Microsoft Active Directory (MS AD) wizard for users
The main importance of wizards is to simplify the work of the user, so as to avoid complicated entering values and possibly to avoid common mistakes. System wizards are used primarily to create a new system connected to a given external system. The first step is to select the connector you want to use for the connection.
The most ambitious is the wizard for connecting the Microsoft Active Directory system (AD). Connecting AD within IdM is very important and at the same time manual connection can be a relatively complex matter for many and more advanced users. The complication starts in communication with AD. Here it is very important to use secure communication (SSL), which requires the installation of a correct certificate. It is also important to verify that our service AD account has sufficient privileges. However, the biggest difficulties can occur with many rules that must be followed during the connection (connector settings) and especially in the way to correctly map the individual attributes of AD. Selecting the correct attributes to map to AD may not be easy for inexperienced users.
This wizard therefore solves all the mentioned problems and is based on our best experience of how to effectively manage an AD system.
Connection to an AD system
In the first step, choose the name of the system as you want it to appear in IdM. Next, fill access data to the connected AD. Ie. host name, TCP port, user name and password.
Certificate
In the second step, the wizard can download the certificate from the AD and save it to the server. First, the wizard verifies that your IdM server has the correct certificate installed for communication with AD. Next, the certificate is searched directly in AD. The goal is to find a certificate issued by the highest possible authority. The found certificate needs to be inserted into the trusted certificate store and the IdM restarted. The reason why we do not recommend using a server certificate directly in the trusted certificate store (it would be functionally sufficient) is its shorter validity (typically only 1 year).
Check of permissions
In the next step, you have the option to perform a set of tests for a successful IdM connection. The most basic test is to create and delete a user. This will verify that you have correctly defined the rights for the service account that IdM accesses to AD and set the authentication information correctly in the previous steps.
Not all tests need to be performed to complete the connection. For example, grouping a user is an optional operation for some deployments
Additional data
The next step specifies in which OUs users are managed and where protected are placed. In the simplest cases, all OUs will be the same. The most interesting is the option to create a synchronization. This will indicate that you want to preconfigure pairing synchronization, which you will use later so that the accounts on the newly connected AD system link correctly to the identities in CzechIdM.
If you want, you can also activate protected mode in this step. This is to prevent deleting the account in AD. For example: If an identity in IdM ceases to be valid (contract expires), its account in AD will not be deleted, but will be moved to the OU for deleted accounts.
Attributes
In the penultimate step, the wizard prompts you to specify which attributes of the user account in AD you want to manage and from which identity attribute in IdM you want to fulfill them.
The wizard automatically offers the most frequently used attributes and their typical fulfillment from CzechIdM. If there are some attributes that you do not use in your AD or do not want to fulfill, disable them or remove them from the list altogether.
The wizard automatically sets even the most common transformation rules for fulfillment. For example, to fill DN (_ NAME _) or displayName , where it selects the first and last name combination. If you want to perform some attributes with a different transformation than the one listed here, you can now deactivate the attribute and later modify the transformation to your liking.
Conclusion
The last step of this wizard only informs you about the successful completion and allows you to be redirected to the detail of the new system. For example, you can immediately start a pairing sync on this detail, which loads the users in the OU you specify and tries to pair them with existing users in IdM.
