Customer instructions can be found from here.

In this chapter is described configuration instructions for AD connector to be able connect to customers Active Directory (AD). 

For accessing connector management, user needs to have permissions to Efecte Platform configuration.

1. Open the Efecte administration area (a gear symbol).
2. Open connectors view.
3. Choose new connector 

4. Select Data Source type to be Microsoft Active Directory

5. Fulfill information related to customers AD

• Connector name - give your connector a friendly name (name can be changed afterwards)
• AD host - host address which will be used connecting to customers AD
• AD port - port number which will be used connecting to customer AD
• AD username - service account name which is used for reading and writing data to/from customers AD
• AD password - password for the service account

6. Fulfill WebAPI user information

• WebAPI user - select correct WebAPI user which is used when writing data from customers AD to customers Efecte solution
• WebAPI password - password for the WebAPI user

7. Save connector information

• Press test connection to validate that port and host information is set correctly
• Press test authentication to validate that AD user and password (service account) information is set correctly

8. Customers Efecte solution is now able to connect to customers AD

• Next step is to configure scheduled task for data read or event task for data writing. 

AD connector is used for to read user and group information from Customers AD and it is configured from Efecte platform by creating scheduled-based task.   

How to create new task for Scheduled Provisioning

For configuring scheduled-based task, you will need access to Efecte Platform configuration console. 

Note! If connector is not created, you have to create first “new connector” and after that you are able to create new tasks.

1. Open the Efecte administration area (a gear symbol).
2. Open connectors view.
3. Choose connector for which scheduled-based task is configured
4. Select new task under the correct connector

4. Define scheduling for the task (if and how scheduled task should be run periodically). Choose scheduling sequence, which depends how much data is read to customers Efecte solution.

Recommended scheduling sequence, depends how much data is read from customers directory to the Efecte solution and is import partial or full load. 

Example scheduling for reading groups and user accounts. 

5.  Fill in Task Details

• Fill in unique task name for the scheduled-based task, notice that name cannot be changed afterwards. 
• Task usage indicated that is the task used for reading data, writing data or to authentication. Note that If event type is changed afterwards it can break the workflows.
• Mappings type depends what type of information is read from the directory
  • Identity and access rights - are used when user account and group information is read from the directory
  • Single (identity only) - are used when only user account information is read from the directory
  • Single (access right only) - are used when only group information is read from the directory
  • Generic (one template) - are used when a generic information is read from the directory, usually other than Users/Groups
     

Fill in filtering details, 

• Fetch data
  • Full - all information is read according to defined filtering
  • Incremental - only changed information is delivered to Efecte solution
• Fetch data from the LDAP tree root - Optional setting. Makes it possible to fetch the Users and Groups from the LDAP Tree Root in trade of provisioning speed
  If you have set this on, and it's not working, find this text from worker log: 
  Caused by: javax.naming.CommunicationException:
  After it you should see name of server, for example: 
  Caused by: javax.naming.CommunicationException: dev.master.efecte.com
  It means AD Native Connector worker is unable to fetch data through AD Context Referrals. It can't resolved that host in DNS.
  To fix this situation, you need to ask M42 to add that server name and it's ip-address to dns/hosts file.
   

Filtering based on OU

Filter name: LDAP userBase / LDAP userFilter

This filter is commonly set with the OU-path, where users are read from and it also includes all sub-OUs in the import, but it also enables several other filtering possibilities, 

Examples of other commonly used user filter examples:

• The following example finds User-objects: (&(objectCategory=person)(objectClass=user)) 
• The following example finds user-, computer- and contact-objects: (objectClass=person)  
• The following example finds user- and contact-objects: (objectCategory=person) 
• The following example finds all enabled user-objects: (&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) 
• The following example finds user- and contact-object that have an email and SAMAccountName (&(objectCategory=person)(sAMAccountName=*)(mail=*))

Filtering OU, where users are read from

Filter name: AD ignoreOusForUsers

With this filter, it is possible to exclude some of the sub-OUs from the import (like for example OU=Sales,DC=adtest,DC=local). Users will be ignored, if they exist directly in one of defined <OU> and/or if they exist in a sub-tree of one of the defined OUs.

Filtering based on single users

Filter name: Excluded Users

With this filter it is possible to exclude specific users from the import. For ldap use Distinguished Names of the Groups to exclude (separated by newlines). 

