Customer Premise Installation Guide. Active Directory Synchronization. Apptix Live Support:

Transcription

1 Customer Premise Installation Guide Active Directory Synchronization DOCUMENT REVISION DATE: March, 2010

2 AD Sync Customer Installation Guide / Requirements Page 2 of 11 Deployment Diagram Deployment Diagram Installation Requirements and Prerequisites At the customer premise a dedicated Agent Node machine server will be required which meets the following specifications: Be a member of the domain forest which is going to be synchronized so that it has access to actiove directory Have a connect to the internet so that it may reach the Apptix AOD synchronization web service Have Microsoft.NET 2.0 framework or later installed In addition, the following customer premise firewall ports need to be open: Source Target:Port Explanation Agent Node POA Web Service:443 Agent to POA Web Service Agent Node Cust DC:389 Agent Queries Customer Prem AD via DC Domain Controller Agent Node:135 Password filter installed on each Customer DC communicates with AgentNode Password Sync Agent.

3 AD Sync Customer Installation Guide / Downloading Agent Installers Page 3 of 11 Downloading Agent Installers To be able to integrate external AD with POA, you should install agents inside your Windows network. These agents are: ADSynchronizationAgent.msi. This component is responsible for scanning external Active Directory and communication with the AD Sync web service over the internet. It should be installed on any server in external domain except for the Domain Controllers. ADPasswordChangeFilter.msi. Password Filter is a DLL that runs within the Local Security Authority process of every Domain Controller in the domain. It intercepts all the password change events and sends the new password data to the Password Change Listener. The Password Change Listener is embedded into the AD Synchronization Agent, which communicates with the AD Sync web service. The communication between the AD Synchronization Agent and AD Sync web service is performed over SSL-encrypted connection. To download these installers, perform the following operations: 1 Go to Hosting > Configuration & Administration > Directory Synchronization > Service. The Ad Sync service Overview page will open. 2 Move to the Agent Installation tab. At this page you will find the following information: In the Agent Configuration area Entry Point - the URL of the Web Service that receives data from external AD and passes them to POA. You will have to provide this URL during Synchronization Agent installation. Contacts Synchronization - this indicator shows whether the synchronization of Contacts from external AD is allowed. This parameter is configured at Provider's level. In the Download area you will find links to agent installers: Synchronization Agent Installer (x64), Password Synchronization Agent Installer (x64). 3 Click on the link to download any installer.

4 Installing Synchronization Agent AD Sync Customer Installation Guide / Installing Synchronization Agent Page 4 of 11 To install the Synchronization agent, perform the following steps: 1 Log on to the server, which is joined to your Active Directory Domain (you should be a member of the Domain Administrators group). 2 Make sure that a.net framework is installed on the computer. If not, install it. 3 Run ADSynchronizationAgent.msi. 4 At the Welcome page click Next. 5 Select the installation folder of the Synchronization agent and click Next. 6 Enter the password for the AD Synchronization agent user account. If the user does not exist, it will be created immediately. Otherwise, enter the credentials of already created user and then click Next. 7 At the next screen provide the following information: Web service URL. This URL should be taken from the Customer control panel, Hosting > Configuration & Administration > Directory Synchronization > Service > Agent Installation tab. Figure 1

5 AD Sync Customer Installation Guide / Installing Synchronization Agent Page 5 of 11 POA staff member login and password. Enter the credentials of the Staff Member that was created at the Directory Synchronization service activation in CCP (on page 10). Click Next. 8 At the next screen mark the checkbox if you want to run the initial synchronization right after installation completion. Click Close. Note: Before the first synchronization attempt, you are strongly recommended to edit the agent config file (on page 16). 9 The installation process starts. After the installation completes, you can find the synchronization task in the Windows scheduler (Start > Administrative Tools > Task Scheduler > under Task Scheduler library directory). NOTE: IF a self-signed certificate is being used on the remote CDI server (the server at the Providers Apptix premise) in order for the ADSyncAgent and the ADPasswordSync Agent to work, the remote side certificate will need to be installed on the you re ADSync Server at the machine level.

