory connector ==== | ||
+ | |||
+ | <note warning> | ||
First of all, you need to download the connector from Connid (e.g. [[http:// | First of all, you need to download the connector from Connid (e.g. [[http:// | ||
Line 86: | Line 87: | ||
* **Server hostname** - hostname or IP | * **Server hostname** - hostname or IP | ||
* **Server port** - usually 389 or 636 | * **Server port** - usually 389 or 636 | ||
+ | * **Failover** - an optional list of other domain controllers used in the case that the primary server is not available. Use URL format ''< | ||
* **Principal** - login of the user with admin privilege that CzechIdM will use for the connection. DN of the user should work too. | * **Principal** - login of the user with admin privilege that CzechIdM will use for the connection. DN of the user should work too. | ||
* **Principal password** - password of the administrator user | * **Principal password** - password of the administrator user | ||
Line 221: | Line 223: | ||
{{ : | {{ : | ||
+ | |||
+ | ===== ldapGroups not returned ===== | ||
+ | |||
+ | If you are running on a Windows server, the ' | ||
===== Connection via SSL not working ===== | ===== Connection via SSL not working ===== | ||
Line 227: | Line 233: | ||
{{: | {{: | ||
click on View certificate -> tab General -> field Issued To -> Common name(CN) and use this value as server hostname. | click on View certificate -> tab General -> field Issued To -> Common name(CN) and use this value as server hostname. | ||
+ | |||
+ | ===== LdapErr: DSID-0C0907C5 ===== | ||
+ | If you see this error when reconciliating AD groups: | ||
+ | < | ||
+ | |||
+ | the likely cause is that some groups have many members. AD has a property MaxPageSize which is probably set to lower than necessary (default is 1000). Increasing the value to an arbitrary large number (30000) helped in our case but only AD admin can change this. | ||
===== Video Guide ===== | ===== Video Guide ===== | ||
[[https:// | [[https:// |