Active Directory Sync (AD) How to Setup

Transcription

1 Active Directory Sync (AD) How to Setup 1 P a g e

2 Contents How to Setup Active Directory Sync... 3 Download your AD Script... 3 Configuration... 5 Active Directory Sync F.A.Q P a g e

3 How to Setup Active Directory Sync Pre-requisite: You must be an Account Owner in order to perform the Initial Steps. If you are not an Account Owner and you do not know who your WhosOnLocation Account Owner is; please and will advise you. Download your AD Script 1. Login to your WhosOnLocation Account 2. Select Tools > Account > Employee Management You will see this screen below: 3. Select the Yes option alongside Active Directory Sync (AD) 4. The Active Directory Sync Enabled acknowledgement will show. Select Close. 3 P a g e

4 5. Download Script: You will be presented with the Download Script button. Select this to download your unique script. Please note: The API key illustrated on this screen is unique to your organisation. You do not need to copy it as we pre-populate that into your script when you download it. However, we illustrate it for your reference. 6. New employee policy. When a new employee is added to your WhosOnLocation account via Active Directory Sync visitors will be able to select them as their Host immediately. However in order for the employee to gain access to their WhosOnLocation account for the purposes of pre-registering visitors, tagging themselves on or off-site, or access any of the User Roles, they must first be sent an activation . There are two options for activating this a. Manual Activation means one of your WhosOnLocation Administrators must grant them access manually by sending the employee an Activation from the Employee management tools under Tools > Locations > View Location > Employees. On receipt of the activation the employee selects the embedded link (inside the ) and they are directed to the login screen of your WhosOnLocation account. They must then create a password in order to login. b. Automatic Activation means when a new employee is added to your WhosOnLocation account via the Active Directory Sync, an activation is sent automatically to the new employee inviting them to create their own password in order to login. 4 P a g e

5 Configuration You must enter five configuration items in to the Sync script. We provide default values to assist. Appkey This is a secure token which uniquely identifies your company in our software, we preenter this value for you. Location (optional) default: "" The staff location normally is matched from the l LDAP attribute, this can be overridden by setting the location variable in the script. Multiple copies of the Sync script can be run with different location variable and LDAP parameters to ensure the staff are imported to the correct place. LDAP host default: localhost The hostname of the AD domain controller within your infrastructure to run the LDAP query. Since the script is running within your network there are no external connections to your domain controller or firewall changes needed. LDAP base example: "CN=Users,DC=example,DC=com" The point within your Active Directory tree to search for user accounts. LDAP search default: "(objectclass=user)" The criteria to match a user account within the Active Directory tree for export to WhosOnLocation. LDAP fields The LDAP attributes to send to WhosOnLocation. This is pre-set to "displayname, GivenName, sn, title, department, l, physicaldeliveryofficename, co, company, mail, mobile, telephonenumber" P a g e

6 Active Directory Sync F.A.Q 1. Q: We have multiple locations using WhosOnLocation. How do we assign the employees to their respective Locations setup in our WhosOnLocation account? A: The staff location normally is matched from the 'l' LDAP attribute, this can be overridden by setting the location variable in the script. Multiple copies of the Sync script can be run with different location variable and LDAP parameters to ensure the staff are imported to the correct place. 2. Q: Do users still login using the password they create themselves? A: Yes unless you use Single Sign-on, all users will create their own password when they initially receive their Activation (if applicable). 3. Q: Can users change their password? A: Yes. Users can change their password anytime by opening their Profile and selecting Change my Password. 4. Q: Can we still add employees manually if they do not appear in our Active Directory? A: Yes. However assuming you include the new employee s address when setting them up, should they ever be added to your Active Directory, their manually created record will be updated with the first Active Directory Sync and overridden using the Active Directory Sync employee profile. If the Active Directory employee profile records a different address to that of the manually created profile, then two, independent profiles, will exist. In such circumstances we recommend removing the manually created one. 5. Q: WhosOnLocation does not permit an employees (or any) address to be used more than once. So two or more employees cannot share an address. So how does WhosOnLocation treat an Active Directory Sync where the same address is recorded against two or more employees? A: Subsequent duplicates will be ignored in the Sync. 6. Q: Can you tell me anything about the security of the AD Data transfer? A: The AD Sync application connects back to the WhosOnLocation API server over a secure HTTPS connection. The application will only accept a connection to a valid and trusted certificate before sending any data. Our certificate is issued by Comodo UK and provides a chain of trust back to the default Windows certificate store. We have an additional option in the Sync application to verify the public key, this will directly compare the public key for the remote side to the known value for api.whosonlocation.com. This option forgoes the issuer validation and ensures that it is absolutely connected to WhosOnLocation, a fake trusted certificate cannot be used to intercept communications. If you require any further information about AD for WhosOnLocation please contact us on: helpdesk@whosonlocation.com 6 P a g e