Scenarios

This section will describe some scenarios that require a variation on the settings proposed in the step-by-step shown above. Remember that there is no single configuration for all environments, being always necessary to go through a planning phase prior to the deployment of the integration with a directory service:

Scenario 1: I have more than one directory service running on different servers and I want to import/authenticate users from all of them.

SE Suite supports multiple domain configurations. To do this, perform the desired domain settings in the SE Configuration component Authentication (CM008) Directory integration Domains section. Synchronization will be done for all recorded domains, generating a unique record in the synchronization history.

The system also allows for equal logins, however, from different domains. To do this, a different configuration is required in the rules added in the federation service if you use integrated authentication via SAML 2.0. See how to configure authentication via SAML 2.0 with multiple domains in AD FS:

1.Perform the configuration for integrated authentication via SAML 2.0 normally, until the step of configuring the "Claim rules". In this step, select the "Send claims using a custom rule" option and click Next:

sda0016

2.In the next step, give the rule a name and enter the following custom rule:

sda0017

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",

Issuer == "AD AUTHORITY"]

=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier"),

query = ";objectGUID;{0}", param = c.Value);

3.After that, click Finish.

IMPORTANT!

For this scenario, it is required that the attribute mapped to the "ID # in domain controller" field in the domain configuration in the SE Configuration component Authentication (CM008) Directory integration Domains section, is the "objectGUID" attribute.

Scenario 2: The company uses directory services in a forest architecture, with several independent servers managed by one main server that manages and synchronizes the data of others, which maintains a copy in read mode.

For this scenario we have two solutions:

1.This solution is most appropriate: point to the address of the main server that manages and synchronizes the data of others in the configuration of the domain, as it must have the most up-to-date data from all points of the structure.

2.Connect directly to one of the servers that has the best connection to SE Suite. This alternative should be considered in situations where the system server does not have access to the main server that manages and synchronizes the data of others or the connection to it is limited.

Scenario 3: I want to import only specific users of the mapped directories, not all those contained in them.

It is recommended to create a group for the users that should be imported into SE Suite. In this way, it is possible to add a specific filter that restricts synchronization only to users in this group, regardless of the directory. See the example:

1.Create a group called "SESuiteUsers" in the directory service and add all users that will be imported into SE Suite into it. The field that identifies the group is the "distinguishedName":

sda0018

2.Once this is done, add the filter to the domain configuration in the SE Configuration component Authentication (CM008) Directory integration Domains section, as in the following example:

(memberOf=CN=SESuiteUsers,OR=Groups,DC=contoso,dc=local)

Scenario 4: I have users who must have one attribute for a given field and others that must have another, within the same domain.

For example, for users in the Employees group, the attribute for the "user ID" field should be "description", but for those who are in the Trainees group it should be "samAccountName". In this situation, you will need to create two domain configurations, even if both are connected to the same domain. The only thing different in the two configurations will be the ID # and the attribute that changes from one to another.