PowerCAMPUS Portal and Active Directory

Transcription

1 SUNGARD SUMMIT 2007 sungardsummit.com 1 PowerCAMPUS Portal and Active Directory Presented by: Chad Sexton PowerCAMPUS Portal Development March 21, 2007 A Community of Learning

2 Overview SunGard Higher Education s vision for higher education is to help every institution create the Unified Digital Campus (UDC), an environment in which systems, individuals, and communities interact seamlessly for learning, teaching, administration, and achievement. A Portal serves as a very important piece of the UDC because it provides institutions with the ability to unify and manage their core academic, administrative and community web applications in a common platform that ultimately provides a seamless, secure, and personalized atmosphere. 2

3 Overview The portal solution chosen by the PowerCAMPUS line of business is Microsoft Sharepoint Portal Server 2003 (for Portal 1.1) and Microsoft Office SharePoint Server 2007 (for PowerCAMPUS Portal 2007). With SPS 2003, all nonanonymous access to SharePoint Portal Server sites and areas requires that the user possess an Active Directory account. An important part of the value added to the Sharepoint Server solutions the PowerCAMPUS line of business will offer is the automatic provisioning of Active Directory accounts based on pre-existing IQ.Web accounts as well as newly created IQ.Web accounts. The current design has moved from a user-driven method of account provisioning to an administrator-driven method. 3

4 What s Included Important Active Directory Object Attributes Microsoft Management Console (MMC) - ADSI Edit PowerCAMPUS message sources to Portal/Active Directory messages within the system. IQ.Web Administrative pages related to Active Directory Portal Settings page in IQ.Web to access Portal/Active Directory settings. 4

5 What s Included Portal Account Maintenance page in IQ.Web titled Portal Unlock Accounts has been added that allows IQ.Web administrators to unlock accounts that have been denied access to enter Active Directory credentials due to failed Active Directory/Network login attempts within IQ.Web. A new Windows Application to access/configure Portal/Active Directory settings. The new application will allow administrators to setup default Domains, Organizational Units, Groups in regards to Active Directory. Other setups include our proprietary ADConnect process, general settings, and logon and full name formats. A new Windows Service which handles the account provisioning of Active Directory/IQ.Web accounts. 5

6 Managing the guest/applicant/student lifecycle User ADWatcher Active Directory Domain Controller SharePoint Server 1. User goes to anonymous site 2. User submits application in Self-Service 3. Applicant record created 4. ADWatcher executes applicant view 5. ADWatcher creates portal account 6. Self-Service s user id and password 7. User enters authenticated Portal site 8. User views content customized to her role PowerCAMPUS Database Server AD Connect Self-Service Server 6

7 Managing IQ users who already have AD accounts User ADWatcher Active Directory Domain Controller SharePoint Server 1. User logs in to IQ 2. User is prompted for AD credentials 3. AD.Connect validates credentials 4. Portal Account is mapped to IQ Account 5. User logs in to Portal 6. Personal data shows in Web Parts and SSO to IQ is successful PowerCAMPUS Database Server AD Connect Self-Service Server 7

8 Domains What is a Domain? A domain is logically an organizational grouping of resources allowing central management of those resources. Physically, it is a database containing information about those resources. Domains act as the building block for an Active Directory tree structure. 8

9 Active Directory and Domains Root Domain The first domain created in Active Directory becomes the root domain. The root domain acts as the top of the structure and determines the beginning of the Active Directory namespace. The name of the first domain must match the top level of your desired namespace. After the first domain is created, each subsequent domain is added to the tree somewhere beneath it. So additional domains are always considered children. So if our root domain is PowerCAMPUS then all subsequent domains will follow the naming pattern of <new name>.powercampus Ex. PowerCAMPUS -> Malvern.PowerCAMPUS (DN=Malvern.PowerCAMPUS) PowerCAMPUS -> Rochester.PowerCAMPUS (DN=Rochester.PowerCAMPUS) Domains do act as administrative boundaries in that it is easy to give one administrator control over all resources within a domain. But using domains as the boundary for administrative privileges does not offer great granularity. For that need, Active Directory includes the Organizational Unit (OU) object class. 9

10 Active Directory Groups Creating Groups Groups in Active Directory are a way to organize individual user or computer accounts. They are typically used for security and distribution purposes. It is recommended that most of your directory management should be done through groups, rather than to individual users or computers. 10

