Importing from Active Directory / LDAP

Transcription

1 Importing from Active Directory / LDAP To synchronise or import user details from an LDAP directory, such as Active Directory (AD): 1. Set the default LDAP import query string in N > Setup > Main Configuration > Active Directory. This string will be used as the default for any new sites. 2. There is a LDAP/AD Field Mapping button that can help you populate this field. You may need to engage the input of the person maintains your AD 3. Once done, you can click on the Setup LDAP Sites and Connection button, to map sites to parts of your AD. 4. How you structure the treeview in NetHelpDesk does not have to necessarily reflect the structure in your AD, but if your AD is well structured and maintained, the import will be straight forward. 5. At the site level, right click and Edit Site and Services and specify the LDAP Import String and Filter inside [] field query string as required. 6. Click Update, right click on the site level, and then Sync to LDAP. Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 1 of 7

2 7. Any users that match the query string will be regarded as being at that site. 8. A screen showing the users allows you to further restrict who is imported, and a LDAP filter can be setup if you need to have more control over which users are imported. This is done as the end part of the LDAP string, and uses square brackets. 9. Put the filter along with an 'and' condition inside [ ] at the end of the string. e.g.: LDAP://CN=Users,DC=MyADdomain,DC=co,DC=uk[and department='finance'] 10. You can import each site separately, or use the 'LDAP sync all sites' option on the main file menu. Here is another example of the AD tree and associated LDAP string: LDAP://ou=guest,ou=hq,ou=sci,DC=adw2k1,DC=co,DC=uk The order of the OU's is important. It is case insensitive. Should you have any questions regarding any steps in this guide, please speak with the NetHelpDesk Support Team. nethelpdesk.com/contact Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 2 of 7

3 LDAP FIELDS The LDAP fields or attributes are matched to NetHelpDesk fields using the LDAP matching table in the setup screen. This allows you to choose how the Active Directory fields are related to the NetHelpDesk fields. The LDAP field names can be found out using the ADSIedit program which comes with Windows. PLEASE NOTE: The label seen in active directory is different to the field name quite often: LDAP Attribute CN - Common Name description displayname Example CN=Guy Thomas. Actually, this LDAP attribute is made up from givenname joined to SN What you see in Active Directory Users and Computers. Not to be confused with displayname on the Users property sheet. displayname = Guy Thomas. Avoid this attribute if possible, as it can be confused with CN or description. DN - also distinguishedname givenname homedrive name objectcategory objectclass physicaldeliveryofficename profilepath samaccountname SN useraccountcontrol userprincipalname DN is simply the most important LDAP attribute. CN=Jay Jamieson, OU= Newport,DC=cp,DC=com First name Home Folder : connect. name = Guy Thomas. Exactly the same as CN. Defines the Active Directory Schema category. For example, objectclass = Person objectclass = User. Also used for Computer, organizationalunit, even container. Important top level container. Office on the user's General property sheet Roaming profile path: connect samaccountname = guyt. Old NT 4.0 logon name, must be unique in the forest. Can be confused with CN. SN = Thomas. This would be referred to as last name or surname. Used to disable an account. A value of 514 disables the account, while 512 makes the account ready for logon. userprincipalname = guyt@cp.com Often abbreviated to UPN, and looks like an address. Very useful for logging on especially in a large Forest. Note UPN must be unique in the forest. Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 3 of 7

4 Exchange Specific LDAP attributes LDAP Attribute homemdb mail mapirecipient - FALSE mailnickname mdbusedefaults msexchhomeservername Example Here is where you set the MailStore An easy, but important attribute. A simple SMTP address is all that is required billyn@ourdom.com Indicates that a contact is not a domain user. Normally this is the same value as the samaccountname, but could be different if you wished. Needed for mail enabled contacts Another straightforward field, just the value to:true Exchange needs to know which server to deliver the mail. e.g: /o=yourorg/ou=first Administrative Group/cn=Configuration/cn=Servers/cn=MailSrv legacyexchangedn proxyaddresses targetaddress showinaddressbook Legacy distinguished name for creating Contacts. In the following example, Guy Thomas is a Contact in the first administrative group of GUYDOMAIN: /o=guydomain/ou=first administrative group/cn=recipients/cn=guy Thomas As the name 'proxy' suggests, it is possible for one recipient to have more than one address. Note the plural spelling of proxyaddresses. SMTP:@ address. Note that SMTP is case sensitive. All capitals means the default address. Displays the contact in the Global Address List. Should you have any questions regarding any steps in this guide, please speak with the NetHelpDesk Support Team. nethelpdesk.com/contact Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 4 of 7

5 Other LDAP attributes c company department homephone l (Lower case L) location manager mobile ObjectClass OU postalcode st streetaddress telephonenumber Country or Region Company or organization name Useful category to fill in and use for filtering Home Phone number, (Lots more phone LDAPs) L = Location. City (Maybe Office) Important, particularly for printers. Boss, manager Mobile/Cell Phone number Usually User, or Computer Organizational unit. See also DN Zip or post code State, Province or County First line of address Office Phone Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 5 of 7

6 NetHelpDesk User Fields for LDAP Sync User Field Username Title Address Additional s LDAP Proxy Network Login Work Direct/Extn. Work General Work Mobile/Cell Home Mobile/Cell Home Fixed Fax Number User Defined 1 User Defined 2 User Defined 3 User Defined 4 User Defined 5 Notes Twitter Screen Name Disclaimer Matching String Database Field Name Uusername Utitle U U 2 U 3 Ulogin Uextn (set at site level) Umobile2 Umobile Utelhome Ufax Uother1 Uother2 Uother3 Uother4 Uother5 Unotes Utwitterscreenname Ufacebookid Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 6 of 7

7 ISSUE WITH CHILD DOMAINS 1. When logged into one domain, if you try and do an LDAP sync to a child domain, then no users are listed. There is no error message. 2. This is because the default domain context is taken to be the domain into which you are logged. This can probably be fixed by logging into the child domain. 3. Alternatively, specify the FDQN of the domain in the LDAP string. For example, it is possible to explicitly specify the FDQN of the LDAP server in the string. So instead of: You can say: LDAP://CN=Users,DC=adw2k1,DC=co,DC=uk LDAP://adw2k1.co.uk/CN=Users,DC=adw2k1,DC=co,DC=uk 4. Put the child domains FQDN in the string instead to query the child domain. SETTING UP THE LDAP SYNC AS A SCHEDULED TASK It may be preferred to run the LDAP sync automatically as a repeating scheduled task (e.g. once a week), to ensure continued scanning following a Server reboot, for example. This will not require a logged in session. The fundamental points for setup are as follows. Values are examples: Name: Security Options: NHDLDAPSYNC Run whether user is logged on or not Run with the Highest Privileges Trigger: Weekly, recur every (choose day) Daily: Current date, at 00:01 Task To Perform: Program/Script: Add Arguments: Start A Program e.g. C:\NetHelpDesk\Win\NetHDClient.exe e.g. C:\NetHelpDesk\NetHelpDesk.udl LDAPSYNC - END OF DOCUMENT - Net Help Desk Limited NetHelpDesk-Mini-Guide-Active-Directory-LDAP.docx Page 7 of 7