Connect to Active Directory

In this article, we demonstrate how to use the EmpowerID Active Directory connector to connect to Active Directory. After ensuring you have met the prerequisites specified in the Getting Started with Directory Systems topic, you connect EmpowerID to Active Directory by doing the following:

1. Creating an account store in EmpowerID for Active Directory.

2. Configuring EmpowerID settings for the account store connection, including whether to provision EmpowerID Persons during inventory or in batches using the Account Inbox permanent workflow.

3. Mapping your external roles and locations to corresponding EmpowerID Business Roles and Locations.

4. Reviewing and configuring the attribute flow rules for the account store.

5. Turning on inventory.

6. Enabling the Account Inbox Permanent Workflow when ready—if you are using batch processing to provision Person objects from the inventoried user accounts. This is the recommended method.

7. Monitoring Inventory.

EmpowerID “Proxy” or Connection Account Requirements

EmpowerID uses highly privileged user accounts when connecting to user directories such as Active Directory, LDAP or database systems. These user "account stores" use saved proxy accounts for connecting to these systems and performing user account management operations. EmpowerID requires one privileged account per domain or directory. This account requires all of the privileges matching the functions that EmpowerID may perform (user creation, deletion, password reset, group creation, etc).

If you will be managing an Active Directory Domain, the proxy account must be able to access the deleted items container in AD. Access to the Deleted Items container requires Domain Admin access unless the container security is edited to allow non-domain admins to read it. Instructions for editing the security of the deleted items container can be found in Microsoft’s article “How to let non-administrators view the Active Directory deleted objects container” which can be viewed in full at http://support.microsoft.com/kb/892806.

If you are connecting to an Active Directory Forest with multiple domains, you must first create an account store for the forest root domain before creating account stores for other domains in the forest. The proxy account used when adding your AD account store, must have read access to the AD Configuration Partition in order for topology discovery to succeed. Errors will occur if this process and its required access are not followed.

You do not need to enable inventory on the account store created for the forest root domain.

To create an Active Directory account store in EmpowerID

1. On the navbar, expand Admin > Applications and Directories and then click Account Stores and Systems.

2. On the Account Stores page, click Create Account Store.

   Open

   

   
   
   

3. Under System Types, search for Active Directory Domain Services.

4. Click Active Directory Domain Services to select the type and then click Submit.

   Open

   

    

5. On the Active Directory Settings page that appears, fill in the following information:

   1. Name and Display Name — Enter a name for the Active Directory account store.

   2.  FQDN of the Active Directory Forest — Enter the fully qualified domain name of the AD forest. If you are using LDAPS, enter the Subject name of the certificate for the domain controller to which you are connecting followed by port 636. Thus, if the Subject name is "dc01.eiddoc.com," you enter dc01.eiddoc.com:636.

   3. Is Remote (Requires Cloud Gateway) — This setting appears for account stores with local directories, such as Active Directory, LDAP, SAP, etc. When enabled, this tells EmpowerID to use the Cloud Gateway Connection for that account store. The Cloud Gateway Connection must be installed on an on-premise machine. For installation information, please see Installing the EmpowerID Cloud Gateway Client.

   4. Proxy Account Username — Enter a user account with read access to the Active Directory configuration partition that holds the list of all of the domains in the forest (and to the Exchange Organization, if present). 

   5. NetBIOS Domain — Enter the NetBIOS name of the domain or child domain that hosts Active Directory.

   6. Password — Enter the password for the proxy account.

6. When ready, click Submit to create the account store.

    

7. On the Choose Servers page that appears, select the appropriate EmpowerID server and click Submit.

8. On the Discover Active Directory Domains page that appears, select one or more domains to add to the account store and click Submit.

9. EmpowerID creates the account store and the associated resource system. The next step is to configure attribute flow between the account store and EmpowerID.

 

Now that the attribute flow has been set, the next steps include configuring the account store, mapping locations and enabling EmpowerID to inventory it.

To configure account store settings

1. On the Account Store and Resource System page, click the Account Store tab and then click the pencil icon to put the account store in edit mode.

   
   This opens the edit page for the account store. This page allows you to specify the account proxy used to connect EmpowerID to your Active Directory as well as how you want EmpowerID to handle the user information it discovers in Active Directory during inventory. Settings that can be edited are described in the table below the image.

   
   

2. Edit the account store as needed and then click Save to save your changes.

Next, map the OUs containing user accounts and other managed objects in your account store to corresponding EmpowerID locations as described in the next section. This ensures that the location of an object in EmpowerID reflects the location of the object in Active Directory. In environments with multiple directories or domains, location mapping allows administrators and business users to see one condensed view of the organizations and have policies applied in one spot.

To map locations

EmpowerID Role and Location mappings allow multiple AD, LDAP or other external directory containers to be visually mapped to one or more logical locations in EmpowerID for unified and easy management. When a mapping occurs, all the resources or objects located in the directory container are assigned to a corresponding EmpowerID location, allowing you to use those locations for delegating user access and setting default policy settings. If you create these mappings before your first inventory, all new people discovered by EmpowerID during the inventory process will be provisioned in EmpowerID locations (instead of directory locations), and those EmpowerID locations will be assigned to them as the "Location" portion of their Business Role and Location (BRL). For example, if you have a user named "Barney Smythe" in a London > Contractors OU and a user named "Kris McClure" in a London > Employees OU and you map both of those London OUs to a single London location in EmpowerID, when you turn on your inventory the Location portion of the BRL for both Barney Smythe and Kris McClure would be the EmpowerID location and not the external OUs.

1. From the navigation sidebar, expand Identity Lifecycle and click Role and Location Mapper.

2. Select the Location Mapper tab.

3. From the Location pane of the Location Mapper tab, enter the name of the EmpowerID location you want to map and press ENTER to load the location.

4. Select the location from the tree.

    

5. From the External Location pane, enter the name of the external directory location to which you want to map the EmpowerID location.

    

6. Click Save to save the mapping.

7. Repeat for any other mappings you wish to create.

Now that everything is configured, you can enable the Account Inbox Permanent Workflow and monitor inventory. Be sure inventory is enabled on the account store settings page.