11 Active Directory Groups Types of Groups Security Groups Security Groups are used to grant permissions to resources. Computers, users, and other groups can be members of a security group. If you wanted to grant users permissions on a share or to a particular machine, for instance, you could create a group, grant that group the appropriate permissions, and then add users (or other groups even) as members of that group. Distribution Groups Distribution Groups are used for non-security functions, such as . Distribution Groups cannot be assigned permissions or rights. 11

12 Active Directory Groups Scopes of Groups The scope, or area of influence, for a group can be limited to a single domain, to multiple domains (through trusts), or to the entire network. Domain Local Groups Domain local groups are limited to a single domain. They can be used to grant permissions to resources only within that domain. Global Groups Global groups are used to grant permissions to objects in multiple domains and are visible to all trusted domains. Global groups, though, can have as members only users and groups from within their own domain. Universal Groups Universal groups are similar to global groups in that they can be used to grant permissions across multiple domains. The big difference is that universal groups can contain any combination of user and global group accounts from any trusted domain in the forest. 12

13 Active Directory Security Groups Active Directory Security Groups 13

14 Active Directory Security Groups Groups Member Of 14

15 Active Directory Security Groups Setting up Active Directory Security Groups in Directory Integration 15

16 Active Directory Organizational Units An Organizational Unit (OU) object is a container object used to organize the resources in your directory. Organizational Units form logical administrative units that can be used to delegate administrative privileges within a domain. Rather than add another domain to an existing structure, it is often more advantageous to just create another Organizational Unit to organize objects. Organizational Units provide structure within a domain. This structure is hierarchical in nature. Each OU acts as a subdirectory to help administrators organize the various resources described within the directory. Organizational Units should reflect the business structure of your company or organization. One should not create containers just for the sake of structure. If you can t justify a container for either management or user convenience, then you probably don t need that OU. 16

17 Active Directory Organizational Units An OU can contain the following types of objects: Users Groups Computers Printers Applications Security Policies File Shares Other OUs * The only object an OU cannot contain is any object from another domain. 17

18 Active Directory Organizational Units Why Create Containers To delegate administrative control, allowing an individual the ability to add, delete, or modify objects in a limited portion of the tree. To ease management by grouping like objects. You might create containers to hold users with similar security requirements. To control the visibility of objects. To make administration more straightforward, assigning permissions once to the OU rather than multiple times for each object. To make administration easier by limiting the number of objects in a single container. Even though the limit in a container is large, no one wants to page through a huge list every time they need to view/manage a single object. To be used as a holding container for other OUs. 18

19 Active Directory Organizational Units Active Directory Containers and Organizational Units 19

20 Active Directory Organizational Units Sample Structured View of Organizational Units 20

21 Active Directory Organizational Units Setting up Active Directory Containers in Directory Integration 21

22 Active Directory Organizational Units ADSI Edit 22

23 Windows Server 2003 Support Tools Download the latest version of the Support Tools To enable the use of the ADSI snap-in module, you will need to go to Microsoft s site to download the latest version, or the version that supports your instance of Windows Server 2003, of the Windows Server 2003 Support Tools. The link below will get the latest Support Tools for Windows Server 2003 SP1. EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en 23

24 Microsoft Management Console (Install ADSI Edit) Start, Run, mmc 24

25 Microsoft Management Console Add/Remove Snap-in 25

26 MMC ADSI Edit Snap-in Adding ADSI Edit Snap-in 26

27 MMC ADSI Edit Snap-in Adding Active Directory Users and Computers Snap-in 27

28 MMC ADSI Edit Snap-in Completing addition of snap-ins 28

29 MMC ADSI Edit Snap-in Viewing addition of Snap-ins 29

30 MMC ADSI Edit Snap-in Selecting a domain to connect to via ADSI Edit 30

31 MMC ADSI Edit Snap-in ADSI Edit Connection Settings 31

32 MMC ADSI Edit Snap-in Tree display in ADSI Edit 32

33 Active Directory Attributes Logon Name samaccountname Attribute 33

34 Active Directory Attributes Organizational Unit distinguishedname Attribute 34

35 Active Directory Attributes Container distinguishedname Attribute Jimmy.Page Container CN=Jimmy.Page,OU=Graduate,OU=Students,OU=MyCollege,DC=domain,DC=com 35

36 Sharepoint Portal Active Directory credentials stored in PORTALACCOUNT Table 36

37 IQ.Web & Active Directory AD.Connect is the interface between IQ.Web and Active Directory 37

38 PowerCAMPUS Portal Message Sources PORTALLINK,PORTALCRED,PORTALFAIL 38

39 IQ.Web Administration/Setup Portal Settings icon on Global Settings page 2 Portal administrative pages 39

40 IQ.Web Administration/Setup Portal Global Settings 40

41 IQ.Web Administration/Setup Portal Settings page Easy access to all Portal/Active Directory Settings For your IQ.Web and Active Directory Integration to work properly, the General Portal Settings page must be entered initially and processed. 41

