Skip to main content

Configuring AD

Attribute Sync Direction​

While adding attribute in json file, you can choose which direction your data flows for every attribute in IDHub.

Use function syncDirection for every attribute to choose their data flow directions.

Possible values are as follows:

'bi-directional': 'Bidirectional Synchronization',
'idhub-to-app': 'Sync IDHub to Application only',
'app-to-idhub': 'Sync Application to IDHub only',
'no-sync': 'No Synchronization'

Based on attribute functions we recommend directions. See below:

  • RBAC (Role based Access Control) : app-to-idhub or bi-directional
  • Reporting and not sensitive : bi-directional
  • Modify functions in target system and RBAC : idhub-to-app
  • Only for display : no-sync
  • Sensitive Attribute not used for audit/ reporting : Do not add attribute

Field Mapping​

Another function in the json is to match a specific IDHub field with the target system attribute.

Use function idhubFieldName and add from IDHub field list to match the fields.

info

List of IDHub fields can be viewed in your IDHub instance in Admin Settings page in Admin Module. Target System fields can be matched with custom added IDHub field as well.

Example
{
  "name": "givenName",
  "type": "string",
  "multiValued": false,
  "description": "The FirstName of the user.  REQUIRED.",
  "returned": "always",
  "required": true,
  "idhubFieldName": "firstName",
  "syncDirection": "bi-directional"
}

Here target system attribute givenName is mapped with IDHub attribute firstName.

Multi-value Field​

For making an attribute multi-valued in IDHub, use function multivalue and mark it as true. Some common examples are email addresses, membership, licenses attributes which provides multiple values.

Unique Field​

Every target system provides at-least one unique attribute to distinguish their accounts. To mark that attribute as unique account name (In case multiple unique keys are present and you do not wish for IDHub to fetch all unique keys and mark only one as account name) use function uniqueness and value can be server or global

note

Reconciliation will fail if more than one attribute is added as unique.

For AD, below are some of the attributes among others that can be unique account name.

  • mail
  • sAMAccountName - Recommended
  • id
  • cn
  • employeeID
  • userPrincipalName

Reconciliation Key​

Possible unique reconciliation key to match account in AD with User in IDHub are as follows:

  • sAMAccountName (AD) with login (IDHub) - Recommended
  • mail (AD) with email (IDHub)

Use function

  • isRecon and mark as true AND
  • mutability and mark as immutable

Both functions need to be added to the attribute to mark it as a reconciliation key.

Example : Below is a sAMAccountName attribute which is marked as Reconciliation key.
{
  "name": "sAMAccountName",
  "type": "string",
  "description": "sAMAccountName used as network ID",
  "mutability": "immutable",
  "isRecon": true,
  "uniqueness": "server",
  "required": true,
  "returned": "always",
  "multiValued": false,
  "idhubFieldName": "login",
  "syncDirection": "bi-directional"
}

More than one attribute can be used as reconciliation key. It is used to match IDHub users with accounts and combination of reconciliation keys will be used to match the account.