Filtering groups

Filter name: AD groupBase / AD groupFilter

This filter is commonly set to the OU-path, where groups are read from. All sub-OUs will be included in the import (example: OU=Finance,DC=adtest,DC=local). Users will be ignored, if they exist directly in one of defined <OU> and also they exist in subtree of one of the already defined <OU>.

  Examples of other commonly used group filters:

• The following example finds group-objects:
  (objectCategory=group)
• The following example finds group-objects that has value in cn:
  (&(objectCategory=group)(cn=*))
• The following example finds group-objects that have value in their description: 
  (&(objectCategory=group)(description=*))
• The following example finds all security group-objects: 
  (groupType:1.2.840.113556.1.4.803:=2147483648) 

Filtering OU's, where groups are not read from

Filter name: AD ingnoredOusForGroup

This filter is commonly set to the OU-path, where groups are read from. All sub-OUs will be included in the import (example: OU=Finance,DC=adtest,DC=local). Users will be ignored, if they exist directly in one of defined <OU> and also they exist in subtree of one of the already defined <OU>.

Filtering single groups

Filter name: Excluded Groups

With this filter it is possible to exclude specific groups from the import. For ldap use Distinguished Names of the Groups to exclude (separated by newlines). 

Filtering users based on group-memberships

Filter name: Exclude Users with specific groups

With this filter it is possible to exclude specific users from the import based on group memberships. For ldap use Distinguished Names of the Groups to exclude (separated by newlines). For Azure-based tasks, put Object IDs of the Groups to exclude (separated by newlines)  

Fill in failure information

Optional settings for failure handling, if scheduled task fails it can create data card that displays the error. If failure settings are defined, the administrator does not need to manually check the status of scheduled tasks.

• Failure template - Select a Template of datacard which will be created in case of any errors during provisioning (connection to data sources, timeouts,etc.)
• Failure folder - Select folder where failure data card is stored. 
• Failure attribute - Select an attribute where in the Failure Template should the error information be stored in. Select text type attribute.
   

Example of IGA admin task, which also can contain instructions how to solve the issues,

6. Fill in Identity Mappings

Users are imported to IGA Account template and it is mandatory to set Target folder, datasourceid and unique values which are used for identifying users between customers AD and Efecte solution. For example.

• Target template - Select a template to define attribute mappings
  Select a template to define attribute mappings
• Target folder - Select a folder from a list of folders. The list is narrowed down to match compatibility with selected Template.

• Data Source Type mapping - optional. If it is set, it writes connectors type to that attribute.
• Task Id mapping - Task id number is written to this attribute.
• Set value to datacard fo object deleted from source system - This functionality is activated by setting checkbox on. When someobject that was previously read from 3rd party system to solution is deleted from 3rd party system (meaning this task query doesn't return it anymore). This scheduled task notices thatis was deleted and marks that datacard selected attribute with value you want. This can be for example used to set Status attribute to Deleted (as shown in below example screenshot). This functionality functions only for task type Full not for Incremental.

• Attribute mappings
  1. External attribute - which attribute from the directory/system is mapped
  2. Local attribute - to which attribute in template attribute is mapped to
      

7. It is possible to set additional attributes, which are read from user accounts in AD, by choosing New attribute

8. Fill in Access Rights Mappings

Groups are read to IGA Entitlement template and it is mandatory to set target folder, datasourceid and unique values which are used for identifying users between customers AD and Efecte solution.

• Target template - Select a template to define attribute mappings
  Select a template to define attribute mappings
• Target folder - Select a folder from a list of folders. The list is narrowed down to match compatibility with selected Template.

• Data Source Type mapping - optional. If it is set, it writes connectors type to that attribute.
• Task Id mapping - Task id number is written to this attribute.
• Set value to datacard fo object deleted from source system - This functionality is activated by setting checkbox on. When someobject that was previously read from 3rd party system to solution is deleted from 3rd party system (meaning this task query doesn't return it anymore). This scheduled task notices thatis was deleted and marks that datacard selected attribute with value you want. This can be for example used to set Status attribute to Deleted (as shown in below example screenshot). This functionality functions only for task type Full not for Incremental.