42 IQ.Web Administration/Setup General Settings. 42

43 IQ.Web Administration/Setup The ability to view which users Active Directory credentials have been authenticated 43

44 IQ.Web Administration/Setup This page contains all of the accounts that have reached the maximum credential verification attempts. They will not be prompted to enter any Active Directory credentials once they have been locked. 44

45 IQ.Web Administration/Setup No locked accounts 45

46 Directory Integration New Windows Application 46

47 Directory Integration Setup Dataconfiguration.config 47

48 Directory Integration Script Execute Tab 48

49 Directory Integration Script Execute Settings Saved in XML Format 49

50 Directory Integration General Settings Tab 50

51 Directory Integration General Settings Settings Saved in XML Format 51

52 Directory Integration Log and Information Files AD Connect Log File User chooses name and location on Disk. *.log extension is recommended. AD Watcher Log File ADWatchService Log.txt User chooses location on Disk AD Watcher Information (Verbose) File ADWatchInfo Log.txt User chooses location on Disk AD Watcher Event Log File ADWatchService Log Windows Event Viewer 52

53 Directory Integration General Settings Log Files and Location 53

54 Directory Integration General Settings Error Log 54

55 Directory Integration General Settings Info Log 55

56 Directory Integration AD Connect Tab 56

57 Directory Integration AD Connect Settings Saved in Registry in 3 locations General Section 57

58 Directory Integration AD Connect Settings Saved in Registry in 3 locations Bindings Section 58

59 Directory Integration AD Connect Settings Saved in Registry in 3 locations Containers/Paths Section 59

60 Directory Integration AD Connect Settings Saved in Registry in 3 locations General Section Trace Log File for AD Connect process 60

61 Directory Integration Change SID Tab 61

62 Directory Integration Change SID Settings Saved in Registry 62

63 Directory Integration Logon Format Tab 63

64 Directory Integration Logon Format Tab Changing the format of a field (via right context menu) 64

65 Directory Integration Logon Format Tab Changing the field format values 65

66 Directory Integration Logon Format Tab Current Format changed and display changed 66

67 Directory Integration Logon Format Settings Saved in Database 67

68 Active Directory Logon Name User Object logon name 68

69 Active Directory Attributes Logon Name samaccountname Attribute 69

70 Directory Integration Name Format Tab 70

71 Directory Integration Name Format Settings Saved in Database 71

72 Active Directory Full Name Creating a new User object in Active Directory 72

73 Active Directory Full Name Populating Full name when creating new User Object 73

74 Active Directory Full Name Display of Full name for User Object 74

75 Active Directory Full Name Container Name display of Full Name 75

76 Directory Integration Windows Service Tab 76

77 Directory Integration Windows Service Tab Schedule Service 77

78 Directory Integration Windows Service Tab Service Running Status 78

79 Directory Integration Windows Service Tab ADWatcher Service showing in System Services 79

80 Directory Integration ADWatcher Service Set Logon Properties to user Administrator Account 80

81 Directory Integration Windows Service Event Log 81

82 Directory Integration Windows Service Event Log Message showing that the service was started 82

83 Directory Integration Windows Service Event Log Service executing and notifying records found for processing 83

84 IQ.Web Administration/Setup All new Portal/Active Directory pages as displayed in Maintain Pages section of Security Setup 84

85 Portal Identify Yourself Portal Identify Yourself page If you have one of the People Types as mapped in the Portal Roles page, and have not been prompted for Active Directory credentials previously, you will be directed to the Portal Identify Yourself page when you log into the IQ.Web application. 85

86 Portal Enter Credentials Yes, I do have credentials User shall enter proper Active Directory/Network credentials per their institution 86

87 Portal Enter Credentials Invalid credentials entered or problem communicating with Active Directory 87

88 Portal User Information Data Stored in PORTALACCOUNT Table after successful Active Directory account credentials 88

89 Questions & Answers Any Questions? 89

90 Thank You! Chad Sexton Please complete the online class evaluation form SunGard, the SunGard logo, Banner, Luminis, PowerCAMPUS, Matrix, and Plus are trademarks or registered trademarks of SunGard Data Systems Inc. or its subsidiaries in the U.S. and other countries. Third-party names and marks referenced herein are trademarks or registered trademarks of their respective owners SunGard. All rights reserved. 90