There are various special cases to take into account when setting up a synchronization project for Active Directory Lightweight Directory Services (AD LDS).
AD LDS supports different authentication methods.
Different settings arise, which need to be considered when setting up the synchronization project, depending on the authentication method you choose.
Authentication with AD LDS security principal
For this authentication method, you use a user account that is in AD LDS.
-
The user account must be a member in the Administrators group of the AD LDS instance.
-
The user account must have a password.
If it does not have a password, authentication is anonymous. This causes the schema to load incorrectly and the synchronization project set up fails.
Take note of the following for setting up your synchronization project.
-
Authentication must use SSL encryption.
-
Basic must be used as authentication method.
-
Enter the distinguished LDAP name (DN) with the user account's user name for logging in to AD LDS.
Syntax example: CN=Administrator,OU=Users,DC=Domain,DC=com
Authentication with Windows security principal
Use a user account for authentication that resides on a local computer or in an Active Directory domain.
-
The user account must be a member in the Administrators group of the AD LDS instance.
Take note of the following for setting up your synchronization project.
-
Negotiate must be used as the authentication method.
-
If SSL encoding is not being used, sealing and signing authentication modes must be enabled.
-
If SSL encoding is being used, sealing and signing authentication modes must not be enabled.
-
Enter the user principal name with the user account's user name for logging in to AD LDS.
Syntax example: Administrator@<domain.com>
Authentication with AD LDS proxy object
Use a user account for authentication which exists in AD LDS and serves as binding for a local user account or a user account in an Active Directory domain. The local user account or the Active Directory user account is referenced in AD LDS as security ID (SID).
-
The user account (AD LDS proxy object) must be a member in the Administrators group of the AD LDS instance.
Take note of the following for setting up your synchronization project.
-
Authentication must use SSL encryption.
-
Basic must be used as authentication method.
-
Use the AD LDS proxy object user name for the AD LDS login.
-
Enter the distinguished LDAP name (DN) with the user name.
Syntax example: CN=Administrator,OU=Users,DC=Domain,DC=com
-
The user account password referenced by the AD LDS proxy object is to be used as a login password.