• Attribute mappings
  1. External attribute - which attribute from the directory/system is mapped
  2. Local attribute - to which attribute in template attribute is mapped to
• It is possible to set additional attributes, which are read from user accounts in directory, by choosing New attribute

9. Mappings for generic template

Generic data are read to any template user want's and it is mandatory to set target folder, datasourceid and unique values which are used for identifying data between customers AD and Efecte solution.

• Target template - Select a template to define attribute mappings
  Select a template to define attribute mappings
• Target folder - Select a folder from a list of folders. The list is narrowed down to match compatibility with selected Template.

• Data Source Type mapping - optional. If it is set, it writes connectors type to that attribute.
• Task Id mapping - Task id number is written to this attribute.
• Set value to datacard fo object deleted from source system - This functionality is activated by setting checkbox on. When someobject that was previously read from 3rd party system to solution is deleted from 3rd party system (meaning this task query doesn't return it anymore). This scheduled task notices thatis was deleted and marks that datacard selected attribute with value you want. This can be for example used to set Status attribute to Deleted (as shown in below example screenshot). This functionality functions only for task type Full not for Incremental.

• Attribute mappings
  1. External attribute - which attribute from the directory/system is mapped
  2. Local attribute - to which attribute in template attribute is mapped to
• It is possible to set additional attributes, which are read from user accounts in AD, by choosing New attribute button.

11. Save provisioning task from the Save button. If some required attributes are missing the save button is displayed as grey and it will display what is missing from the settings.

12. You have now configured scheduled-based connector task for AD data read. 

• You can now wait until task is started based on scheduling or
• Run task manually - by clicking the “Run Task” button task starts immediately. Usually for test runs or if you don't want to change the schedule settings, but want to run the task now.   

When clicking “Run Task”, user is informed about the run

If task is executed manually (run task) or it is run according to scheduling, task status can be reviewed from "View history":

Event task is used when writing data towards customers Active Directory. These Provisioning Engine capabilities related to accounts, groups and permissions are available only for IGA solution and IGA license is required if these are used. 

All configuration related to Provisioning Engine and event-based provisioning task are configured in Matrix42 Core, Pro and IGA platform.
 

1. Open the Efecte Platform configuration view (a gear symbol).
2. Open connectors view
3. Choose connector, which will use the event task
4. Select  “new task” under correct connector

4. Fill in Task Details

• Task name - Give name name for the task, it will be displayed in connectors view. 
  • It is good practice to name a task in a way that describes its purpose for example [Template name]:[Activity] IGA Service request:Verify user
• Task usage indicated that is the task used for reading data or writing data. Can be changed afterwards, but it's not recommended if event task is in use. It will break workflows. 
• Mappings type depends what type of information is read from the directory, identity mappings selections are displayed based on this setting. 
  • Identity and access rights - are used when user account and group information is read from (or write to) the directory
  • Single (identity only) - is used when only user account information is read from (or write to) the directory
  • Single (access right only) - is used when only group information is read from (or write to) the directory
  • Generic (one template) - is used when generic information is read from (or write to) the directory. Usually some other data than user or group information. 

Warning about changing task usage or mappings type when event task in use. Usually you should not change those after you have done first save:

5. Fill in Security Information 

This information is needed if user creation process in workflow is attached to the task.

• Password for first login - Default password that is the same for all users, random password is generated in workflow, and it's usually unique. 
  • Default password / type in the box below 
    • Default password - Type default password that is same for all users and matches to directory requirements for the password. Note that number of characters doesn't represent actual length of the password
    • Not recommended in production environments to have same password for all new accounts
  • Random password / generate in the workflow 
    • Generated password 

Filtering

When data is written to customer directory, filtering is needed for the connector to know to which OU's information is written. 

Filtering OU's where users are written

Filter name: AD userBase / AD userFilter mode selection

• Read OU path from the data card - connector reads from
• Type search base / search filter in the box below
  • AD userBase / AD userFilter - examples here
  • AD ignored OusForUser - examples here

Filter name: AD groupBase / AD groupFilter mode selection

• Read OU path from the data card - connector reads from
• Type search base / search filter in the box below
  • AD groupBase / AD userFilter - examples here
  • AD ignored OusForGroup - examples here

Filtering generic template mappings type information

Filter name: AD searchBase / AD searchFilter - example here

6. Define identity mappings

• Target template - Select a template to define attribute mappings
  Select a template to define attribute mappings
• Target folder - Select a folder from a list of folders. The list is narrowed down to match compatibility with selected Template.
• Attribute mappings
  1. External attribute - which attribute from the directory/system is mapped
  2. Local attribute - to which attribute in template attribute is mapped to
• Add new attribute -  It is possible to set additional attributes, which are read from user accounts in AD, by choosing New attribute button.

