立即与支持人员聊天
与支持团队交流

Active Roles Sync Service 8.2 - Administration Guide

Synchronization Service overview Deploying Synchronization Service Deploying Synchronization Service for use with AWS Managed Microsoft AD Getting started Connections to external data systems
External data systems supported with built-in connectors
Working with Active Directory Working with an AD LDS (ADAM) instance Working with Skype for Business Server Working with Oracle Database Working with Oracle Database user accounts Working with Exchange Server Working with Active Roles Working with One Identity Manager Working with a delimited text file Working with Microsoft SQL Server Working with Micro Focus NetIQ Directory Working with Salesforce Working with ServiceNow Working with Oracle Unified Directory Working with an LDAP directory service Working with an OpenLDAP directory service Working with IBM DB2 Working with IBM AS/400 Working with IBM RACF Working with MySQL database Working with an OLE DB-compliant relational database Working with SharePoint Working with Microsoft 365 Working with Microsoft Azure Active Directory Configuring data synchronization with the SCIM Connector Configuring data synchronization with the Generic SCIM Connector
Using connectors installed remotely Creating a connection Renaming a connection Deleting a connection Modifying synchronization scope for a connection Using connection handlers Specifying password synchronization settings for a connection
Synchronizing identity data Mapping objects Automated password synchronization Synchronization history Scenarios of use Developing PowerShell scripts for attribute synchronization rules Using PowerShell script to transform passwords

Deploying Synchronization Service

This section describes how to:

  • Install and configure Active Roles Synchronization Service.

  • Configure Azure BackSync.

  • Upgrade from supported versions of One Identity Quick Connect.

It also lists the communication ports used by Synchronization Service.

Installing Synchronization Service

To install all features and components of Active Roles Synchronization Service, use the installation media downloaded from the One Identity Support Portal. Alternatively, you can also install the Synchronization Service Management Shell only.

Prerequisites

Make sure the system on which you want to install Synchronization Service meets the system requirements described in the Active Roles Synchronization Service Release Notes.

NOTE:

After installing a supported version of the Az.Accounts PowerShell module, to prevent the module from using a non-supported authentication method later, run the following command in Windows PowerShell:

Update-AzConfig -EnableLoginByWam $false

Running this command ensures that the module uses an authentication method supported by Active Roles Synchronization Service, even if the Az.Accounts module is updated later to a newer version (for example, because of upgrading another PowerShell module) that uses a newer, unsupported authentication method by default.

To install Synchronization Service and all its components

  1. From the Active Roles Synchronization Service installation package, run the Active Roles Synchronization Service setup.

  2. Follow the instructions in the setup wizard.

  3. On the Ready to Install page, click Install. The wizard will then install the following components:

    • Synchronization Service Console: The graphical user interface of Active Roles Synchronization Service.

    • Management Shell: A command-line interface to synchronize data between external data systems with Active Roles Synchronization Service. For more information, see Synchronization Service Management Shell.

    • All built-in connectors to connect Synchronization Service to external data systems.

  4. To exit the wizard, click Finish.

To install Synchronization Service Management Shell only

  1. In Windows Explorer, navigate to the following folder of the installation media:

    \Components\ActiveRoles Synchronization Service

  2. To open the Windows command prompt, click the navigation bar of Windows Explorer, enter cmd, then press Enter.

  3. To install Synchronization Service Management Shell only, enter the following command, then press Enter:

    SyncService.msi INSTALLSYNCSHELL=1

    The installer then silently installs Synchronization Service Management Shell.

  4. To check if Management Shell has finished installation, search the application either in the Windows Start Menu, or in the Apps & Features list of the operating system. After the setup finished the installation, Management Shell will appear in these lists.

    To uninstall, navigate to Add or remove programs, click Active Roles Synchronization Service Management Shell, then click Uninstall.

    NOTE: Running the Active Roles Synchronization Service installation wizard with the .exe file of the installation media always installs both the Synchronization Service Console and the Synchronization Service Management Shell.

    One Identity recommends using the installation wizard to install both the Synchronization Service Console and the Synchronization ServiceManagement Shell for most use cases.

Configuring Synchronization Service

To configure Synchronization Service, you can use one of the following methods:

  • Specify new SQL Server or Azure SQL Server databases for storing the Synchronization Service data.

    With this method, you can store the configuration settings and synchronization data either in a single new SQL Server database or in two separate databases.

  • Share existing configuration settings between two or more instances of Synchronization Service.

Prerequisites

  • If you are using an Azure SQL Server, set the db_owner database role to the user of the Azure SQL Server.

  • If you are using an SQL Server, set the dbcreator server role to the user of the SQL Server.

    dbcreator is the minimum role that the user of the SQL Server or Azure SQL Server requires for the initial configuration of Synchronization Service.