6 In order to do this the following must be done: AD Sync Customer Installation Guide / Installing Synchronization Agent Page 6 of 11 Step-by-step instructions on importing the certificate into the local machine storage: 1. Click Start, and then click Run. 2. In the Open box, type mmc, and then click OK. 3. On the File menu click Add/Remove snap-in. 4. In the Add/Remove Snap-in dialog box, click Add. 5. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add. 6. In the Certificates snap-in dialog box, click Computer account, and then click Next. 7. In the Select Computer dialog box, click Local computer: (the computer this console is running on), and then click Finish. 8. In the Add Standalone Snap-in dialog box, click Close. 9. In the Add/Remove Snap-in dialog box, click OK. 10. In the left pane of the console, double-click Certificates (Local Computer). 11. Right-click Trusted Root Certification Authorities, point to All Tasks, and then click Import. 12. On the Welcome to the Certificate Import Wizard page, click Next. 13. On the File to Import page, click Browse, locate your certificate file, and then click Next. 14. If the certificate has a password, type the password on the Password page, and then click Next. 15. On the Certificate Store page, click Place all certificates in the following store, and then click Next. 16. Click Finish, and then click OK to confirm that the import was successful. An alternative to steps is copy-pasting the certificate from the current user store: 11. On the File menu click Add/Remove snap-in. 12. In the Add/Remove Snap-in dialog box, click Add. 13. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add. 14. In the Certificates snap-in dialog box, click My user account, and then click Next. 15. In the Add Standalone Snap-in dialog box, click Close. 16. In the Add/Remove Snap-in dialog box, click OK. 11. Expand Certificates Current User, Personal, Certificates 12. Right-click the necessary certificate and click Copy 13. Expand Certificates (Local Computer), Trusted Root Certification Authorities 14. Right-click Certificates and click Paste

7 AD Sync Customer Installation Guide / Installing AD Password Change Filter Page 7 of 11 Installing AD Password Change Filter (Optional) The special Password Filter and Password Change Listener securely deliver the password change requests to POA to ensure the unified sign-in experience. This is optional feature. If it is not required, you should not install the AD Password Change Filter component. During the initial synchronization the passwords for the new users are auto-generated. After that, when a user changes password in external AD, it is passed to POA by AD Password Change Filter component. To install the AD password change filter agent on Domain Controller, perform the following steps: 1 Log on to the Domain Controller (you should be a member of the Domain Administrators group). 2 Run the ADPasswordChangeFilter.msi file. 3 At the Welcome page click Next. 4 In the provided filed enter the NETBIOS name of the server where the Synchronization agent is installed and click Next. 5 Click Next to start the installation. 6 After the installation completes, restart the server. Repeat steps 1-6 for each Domain Controller of your Active Directory Domain.

8 AD Sync Customer Installation Guide / Configuring Synchronization Options Page 8 of 11 Configuring Synchronization Options When the Sync agent is installed, you can configure rules for filtering the objects and their properties to be synced. These rules should be defined in the ADSync.exe.config file located in the C:/Program Files/Parallels/Directory Integration directory on the customer premise ADSync Node machine. You can open and edit this file using MS Notepad or Wordpad. SynchronizeContacts SynchronizeContacts parameter is responsible for Contacts synchronizing. You can select whether to sync the contacts along with other AD objects or not. Use 'true' value to turn it on, or 'false' to disable Contacts syncing. <ADSync.Settings SynchronizeContacts="true"> OrganizationUnits section The OrganizationUnits section contains the list of Units. Each Unit describes search root and query filter. Unit can contain following items: <Root>, <Query> and <DomainController>. <OrganizationUnits> <Units> <Unit> <Query>(&( (&(objectclass=contact)(targetaddress=*))(objectclass=user))( (display Name=*)(mailNickname=*)(givenName=*)(sn=*)))</Query> </Unit> </Units> </OrganizationUnits> <Root>. 'Root' item specifies distinguished name of a search root. If search root is not set, then default directory naming context is used; typically it is distinguished name like 'DC=domain,DC=local'. Sample of search root setting for objects under Persons organization name: <Root>OU=Persons,DC=domain,DC=local</Root>. This parameter is optional. <Query>. 'Query' item specifies the LDAP search query for synchronized entities filtering. Using this filter one can reduce the resulting list of synchronized entities. Note that if SynchronizeContacts attribute is set to "false", then all contacts will be excluded internally and only users object will be synchronized. Sample of LDAP query setting for all objects from company "Neverhood Inc": <Query>(company=Neverhood Inc)</Query>. Refer to the Microsoft MSDN Developer's Center ( to learn the LDAP query syntax. <DomainController>. 'DomainController' item specifies the FQDN of the domain controller where LDAP search will be performed. If domain controller is not set, the default domain controller is used. Sample of LDAP query setting for using domain controller "dc1.domain.local": <DomainController>dc1.domain.local</DomainController>. The following is an example of what the OrganizationUnits section should look like : <OrganizationUnits> <Units> 18 Parallels Operations Automation Parallels