7. Define Access Rights mappings

• Target template - Select a template to define access rights mappings
  Select a template to define attribute mappings
• Target folder - Select a folder from a list of folders. The list is narrowed down to match compatibility with selected Template.
• Attribute mappings
  1. External attribute - which attribute from the directory/system is mapped
  2. Local attribute - to which attribute in template attribute is mapped to
• Add new attribute -  It is possible to set additional attributes, which are read from groups in AD, by choosing New attribute button.

8. Define generic mappings

• Target template - Select a template to define attribute mappings
  Select a template to define attribute mappings
• Target folder - Select a folder from a list of folders. The list is narrowed down to match compatibility with selected Template.
• Attribute mappings
  1. External attribute - which attribute from the directory/system is mapped
  2. Local attribute - to which attribute in template attribute is mapped to
• Add new attribute -  It is possible to set additional attributes, which are read from AD, by choosing New attribute button.

8. Save provisioning task from “save” button

If any mandatory information is missing, you are not able to save the task and save button will show missing information. 

9. The next step is to configure the workflow Orchestration node to use this event-based task. From workflow engine, it is possible to execute provisioning activities towards customer directory services. This means that any of the available orchestration nodes activity can be run at any point of the workflow.

Workflow references are shown in the connector overview page:

Authentication task is needed when customers AD is used for authenticating users to customers Efecte solutions. 

There are two options to create a new authentication task. Option one is to copy existing provisioning task into authentication task, if authentication method is using same settings. Option two is to create new authentication task. 

Option 1: Create new Authentication task from provisioning task

1. Open the Administration area (gear symbol) 
2. Choose Connectors tab, copy desired task from Clone button

3. Give name for the new authentication task and change task usage to be authentication

4. Fill in the required fields and save the task
 

Option 2: Create new Authentication task

1. Open the Administration area (gear symbol) 
2. Choose Connectors module
3. Choose Authentication tab
4. Choose connector and Create New Task

5. Give name to your authentication task

6. Select task usage to be authentication

7. Define filters for users

• Most commonly for AD authentication OU-paths are used for defining who can access to Efecte solutions

8. Define filters for groups

• From where needed groups can be read to Efecte solution from the customers AD 

7. Select Authentication realm. 

• Realm for which authentication configuration will be created in ESA

8. Save task and run ESA Sync

• Syncing information will automatically fulfill configuration in Efecte Secure Access

9. Next step is to move to Efecte Secure Access configuration instructions according to required authentication method.

The Efecte Provisioning Engine (EPE) provides the possibilities to orchestrate the following activities to Microsoft Active Directory.
 

Activate / Deactive User 

In the illustration above admins has chosen the correct Active Directory “Target” and are able to view the Identity Mappings which are configured for selected AD tasks. In this orchestration view admins are not allowed to change any mappings, those are presented only as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view. 

Inside this same node, administrators are able to choose the action what they are prefer to use “Activate” or “Deactivate”. Active Directory: ‘Activating/Deactivating’ functionality here refers to setting 'useraccountcontrol’ Active Directory attribute to ‘512/514’ value (Enable/Disable) 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Add User to Group

In the illustration above, the Person attribute configuration should point to the template where the orchestration node finds the user’s data (usually IGA account). The Role attribute needs to be configured to define where the orchestration node finds the available roles (directory groups where the user should be removed). There might be single or multiple attribute groups configured in a “Role attribute”. The list of available registered directory Tasks is fetched from the EPE-master. 

It is required to select the directory Task, because the Efecte Provisioning Engine orchestration node will use identity and access rights fields mapping to know, under which attribute code, the user’s and directory group distinguished names are stored. 

