黑料海角91入口

The 黑料海角91入口 Active Directory Integration (ADI) enables the syncing of users, groups, and passwords between 黑料海角91入口 and on-premise or off-premise AD. As covered in Get Started: Active Directory Integration, the ADI uses two agents: an Import Agent and a Sync Agent that can be installed in three (3) configurations which are based on where you want to manage users, groups, and passwords.

1. Manage users, groups, and passwords in AD.
2. Manage users and passwords in AD, 黑料海角91入口, or both.
3. Manage users, groups, and passwords in 黑料海角91入口.

This article provides a step-by-step guide for configuring ADI to manage users, security groups, and passwords in AD. This configuration is typically used when you want to extend AD to the cloud for additional functionality, plan to keep AD as your primary user, group, and password authority, and want minimal changes to your existing AD environment. 

Deployment Configuration Overview

• Use ADI import agent only.
• Install import agent on all domain controllers (DCs) or on at least 2 member servers.
• Add users and security groups under the ADI security group in AD.

To explore the use cases and benefits of this configuration, see Manage users, groups, and passwords in AD in the Configure Active Directory Integration (ADI) help center article.

Workflows

AD Import Agent Only 鈥� Single Domain Workflow

AD Import Agent Only 鈥� Multiple Domain Workflow

To learn more about the general user identity workflow and expected behavior for any user, group, and password change in AD and in 黑料海角91入口 read Use and Manage the Active Directory Integration (ADI) . 

System Requirements

• 64-bit Windows Server (versions 2012, 2016, 2019, 2022)
  • Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the /msiexec parameter when running the agent installer
• 15MB disk space
• 10MB RAM

New Installation Overview

The main steps you will take to install and configure ADI for a one-way sync from AD to 黑料海角91入口 are:

1. Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).
2. Complete the prerequisite checklist.
3. Determine the Root User Container in AD. 
4. Create the 黑料海角91入口 ADI Integration Security Group in AD.
5. Create the AD Import Service Account.
6. Delegate read-only control for the 黑料海角91入口 import account.
7. Create an ADI domain instance in 黑料海角91入口.
8. Select your configuration and follow the installation steps and download the import agent
9. Run the the AD Import Agent installation wizard
10. Reboot the servers on which the agent was installed.
11. Verify the Import Agent Service started on each AD server.
12. Complete post-installation AD import agent configuration on each AD server.
13. Verify the AD import.

Considerations

Agent Version Considerations

• As of import agent v2.2.1, the following changes were made:
  • The default location for all agent related installation, configuration, and log files is C:\Program Files\黑料海角91入口\AD Integration.
  • All references to AD Bridge changed to AD Import.
  • The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.
• Import agent v3.0.0 and higher supports delegated user authentication to AD.

Delegated Authentication Considerations

Review ADI: Use AD Delegated Authentication for specific considerations and more information about delegated authentication to AD. 

• The delegated authentication setting, Delegated Password Validation, is enabled by default for this ADI configuration and cannot be disabled.
• When the delegated authentication setting, Delegated Password Validation, is enabled and active:
  • All users imported by import agent v3.0.0 or higher will have their Delegated Authority automatically set to Active Directory and their login to the 黑料海角91入口 User Portal and SSO login delegated to AD for validation.
  • Existing AD users imported from AD to 黑料海角91入口 no longer have to reset their password in AD to log in to 黑料海角91入口 managed resources when delegation is enabled for them.

General Installation Considerations

• Non-standard ASCII characters are not supported in the Root User DN.
• When upgrading an import agent, the installation wizard prompts for minimal information:
  • Agent connect key, when upgrading from import agent v2.6.0 or lower.
  • Directory for where the installation should occur.
  • Finish screen.

• Demoting a DC installation to a member server and promoting a member server installation to a DC aren鈥檛 supported.  The agent(s) must be uninstalled first and then installed on the other type of server.
• A reinstall of the same ADI import agent is treated as an update.
• User passwords must be managed in AD.
• Users who are imported from AD to 黑料海角91入口 will automatically have their Password Authority set to Active Directory by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.

Member Server Installation Considerations

The following are considerations only if you choose to install the import agents on member servers:

• The AD password does NOT sync from AD to 黑料海角91入口. Users imported and synced from AD will not have a password in 黑料海角91入口.

Domain Controller (DC) Installation Considerations

The following are considerations only if you choose to install the import agents on DCs:

• An import agent must be installed on all Domain Controllers. 
• Downtime should be scheduled. The installation requires a server reboot.
• AD passwords will sync from AD to 黑料海角91入口. This means that the password will be managed in AD and stored in both AD and 黑料海角91入口.

Security Considerations

• We STRONGLY recommend installing and using LDAPS for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.
• We recommend periodically rotating the password for the server account used by the integration (e.g., jcimport)for security reasons.
• API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your 黑料海角91入口 organization when an Admin account is deleted.

Password Considerations

• Users imported and synced from AD to 黑料海角91入口 will have their Password Authority set to Active Directory, which means a password cannot be created or changed in 黑料海角91入口 by either a 黑料海角91入口 Admin or an end-user. The password can only be created and updated in AD.

• When the 黑料海角91入口 AD import agent is installed on member servers, the AD password does NOT sync to 黑料海角91入口. The password will only be in AD.
  • In this configuration, the user鈥檚 Password Authority should also be set to Active Directory to prevent a password from being entered in 黑料海角91入口 by either a 黑料海角91入口 Admin or the end user.

• When the 黑料海角91入口 AD import agent is installed on all DCs, the AD password does sync from AD to 黑料海角91入口. This means that the password will be saved in both AD and 黑料海角91入口.
  • When passwords are imported and synced from AD to 黑料海角91入口:
    • Passwords are still managed in AD.
    • Password complexity requirements in AD and 黑料海角91入口 should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.
    • If you set a password expiration policy in 黑料海角91入口, these users will not receive password expiration notifications automatically.
    • Sending password expiration notifications from 黑料海角91入口 is not recommended. You can send notifications manually by going to users 禄 select expiring users 禄 resend email.
    • Users with their password authority set to Active Directory managed by AD are restricted from changing their password in 黑料海角91入口, with the exception of the link from the password expiration notification.

Import Considerations

• We recommend that all users you plan to import from AD into 黑料海角91入口 live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory
  • If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your 黑料海角91入口 instance, along with any associated data and resource associations
• The 黑料海角91入口 ADI import agent services use TLS for all communication. If no network connectivity exists to 黑料海角91入口, the ADI will fail to sync and will not work properly.
• Users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty,  otherwise the users will fail to sync from AD to 黑料海角91入口.
• Users who are imported from AD to 黑料海角91入口 will automatically have their Password Authority set to Active Directory by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.
  • The Password Authority setting can be changed for a specific user from their user record directly or for multiple users from Users >More Actions>Set External Password Authority.
• You can manage users in 2 ways:
  • Individually by adding them to the security group created for this integration, located in the designated OU 
  • Using groups located in or nested in the designated Root user container by adding those groups as a member of the 黑料海角91入口 Integration Security Group.
• ADI Import Agent settings in the jcadimportagent.config.json file control the behaviors that occur in 黑料海角91入口 when certain actions are taken on the user in AD.
  • Removing users from the 黑料海角91入口 integration Security Group within AD will either delete those users in 黑料海角91入口 and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in 黑料海角91入口 and allowing them to be managed in 黑料海角91入口 directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file.
• Importing , such as Domain Admins and accounts with 鈥渁dminCount=1鈥�, into 黑料海角91入口 from AD or managing them in AD from 黑料海角91入口, isn鈥檛 supported.

Attributes

The user attributes that sync from AD to 黑料海角91入口 are:

• First Name
• Last Name
• Username
• Email

Prerequisite Checklist for New Installations

Before installing the ADI import agents for the first time, complete the following checklist

1. Know your AD Domain Admin credentials.
2. Decide whether you want to install the sync agents on your AD domain鈥檚 non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).
   • When installing the import agent on DCs, schedule downtime. Installation requires server reboot! 
3. Verify you have access to all Domain Controllers (DCs) in the AD domain or to the member servers on which you plan to install the import agents.
4. Ensure the servers on which you are installing the import agent are running on a 黑料海角91入口 supported 64-bit Windows Server version (2012, 2016, 2019, 2022).
5. Confirm the servers on which you are installing the import agent have networking access to the internet and are able to communicate outbound to console.jumpcloud.com over HTTPS port 443. 
6. If installing the import agents on DCs, schedule Downtime 鈥� installation requires a server reboot!
7. Create a dedicated Administrator account in 黑料海角91入口 that is specifically for the ADI.

7. Generate and securely store the API key for the ADI dedicated Administration account.
8. Verify all users to be synced from AD to 黑料海角91入口 have a value for first name and last name in AD.
9. If you install the import agents on DCs, align password complexity requirements between AD and 黑料海角91入口 as closely as possible. Otherwise, passwords may not replicate if they鈥檙e rejected by the destination directory鈥檚 complexity requirements.
10. [Recommended] Verify all users you plan to import into 黑料海角91入口 live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. 
11. Review Advanced Configurations for the Active Directory Import Agent to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation. 
12. [STRONGLY recommended] Install LDAPS.

Prepare AD for the Import Agent Installations

To import and update user identities, attributes, and user groups from AD into 黑料海角91入口, you'll need to install a 黑料海角91入口 AD import agent on your non-DC Domain Member Servers (member servers) or all Domain Controllers (DCs) within your domain.  Complete the steps below to prepare for installing the agents on your servers.

Prepare for the AD Import Agent Installation in AD

Determine the Root User Container in AD

The 黑料海角91入口 AD Import agent is designed to integrate with AD鈥檚 default 鈥楿sers鈥� container (CN=Users) which is pre-populated in the AD Users and Computers (ADUC) interface and labeled as 鈥淯sers鈥� as shown in the following image. (This is a default domain with no custom containers. In this use-case the Root Container is CN=Users;DC=example;DC=com).

The import agent installation wizard assumes that this is the Root User container and uses this path in your AD Import agent configuration file. During installation, you鈥檙e prompted for the domain components (DC) used in your AD Domain (i.e., DC=example;DC=com). The installation wizard uses this base level domain information to construct the following Root user container DN (Distinguished Name).

EXAMPLE: CN=Users;DC=example;DC=com

Create the 黑料海角91入口 ADI Integration Security Group in AD

A Security Group for the integration must be created within the Root User Container you鈥檝e defined in the previous step. This Security Group is required. Any member of this group will be exported to your 黑料海角91入口 tenant.

1. Open the ADUC Menu by clicking Start, typing dsa and clicking the Active Directory Users and Computers icon.
2. Find your Root User Container.
3. Right Click on the Root User Container鈥檚 folder and select New > Group.
   • Ensure the Security Group is a Global Security Group.
   • Give the Security Group a name that helps identify it as the group used by the ADI (e.g., 鈥満诹虾＝�91入口鈥� for single domain environments, 鈥満诹虾＝�91入口 (Domain)鈥� for multi-domain environments).
   • Click OK.

Create the AD Import Service Account

1. Open the ADUC Menu by clicking Start, typing dsa and clicking the Active Directory Users and Computers icon.
2. Find your Root User Container.
3. Right Click on the Root User Container鈥檚 folder and select New > User.

4. Enter the following values for the 黑料海角91入口 Import Service Account user:
   • First Name: 黑料海角91入口
   • Last Name Import
   • User logon name: jcimport

5. Enter a password for the jcimport user and ensure that it is set to Never Expire since this will be a service account for the Import Agent.

6. Click Save.

Delegate read-only control for the 黑料海角91入口 import account

1. Navigate to the Root User Container in ADUC that you have selected, right-click the container and select Delegate Control. This launches the Delegation of Control Wizard.
2. Click Next.
3. Add the 黑料海角91入口 Import Agent account to the Delegation of Control Wizard. 

4. Click Next, then select Read all user information.

5. Click Next, then click Finish at the final screen.

Install the AD Import Agent

Create an ADI domain instance in 黑料海角91入口

Create a new ADI domain instance in 黑料海角91入口 if one does not already exist

1. Log in to the .
2. Go to Directory Integrations > Active Directory.

3. Click ( + Add ADI Domain )
4. Select Manage users and passwords in Active Directory.

5. Enter the name of an Active Directory domain that you want to integrate with your 黑料海角91入口 tenant. For example, 鈥淒C=example;DC=com鈥�.

6. Click Save.
7. Click Download Import Agent.
8. The Import Agent installer will automatically save to your local Downloads folder.
9. After downloading the agent, note and store the 3 values needed for the agent installation:
   • Your 黑料海角91入口 Organization ID
   • Your Import Agent Connect Key
   • The API key for the dedicated admin account for the integration
10. Copy and securely store the values for later use.

11. Save the downloaded installer to the AD servers.

Install the AD Import Agent on your AD Servers

Run the AD Import Agent Installation Wizard

Now you are ready to install the 黑料海角91入口 AD import agent. 

1. Browse to where you saved the AD Import installer file on your DC. 
2. Right-click the file, then select Run as administrator.
3. The Install Wizard will start and prompt you to agree to the C++ license terms and conditions.
   

4. Select your Server Type and click Next.
   

5. If you selected Domain Controller, skip to step 9.
6. If you selected Member Server for the server type, provide the FQDN or IP address for that server. We recommend using FQDN.
   
   
   
7. Confirm your LDAP connection type and decide if you want to allow the use of LDAP if the connection using secure LDAP fails.
   

8. If you checked Allow insecure connection (LDAP) to a Domain Controller, if secure connection fails, you must confirm that you understand the risk before you can proceed.
   
9. Enter the AD Distinguished Name (DN) of the domain and click Next.

10. Enter the jcimport account and password, then click Next. Be sure to use the NetBIOS domain format and not the full DNS name. (For example, example\jcimport and the user password).

11. Enter your 黑料海角91入口 Organization ID, then click Next.

12. Enter the import agent Connect Key, then click Next.

13. Enter the 黑料海角91入口 API Key for the dedicated Admin account created for the ADI, then click Next.

14. On Selecting the File Destination, leave the defaults and click Next.

15. Click Install. The import agent will take about 1 to 2 minutes to install.

16. Select Yes, restart the computer now to reboot your DC and click Finish.

Verify the 黑料海角91入口 AD Import Agent Service Started

Once your DC restarted, verify that the service started by confirming display name: 鈥満诹虾＝�91入口 AD Import Agent鈥� ; service name: 鈥淛CADImportAgent鈥�; is running in services.msc. If the service fails to start, you can review the agent logs at C:\Program Files\黑料海角91入口\AD Integration\黑料海角91入口_AD_Import.log.

Configure AD Import Agent

There are several configuration options that you should implement post-installation of the AD import agent. The recommended configuration updates are: 

• Update LDAPS configuration file
• Modify the Root User Container Used by AD Import
• Update the security group name if your environment has multiple domains

Verify and update default import settings described in Advanced Configurations for AD Import.

Modify the Root User Container used by AD Import

If your Root User Container is the default CN=Users;DC=company;DC=com, you can skip this section.

If you鈥檙e using a different Root user container for managing AD resources with the AD Import agent, follow the steps below to modify the User container location in the agent configuration json file. 

1. Verify the full LDAP path for the chosen Root user container you have selected in ADUC:
   1. From the ADUC panel鈥檚 View menu, enable Advanced Features. 
   2. Right-click the container and select Properties. 
   3. Select the Attribute Editor tab. 
   4. Select the 鈥渄istinguishedName鈥� attribute, then click View.

2. In the AD Import Agent configuration file, replace the CN=Users;DC=company;DC=com reference in the LDAP section of the json configuration file with the 鈥渄istinguishedName鈥� value from ADUC, leaving the CN=黑料海角91入口 security group reference in place. See the example below:

An example of the configuration file that has been changed from the Defaults to match what鈥檚 actually the true Root User Container. In the below example config, Example鈥檚 Root User Container needs to be, CN=黑料海角91入口;OU=Corporate Users;DC=example;DC=com.

Modify the Security Group used by AD Import

You will need to update the security group name in the AD import configuration file to match the name you gave the 黑料海角91入口 integration Security Group in the Create the 黑料海角91入口 ADI Integration Security Group in AD above.

1. Update the security group reference in the DN, CN=黑料海角91入口, to match the name you gave the 黑料海角91入口 integration security group.

Modify default Advanced Configuration settings for AD Import

Adjust the default configuration settings to control how the import works and what happens to users in 黑料海角91入口 when certain actions are taken in AD. These settings are considered advanced configurations. See Advanced Configurations for AD Import for more information.

Save the configuration changes and restart the AD import agent service

Once all configuration changes have been made save them and restart the service.

1. Save the jcadimportagent.config.json file.
2. Restart the 黑料海角91入口 AD Import Agent service using the Windows Service Manager.

Verify AD Import

Once you鈥檝e installed and configured AD Import within your environment, you can easily verify that the 黑料海角91入口 AD Import Agent is working. Please ensure the following are present and visible: The 黑料海角91入口 AD Import Agent should be shown as green and active within the Admin Portal under Directory Integrations > Active Directory > Your ADI Instance > Domain Agents section.

• 黑料海角91入口 User Group is now within your 黑料海角91入口 organization. The 黑料海角91入口 User Group should have a User Group icon with an AD badge in the User Group Details pane. See the example below:
  • Navigate to User Management > User Groups. You should see the 黑料海角91入口 User Group with a Microsoft badge next to it. Click on the User Group to open up its details.

• When opened, you can see that the User Group has a Microsoft Badge and is also assigned to AD on the Directories tab.

Next Steps

Please read the Using and Managing the ADI article next.

Want additional assistance from 黑料海角91入口? 

If you鈥檙e having issues with getting 黑料海角91入口鈥檚 ADI working, try the Troubleshooting Guide.

黑料海角91入口 offers myriad professional services offerings to assist customers with implementing and configuring 黑料海角91入口. If you鈥檙e looking for assistance with Migrating from AD, or to integrate AD with 黑料海角91入口, we recommend you reach out to 黑料海角91入口鈥檚 Professional Services team on the following page: Professional Services - 黑料海角91入口.