When creating a user in the Top Secret database, the following LDAP attributes must be defined:
-
objectclass
-
tssacid
-
name
-
Department
-
userPassword
Initializing and configuring the LDAP connector for CA Top Secret
Prerequisites
Platform support
Operating constraints
How to initialize and configure the Top Secret LDAP connector
System variables
Domain filter setting
User mapping information
Group mapping information
Top Secret attributes
Mandatory Top Secret group attributes
Property mapping rules
Object matching rules
Synchronizing Top Secret group members
Profile mapping information
Mandatory Top Secret user attributes
Property mapping rules
-
CanonicalName ← vrtEntryCanonicalName
vrtEntryCanonicalName is a virtual property, set to the canonical name of the object in the connector. Select the Ignore case sensitivity check box.
Sample value:
COM/MYCOMPANY/TOPSECRET1/ACIDS/USER1234
-
cn ←→ tssacid
On the Top Secret system, tssacid is the user ID. Select the Ignore case sensitivity check box.
Sample value:
USER1234
-
DistinguishedName ← vrtEntryDN
vrtEntryDN is a virtual property, set to the DN of the object in the connector. Once this mapping rule is created, edit the mapping rule by clicking on it. Select the Ignore case sensitivity check box.
Sample value:
tssacid=USER1234,tssadmingrp=acids,host=topsecret1,o=mycompany,c=com
-
ObjectClass ←→ objectClass
The objectClass attribute (multi-valued) on the Top Secret system. Select the Ignore case sensitivity check box.
Sample value:
TSSACID
-
StructuralObjectClass ← vrtStructuralObjectClass
vrtStructuralObjectClass on the Top Secret system defines the single object class for the object type. Select the Ignore case sensitivity check box.
Sample value:
TSSACID
-
UID_LDPDomain ← vrtIdentDomain
Create a fixed-value property variable on the Top Secret side calledvrtIdentDomain that is set to the value $IdentDomain$. Map this to UID_LDPDomain. This will cause a conflict and the Property Mapping Rule Conflict Wizard opens automatically.
To resolve the conflict
-
In the Property Mapping Rule Conflict Wizard, select the first option and click OK.
-
On the Select an element page, select Ident_Domain and click OK.
-
Confirm the security prompt with OK.
-
On the Edit property page:
-
Clear Save unresolvable keys.
-
Select Handle failure to resolve as error.
-
-
To close the Property Mapping Rule Conflict Wizard, click OK.
Sample value:
TOPSECRET1
-
-
vrtParentDN → vrtEntryParentDN
Create a fixed-value property variable on the One Identity Manager side called vrtParentDN equal to a fixed string with value $UserLocation$. Map this to vrtEntryParentDN on the Top Secret side. Select the Ignore case sensitivity check box.
Sample value:
tssadmingrp=acids,host=topsecret1,o=mycompany,c=com
-
BusinessCategory ←→ Department
The Department attribute defines the Top Secret department assigned to the user. Select the Ignore case sensitivity check box.
Sample value:
TSSDEPT1
-
Description ←→ name
The name attribute contains a description for the user. Select the Ignore case sensitivity check box.
Sample value:
TEST USER
-
vrtRDN → vrtEntryRDN
Create a new variable on the One Identity Manager side of type Script Property with the name vrtRDN and a data type of String. In the Scripts section, enter one of the following scripts in the Read script section, depending on whether your project is configured for C# or Visual Basic.
C# Script:
references VI.TSUtils.dll;
return (VI.TargetSystem.Base.Utils.LDAP.RDN.Create("cn", useOldValues ? $cn[o]$ : $cn$).ToString()).Replace("cn=","tssacid=");
VB Script:
References VI.TSUtils.dll
Imports VI.TargetSystem.Base.Utils.LDAP
Dim name as String = ""
If useOldValues Then
name = $cn[o]$
Else
name = $cn$
End If
return RDN.Create("cn",name).ToString().Replace("cn=","tssacid=")
Then map vrtRDN to vrtEntryRDN on the Top Secret side.
Sample value:
tssacid=USER1234
-
userPassword → userPassword
Used to change a user’s password in Top Secret. A condition needs to be set on this rule to map the password only when there is a value to be copied.
To add a condition
-
Create the mapping.
-
Edit the property mapping rule.
-
Expand the Condition for execution section at the bottom of the dialog.
-
Click Add condition and set the following condition (a blank password is indicated by using two apostrophe characters).
Left.UserPassword<>''
-
Related topics
Object matching rules
-
DistinguishedName (primary rule) vrtEntryDN
vrtEntryDN is a virtual property set to the DN of the object in the connector. This forms a unique ID to distinguish individual user objects on the Top Secret system.
To convert this mapping into an object matching rule
-
Select the property mapping rule in the rule window.
-
Click
in the rule view toolbar.
A message appears.
-
Click Yes to convert the property mapping rule into an object matching rule and save a copy of the property mapping rule. Do not mark this rule as case-sensitive. Leave the check box cleared.
Sample value:
tssacid=USER1234,tssadmingrp=acids,host=topsecret1,o=mycompany,c=com
-
Related topics
Group mapping information
This section shows a possible mapping between a group in Top Secret and the standard One Identity Manager database table called LDAPGroup.
-
Set up a new mapping from LDAPGroup(all) to tssgroup(all).
For more detailed information about setting up mappings, see the One Identity Manager Target System Synchronization Reference Guide.