This topic demonstrates how to add an LDAP Directory domain to the EmpowerID Identity Warehouse as a managed Account Store. We demonstrate this by connecting EmpowerID to Open LDAP, but the process is the same for connecting to other supported LDAP directories, including:
The OpenLDAP system should be supporting LDAP controls -
Ascending sorting enabled on createTimeStamp attribute with a Matching Rule.
( * ) Mandatory
On the Choose Servers page that appears, select the EmpowerID server or servers to register and click Submit.
The Choose Servers page displays only those servers where the EmpowerID Web Role service is running. If you do not see your server on the page, check the following:
(The LDAP Management Host Web Service is responsible for LDAP communications and is enabled by default on each server running the EmpowerID Web Role service.)
All selected servers must be in the same forest and able to communicate with the LDAP system over LDAP port TCP 389.
The LDAP Settings page appears, where you enter settings to connect to your LDAP directory to allow EmpowerID to discover and connect to it.
In the LDAP Server field, enter the name of the server on which the directory is installed and include the port number if it is other than 389.
In the Proxy User field, enter the admin user account that has read access to the partition that holds the objects in the directory.
This user account is saved as the connection credential for this account store. You can change it at any time.
The Account Store is created and appears in the list of Account Stores in both the web application and the Management Console and a corresponding Resource System is created.
This procedure continues on the Account Store Details page from the previous procedure, which was performed on the Settings tab.
The last action to perform on this screen is to enable inventory. However, before doing so, it is important to configure the attribute flow rules for the account store and to enable the Account Inbox if batch processing of those accounts is desired.
To configure Attribute Flow rules
Now that the attribute flow has been set, the next steps includes turning on and monitoring inventory.
To turn on inventory
If you are using the Account Inbox to provision or join the user accounts in Google to Empower Persons, you need to turn on the Account Inbox. This is demonstrated in the below section.
To enable the Account Inbox permanent workflow
To monitor inventory