Setting up the synchronization server
To set up synchronization with Azure Infrastructure, a server has to be available that has the following software installed on it:
All One Identity Manager Service actions are executed against the target system environment on the synchronization server. Data entries required for synchronization and administration with the One Identity Manager database are processed by the synchronization server. The synchronization server must be declared as a Job server in One Identity Manager.
Use the One Identity Manager Service to install the Server Installer. The program executes the following steps:
- Setting up a Job server.
- Specifying machine roles and server function for the Job server.
- Remote installation of One Identity Manager Service components corresponding to the machine roles.
- Configuration of One Identity Manager Service.
- Starts the One Identity Manager Service.
NOTE: The program executes remote installation of the One Identity Manager Service. Local installation of the service is not possible with this program. Remote installation is only supported within a domain or a trusted domain.
For remote installation of One Identity Manager Service, you require an administrative workstation on which the One Identity Manager components are installed. For detailed information about installing a workstation, see the One Identity Manager Installation Guide.
To install and configure One Identity Manager Service remotely on a server
- Start the program Server Installer on your administrative workstation.
- Enter the valid connection credentials for the One Identity Manager database on the Database connection page.
- Specify the server on which you want to install One Identity Manager Service on the Server properties page.
Select a Job server from the Server menu.
- OR -
To create a new Job server, click Add.
Enter the following data for the Job server.
Table 2: Job Server Properties
| Property |
Description |
| Server |
Job server name. |
| Queue |
Name of the queue to handle the process steps.
Each One Identity Manager Service within the network must have a unique queue identifier. The process steps are requested by the job queue using exactly this queue name. The queue identifier is entered in the One Identity Manager Service configuration file. |
| Full server name |
Full server name in accordance with DNS syntax.
Example: <Name of servers>.<Fully qualified domain name> |
NOTE: You can use the Extended option to make changes to other properties for the Job server. You can also edit the properties later with Designer.
- Select SCIM on the Machine roles page.
- Select SCIM connector on the Server functions page.
- Check the One Identity Manager Service configuration on the Service settings page.
NOTE:The initial service configuration is predefined already. If further changes need to be made to the configuration, you can do this later with the Designer. For more information about configuring the service, see the One Identity Manager Configuration Guide.
-
To configure remote installations, click Next.
-
Confirm the security prompt with Yes.
-
Select the directory with the install files on Select installation source.
-
Select the file with the private key on the page Select private key file.
NOTE: This page is only displayed when the database is encrypted.
-
Enter the service's installation data on the Service access page.
Table 3: Installation Data
| Data |
Description |
| Computer |
Server on which to install and start the service from.
To select a server
Enter a name for the server.
- OR -
Select an entry from the list. |
| Service Account |
User account data for the One Identity Manager Service.
To enter a user account for the One Identity Manager Service
Set the option Local system account. This starts the One Identity Manager Service under the NT AUTHORITY\SYSTEM account.
- OR -
Enter user account, password and password confirmation. |
| Installation account |
Data for the administrative user account to install the service.
To enter an administrative user account for installation
-
Enable Advanced.
-
Enable Current user.
This uses the user account of the current user.
- OR -
-
Enter user account, password and password confirmation. |
- Click Next to start installing the service.
Installation of the service occurs automatically and may take some time.
- Click Finish on the last page of Server Installer.
NOTE: The service is entered with the name One Identity Manager Service in the server service management.
Creating a synchronization project for initial synchronization of Azure Cloud System
Use the Synchronization Editor to set up synchronization between the One Identity Manager database and Azure Cloud System. The following describes the steps for initial configuration of a synchronization project.
After the initial configuration, you can customize and configure workflows within the synchronization project. Use the workflow wizard in the Synchronization Editor for this. The Synchronization Editor also provides different configuration options for a synchronization project.
The following information is required for setting up a synchronization project.
NOTE: Be aware of case sensitive parts of the URL during configuration.
Table 4: Information Required for Setting up a Synchronization Project
| Data |
Explanation |
|
Servers DNS name / URL |
DNS name of the server that provides the SCIM interface or URL for connecting to the server. |
|
Port |
Port for accessing the cloud application. |
|
URI service |
URL for reaching the SCIM service. |
|
Authentication endpoint or URL |
URL available for authenticating. If authentication of another server or another root URL is used for authentication, the full URL must be entered here. |
|
User account and password |
User name and password for logging into the cloud application with the authentication types "Basic authentication", "OAuth authentication" and "Negotiated authentication". |
|
Client secret |
Security token for logging into the cloud application with the authentication type "OAuth authentication". |
|
Application/Client ID |
The application/client ID used to register the cloud application with the security token service. It is required for registering with the authentication type "OAuth-Authentication". |
|
SCIM endpoint |
Endpoint URIs or URLs for accessing the cloud application's schema, resource and service provider data. |
|
Synchronization server |
All One Identity Manager Service actions are executed against the target system environment on the synchronization server. Data entries required for synchronization and administration with the One Identity Manager database are processed by the synchronization server.
