Ensure that the following software requirements are met:
- Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, or Microsoft Windows Server 2019 operating system.
- Microsoft .NET Framework 4.7.2.
- Microsoft Internet Information Services (IIS). For proxy mode, the IIS server must be part of an Active Directory forest where Active Roles is deployed.
- For proxy mode, Active Roles Administration Service 7.4 is required.
TIP: If you choose the proxy mode, for performance reasons, we recommend that you install the Active Roles SPML Provider on the computer running the Active Roles Administration Service.
NOTE: SPML component cannot be installed on a System with TerminalServer roles and components enabled.
Windows Server 2012
On a Windows Server 2012 or Windows Server 2012 R2 based computer, ensure that the Web Server (IIS) sever role is installed, including:
- Web Server/Common HTTP Features/
- Default Document
- HTTP Errors
- Static Content
- HTTP Redirection
- Web Server/Security/
- Request Filtering
- Basic Authentication
- Windows Authentication
- Web Server/Application Development/
- .NET Extensibility 4.7.2
- ASP
- ASP.NET 4.7.2
- ISAPI Extensions
- ISAPI Filters
- Management Tools/IIS 6 Management Compatibility/
- IIS 6 Metabase Compatibility
Windows Server 2016 and Windows Server 2019
On Windows Server 2016 and Windows Server 2019 based computer, ensure that the Web Server (IIS) sever role is installed, including:
- Web Server/Common HTTP Features/
- Default Document
- HTTP Errors
- Static Content
- HTTP Redirection
- Web Server/Security/
- Request Filtering
- Basic Authentication
- Windows Authentication
- Web Server/Application Development/
- .NET Extensibility 4.7.2
- ASP
- ASP.NET 4.7.2
- ISAPI Extensions
- ISAPI Filters
- Management Tools/IIS 6 Management Compatibility/
- IIS 6 Metabase Compatibility
Use Server Manager to add the required role, role services, and features.
Feature Delegation
Configure Internet Information Services (IIS) to provide Read/Write delegation for the following features:
Use Feature Delegation in Internet Information Services (IIS) Manager to verify that these features have delegation set to Read/Write.
Configuring Active Roles SPML Provider
Configuration settings allow the administrator to configure SPML Provider and its schema in order to adjust the SPML Provider behavior. Administrators can, for example, specify the required managed objects and attributes in the schema, or choose the type of execution (disabling or deprovisioning objects) for the Suspend operation.
The SPML Provider configuration settings can be found in the SPML.Config file located in the Web sub-folder of the SPML Provider installation folder. The SPML.Config file contains data in the XML format. You can open and edit the configuration file with a common text editor such as Notepad.
NOTE: After you modify configuration settings, the IIS application pool for the SPML Provider Web site must be restarted in order for the changes to take effect.
The following table describes the XML elements used in the SPML Provider configuration file.
Table 2: XML elements used in the SPML Provider configuration file
|
service |
configuration |
In proxy mode, specifies the name of the computer running the Active Roles Administration Service. In direct access mode, specifies the name of the AD domain controller or AD LDS server. The name of the AD LDS server must be in the form <servername:portnumber>. |
|
adsiProvider |
configuration |
Specifies the progID of the ADSI Provider. In proxy mode, the progID is EDMS. In direct access mode, the progID is LDAP. |
|
schemaFile |
configuration |
Contains the name of the file that defines the DSML Profile schema for SPML Provider. By default, the file name is SPMLSchema.Config. The schema file must be located in the same folder as the SPML.Config file. |
|
defaultMaxSelect |
search |
Specifies the maximum number of search results that SPML Provider can return without page splitting. The default value is 1000. |
|
pageSize |
search |
Specifies the maximum number of search results per page. The default value is 25.
NOTE: If pageSize is set to 0, SPML Provider returns search results without page splitting. |
|
class |
password |
Contains the LDAP display name of the schema class of objects on which SPML Provider is expected to perform the Password Capability-related operations such as setPassword and expirePassword. |
|
class |
suspend |
Contains the LDAP display name of the schema class of objects on which SPML Provider is expected to perform the Suspend Capability-related operations such as suspend, resume, and active. |
|
suspendAction |
suspend |
Possible values: disable or deprovision. The default value is disable.
If suspendAction is set to disable, SPML Provider disables the specified user account on the target.
If suspendAction is set to deprovision, SPML Provider deprovisions the specified user account in accordance with the deprovisioning policies defined by Active Roles. |
|
checkOutput |
configuration |
Possible values: true or false. The default value is false.
true causes SPML Provider to check the string attribute values retrieved from the underlying directory before adding them to a response. If an attribute value contains illegal characters that could break the XML parser on the client side, SPML Provider converts the attribute value to the base64binary format and then adds the result of the conversion to the response. Note that this option may result in performance degradation of SPML Provider as checking every attribute value is a resource-intensive operation.
false causes SPML Provider not to check the string attribute values retrieved from the underlying directory. An attribute value is added to the response without any conversion even if the value contains illegal characters.
NOTE: In accordance with the XML specification, the legal character range is as follows: #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]. With checkOutput set to true, SPML Provider ensures that attribute values in a response contain only characters from the legal character range. |
