Directory Panel: Configuring the Directory Provider

The Directory Provider can be added, with a license key, to Identity Panel Core Framework. The Directory Provider is able to scan objects in LDAP directories such as Active Directory (AD) and AD LDS. Additional capabilities are available when using the Directory Provider with AD and AD LDS.

Note: The information below describes the configuration of a Directory Connection provider which is supported for existing implementations and new AD connections for Identity Panel versions prior to v7.  When creating a new AD provider connection for version 7 or later a Panel Provider is preferred, which extends the capabilities described herein.

Initial Configuration

Before configuring the Directory Provider, validate that your system version is 3.3.8 or newer. You will also need to apply a Directory Panel license key.

Within Identity Panel or Directory Panel, within Provider settings, select Directory Connection from the provider types list. If it says "License Required", you still need to add the license key. Otherwise, press the "New" button to continue.

Give the provider a name and expand it. Short names display better in the Time Traveler. You can rename the provider at any time. 

For the hostname use either the server name, or domain name if it is Active Directory.

You may tick the "Is Active Directory" checkbox if the connection is for an AD domain or AD LDS instance. Selecting this option will allow the provider to collect ACLs offered by these directory types.

Enter the partition root as the Container Root.

You may optionally enter user and password information, but you MUST have a password storage license key applied to do this. Your can obtain this from your license key page found here. If user is left blank scans will be run under the login context of the account running the scan (e.g. Panel Service account).

After entering connection settings STOP and save settings.

Schema Scan

Run PanelTool, and select the option to run a schema scan for the newly created provider.

Note: When configuring a new Panel Connection for Active Directory (version 7 and above) the schema scan can be performed remotely without the need for PanelTool.

After the schema scan completes return to the provider settings and refresh the page. You will now be able to select items from the Containers to include and exclude lists, as well as add object types to scan.

Object Types and Security Descriptors

When adding object types select only Structural object classes. For example, add "user" not "person".

After adding an object type select which attributes to collect into Identity Panel.If configuring for AD you may optionally scan security descriptors. Select the "Scan Access Rules" and "Scan Audit Rules" to collect DACL and SACL data.

You may optionally select "Skip *" checkboxes on the right to omit types of ACE definitions from the scan results.

After adding object types and attributes save changes. You may now run a directory full scan from Panel Tool or add a full scan to your Identity Panel schedule and use Identity Panel to Time Travel changes of tracked objects in your directory.

Example: Moving the OU ChildOU02 into OU ChildOU1

Configuration Partitions

The same setup process can be used to scan the AD configuration partition, see sample configuration below which is focusing on scanning the PKI-related information in the configuration partition.

When adding secondary directory partitions be sure to consider the possibility of a global catalog server (which is aware of the full forest) being in scope of the directory root defined in the connection string.  This can lead to unwanted scanning of objects outside the partition(s) you are targeting.

In this scenario you MUST ensure your connection string targets the forest root (e.g. myforest.com or my-specific-dc.myforest.com) then individually select which child partitions to include. The specification of discreet partitions when your root connection targets a specific domain (e.g. mydomain.myforest.com) is not supported.

Schedule Directory Scans

Once the Directory Provider is configured and an initial load scan has been performed with Panel Tools, create a regularly scheduled Directory Full Scan.

The directory scan takes an Environment argument.