Active Roles 8.2 - Best Practices Guide

Introduction Installing and upgrading Active Roles

SQL database options Active Roles Web Interface topologies Active Roles client components Multi-factor authentication and two-factor authentication support Integration with other One Identity and Quest products Customization support

General best practices

Minimum permissions Active Roles service recovery Establishing a baseline or benchmark Active Roles deployment considerations Custom scripts Management History and Report Pack use cases

Management History considerations Report Pack considerations

Job Server

Example: Using a job server for Active Roles Synchronization Service Configuring Active Roles to handle real-time dynamic group updates

Performance bottlenecks

Known performance issues and workarounds Active Roles Synchronization Service connector performance SQL Server considerations Performance issues that are affecting only Active Roles Virtual Attributes Other Windows host configuration considerations Latency to the environment Clearing obsolete cached information Handling obsolete and incompatible external components Preventing high CPU usage when running the Dynamic Group Updater scheduled task Common SQL bottlenecks Common memory bottlenecks Hard drive space bottlenecks CPU, network, third-party integration and Azure integration bottlenecks

Troubleshooting

SQL database options

Active Roles topology > SQL database options

Active Roles supports the following SQL Server topologies.

Standalone
- One or more Active Roles services using one SQL Server.
Multiple SQL Servers
- Merge replication
- Mirroring
- Clustering
- Always On availability groups
- Distributed Always On availability groups
- Transaction log shipping

TIP: One Identity recommends implementing a fault tolerant configuration such as:

SQL mirroring
Two Active Roles services using the same database sources

Active Roles Web Interface topologies

Active Roles topology > Active Roles Web Interface topologies

You can install Active Roles Web Interface either on the machine where Active Roles Administration Service is running, or on a standalone server. However, when Active Roles Web Interface is installed on a standalone server, the following limitations apply:

Federated authentication is not supported in a standalone configuration.
You must configure constrained delegation.

Active Roles client components

Active Roles topology > Active Roles client components

CAUTION: Hazard of data loss!

Active Roles client components are version-specific. Using mismatched or older versions can lead to a loss of functionality or data corruption.

Make sure that all Active Roles client components are up-to-date. The supported client components include:

Web Interface
SPML
ADSI
PowerShell or custom code via ADSI or EDMS calls

To check the version of Active Roles client components

Open the Active Roles Console.
To check the list of all clients currently connected to the Active Roles service, navigate to Server Configuration > Client Sessions.
In the Client Version column, take note of any older clients, and upgrade them immediately.

Multi-factor authentication and two-factor authentication support

Active Roles topology > Multi-factor authentication and two-factor authentication support

The Active Roles Web Interface supports the following federated authentication options:

Windows authentication
WS-Federation
SAML 2.0 Authentication (as of Active Roles 8.2).

WS-Federation can be used with Microsoft Entra ID or Active Directory Federation Services (ADFS). SAML 2.0 Authentication can utilize any SAML provider, like OneLogin by One Identity.

You can configure Active Roles Web Interface to use SAML 2.0 Authentication with a number of common Identity Providers. The provider can then request both primary and secondary authentication. For more information, see the Active Roles Administration Guide.

Additional third-party providers can be configured using the Redistributable Secure Token Server (rSTS).

For more information of federated authentication, see Configuring federated authentication in the Active Roles Administration Guide.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Active Roles 8.2 - Best Practices Guide

SQL database options

Active Roles Web Interface topologies

Active Roles client components

Multi-factor authentication and two-factor authentication support