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Exception handling:

• The result of a node will be in the “Completed” state only in the case when all user’s group memberships will be updated successfully. In the case when, for example, the user will be successfully removed from 5 out of 6 groups then the result of a node will be in the “Exception” state.
• Hence the mapping for distinguishedName JSON field, for both Identity and Access Right is required. If mapping won’t be found then the orchestration node will result in an “Exception” state.
• The attempt to remove a user from a group which they do not belong will end as a failure.
• The attempt to add a user to a group to which he already belongs will end as a failure.
• Details about successfully/unsuccessful updated user’s group membership can be found in logs.
• Provisioning and group membership exceptions are optional properties on this workflow node. Admins can configure this properties in use where exceptions can be written if any exceptions exists during the provisioning actions.

 

Create custom object

In the illustration above, the Identity Attribute Mappings are populated from Provisioning tasks. Admin has chosen the correct Directory AD as “Target” and is able to view the Identity Mappings which are configured for selected directory tasks. In this orchestration view admins are not allowed to change any mappings, those are presented as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view. 

The creating new custom object orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. It is important to be sure, that Identity Mapping, being used in Create custom object orchestration node.

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Create user

In the illustration above, the Identity Attribute Mappings are populated from Provisioning tasks. Admins choose the correct Directory “Target” and are able to view the Identity Mappings which are configured for selected directory tasks. In this orchestration view admins are not allowed to change any mappings, those are presented as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view. 

The creating new user orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. It is important to be sure, that Identity Mapping, being used in Create User orchestration node, contains at least two additional Active Directory mappings: for “cn” and “sAMAccountName” attributes. If those two mappings are missing on a given configuration, it will not be presented on a dropdown.  

Creating new user activity notes:

• There are two ways to create the password for a new user for their first login.
  • Define “Default” password in the Provisioning Task -configuration view
    • That password will only be used by users, when they login into the system for the first time 
  • Generating random password in the workflow and select into which attribute on Identity Mapping data-card it was written to
  • In both cases the first time password “pwdLastSet” value is set to zero (0) to force a user to change their password after the first login
  • Possibility to choose if the password must change at the first login or not. Administrators can make the selection for this directly from the workflow User Creation orchestration node.
• There are different ways to provide password for the first login for the end-user. Depending on customers needs it is possible to use workflow functionalities to send the password directly to the end user via email or sms. Another option is to send the password for first login to the manager, who will provide it for the end-user. EPE’s Orchestration node itself DO NOT provide that functionality, it needs to be defined elsewhere. 
• The configuration of “Target” is done in the provisioning task configuration view. For creating new users, admins needs to make sure that there exists only one LDAP userbase / LDAP userfilter in order to avoid conflicts on the workflow
• Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 
   

Create Group

In the illustration above, the Access Rights Attribute Mappings are populated from Provisioning tasks. Admins choose the correct Active Directory “Target” and are able to view the Access Rights Mappings which are configured for selected AD tasks. In this orchestration view admins are not allowed to change any mappings, those are presented as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view. 

The creating new user orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. 

It is important to be sure, that Access Rights Mapping, being used in Create Group orchestration node, contains at least two additional Active Directory mappings: for “cn” and “sAMAccountName” attributes. 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Delete custom object

In the illustration above Object name attribute defines what object EPE is deleting. In this example EPE is deleting DN.

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

 Delete Group

In the illustration above administrators can choose the correct Active Directory “Target”. The delete group orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. For Active Directory-based configurations, 'Role group attribute' should contain group’s distinguishedName name.

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Delete User

In the illustration above administrators can choose the correct Active Directory “Target”. The delete user orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. For Active Directory-based configurations, 'Person Attribute' should contain User's distinguishedName name.

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Manage ProxyAddresses

There are three different possibilities: Set, Update and Remove proxyaddresses. 

Set: admin selects one attribute in ESM's Workflow UI (can be single or multivalue attribute) - Then Workflow Node, contacts AD, finds user account and set's the value into proxyAddresses (this action is used to set the value to proxyAddresses the first time - previous value in AD is null).

Update: admin selects two attributes in ESM's Workflow UI - one for CURRENT value, and the other - the NEW value. Then Workflow Node, contacts AD, finds user account and updates the existing proxyAddresses, finds the CURRENT value in the list, and changes its prefix from: SMTP: to smtp: - and adds NEW value with prefix SMTP: (the other values remain in proxyAddresses).