9 <Unit> <Root>OU=Company1,DC=domain,DC=local</Root> <DomainController>dc1.domain.local</DomainController> </Unit> </Units> </OrganizationUnits> AD Sync Customer Installation Guide / Configuring Synchronization Options Page 9 of 11 In the above example the AD Sync agent will filter all users (and contacts if SynchronizeContacts is set to "true") from the 'Company1' Organization Unit. The dc1.domain,local Domain Controller will be used for performing the LDAP search. <OrganizationUnits> <Units> <Unit> <Query>(&( (&(objectclass=contact)(targetaddress=*))(objectclass=user))( (display Name=*)(mailNickname=*)(givenName=*)(sn=*)))</Query> </Unit> </Units> </OrganizationUnits> In the above example the AD Sync agent will filter all users (and contacts if SynchronizeContacts is set to "true") from the Active Directory. OptionalProperties section This section contains the properties for Users (<UserProperties> set) and Contacts (<ContactProperties> set). In this section you can customize the set of User and Contact properties to be transferred and synced in POA. By default, all the available properties are set for syncing. To put the property away, simply delete the corresponding line from the section. Below is the list of object properties and their mappings to POA AD. POA Property Name Display name External Login Enabled CDI Configuration Name * AD Properties Applied To Is Mandatory Description displayname mailnickname givenname + sn User, Contact Yes ** The 1st non empty combination of AD properties is used targetaddress Contact Yes If this property is empty, then it will be replaced with the value from 'mail' property. userprincipaln ame mailnickname SAMAccountN ame useraccountco ntrol User Yes The 1st non empty AD property is used User Yes

10 AD Sync Customer Installation Guide / Configuring Synchronization Options Page 10 of 11 Alias alias mailnickname User, Contact No AD property is available in case when Exchange is installed in a customer's AD. Hide from Address List hide_from_ad dress_lists msexchhidefr omaddresslis ts Contact First Name first_name givenname User, Contact No Last Name last_name sn User, Contact No Description description description User, Contact No Office office physicaldelive User, Contact No ryofficename Telephone phone telephonenum User, Contact No ber Web Page web_page wwwhomepa User, Contact No ge Primary mail User No Street street streetaddress User, Contact No City city l User, Contact No State / Province state st User, Contact No Zip / Postal code Country No zip_code postalcode User, Contact No country_abbre c User, Contact No viation Country country co User, Contact No Home Phone home_phone homephone User, Contact No Pager pager pager User, Contact No Mobile Phone mobile mobile User, Contact No Fax fax facsimiletelep User, Contact No honenumber IP Phone ip_phone ipphone User, Contact No Title title title User, Contact No Department department department User, Contact No Company company company User, Contact No *** Password password sid objectsid User No (see password) initials initials User, Contact No post_office_bo postofficebox User, Contact No x notes info User, Contact No User No The objectsid property is mandatory if password synchronization is enabled. Passwords changing are traced with special password filter installed on each Domain Controller.

11 AD Sync Customer Installation Guide / Configuring Synchronization Options Page 11 of 11 addresses / SIP addresses Group membership External DN **** proxy_address es proxyaddress es User, Contact membership memberof User, Contact No There will be implemented a complex logic for membership relations importing distinguishedn User, Contact Yes ame usnchanged User, Contact Yes Property is used internally for an entity changing detection. No *You cannot disable import of this property **Import of the AD object/entity fails if any mandatory field cannot be found ***These properties are not displayed in AOD now ****It is planned to add in the frame of CDI