Identity Synchronizer User administration in Domino controlled by Active Directory

Transcription

1 Identity Synchronizer User administration in Domino controlled by Active Directory Contact Max Bakken EVRY

2 TDI Tivoli Directory Integrator TDI in IBM Collaboration products IBM Connections IBM Connections Cloud IBM Sametime Unified Telephony IBM Mashups IBM Domino (v. 8+ for any integration in/out of Domino) Domino Windows Single-Signon (SPNEGO) PDM2Quickr & WCM2Quickr conversion utilities EVRY AS 2

3 TDI Tivoli Directory Integrator

4 About the solution By using an automated solution for user management of domino users: o Save administrators time o Automatic renaming of users using domino data. o Consistent data between solutions. o Reduces steps on password changes on each users. o Registering users only at one place 4

5 Overview Synchronization of active directory users into domino Create, modify, delete and name change of domino users. Active directory user overview with link information. Synchronization of additional data from other data sources. Configurable data mapping for update of the domino directory 5

6 System diagram AD changes Data MQ HR (S1) S2 TDI Update jobs S3 AD Controller Password changes Password MQ S4 Store AD and DD data for matchup DB2 or SQL server TDI Password process TDI System processes Get administrative confirmations Domino Administration database Domino IDVault ADD / Update / Delete Domino users (Directory) 6

7 TDI processes (assembly lines) The solution is logically divided into several TDI assembly lines for the different features of the synchronization job. 7

8 Based on Message Queue Ensures safe transfer of data, you will not loose any data. The queues are set to be persistent. TDI is default using Apache ActiveMQ that is the most popular and powerful open source messaging and Integration Patterns server. TDI can be changed to use any other queue solution. 8

9 Full configuration in properties All jobs are controlled by configurable properties. The property file can be fully encrypted. Default only the passwords are encrypted for easier maintenance 9

10 Active Directory changes We are detecting all active directory changes of users. o New users o Modify users o Name change o Password change (done encrypted and safely using the TDI password plugin on the domain controllers). o User deletions 10

11 Active directory users 11

12 User profile General information 12

13 User profile All attributes and mappings Configurable mappings of data fields in AD, Domino and other data sources. Automatic update of domino directory. 13

14 User profile - Request overview All request that are active or completed are easy to find linked to the user they were performed on 14

15 Requests These request are generated by TDI. Changes in the active directory and the additional data sources are generating these requests. Request types are: Create, link, modify, delete and name change. o Link request are linked to the domino directory by field tdiadid, and tdidomid o Delete and name change requests will generate an adminp request when an administrator does accept the changes. The adminp request are a native domino task, that will maintain user integrity. o Create, link, delete and name changes must be verified by an administrator. o Modification of other attributes will be processed automatically Sample of change log for a user: 15

16 User request done in Notes application 16

17 Certificates Overview of all the domino certificates. o The certifier list is updated by TDI from Domino directory o An administrator configure and activate the desired certificates. 17

18 Domino users from Domino Directory 18

19 Domino directory Synchronizing data from Active directory and additional data sources. o You may configure and synchronize from multiple external sources. o Data may be in any formats, like xml, json, sql, etc. o The only requirement is that there is an valid unique key in the data 19

20 Password changes in real time All password changes are sent to a message queue encrypted from the domain controllers. The passwords are processed by TDI real-time, and updates the ID- Vault id file. Restart the Notes client after password update, and the new id file will be downloaded from IDVault with the correct password. 20

21 Spørsmål? 21

22