On update action, use single value attributes both for current address, and address to be updated, like this:

Remove: admin selects one attribute in ESM's Workflow UI (can be single or multivalue attribute) - Then Workflow Node, contacts AD, finds user account and removes the value from proxyAddresses list (the other values remain in proxyAddresses).

Read User's data

In the illustration above, the Identity Attribute Mappings are populated from Provisioning tasks. Admins choose the correct Active Directory “Target” and are able to view the Mappings which are configured for selected AD tasks. In this orchestration view admins are not allowed to change any mappings, those are presented as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view.  

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Remove User Attribute

In the illustration above administrators can choose the correct Active Directory “Target”. The remove user attribute orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. In the property “Attribute(s) to remove” administrator can define the attribute, which will be removed from selected user on the Active Directory. NAME what you want to remove. On string can contain multi value attributes. like "City, CostCenter, mobile".

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Remove User from Group

In the illustration above administrators can choose the correct Active Directory “Target”. The remove user attribute orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. In the property “Attribute(s) to remove” administrator can define the attribute, which will be removed from the Active Directory.

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Reset User Password

In the illustration above administrators can choose the correct Active Directory “Target”. The Reset user password orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. The Person and Password attributes should point to the template where the orchestration node finds the user’s data.  

User password value “pwdLastSet” is set to zero (1), which means that a user doesn’t need to change their password in the first login. From the EPE version 2022.3 forward we have implemented possibility to choose if the password must change at the first login or not. Administrators can make the selection for this directly from the workflow Reset User password orchestration node.

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Run provisioning task

This activity is used when all information from the directory is immediately needed back. 

In the illustration above administrators can choose the correct Directory “Target”. Run provisioning task orchestration node read attributes from Active Directory to IGA Accounts. 

Requirements for the "Target" EPEtask are:

• Task must be of type "Schedulable task" not event-based
• Workflow's Template must be the same as Identity mapping Template 
• Task must be scheduled at some time - it marks a task to be "enabled" then
• Mappings must be distinct, no duplicated mappings in the task
   

In this orchestration view you are not allowed to change any mappings, those are presented only as a visual aid. If there are needs to change the attribute mappings, those attributes must be defined in the provisioning task configuration view, in order them to be changed in the orchestration node. 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Unlock User

In the illustration above administrators can choose the correct Active Directory “Target”. The unlock user orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory.

It’s important to take into account in the configurations, that 'Person Attribute' should contain User's distinguishedName name.

Person attribute expects an attribute containing users AD accounts Distinguished Name(DN).

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Update Custom Object

In the illustration above administrators can choose the correct Active Directory “Target”. Custom object class defines what object EPE is updating, in this example is Contact, it reads attributes from Data Cards in question and execute LDAP command to Active Directory.

In this orchestration view you are not allowed to change any mappings, those are presented only as a visual aid. If there are needs to change the attribute mappings, those attributes must be defined in the provisioning task configuration view, in order them to be changed in the orchestration node. 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Update group

In the illustration above, the Access Rights Attribute Mappings are populated from Provisioning tasks. Admins choose the correct Active Directory “Target” and are able to view the Access Rights Mappings which are configured for selected AD tasks. 

In this orchestration view admins are not allowed to change any mappings, those are presented only as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view. 

The update group orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory.

The configuration of “Target” is done in the provisioning task configuration view. For updating groups, admins needs to make sure that there exists only one LDAP groupbase / LDAP groupfilter in order to avoid conflicts on the workflow.

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Update User

In the illustration above, the Identity Attribute Mappings are populated from Provisioning tasks. Admins choose the correct Active Directory “Target” and are able to view the Identity Mappings which are configured for selected AD tasks. The update user orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory.

In this orchestration view admins are not allowed to change any mappings, those are presented only as a visual aid. If any changes to the mappings are needed, those needs must be execute in the Provisioning task configuration view. 

Note that User password update is not supported on this orchestration activity.

The configuration of “Target” is done in the provisioning task configuration view. For updating users, admins needs to make sure that there exists only one LDAP userbase / LDAP userfilter in order to avoid conflicts on the workflow.

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Update User Distinguished Name value

In the illustration above administrators can choose the correct Active Directory “Target”. The Update user Distinguished Name Value orchestration node read attributes from Data Cards in question and execute LDAP command to Active Directory. 

