Preparing Identity Repositories

Perform these steps to create a user that AM can use to connect to Active Directory. These steps are one example, consult with your Active Directory administrator on how best to create an account.

1. Create a new user account in the Active Directory domain. For example, in Windows 2019:

   1. In the Active Directory Users and Computers tool, right-click Users in the domain, and select New > User.

   2. Provide descriptive values for the new user, and a logon name such as AM-Bind-Account.

   3. Click Next.

   4. Enter a strong password for the bind account, disable the User must change password at next logon option, and then click Next.

   5. Review the details of the new account, and then click Finish.

2. Give the new bind account access to the directory data:

   1. In the Active Directory Users and Computers tool, right-click the domain that contains your users, and then select Delegate Control.

   2. Add the bind account you created in the previous step, and then click Next.

   3. Select the tasks you want to allow the AM bind account to perform from the list.

      For example, to allow read and write access to users, enable the Create, delete, and manage inetOrgPerson accounts task.

   4. After assigning the tasks you want to allow the AM bind account to perform, click Finish.

   You can now set up the necessary schema in the directory server.

   The bind account to use when configuring the identity store in AM is the full DN of the user, for example uid=AM-Bind-Account,ou=Users,dc=example,dc=org.

If the AM bind account does not have permission to update schema then you must configure existing external data stores by using manual schema updates. To do this, you must update the directory server schema of the external identity repository manually at the following times:

A number of LDIF files are provided in the AM .war file for supported identity directory servers. The path is /path/to/openam/WEB-INF/template/ldif/{directory_type}, where {directory_type} is one of the following:

For more information on the LDIF files, see "Supported LDIF Files".

The following steps update the schema in an Active Directory identity repository. For other directory servers, apply the relevant LDIF files using the appropriate tools.

1. Edit the LDIF files in the /path/to/openam/WEB-INF/template/ldif/ad directory, replacing any variables that are surrounded by at (@) symbols with a value specific to your directory server.

   For the Active Directory LDIF files you must replace all instances of @userStoreRootSuffix@ with the root suffix used by your Active Directory identity store, for example DC=example,DC=org.

2. Using an Active Directory administrator account, add the required AM schema extensions to your external identity repository.

   For example, in PowerShell, run the ldifde command to import the user, device print, and dashboard schema extensions:

   PS C:\Users\Administrator> cd \path\to\openam\WEB-INF\template\ldif\ad
   
   PS C:\path\to\openam\WEB-INF\template\ldif\ad> ldifde -i -f .\ad_user_schema.ldif
   Connecting to "domain.example.org"
   Logging in as current user using SSPI
   Importing directory from file ".\ad_user_schema.ldif"
   Loading entries.................................................................
   64 entries modified successfully.
   
   The command has completed successfully
   PS C:\path\to\openam\WEB-INF\template\ldif\ad> ldifde -i -f .\ad_deviceprint.ldif
   Connecting to "domain.example.org"
   Logging in as current user using SSPI
   Importing directory from file ".\ad_deviceprint.ldif"
   Loading entries.................................................................
   6 entries modified successfully.
   
   The command has completed successfully
   PS C:\path\to\openam\WEB-INF\template\ldif\ad> ldifde -i -f .\ad_dashboard.ldif
   Connecting to "domain.example.org"
   Logging in as current user using SSPI
   Importing directory from file ".\ad_dashboard.ldif"
   Loading entries.................................................................
   6 entries modified successfully.
   
   The command has completed successfully

3. (Optional) If you intend to use push or web authentication, apply the following LDIF files:

   • /path/to/openam/WEB-INF/template/ldif/ad/ad_pushdevices.ldif

   • /path/to/openam/WEB-INF/template/ldif/ad/ad_webauthndevices.ldif

   For more information on these LDIF files, and the equivalent files for supported directory servers, see "Supported LDIF Files".

4. Proceed to configuring the identity store in AM. See Identity Stores.

   Important

   If you updated the schema to make use of web authentication, when configuring the external identity store in a realm, on the User Configuration tab, ensure webauthnDeviceProfilesContainer is in the LDAP User Object Class property. If not, add the value, and then save your changes.

If the bind account has permission to update schema then you can allow AM to update the schema automatically.

To allow AM to update the schema, you must first configure AM to be able to access the directory server, and enable the Load Schema option, by performing the following steps:

1. Configure the directory server in AM by following the instructions in "To Configure an Identity Store".

   Important

   Enable the Load Schema option before clicking Save Changes, and AM will apply the neccessary schema to the directory server.

   The schema is loaded as part of configuring the identity store in AM. No further configuration is required.

2. Verify that the new identity repository is correctly configured in AM. See "Testing External Identity Repository Access".