After installing the product, you must configure the product deployment, which includes:
Configuring the directories and global catalogs to be synchronized
Specifying synchronization settings for attribute modifications and object activations/inactivations
Specifying settings for group synchronization
Specifying settings for account lockout and unlockout synchronization
Specifying synchronization settings for (optional) user entry creations and deletions between the configured directories
This section provides an overview of the following configuration element concepts:
For more information about configuration instructions, see Chapter 6, Configuring Core Resources.
A single Windows NT domain
You can configure any number of each directory type.
You use synchronization settings to control the direction in which object creations, object deletions, password and other attribute modifications are propagated between Directory Server and Windows directories. Synchronization flow options are as follows:
From Directory Server to Active directory/Windows NT
From Active directory/Windows NT to Directory Server
In a configuration that includes Active Directory and Windows NT, it is not possible to save a configuration that specifies different synchronization settings for creations or modifications between Windows NT and Directory Server, and between Active Directory and Directory Server.
When you configure resources, you will specify which entries to synchronize based on their objectclass. Object class(es) determine which attributes will be available to synchronize for both Directory Server and Active Directory.
Objectclasses are not applicable for Windows NT
Identity Synchronization for Windows supports two types of objectclasses:
Structural Objectclasses: Every entry that’s created or synchronized from the selected Directory Server must have at least one structural objectclass. Select a structural objectclass from the drop-down list. (Defaults to inetorgperson on Directory Server and User on Active Directory)
Directory Server allows you to select one or more objectclasses from the Available Auxiliary Object Classes list pane to augment the selected structural class, which provides additional attributes for synchronization.
For detailed information about configuring objectclasses and attributes, see Chapter 6, Configuring Core Resources
Attributes hold descriptive information about a user entry. Every attribute has a label, one or more values, and follows a standard syntax for the type of information that can be stored as the attribute value(s).
You can define attributes from the Console. Instructions for defining attributes are provided in Chapter 6, Configuring Core Resources.
Identity Synchronization for Windows synchronizes significant and creation user attributes, as follows:
Creation Attributes: Synchronized between Sun and Windows directories whenever a new user is created, according to specified object creation synchronization settings.
Mandatory creation attributes are attributes that are considered “mandatory” in order to successfully complete a creation action in the target directory. For example, Active Directory expects that both cn and samaccountname have valid values upon creation. On the Sun side, if you are configuring inetorgperson of a user objectclass, Identity Synchronization for Windows will expect cn and sn as mandatory attributes for a creation.
A creation attribute default updates the target directory creation attribute with a default value only when there is no value in the attribute propagated from the originating directory. (Creation attribute defaults can be based on other attribute values. See Parameterized Attribute Default Values.)
Significant attributes are automatically synchronized as creation attributes but not the other way around. Creation attributes are only synchronized during user creations.
To create a parameterized default attribute value, you embed an existing creation or significant attribute name — preceded and followed by percent symbols ( %attribute_name%) — in an expression string. For example, homedir=/home/%uid% or cn=%givenName%. %sn%.
When you create these attribute default values:
You can use multiple attributes in a creation expression ( cn=%givenName% %sn%), but the attributes in % attribute_name% must have single values.
If A=0, then B can have one default value only.
You can use the backslash symbol (\\) for quoting (for example, diskUsage=0\\%).
Do not use expressions that have cyclic substitution conditions (for example, sn=%uid% and uid= %sn%.
After you define the attributes, map the attribute names between the Directory Server and Active directory/Windows NT systems to synchronize them to each other. For example, you must map the Sun inetorgperson attribute to the Active Directory user attribute.
You use attribute maps for both significant and creation attributes, and you must configure attribute maps for all “mandatory creation attributes” in each directory type.
You create Synchronization User Lists (SULs) to define specific users in both the Sun and Windows directories to be synchronized. These definitions enable synchronization of a flat Directory Information Tree (DIT) to a hierarchical directory tree.
The following concepts are used to define a Synchronization User List:
Creation expression (not applicable to Windows NT): Constructs the DN where new users are created, for example, cn=%cn%,ou=sales,dc=example, dc=com where %cn% is replaced with the value of cn from the existing user entry. A creation expression must end with the base DN.
An SUL includes two definitions; where each definition identifies the group of users to be synchronized in the topology terms of the directory type.
The other definition identifies the Windows users to synchronize (for example: cn=users, dc=example, dc=com)
When you are preparing to create SULs, ask yourself the following questions:
Which users will be synchronized?
Which users are excluded from synchronization?
Where should new users be created?
See Appendix D, Defining and Configuring Synchronization User Lists for Identity Synchronization for Windows for detailed information about creating SULs.