In the field “Current Distinguished Name Value*” admin must select, from which attribute on given template/data-card, ‘old’ name of AD location will be read. Field “New Distinguished Name Value* selects attribute from given template/data-card, which will be used as a name of new AD location.  

With This activity admins are able for example to limit update action to ‘commonname’ attribute, but It’s required to give whole Distinguished value, example: 

Current Distinguished Name Value: CN=DemoAccount,OU=DemoUsers,DC=testad,DC=local 

New Distinguished Name Value: CN= DemoAccount,OU=OldDemoUsers,DC=testad,DC=local

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Verify Group

In the illustration above, the Access Rights Attribute Mappings are populated from the Provisioning tasks. Administrators choose the correct Active Directory from “Target” and are able to view what Access Rights Mappings are configured for the selected AD task. 

In this orchestration view you are not allowed to change any mappings, those are presented only as a visual aid. If there are needs to change the attribute mappings, those attributes must be defined in the provisioning task configuration view, in order them to be changed in the orchestration node. 

Within the Access Rights Mappings admins panel, admins are able to provide “IF” expression, which will form a LDAP query to verify if the group exists. It’s possible to select as many attributes from the Data Card as needed to confirm the uniqueness of a group. When an action takes place, those attributes will be read from the Data Card in question and will be compared to the appropriate AD attributes according to the “Target*“ Active Directory configuration. Admins can also choose to use “equal” or “not equal” to corresponding AD attribute by changing the “IF” expression. The “Save result*” field is used to define where the successful LDAP query results are saved, “true” if group was found or “false” otherwise. 

Administrators has possibility to “check” Include OU subtree -property on this orchestration node to verify if group exists in the defined Organization Unit -subtree. If this administrator doesn’t select this option, orchestration node will only check the specific OU defined in the configuration. 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions.

Verify Group Membership

In the illustration above, the Identity Attribute Mappings are populated from the Provisioning tasks. Administrators choose the correct Active Directory from “Target” and are able to view what Identity Mappings are configured for the selected AD task. 

In this orchestration view you are not allowed to change any mappings, those are presented only as a visual aid. If there are needs to change the attribute mappings, those attributes must be defined in the provisioning task configuration view, in order them to be changed in the orchestration node. 

The “Save result*” field is used to define where the successful LDAP query results are saved, “true” if user was found or “false” otherwise. 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

Verify User

In the illustration above, the Identity Attribute Mappings are populated from the Provisioning tasks. Administrators choose the correct Active Directory from “Target” and are able to view what Identity Mappings are configured for the selected AD task. In this orchestration view you are not allowed to change any mappings, those are presented only as a visual aid. If there are needs to change the attribute mappings, those attributes must be defined in the provisioning task configuration view, in order them to be changed in the orchestration node. 

Within the Identity Mappings admins panel, admins are able to provide “IF” expression, which will form a LDAP query to verify if the user exists. It’s possible to select as many attributes from the Person Data Card as needed to confirm the uniqueness of a user. When an action takes place, those attributes will be read from the Data Card in question and will be compared to the appropriate AD attributes according to the “Target*“ Active Directory configuration. Admins can also choose to use “equal” or “not equal” to corresponding AD attribute by changing the “IF” expression. The “Save result*” field is used to define where the successful LDAP query results are saved, “true” if user was found or “false” otherwise. 

Key point to understand this node's mechanics is - while forming IF expression, admin needs to use Template's attributes, but in fact, values read from them, will be translated (mapped) to proper Active Directory attributes, according to Identity Mapping configuration and will be passed to Active Directory as a search query. 

Administrators has possibility to “check” Include OU subtree -property on this orchestration node to verify if user exists in the defined Organization Unit -subtree. If this administrator doesn’t select this option, orchestration node will only check the specific OU defined in the configuration. 

Provisioning exception is an optional property on this workflow node. Admins can configure this property in use where exceptions can be written if any exceptions exists during the provisioning actions. 

It is highly recommended that Customer is instructed to create process for renewing certificates before they get old and connection is lost. This will mean that Customers end-users are not able to login Efecte Solutions and / or data from AD cannot be read or written. 

Instructions

In this chapter are described troubleshooting options,

• In case failure template is used, check correct data card
• Check scheduled task history from connector management
• Check Efecte Provisioning Engine logs