Installing the Active Directory Password Synchronization Plugin

OpenIDM URL

Enter the URL where IDM is deployed, including the query that targets each user account. For example:

https://localhost:8444/openidm/managed/user?_action=patch&_queryFilter=userName+eq+'${samaccountname}'

OpenIDM User Password attribute

The password attribute for the managed/user object, such as password.

If the password attribute does not exist in the IDM managed/user object, the password sync service will return an error when it attempts to replay a password update that has been made in Active Directory. If your managed user objects do not include passwords, you can add an onCreate script to the Active Directory > Managed Users mapping that sets an empty password when managed user accounts are created. The following excerpt of a sample sync.json file shows such a script in the mapping:

"mappings" : [
 {
   "name" : "systemAdAccounts_managedUser",
   "source" : "system/ad/account",
   "target" : "managed/user",
   "properties" : [
     {
       "source" : "sAMAccountName",
       "target" : "userName"
     }
   ],
   "onCreate" : {
     "type" : "text/javascript",
     "source" : "target.password=''"
   },
...

The onCreate script creates an empty password in the managed/user object, so that the password attribute exists and can be patched.

User name

Enter the name of an administrative user that can authenticate to IDM, for example, openidm-admin.

Password

Enter the password of the user that authenticates to IDM; for example, openidm-admin.

OAuth2 Access Token URL

If you are using the authentication type OAuth2 Access Token, enter the token URL; for example:

https://am.example.com/am/oauth2/realms/root/access_token

OAuth2 Scope

If you are using the authentication type OAuth2 Access Token, enter the OAuth2 token scope; for example fr:idm:*.

Select authentication type

Select the authentication type that Active Directory will use to authenticate to IDM:

Select Certificate file

Browse to select the certificate file that Active Directory will use to authenticate to IDM. The certificate file must be configured with an appropriate encoding, cryptographic hash function, and digital signature. The plugin can read a public or a private key from a PKCS #12 archive file.

For production purposes, you should use a certificate that has been issued by a Certificate Authority. For testing purposes, you can generate a self-signed certificate. Whichever certificate you use, you must import that certificate into the IDM truststore.

To generate a self-signed certificate for Active Directory, follow these steps:

Password to open the archive file with the private key and certificate

Specify the keystore password (changeit, in the previous example).

Select certificate file

Browse to select the certificate that will be used for password encryption. The certificate format must be PKCS #12.

For evaluation purposes, you can use a self-signed certificate, as described earlier. For production purposes, you should use a certificate that has been issued by a Certificate Authority.

Whichever certificate you use, the certificate must be imported into the IDM keystore, so that IDM can locate the key with which to decrypt the data. To import the certificate into the IDM keystore, keystore.jceks, run the following command on the IDM host (UNIX):

keytool \
 -importkeystore \
 -srckeystore /path/to/ad-pwd-plugin-localhost.p12 \
 -srcstoretype PKCS12 \
 -destkeystore /path/to/openidm/security/keystore.jceks \
 -deststoretype jceks

Private key alias

Specify the alias for the certificate, such as ad-pwd-plugin-localhost. The password sync plugin sends the alias when communicating with IDM, which uses the alias to retrieve the corresponding private key in IDM's keystore.

Update the IDM secret store (conf/secrets.json) to add this certificate alias to the idm.default secretId:

"mappings": [
    {
        "secretId": "idm.default",
        "types": [ "ENCRYPT", "DECRYPT" ],
        "aliases": [ "&{openidm.config.crypto.alias|openidm-sym-default}","ad-pwd-plugin-localhost" ] },
        ...
    }
]

For more information about secret stores, see "Configuring Secret Stores".

Password to open certificate file

Specify the password to access the PFX keystore file, such as changeit, from the previous example.

Select encryption standard

Specify the encryption standard that will be used when encrypting the password value (AES-128, AES-192, or AES-256).

Select the folder in which Service will store its output data files

The server should prevent access to this folder, except access by the Password Sync service. The path name cannot include spaces.

Directory poll interval (seconds)

Enter the number of seconds between calls to check whether IDM is available, for example, 60, to poll IDM every minute.

Select the folder in which Service will store its log files

The path name cannot include spaces.

Select logging level

Select the severity of messages that should be logged, either error, info, warning, fatal, or debug.