Skip to main content

EmpowerID Admin Lab 3: Active Directory Connector

Purpose​

This lab guides you through creating an account store connection and definition to an Active Directory (AD) domain.

Prerequisites​

  1. Access to the EmpowerID training environment.
  2. Credentials for the AD domain (e.g., Administrator username and password).
  3. A Cloud Gateway server configured to connect to the domain.
  4. A modern web browser.

Steps​

1. Initiate the Create Account Store Workflow​

  1. Open your browser and log in to EmpowerID.
  2. Go to Admin > Applications and Directories > Account Stores and Systems.
  3. Refresh the page to view existing account stores.
  4. Click Create Account Store.
  5. Search for and select Active Directory Domain Services as the system type.

2. Enter the Connection Details for the Account Store​

General

  • Name: Enter a name for the account store
  • Display Name: Enter a Display name for the account store

Active Directory Forest

  • FQDN: Enter the fully qualified domain name of the forest.
  • Is Remote (Requires Cloud Gateway): Check this box.

Proxy Information

  • Proxy Account Username: Enter the username of the connection account ("admin2" for the provided student lab)
  • NetBios Domain: Enter the netbios domain name of the domain ("addomain" for the provided student lab).
  • Password: Enter the password for the connection account ("p@$$w0rd@534" for the provided student lab).

Submit the information.

3. Select the Cloud Gateway Server​

  1. Search for and select the Cloud Gateway Server for the connection.
  2. EmpowerID will validate the credentials and list available domains in the forest.
  3. Select the target domain (e.g., addomain.com) and submit The workflow will now create the account store and resource system definitions and return you to the Account Store page

4. Verify and Edit Account Store Settings​

  1. Refresh the search results to see the new AD domain account store.
  2. Click the account store name to bring up the main Account Store page.
  3. Click the pencil icon by the account store name to edit the configuration

General Settings​

Configure the following settings in the Settings page

  1. Enable the Is Visible in IAM Shop flag to allow the resources to be visible in the IAM Shop
  2. Enable the Allow Password Sync to synchronize passwords with AD.
  3. Disable the Allow Person Provisioning (Identity Source) since we do not want to provision people from this account store.
  4. Enable Allow Attribute Flow.
  5. Enable Allow Provisioning (By RET) and Allow Deprovisioning (By RET) to allow account creation and deletion by the provisioning policies
  6. Disable Allow Business Role and Location Re-Evaluation (OROZ Source) since we will not be using assigning roles and locations from data in this system.

Inventory Settings​

  1. Go to the Inventory tab.
  2. Enable Inventory Enabled.

Membership Settings​

  1. Go to the Membership tab.
  2. Enable Enable Group Membership Reconciliation to manage group memberships.

Save the account store settings.

5. Monitor the Inventory Job​

  1. Navigate to the Job History tab.
  2. Wait for the inventory job to run and monitor its progress.
  3. Confirm successful completion of the inventory job:
    • The Succeeded column will have a check mark in the box if the job completed successfully

6. Verify Imported Data​

  1. Navigate to the User Accounts Tab
    • You should see the list of users that was inventoried from the system.
  2. Navigate to the Groups Tab
    • You should see the list of groups that was inventoried from the system.
  3. Select a user or group by clicking on one of the name linkds to view details and confirm data accuracy.

Notes​

  • Ensure accurate domain credentials and Cloud Gateway configuration.
  • Monitor job history for errors during the inventory process.
  • If issues arise, consult logs or your instructor for assistance.

Completion​

Once you’ve successfully connected EmpowerID to the AD domain, verified the imported accounts and groups, and configured all required settings, this lab is complete. Proceed to the next lab for additional integrations and configurations.

Video Walk-thru​

View a video walk-thru of this lab exercise.