The One Identity Manager Service with the SCIM connector must be installed on the synchronization server.
The synchronization server must be declared as a Job server in One Identity Manager. Use the following properties when you set up the Job server.
Table 5: Additional properties for the Job server
|
Property |
Value |
|
Server function |
SCIM connector |
|
Machine role |
Server/Job server/SCIM |
For more information, see Setting up a synchronization server. |
| One Identity Manager database connection data |
Database server
- Database
- SQL Server Login and password
Specifies whether integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication. |
| Remote connection server |
To configure synchronization with a target system, One Identity Manager must load the data from the target system. One Identity Manager communicates directly with target system to do this. Sometimes direct access from the workstation on which the Synchronization Editor is installed is not possible, because of the firewall configuration, for example, or because the workstation does not fulfill the necessary hardware and software requirements. If direct access to the workstation is not possible, you can set up a remote connection. The remote connection server and the workstation must be in the same Active Directory domain.
Remote connection server configuration
- One Identity Manager Service is started
- RemoteConnectPlugin is installed
- SCIM connector is installed
The remote connection server must be declared as a Job server in One Identity Manager. The Job server name is required.
NOTE: The remote connection server requires the same configuration as the synchronization server (with regard to the installed software and entitlements). Use the synchronization as remote connection server at the same time, by simply installing the RemoteConnectPlugin as well. For more information about setting up a remote connection, see the One Identity Manager Target System Synchronization Reference Guide. |
NOTE: The following sequence describes how you configure a synchronization project if Synchronization Editor is both
- Run in default mode, and
- Started from the launchpad
If you run the project wizard in expert mode or directly from Synchronization Editor, additional configuration settings can be made. Follow the project wizard instructions through these steps.
To set up initial synchronization project for Azure Cloud System
- Start the Launchpad and log on to the One Identity Manager database.
NOTE: If synchronization is run by an application server, connect the database through the application server.
- Select Target system type SCIM interface and click Start.
This starts the Synchronization Editor's project wizard.
- On the System access page, specify how One Identity Manager can access the target system.
- If access is possible from the workstation on which you started Synchronization Editor, you do not need to make any settings.
- If access is not possible from the workstation on which you started Synchronization Editor, you can set up a remote connection.
Enable the Connect using remote connection server option and select the server to be used for the connection under Job server.
-
On the Configuration data page, enter the connection parameters required by the SCIM connector to login to the cloud application.
Table 6: Server parameter
|
Property |
Description |
|
Servers DNS name / URL |
DNS name of the server that provides the SCIM interface or URL for connecting to the server. |
|
URI service |
URL for reaching the SCIM service. Only the part of the URL used in common by all endpoints to be called, is required. The SCIM connector take the URL from the server URL, the port and URI together.
For example, if the full URL is "https://identities.example.net:8080/scim/v2", then enter "scim/v2" as the URI. |
Table 7: Authentication type
|
Property |
Description |
|
OAuth Authentication |
Authentication using the OAuth protocol 2.0. |
-
On the OAuth authentication page, enter the security token for the authentication type "OAuth authentication" and select the access type.
Table 8: Features of OAuth Authentication
|
Property |
Description |
|
Client secret |
Security token for logging into the cloud application.
If the client secret is not known, enter the user name and password. |
|
Application/Client ID |
The application/client ID used to register the cloud application with the security token service. |
|
Grant type |
Enable Client credentials |
-
You can test the connection on Verify connection settings. Click Test.
One Identity Manager tries to connect to the Starling connect Azure infrastructure Connector.
TIP: The One Identity Manager saves the test result. When you reopen the page and the connection data has not changed, the result of the test is displayed. You do not have to run the connection test again if it was successful.
- On the Endpoint configuration page, enter the URIs for the SCIM end points. The SCIM default is used there is no URI.
Table 9: End point configuration
|
Property |
Description |
|
Schema |
End point for accessing the schema information for the cloud application. |
|
Resources |
End point for accessing resource information for the cloud application, for example groups or user accounts. |
|
Supported service options |
End point for accessing the service provider information for the cloud application. |
To test the connection at the specified end points, click Test.
TIP:The One Identity Manager saves the test result. If you reopen the page and the end point configuration has not changed, the save test result is displayed.
- On the Target product selection page, you can select One Identity Starling Connect.
-
On the One Identity Manager Connection tab, test the data for connecting to the One Identity Manager database. The data is loaded from the connected database. Re-enter the password.
NOTE:If you use an unencrypted One Identity Manager database and have not yet saved any synchronization projects to the database, you need to enter all connection data again. This page is not shown if a synchronization project already exists.
-
The wizard loads the target system schema. This may take a few minutes depending on the type of target system access and the size of the target system.