    After creating the new database, you can revoke the dbcreator role because the db_owner role that is automatically assigned to the same user of the SQL Server is sufficient for the Synchronization Service database connection.

To configure Synchronization Service using a new database

  1. Start the Synchronization Service Console.

  2. Follow the steps in the wizard that starts automatically to configure Synchronization Service.

  3. On the Service Account and Mode page, specify the following and click Next:

    • The account under which you want Synchronization Service to run.

    • The mode (local or remote) in which you want to use Synchronization Service. Use the remote mode to work with connectors installed remotely. For more information, see Using connectors installed remotely. If you select the remote mode, click Finish to close the wizard.

  4. Select Create a new configuration and click Next.

  5. On the Database Connection page, specify an SQL Server database.

    • SQL Server: Enter the name of the SQL Server computer that hosts the database you want to participate in data synchronization operations.

    • Database: Enter a name for the new SQL Server database.

  6. (Optional) Select Store sync data in a separate database.

    • If you want to store the configuration settings and synchronization data in a single SQL Server database, clear the check box.

    • If you want to store the configuration settings and synchronization data in two separate databases, select the check box, then specify the database in which you want to store the synchronization data.

  7. On the Database Connection page, select an SQL Server authentication method, and click Next.

    NOTE: For all Azure SQL Server variants, select Use SQL Server authentication because Windows authentication is not supported.

    • Use Windows authentication: Allows you to access the SQL Server in the security context of the account under which the Synchronization Service is running.

    • Use SQL Server authentication: Allows you to access the SQL Server in the security context of the SQL Server user account whose user name and password you specify.

  8. On the Configuration File page, select the file for storing the created configuration profile, protect the file with a password, and click Finish.

To configure Synchronization Service using an existing database

  1. Start the Synchronization Service Console.

  2. Follow the steps in the wizard that starts automatically to configure Synchronization Service.

  3. On the Service Account and Mode page, specify the following and click Next:

    • The account under which you want Synchronization Service to run.

    • The mode (local or remote) in which you want to use Synchronization Service. Use the remote mode to work with connectors installed remotely. For more information, see Using connectors installed remotely. If you select the remote mode, click Finish to close the wizard.

  4. Select Use an existing configuration and click Next.

    NOTE: If the Synchronization Service is already configured, using an existing configuration file does not override the existing SQL Server or Azure SQL Server database settings. To change the settings of the database, you must reconfigure it or reinstall the Synchronization Service with the new configuration.

  5. On the Configuration File page, select I have the configuration file to provide the configuration file you exported from an existing Synchronization Service instance, enter the password if necessary, and click Next. If you do not have the configuration file, after clicking Next you will need to enter the required settings.

  6. If you provided the configuration file, specify the authentication method for accessing the database. Otherwise, enter the required database name and select the authentication method. Click Finish.

After you configure Synchronization Service, you can change its settings at any time using the Configuration Wizard. To start the wizard, start the Synchronization Service Console and click the gear icon in the upper right corner of the Synchronization Service Console.

Configuring Azure BackSync

In hybrid environments, on-premises Active Directory (AD) objects are synchronized to Azure AD, for example via Azure AD Connect. When you deploy Active Roles Synchronization Service in such a hybrid environment, this synchronization works only if existing user and group information (such as the Id) are also synchronized back from Azure AD to the on-premises AD. Active Roles Synchronization Service uses Azure back-synchronization (also known as Azure BackSync) for this purpose.

Prerequisites

The hybrid environment must meet the following requirements to configure Azure BackSync:

  • Azure Active Directory (Azure AD) module version 2.0.0.131 or later must be installed and configured.

  • The Directory Writers role must be enabled in Azure AD. To enable the role, use the following script:

    $psCred=Get-Credential
Connect-AzureAD -Credential $psCred
$roleTemplate = Get-AzureADDirectoryRoleTemplate | ? { $_.DisplayName -eq "Directory Writers" }

# Enable an instance of the DirectoryRole template

Enable-AzureADDirectoryRole -RoleTemplateId $roleTemplate.ObjectId

In addition, the user account you use to configure Azure BackSync must have the following roles:

  • User Administrator

  • Exchange Administrator

  • Application Administrator

Automatic and Manual Azure BackSync

You can perform Azure back-synchronization with Active Roles Synchronization Service, either automatically or manually:

  • You can configure automatic Azure back-synchronization via the (Settings) > Configure Azure BackSync option of Active Roles Synchronization Service. For more information, see Configuring automatic Azure BackSync.
  • You can also configure manual Azure back synchronization, using existing Active Roles Synchronization Service feature components. For more information, see Configuring manual Azure BackSync.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级