Chat now with support
Chat with Support

Active Roles 7.6.1 - Solutions Guide

Active Roles Solutions Overview Exchange Resource Forest Management Configuration Transfer Wizard Solution Active Roles SPML Provider Skype for Business Server Solution
Introducing Skype for Business Server User Management Supported Active Directory topologies User Management policy Master Account Management policy Access Templates for Skype for Business Server Deploying the Solution Managing Skype for Business Server Users
Management Pack for SCOM

Software requirements

Ensure that the following software requirements are met:

  • Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, or Microsoft Windows Server 2019 operating system.
  • Microsoft .NET Framework 4.7.2.
  • Microsoft Internet Information Services (IIS). For proxy mode, the IIS server must be part of an Active Directory forest where Active Roles is deployed.
  • For proxy mode, Active Roles Administration Service 7.4 is required.

    TIP: If you choose the proxy mode, for performance reasons, we recommend that you install the Active Roles SPML Provider on the computer running the Active Roles Administration Service.

NOTE: SPML component cannot be installed on a System with TerminalServer roles and components enabled.

Web Server requirements

Windows Server 2012

On a Windows Server 2012 or Windows Server 2012 R2 based computer, ensure that the Web Server (IIS) sever role is installed, including:

  • Web Server/Common HTTP Features/
    • Default Document
    • HTTP Errors
    • Static Content
    • HTTP Redirection
  • Web Server/Security/
    • Request Filtering
    • Basic Authentication
    • Windows Authentication
  • Web Server/Application Development/
    • .NET Extensibility 4.7.2
    • ASP
    • ASP.NET 4.7.2
    • ISAPI Extensions
    • ISAPI Filters
  • Management Tools/IIS 6 Management Compatibility/
    • IIS 6 Metabase Compatibility
Windows Server 2016 and Windows Server 2019

On Windows Server 2016 and Windows Server 2019 based computer, ensure that the Web Server (IIS) sever role is installed, including:

  • Web Server/Common HTTP Features/
    • Default Document
    • HTTP Errors
    • Static Content
    • HTTP Redirection
  • Web Server/Security/
    • Request Filtering
    • Basic Authentication
    • Windows Authentication
  • Web Server/Application Development/
    • .NET Extensibility 4.7.2
    • ASP
    • ASP.NET 4.7.2
    • ISAPI Extensions
    • ISAPI Filters
  • Management Tools/IIS 6 Management Compatibility/
    • IIS 6 Metabase Compatibility

Use Server Manager to add the required role, role services, and features.

Feature Delegation

Configure Internet Information Services (IIS) to provide Read/Write delegation for the following features:

  • Handler Mappings
  • Modules

Use Feature Delegation in Internet Information Services (IIS) Manager to verify that these features have delegation set to Read/Write.

Configuring Active Roles SPML Provider

Configuring Active Roles SPML Provider

Configuration settings allow the administrator to configure SPML Provider and its schema in order to adjust the SPML Provider behavior. Administrators can, for example, specify the required managed objects and attributes in the schema, or choose the type of execution (disabling or deprovisioning objects) for the Suspend operation.

Configuration settings in SPML.Config

The SPML Provider configuration settings can be found in the SPML.Config file located in the Web sub-folder of the SPML Provider installation folder. The SPML.Config file contains data in the XML format. You can open and edit the configuration file with a common text editor such as Notepad.

NOTE: After you modify configuration settings, the IIS application pool for the SPML Provider Web site must be restarted in order for the changes to take effect.

The following table describes the XML elements used in the SPML Provider configuration file.

 

Table 2: XML elements used in the SPML Provider configuration file

Element

Parent element

Description

service

configuration

In proxy mode, specifies the name of the computer running the Active Roles Administration Service. In direct access mode, specifies the name of the AD domain controller or AD LDS server. The name of the AD LDS server must be in the form <servername:portnumber>.

adsiProvider

configuration

Specifies the progID of the ADSI Provider. In proxy mode, the progID is EDMS. In direct access mode, the progID is LDAP.

schemaFile

configuration

Contains the name of the file that defines the DSML Profile schema for SPML Provider. By default, the file name is SPMLSchema.Config. The schema file must be located in the same folder as the SPML.Config file.

defaultMaxSelect

search

Specifies the maximum number of search results that SPML Provider can return without page splitting. The default value is 1000.

pageSize

search

Specifies the maximum number of search results per page. The default value is 25.

NOTE: If pageSize is set to 0, SPML Provider returns search results without page splitting.

class

password

Contains the LDAP display name of the schema class of objects on which SPML Provider is expected to perform the Password Capability-related operations such as setPassword and expirePassword.

class

suspend

Contains the LDAP display name of the schema class of objects on which SPML Provider is expected to perform the Suspend Capability-related operations such as suspend, resume, and active.

suspendAction

suspend

Possible values: disable or deprovision. The default value is disable.

If suspendAction is set to disable, SPML Provider disables the specified user account on the target.

If suspendAction is set to deprovision, SPML Provider deprovisions the specified user account in accordance with the deprovisioning policies defined by Active Roles.

checkOutput

configuration

Possible values: true or false. The default value is false.

true causes SPML Provider to check the string attribute values retrieved from the underlying directory before adding them to a response. If an attribute value contains illegal characters that could break the XML parser on the client side, SPML Provider converts the attribute value to the base64binary format and then adds the result of the conversion to the response. Note that this option may result in performance degradation of SPML Provider as checking every attribute value is a resource-intensive operation.

false causes SPML Provider not to check the string attribute values retrieved from the underlying directory. An attribute value is added to the response without any conversion even if the value contains illegal characters.

NOTE: In accordance with the XML specification, the legal character range is as follows: #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]. With checkOutput set to true, SPML Provider ensures that attribute values in a response contain only characters from the legal character range.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating