System Components Distribution

Before you can develop an effective deployment, you must understand how Identity Synchronization for Windows components are organized and how the product operates. This section is organized as follows:

• Core

• Directory Server Connector and Plug-in

• Active Directory Connector

• Windows NT Connector and Subcomponents

  When you understand the basic concepts described in this section and in the Deployment Scenario example (on Deployment Example: A Two-Machine Configuration), you should be able to extrapolate the information to create deployment strategies for more complex, sophisticated scenarios (such as mixed Active Directory and Windows NT environments or multi-server environments).

Core

Install all Core components only once in any of the supported operating system’s directory servers. Identity Synchronization for Windows installs Administration Server on your machine if it is not already installed. Install Message Queue 3.6 Enterprise Edition on the same machine where you are planning to instal Core.

Directory Server Connector and Plug-in

You can install Directory Server Connectors on any of the supported operating systems. You are not required to install a Directory Server Connector on the same machine where the Directory Server being synchronized is running. However, there must be one Directory Server Connector installed for each configured Directory Server source.

You must configure the Directory Server Plug-in on every host where a Directory Server to be synchronized resides.

A single Directory Server Connector is installed for each Directory Server source. However, Directory server Plug-ins should be configured for each master, hub, and consumer replica to be synchronized.

Active Directory Connector

You can install Active Directory Connectors on any of the supported operating systems. You are not required to install an Active Directory Connector in the Windows environment; however, there must be one Active Directory Connector installed per Active Directory domain.

Figure 3–2 Directory Server and Active Directory Component Distribution

Windows NT Connector and Subcomponents

To synchronize with Windows NT SAM Registries you must install the Windows NT Connector in the Primary Domain Controller (PDC). In addition, the installation program installs the two NT Connector subcomponents (the Change Detector and the Password Filter DLL) along with the Connector in the PDC of the NT Domain. A single NT Connector synchronizes users and passwords for a single NT Domain.

Figure 3–3 Directory Server and NT Component Distribution