Aras Innovator Active Directory Sync

Size: px

Start display at page:

Download "Aras Innovator Active Directory Sync"

Kevin Pearson
5 years ago
Views:

Photos placed in horizontal position with even amount of white space between photos and header Aras Innovator Active Directory Sync Sandia National Laboratories is a multi-program laboratory managed

1 Photos placed in horizontal position with even amount of white space between photos and header Aras Innovator Active Directory Sync Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S. Department of Energy s National Nuclear Security Administration under contract DE-AC04-94AL SAND NO XXXXP

2 Overall Goal Use Active Directory groups to manage: Users (controls access to Aras) Identities (controls permissions within Aras) 2

3 AD Sync: Why Is It Needed? The Old Way User submitted service request Manually performed an internal charge back for a portion of Aras subscription Had to track down and confirm with a point of contact to ensure they had the proper approval to access the data User Access and Permissions were becoming burdensome Tracking down approvers is challenging Service improvement Automated license validation 3

4 Implementation - Components 1. Custom App to obtain access to Aras - Software Asset Management System (SAMS) 2. Custom App to manage AD accounts - Metagroup Utility 3. Custom Code to extract AD data and sync with Users and Identities in Aras C# server method Using Aras IOM Aras identities 4

5 1. SAMS to purchase Aras license User purchases license from SAMS User is put into an active directory group for that software (i.e. Aras-License) 5

6 2. POC uses Metagroup Utility to create AD Groups The Metagroup Utility is our front-end for users to create and modify Active Directory/LDAP groups POC adds user to the proper group in Metagroup (i.e. Aras-Editors) Syncs to Active Directory in 10 minutes POCs Add Users Editors Viewers 6

7 3. Code to Sync AD and Aras C# Code on server Loops through XML parameters Gets server info, AD groups, Aras Identities Calls multiple functions Calls Calls Windows Task Scheduler Kicks off at 2AM Batch File Console App.exe 7

8 Verifying Logon with Licenses Every morning the code runs and disables logons on all Aras Users Loops through AD group, adds the users to Aras if they don t exist Enables logons for all users in AD group (current license) 8

9 Aras Identities The Identities are cleared of their members Identity to Identity Relationship The code loops through a different AD group and adds all individual to the proper identity in Aras Editors Aras - Editors Aras - Viewers Aras - Admins Aras - Editors Aras - Viewers Aras - Admins Viewers Administrators 9

10 Functions in Code AD Looping Using the System.DirectoryServices library Using the DirectoryEntry class Loops through all passed groups in active directory string array "LDAP://CN=<group name>, CN =<Users>, DC=<domain component>, DC=<domain component> 10

11 Functions in Code In House Functions: Addusers (inn, AD group name from XML) Adds all users from the AD group to Aras if they aren t already in Aras DelIdentities (inn, Identity from XML) Removes members from the identities we will add people to later (i.e. editors and viewers) AddIdentities (inn, AD group from XML, Identity from XML) Take the users from the AD group, find their alias identity and add it to the identity permission group (i.e. Editors Identity) 11

12 Functions (cont.) RemoveNonSAMSLogon (inn) Sets logon_enabled to 0, or off, for all users with an address AddSAMSLogon (inn, License Group from XML) Sets logon_enabled to 1, or on, for all users in the AD license group AddAdminintoAdministrators (inn) Since admin is not in the AD group, we hardcode the admin back in ResetAuthPasswords (inn) Runs the Aras Reset All Auth Passwords method to enable Logon_User 12

13 Obstacles/Solutions Removing a user that no longer needs access Can t delete because users are often related to objects like documents Recreating them would create a new primary key Deleting Alias Identities Every user must have an alias Deleting Aliases tied to users is not possible System Accounts being removed/disabled Not in the Active Directory groups upon sync Hard-Coded Aras Innovator Admin to enable logon and be in the Administrator Identity in the console application 13

14 Conclusion AD Sync and Aras 10 = Automation and quicker service! Yearly true up with Aras using the licensed metagroup from SAMS makes licenses easy to maintain 14

15 Photos placed in horizontal position with even amount of white space between photos and header Thank You Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S. Department of Energy s National Nuclear Security Administration under contract DE-AC04-94AL SAND NO XXXXP

Sandia National Laboratories Solutions for Aras Innovator

Photos placed in horizontal position with even amount of white space between photos and header Sandia National Laboratories Solutions for Aras Innovator Sandia National Laboratories is a multi-program