Start the ADSI Edit application by selecting
.In the tree view, select the root item called
.Under the
menu, select .In the Configuration.
field, typeSelect
. Make sure the value in the drop-down list is set to .Set the other authentication credentials as appropriate, then click
.In the tree view, expand the
item and those items underneath it until you can select the following entry:CN=NTDS Settings,CN=ServerName$InstanceName,CN=Servers, CN=Default-First-Site-Name, CN=Sites,CN=Configuration,CN={GUID}
Keep in mind that in the above DN, you should replace ServerName, InstanceName, and GUID with those values actually used in your AD LDS/ADAM instance.
Under the
menu, select .Select the
attribute, then click .Specify the same value you used in Step 8 in Section B.2.3, Installing AD LDS/ADAM.
Click
twice.Restart your AD LDS/ADAM instance so the new default naming context takes effect.
For the driver to work properly, it is best to create a user object specifically for the driver to use. This user should only have the rights to do the work that is required. For more information, see Section 2.4, Creating an Administrative Account.
You can create the AD LDS/ADAM driver through Designer or iManager. The AD LDS/ADAM driver cannot use packages. You must use the driver configuration file to create the driver.
Open a project in Designer. In the Modeler, right-click the driver set and select
.Click
.From the drop-down list, select
then click .The ADAM driver is not listed alphabetically, so you might have to scroll to find it in the list.
Configure the driver by filling in the fields. Specify information for your environment. For information on the settings, see Table B-1.
After specifying parameters, click
to import the driver.After the driver is imported, customize and test the driver.
After the driver is fully tested, deploy the driver into the Identity Vault. See Deploying a Driver to an Identity Vault
in the Designer 4.0.1 for Identity Manager 4.0.1 Administration Guide.
In iManager, select
> .Select a driver set, then click
.If you place this driver in a new driver set, you must specify a driver set name, context, and associated server.
Import a configuration into the driver set by selecting a configuration from the server (.XML file):
All configurations
Identity Manager 3.0 configurations
Identity Manager 3.5 configurations
Identity Manager 3.6 configurations
Identity Manager 4.0 configurations
Configurations not associated with an Identity Manager version
Select the ADAM driver, then click
.Configure the driver by filling in the configuration parameters, then click Table B-1.
. For information on the settings, seeDefine security equivalences, using a user object that has the rights that the driver needs to have on the server, then click
.Use the user created in Section B.3.2, Creating a User in AD LDS/ADAM with Sufficient Rights.
Identify all objects that represent administrative roles and exclude them from synchronization, then click
.Exclude the security-equivalence object (for example, DriversUser) that you specified in Step 6. If you delete the security-equivalence object, you have removed the rights from the driver, and the driver can’t make changes to Identity Manager.
Click
.NOTE:The parameters are presented on multiple screens. Some parameters are only displayed if the answer to a previous prompt requires more information to properly configure the policy.
Table B-1 Configuration Parameters for the AD LDS/ADAM Driver
Parameter |
Description |
---|---|
|
Specify the name of the driver object. |
|
Specify the name of the connected system, application, or Identity Manager driver. This value is used by the e-mail notification templates to identify the source of notification messages. |
|
Specify the DNS name of the AD LDS/ADAM instance managed by this driver. |
|
Specify the container where the objects reside in AD LDS/ADAM. |
|
Configure the driver for use with the Remote Loader service by selecting , or select to configure the driver for local use. |
|
Specify the name of the user object created in Section B.3.2, Creating a User in AD LDS/ADAM with Sufficient Rights. The name needs to be specified as a full LDAP DN. For example, CN=IDM,CN=Users,DC=domain,DC=com |
|
Specify the password of the user object with sufficient rights. |
|
Specify the DNS name or IP address of the AD LDS/ADAM instance server. |