-
Select the project template “Azure Infrastructure Synchronization” on the Select project template page to use for setting up the synchronization configuration.
-
On the Restrict target system access page, you specify how system access should work. Select the following option:
Table 10: Specify target system access
| Option |
Meaning |
| Read-only access to target system |
Specifies whether a synchronization workflow is only to be set up for the initial loading of the target system into the One Identity Manager database.
The synchronization workflow has the following characteristics
- Synchronization is in the direction of One Identity Manager.
- Processing methods in the synchronization steps are only defined for synchronization in the direction of One Identity Manager.
|
- Select the synchronization server to run synchronization on the Synchronization server page.
If the synchronization server is not declared as a Job server in the One Identity Manager database yet, you can add a new Job server.
- Click
to add a new Job server.
-
Enter a name for the Job server and the full server name conforming to DNS syntax.
-
Click OK.
The synchronization server is declared as Job server for the target system in the One Identity Manager database.
NOTE: After you save the synchronization project, ensure that this server is set up as a synchronization server.
-
To close the project wizard, click Finish.
This creates and allocates a default schedule for regular synchronization. Enable the schedule for regular synchronization.
The synchronization project is created, saved and enabled immediately.
To configure the content of the synchronization log
- Open the synchronization project in the Synchronization Editor.
- To configure the synchronization log for target system connection, select the category Configuration | Target system.
- To configure the synchronization log for the database connection, select Configuration | One Identity Manager connection.
- Select the General view and click Setup.
- Select the Synchronization log view and set Create synchronization log.
- Enable the data to be logged.
NOTE: Some content generates a particularly large volume of log data. The synchronization log should only contain data required for troubleshooting and other analyses.
- Click OK.
To synchronize on a regular basis
- Open the synchronization project in the Synchronization Editor.
- Select the category Configuration | Start up configurations.
- Select a start up configuration in the document view and click Edit schedule.
- Edit the schedule properties.
- To enable the schedule, click Activate.
- Click OK.
To start initial synchronization manually
-
Open the synchronization project in the Synchronization Editor.
-
Select the category Configuration | Start up configurations.
-
Select a start up configuration in the document view and click Execute.
-
Confirm the security prompt with Yes.
Detailed information about this topic
Related Topics
Displaying synchronization results
Synchronization results are summarized in the synchronization log. You can specify the extent of the synchronization log for each system connection individually. One Identity Manager provides several reports in which the synchronization results are organized under different criteria.
To display a synchronization log
-
Open the synchronization project in the Synchronization Editor.
-
Select Logs.
-
Click in the navigation view toolbar.
Logs for all completed synchronization runs are displayed in the navigation view.
-
Select a log by double-clicking on it.
The synchronization analysis is shown as a report. You can save the report.
To modify the retention period for synchronization logs
Customizing synchronization configuration
You have used the Synchronization Editor to set up a synchronization project for initial synchronization with Azure Cloud System. You can use this synchronization project to load Azure Infrastructure objects into the One Identity Manager cloud database.
You must customize the synchronization configuration in order to compare the database with the Azure Cloud System regularly and to synchronize changes.
IMPORTANT: As long as synchronization is running, you must not start another synchronization for the same target system. This applies especially, if the same synchronization objects would be processed.
For detailed information about configuring synchronization, see the One Identity Manager Target System Synchronization Reference Guide.
Updating Schemas
All the schema data (schema types and schema properties) of the target system schema and the One Identity Manager schema are available when you are editing a synchronization project. Only a part of this data is really needed for configuring synchronization. If a synchronization project is finished, the schema is compressed to remove unnecessary data from the synchronization project. This can speed up loading the synchronization project. Deleted schema data can be added to the synchronization configuration again at a later point.
If the target system schema or the One Identity Manager schema has changed, these changes must also be added to the synchronization configuration. Then the changes can be added to the schema property mapping.
To include schema data that have been deleted through compressing and schema modifications in the synchronization project, update each schema in the synchronization project.
This may be necessary if
- A schema was changed by
- Changes to a target system schema
- Customizations to the One Identity Manager schema
- A One Identity Manager update migration
- A schema in the synchronization project was shrunk by
- Enabling the synchronization project
- Saving the synchronization project for the first time
- Compressing a schema
To update a system connection schema
- Open the synchronization project in the Synchronization Editor.
-
Select the category Configuration | Target systems.
- OR -
Select the category Configuration | One Identity Manager connection.
- Select the view General and click Update schema.
- Confirm the security prompt with Yes.
This reloads the schema data.
To edit a mapping
- Open the synchronization project in the Synchronization Editor.
- Select the category Mappings.
- Select a mapping in the navigation view.
The Mapping Editor is displayed.
For more detailed information about mappings, see the One Identity Manager Target System Synchronization Reference Guide.
NOTE: The synchronization is deactivated if the schema of an activated synchronization project is updated. Reactivate the synchronization project to synchronize.
