Short Description
AD is one of the most commonly used connector. This article provides best practices for configuring AD connector
Applicable version
All versions
Detail best practice
- Try to use ObjectGUID as reconciliation Attribute in Account_Attribute parameter
Sample JSON for the Accounts Import -
[ACCOUNTID::objectGUID#String,
NAME::sAMAccountName#String,
DISPLAYNAME::name#String,
CUSTOMPROPERTY26::objectGUID#Binary,
RECONCILATION_FIELD::CUSTOMPROPERTY26]
- Similarly map ObjectGUID as reconciliation Attribute in in groupImportMapping
Sample JSON for Group Import -
{
"entitlementTypeName": "",
"performGroupAccountLinking": "true",
"importnestedmembershipoutofscope": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectclass=group)",
"mapping":"memberHash:member_char,customProperty1:sAMAccountType_char,customProperty2:instanceType_char,customProperty3:uSNCreated_char,customProperty4:groupType_char,customProperty5:dSCorePropagationData_char,customProperty12:dn_char,customProperty13:cn_char,lastscandate:whenCreated_date,customProperty15:managedBy_char,entitlement_glossary:description_char,description:description_char,displayname:name_char,customProperty9:name_char,customProperty10:objectCategory_char,customProperty11:sAMAccountName_char,entitlement_value:distinguishedName_char,entitlementid:distinguishedName_char,customProperty14:objectClass_char,updatedate:whenChanged_date,customPropErty17:distinguishedName_char,RECONCILATION_FIELD:customProperty18,customProperty18:objectGUID_Binary,
"tableFieldAttribute": "accountID"
}
- Implement AD Account incremental import with daily frequency. We need to add below attributes in Accounts Import mapping of AD Connector to enable the incremental Import and run the Incremental Import
CREATED_ON::whenCreated#date,UPDATEDATE::whenChanged#date
- AD User Incremental Import can be configured at the object filter level in AD Connector. Please find the object filter details in the below screenshot
- Use ADVANCE_FILTER_JSON if you just want to import accounts from specific containers :
- Similarly, Advanced Group filter can be used in Group Import Mapping JSON to import groups from specific containers
- Schedule either AD accounts import or access import, don’t implement both. Both accounts and access triggers can bring Accounts and entitlements with the difference being Access imports also bring entitlements which are not yet assigned to any account
- If there are multiple AD domains then instead of multiple AD connectors per domain, make use of ADSI connector. Note - no need to use ADSI connector if there is only AD domain
- Ensure AD connection’s Status and threshold parameter has all the AD userAccessControl which can mark accounts’ status as Active or Inactive
Below are the possible Active status of AD userAccessControl. There might be some ddditional once specific to your customer so recommended to do a LDAP search before finalizing the status list
"activeStatus":["512","590336","2163200","640","66048","66080","544","262656","328192","328224","262688","2080","2097664"] - Make use of character "?" for null check. Example: "manager":"${managerAccount?.accountID}“
- Make sure REUSEINACTIVEACCOUNT parameter is marked FALSE. If this config is set to TRUE then the connector will reuse the existing inactive account name while creating new accounts. By default this will be set to TRUE so our recommendation is to set this value to false.
- SUPPORTEMPTYSTRING should be FALSE, in case you want to skip the null/empty values for any attribute during creation
Key Benefit
Better performance and ease of maintenance
Reference documentation
