To configure synchronization with a target system, One Identity Manager must load the data from the target system. One Identity Manager communicates directly with the target system to do this. Sometimes direct access from the workstation, on which the Synchronization Editor is installed, is not possible. For example, because of the firewall configuration or the workstation does not fulfill the necessary hardware and software requirements. If direct access is not possible from the workstation, you can set up a remote connection.
The remote connection server and the workstation must be in the same Active Directory domain.
Remote connection server configuration:
-
One Identity Manager Service is started
-
RemoteConnectPlugin is installed
-
Windows PowerShell version 5 or above is installed
-
Windows PowerShell module safeguard-ps is installed
-
One Identity Safeguard connector is installed
The remote connection server must be declared as a Job server in One Identity Manager. The Job server name is required.
TIP: The remote connection server requires the same configuration as the synchronization server (with regard to the installed software and entitlements and user account certificate). Use the synchronization as remote connection server at the same time, by simply installing the RemoteConnectPlugin as well.
For more detailed information about setting up a remote connection, see the One Identity Manager Target System Synchronization Reference Guide.
Related topics
Use the Synchronization Editor to configure synchronization between the One Identity Manager database and a One Identity Safeguard appliance. The following describes the steps for initial configuration of a synchronization project. For more detailed information about setting up synchronization, see the One Identity Manager Target System Synchronization Reference Guide.
After the initial configuration, you can customize and configure workflows within the synchronization project. Use the workflow wizard in the Synchronization Editor for this. The Synchronization Editor also provides different configuration options for a synchronization project.
Related topics
Have the following information available for setting up a synchronization project.
Table 4: Information required for setting up a synchronization project
|
Appliance hostname or IP |
Host name or IP address of the One Identity Safeguard appliance. If you use a cluster of multiple One Identity Safeguard appliances, enter the primary appliance here.
NOTE: This value must be adjusted if the primary appliance changes in the cluster. If the Always connect to the primary cluster node option is set in the system connection wizard, the primary appliance is calculated automatically. |
|
Trusted certificate thumbprint |
Thumbprint of the trusted certificate that is used by the synchronization user and the user account of the One Identity Manager Service.
For more information, see Users and permissions for synchronizing with a One Identity Safeguard appliance. |
|
Synchronization server for the appliance |
All One Identity Manager Service actions are executed against the target system environment on the synchronization server. Data entries required for synchronization and administration with the One Identity Manager database are processed by the synchronization server.
The One Identity Manager Service with the One Identity Safeguard connector must be installed on the synchronization server.
Table 5: Additional properties for the Job server
| Server function |
One Identity Safeguard connector |
| Machine role |
Server | Job server | Privileged Account Management |
For more information, see System requirements for the One Identity Safeguard synchronization server. |
|
One Identity Manager database connection data |
-
Database server
-
Database
-
SQL Server login and password
-
Specifies whether integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication. |
|
Remote connection server |
For more information, see Preparing a remote connection server for access to the One Identity Safeguard appliance. |
NOTE: The following sequence describes how to configure a synchronization project if the
Synchronization Editor is both:
If you execute the project wizard in expert mode or directly from the Synchronization Editor, additional configuration settings can be made. Follow the project wizard instructions through these steps.
To set up an initial synchronization project for One Identity Safeguard
-
Start the Launchpad and log in to the One Identity Manager database.
NOTE: If synchronization is executed by an application server, connect the database through the application server.
-
On the System access page, specify how One Identity Manager can access the target system.
-
If access is possible from the workstation on which you started the Synchronization Editor, do not change any settings.
-
If access is not possible from the workstation on which you started the Synchronization Editor, you can set up a remote connection.
Enable the Connect using remote connection server option and select the server to be used for the connection under Job server.
-
On the Connection parameters page, enter the following information:
-
Appliance hostname or IP: Enter the host name or IP address of the appliance. If you use a cluster of multiple One Identity Safeguard appliances, enter the primary appliance here.
NOTE: This value must be adjusted if the primary appliance changes in the cluster. On the Description of the appliance page, if the Always connect to the primary cluster node option is set, the primary appliance is calculated automatically.
-
Trusted certificate thumbprint: Enter the thumbprint of the trusted certificate used by the synchronization user and by the user account of One Identity Manager Service.
-
Ignore SSL connection errors: You should only activate this option for test purposes, because this may lead to potential trusting of insecure connections.
-
Click Test connection data to test the connection. The system tries to establish a connection to the appliance.
-
On the Description of the appliance page, enter the following information:
-
Appliance display name: Enter a name for displaying in One Identity Manager tools.
-
System identifier: Enter a unique identifier to identify the device.
|
|
CAUTION: The system identifier must describe the appliance uniquely. Appliances are differentiated on the basis of the system identifier. If you use an identifier more than once for different appliances, it can cause errors and loss of data. |
-
Always connect to the primary cluster node: This option is automatically set if a One Identity Safeguard cluster is identified when the connection is tested. If you use a cluster of multiple One Identity Safeguard appliances, this option should be enabled.
- You can save the connection data on the last page of the system connection wizard.
-
Set the Save connection locally option to save the connection data. This can be reused when you set up other synchronization projects.
-
Click Finish, to end the system connection wizard and return to the project wizard.
-
On the One Identity Manager Connection tab, test the data for connecting to the One Identity Manager database. The data is loaded from the connected database. Reenter the password.
NOTE: If you use an unencrypted One Identity Manager database and have not yet saved any synchronization projects to the database, you need to enter all connection data again. This page is not shown if a synchronization project already exists.
-
The wizard loads the target system schema. This may take a few minutes depending on the type of target system access and the size of the target system.
- On the Restrict target system access page, specify how system access should work. You have the following options:
Table 6: Specify target system access
|
Read-only access to target system. |
Specifies that a synchronization workflow is only to be set up for the initial loading of the target system into the One Identity Manager database.
The synchronization workflow has the following characteristics:
- Synchronization is in the direction of One Identity Manager.
- Processing methods in the synchronization steps are only defined for synchronization in the direction of One Identity Manager.
|
|
Read/write access to target system. Provisioning available. |
Specifies whether a provisioning workflow is to be set up in addition to the synchronization workflow for the initial loading of the target system.
The provisioning workflow displays the following characteristics:
- Synchronization is in the direction of the Target system.
- Processing methods are only defined in the synchronization steps for synchronization in the direction of the Target system.
- Synchronization steps are only created for such schema classes whose schema types have write access.
|
- On the Synchronization server page, select a synchronization server to execute synchronization.
If the synchronization server is not declared as a Job server in the One Identity Manager database yet, you can add a new Job server.
-
Click 
to add a new Job server.
-
Enter a name for the Job server and the full server name conforming to DNS syntax.
- Click OK.
The synchronization server is declared as a Job server for the target system in the One Identity Manager database.
NOTE: After you save the synchronization project, ensure that this server is set up as a synchronization server.
- To close the project wizard, click Finish.
This creates and allocates a default schedule for regular synchronization. Enable the schedule for regular synchronization.
The synchronization project is created, saved, and enabled immediately.
NOTE: If enabled, a consistency check is carried out. If errors occur, a message appears. You can decide whether the synchronization project can remain activated or not.
Check the errors before you use the synchronization project. To do this, in the General view on the Synchronization Editor‘s start page, click Verify project.
NOTE: If you do not want the synchronization project to be activated immediately, disable the Activate and save the new synchronization project automatically option. In this case, save the synchronization project manually before closing the Synchronization Editor.
NOTE: The connection data for the target system is saved in a variable set and can be modified in the Configuration | Variables category in the Synchronization Editor.
Related topics
