AD as Identity Source

This guide explains how to configure Active Directory (AD) as an identity source in IDaaS, synchronizing AD-managed organizational and user data into the IDaaS platform to ensure data consistency across enterprise application systems.

Prerequisites

• The IDaaS public cloud service can access the AD service. If the AD server has network policies, add the IDaaS public cloud service IP (47.92.171.137) to the network whitelist.
• Administrator permissions for the IDaaS Enterprise Center.

Procedure

1. Log in to the IDaaS Enterprise Center, choose Users > Identity Source Management from the top navigation bar, click Add Identity Source, and select AD.

   

2. Customize the identity source name, fill in the host, TCP port, and other parameters as prompted. It is recommended to select Direct Connection as the connection method, then click OK to save.

3. Enter the detail page of the newly created identity source to view or update the Basic Configuration, including connection parameters and synchronization mechanism.

   

4. Switch to the Optional Configuration tab. Key configurations are as follows.

   

   TIP

   • In optional configuration, only set the parameters mentioned in the table below; keep the rest at default.
   • If you want to use another AD attribute as the username in IDaaS, such as sAMAccountName, set it to sAMAccountName. Then, in the next step under Object Model > User Mapping Definition > Account Name > Username mapping, change the execution mode to Create and Update.

   Parameter	Description
   Account Object Class	Change to top,person,organizationalPerson,user
   Account Username Attribute	Default is uid,cn. During synchronization, the AD cn value is synchronized to the IDaaS username.
   UID Attribute	Change to objectGUID

5. After configuration, switch to the Advanced Configuration tab. It is recommended to keep the default values or adjust them according to actual requirements.

   

   Parameter	Description
   Select Root Organization	Set the organization node in IDaaS to which data will be synchronized.
   Organization Matching Policy	Map and match organizations based on attribute names in IDaaS and the AD identity source. Multiple matching rules are supported.
   Create Organization	Default is Yes, meaning organizations created in AD are automatically created in IDaaS.
   Update Organization	Default is Yes, meaning organizations updated in AD are automatically updated in IDaaS.
   Delete Organization	After an organization is deleted in AD, IDaaS supports disabling, retaining, or deleting the organization.
   User Matching Policy	Map and match users based on attribute names in IDaaS and the AD identity source. Multiple matching rules are supported.
   Create User	Default is Yes, meaning users created in AD are automatically created in IDaaS.
   Update User	Default is Yes, meaning users updated in AD are automatically updated in IDaaS.
   Delete User	After a user is deleted in AD, IDaaS supports disabling, retaining, or deleting the user.
   Safety Threshold Adjustment	Sets the maximum threshold ratio for changes such as deleting users, deleting organizations, or changing organization hierarchy in the upstream identity source. Threshold = (Difference between platform-recovered data and this recovery / Recovered data) × 100%. If the upstream identity source disables or deletes data exceeding the threshold, the platform will not perform the disable or delete operation.

6. After configuration, switch to the Object Model tab, select Mapping Definition, and complete the attribute definition and mapping according to actual requirements. Key parameters are described below.

   The object model supports mapping attributes of users and organizations from the AD identity source to IDaaS user and organization attributes. After configuration, user and organization attributes are recovered from AD into IDaaS.

   

   • Execution Mode: Sets when the attribute needs to be mapped.
     • Do Not Map: The attribute will not be synchronized to IDaaS.
     • Create: The attribute is synchronized only during creation.
     • Update: The attribute is synchronized only during update.
     • Create and Update: The attribute is synchronized during both creation and update.
   • Transformation Mode: Sets how the attribute is mapped.
     • Auto Transform: Synchronize the value as-is from the identity source.
     • Script Transform: Use this when the value from the identity source does not meet the required format. Refer to Script Mapping Methods.

7. After the object model is configured, click Execute Synchronization to run the synchronization immediately.

   TIP

   If the synchronization mechanism in the basic configuration is set to scheduled synchronization, there is no need to manually execute the synchronization task here.

8. After execution, switch to the Synchronization Events page to view all synchronization tasks for this identity source. Click Details under the Operation column to view the import results, or go to the Users > Users and Organizations page to view the imported data.