Advanced Configuration for Active Directory Using Novell Nsure® Identity Manager 2

Tim Delaney

IDM Engineer

tdelaney@novell.com

Novell, Inc.

Kevin Boogert

IDM Engineer, kmboogert@novell.com

Novell, Inc.

Agenda

Planning your deployment

Preparing the system

Installing driver components

Importing the driver

Upgrading from DirXML® 1

Driver policy review

Driver policy updates

Password synchronization

Q&A

Presentation Structure

Slideware to introduce the driver and discuss deployment issues

Live demonstration of key points

Planning Your Deployment

Objects available for synchronization

Domain

Partition 2

Partition 1

Partition 2

Domain Controller

Identity Server

IDM Synchronizes objects hosted on the Identity Server with a single Active Directory domain context

Many object classes and attributes can be synchronized

The default configuration focuses on Users, Groups and Organization Units

Object Hosting Considerations

Identity Vault and Active Directory

Both are hierarchical, distributed databases

Identity servers can host any partition

Domain controllers can host a single domain context

The driver synchronizes with a single domain

Basic strategy

Host the working set for a single domain on a single Identity server

Use scoping rules when unable to host on a single server

Scope Filtering

Domain

Domain Controller

Partition 2

Identity Server

Partition 1

Identity Server

Partition 2

Partition 1

Identity Server

Domain

Domain Controller

Domain

Domain Controller

Publisher Scope Filtering

Subscriber Scope Filtering

What can be synchronized

Any object class

Any attribute with a supported syntax

Syntaxes that can be synchronized

String, DN, Integer, Enumeration, Boolean, Binary, Bitfield, Security Descriptor (binary only), SDI (binary only), Time

Beware of

Case sensitivity in scripts and transforms

Time formats

Syntaxes that cannot be synchronized

DN with String, DN with Binary, ORName, Presentation Address, Replica link

Anatomy of the Driver

The driver has two principle components

Driver policy

Executed by DirXML engine on IDM server

Uses DirXMLScript or XSL Transforms

Calls Java classes on IDM server

Managed by iManager

Driver shim

“Native” module called addriver.dll

Uses Windows API calls

Managed by iManager and the Remote Loader Console

Anatomy of the Driver

More on the driver shim

Must run on a Windows 2000 or 2003 server

Uses domain authentication

Executes within Identity Server or Remote Loader

Use Remote Loader if Identity Server runs on non-Windows machine

Securing Driver Shim Communication

Shim is the connection endpoint to Active Directory

Secured by using the “use SSL” prompt on import

Remote Loader is the endpoint to Identity Server

Unless shim runs within the Identity Server

Secured by using SLL on the remote loader connection

Preparing the system

Create an Authentication Account

Setup rights in Active Directory

Setup Privileges on Local Machine

Exchange Parameters

Rights Needed for Exchange

Installing driver components

Installation

What to install

Install the addriver.dll shim on the Identity Server or Remote Loader

Install the preconfiguration file on the iManager server

Install the ADManager tool on an administrative workstation

Java support classes in adutil.jar are included in the DirXML Engine install

Driver components can be installed with Engine, Remote Loader and iManager plug-ins or separately

Installation

Where to install the shim

The shim must run on a Windows 2000 or 2003 server

A domain controller or other member server is preferred

If using a non-member server not all features are supported

Password synchronization

Exchange management

Use Remote Loader if Identity Server does not meet the requirements

Importing the driver

Import

Import ActiveDirectory.xml via iManager

Parameter grouping

General

Driver parameters

Target system parameters

Policy selection

Exchange provisioning

Entitlements

Password synchronization

Import

General parameters

Driver name

Encode domain name for easy reference later

Local or Remote Loader

Remote loader is installed and managed separately

Import

Driver parameters

Changed via iManager

Authentication id

Authentication password

Authentication context

Driver polling interval

Additional driver parameters available after import

Import

Target system parameters

Embedded in policy

changed by modifying policy manually

Domain Name

Domain DNS Name

Base container in eDirectory™ and Active Directory

Configure data flow

Import

Policy structure

Decides which policies will be included in driver

Unused policies are discarded

Changed by rewriting policies

Publisher and subscriber placement

Mirrored or flat

Exchange management

Use entitlements

Import

Password management

Upgrading from DirXML 1

Automatic Upgrade with iManager

Migrating Password Synchronization 1

Driver Policy Review
and Updates

Default configuration policies

Flat placement

Mirrored placement

RDN / Full Name mapping

Time conversion

Exchange provisioning

Example policy updates

Fixing logon disabled on user add

Scope filtering

Multiple Exchange Message Databases

Setting group membership by policy

Group membership merge

Supporting Password Synchronization 1.0

Password Synchronization

Q&A

2003-12-08T12:43:39

Timothy Delaney