Nexio Insight LDAP Synchronization Service

Transcription

1 Nexio Insight LDAP Synchronization Service 15-May-2015 Revision: Release

2 Publication Information 2015 Imagine Communications Corp. Proprietary and Confidential. Imagine Communications considers this document and its contents to be proprietary and confidential. Except for making a reasonable number of copies for your own internal use, you may not reproduce this publication, or any part thereof, in any form, by any method, for any purpose, or in any language other than English without the written consent of Imagine Communications. All others uses are illegal. This publication is designed to assist in the use of the product as it exists on the date of publication of this manual, and may not reflect the product at the current time or an unknown time in the future. This publication does not in any way warrant description accuracy or guarantee the use for the product to which it refers. Imagine Communications reserves the right, without notice to make such changes in equipment, design, specifications, components, or documentation as progress may warrant to improve the performance of the product. Trademarks Product names and other brands (such as ADC, D-Series, Nexio, Nexio Insight, Nexio Motion, PowerSmart, Versio, VersioCloud ) are trademarks or trade names of Imagine Communications or its subsidiaries. Microsoft and Windows are registered trademarks of Microsoft Corporation. All other trademarks and trade names are the property of their respective companies. Contact Information Imagine Communications has office locations around the world. For domestic and international location and contact information, visit our Contact page ( Support Contact Information For domestic and international support contact information see: Support Contacts ( ecustomer Portal ( Academy Training ( Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 2 of 10

3 Contents Contents... 4 Install the LDAPSync Service... 4 Configure the LDAPSync Service... 5 Create Service Users... 9 Configure LDAP Authentication in Nexio Insight Server Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 3 of 10

4 The Nexio Insight LDAP Synchronization Service provides the capability to automatically synchronize Insight users with those defined in LDAP. This eliminates the need to manage users through the Insight user interface. LDAPSync is an optional service. Install the LDAPSync Service To install the service, perform the following steps: 1. Launch Nexio Insight LDAP-Synchronizer.msi to install the service. 2. On the Welcome screen click Next. 3. On the Custom Setup screen (Recommend accept defaults) click Next. 4. On the Application Server Information screen enter the name or IP address of the application server. 5. On the Destination Folder screen enter the destination folder location and click Next Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 4 of 10

5 6. On the Ready to Install screen click Install and wait for the installation process to complete. 7. On the Completed screen click Finish. IMPORTANT: Before configuration can be completed, the LDAPSync user must exist. For details on how to create a service account, refer to Create Service Users. Configure the LDAPSync Service To configure the service, perform the following steps: 1. Launch the configui.exe file from the installation folder. 2. Enter the base URL for the application server and the Admin user name and password. 3. Click OK. 4. Specify the following configuration parameters: LDAP Servers Select from a comma-separated list of Active Directory server computers. LDAP Server port Specify the LDAP Server port number. The default value is 389. Invenio Service User name Specify the Insight Server user name. The default value is _ldapsync Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 5 of 10

6 Invenio Service Password Specify the Insight Service Password. The default value is _ldapsync. For details on how to create this service account in Insight, refer to Create Service Users. LDAP hierarchy attributes: Specify what part of Active Directory information should be synchronized. Enter group location, group filter, user location and user filter attributes must be specified. Explanation: Active Directory is a hierarchical storage for different objects, which is similar to a file system. In a file system, there are folders that contain files or other folders. In Active Directory, a folder is called a container and organizational unit. These containers can store different types of objects such as users, groups, printers, etc. Now the focus is on groups and users. Example for Group Synchronization: The groups to synchronize are stored under the bgcom.hu\bg-com\groups container. On the right side, the actual groups are shown in this container. In this example, the Groups container is an organizational unit, as well as the BG-COM container, while bgcom.hu is the root point of the Active Directory. The LDAP syntax requires specifying the path to the group container using the following format: OU=Groups,OU=BG-COM,DC=bgcom,DC=hu (going backward direction, starting at the end). It can be interpreted as follows: the organizational unit called Groups (OU=Groups,) is to be accessed, which is located under the organizational unit called BG-COM (OU=BGCOM,), which is located under the root location (DC=bgcom,DC=hu) Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 6 of 10

7 The first parameter is configured, which the Group DN (distinguished name). Now any filter can be applied in order to filter out groups that should be excluded from the synchronization process. For instance, users may want to synchronize groups whose names start with character c. In this example, all groups in the container are candidates for synchronization; therefore, no filtering should be applied, which can be specified by adding objectclass=group as the group filter. Example for User Synchronization: The container from which the LDAPSynch service will start searching for user objects based on the user filter parameter must be specified. In this example, the user filter parameter is the following: OU=Developers,OU=BG-COM,DC=bgcom,DC=hu. No users need to be filtered out, so the following user filter attribute must be specified: objectclass=user. For details on the LDAP query syntax, click the LDAP Query Syntax Help tab button in the configuration UI Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 7 of 10

8 The last setting is the group membership filter. This setting does not need to be edited; the default following value can be accepted: (&(objectclass=user)(memberof={0})) 5. Click the Test LDAP Parameters button to see if the LDAP configuration attributes specified are correct. Both the groups and users to synchronize will be displayed. 6. Click Save Configuration. If the configured _ldapsync account does not exist in the Insight database, a warning displays. For details, refer to Create Service Users Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 8 of 10

9 7. Use Computer Management to start the Nexio Insight LDAP Synchronization Service. 8. (Optional) Review the log file at C:\ImagineComm\Insight\log to ensure that the service has started correctly. 9. Start Insight, click Users under Security in the menu and confirm that the users have been added. Create Service Users To create service users, perform the following steps: 1. Launch the DAM Console tool from the command line with the t parameter using c:\imaginecomm\insight\app\damcon\damcon.exe. 2. Log on with the logon command. 3. Enter Admin as the username and admin as the password. 4. Create a system account with the following command: cu username password true. 5. Press ENTER. 6. Add the user to the Administrators group with the following command: am Administrators username. 7. Press ENTER Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 9 of 10

10 Configure LDAP Authentication in Nexio Insight Server To configure the LDAP authentication in Insight Server, perform the following steps: 1. Locate C:\ImagineComm\Insight\app\services\www\dam3\web.config and open it in Notepad. 2. To edit the file, locate the LDAPConfig section and set the values as illustrated below. <LDAPConfig> <param Name="Servers" Value="activedirectoyserver.domain.com"></param> <param Name="Port" Value="389"></param> <param Name="UseSSL" Value="False"></param> <param Name="TopDN" Value=" OU=Developers,OU=BG-COM,DC=bgcom,DC=hu"></param> <param Name="Filter" Value="(&((objectClass=user)(sAMAccountName={0})))"></param> <param Name="UserName" Value="cn"></param> </LDAPConfig> 3. Save the file Imagine Communications Corp. Proprietary and Confidential 15-May-2015 Page 10 of 10