This section covers the following configuration topics:
IMPORTANT: If you are using both the NT driver and the Exchange driver, you should complete the following procedure.
The DirXML Driver for NT Domain and the DirXML Driver for Exchange can both create users in the domain. To avoid a conflict, a mechanism can be set up using Identity Manager policies to solve this problem.
The DirXML Driver for NT Domain has a User attribute called DirXML-NTAccountName. This attribute contains the DomainName/UserName attribute. This value is what the Exchange MailBox and Remote objects need to associate to a domain account. For that association to occur correctly, the value in DirXML-NTAccountName needs to be put in the MailBox attribute Assoc-NT-Account. Keep in mind that attribute names are case sensitive.
Using DirXML Script, edit the existing Subscriber Create policy for the Exchange driver (or create a new policy) so that a new MailBox object is not created unless the DirXML-NTAccountName attribute is populated.
Verify the DirXML-NTAccountName attribute is in both the Publisher filter on the DirXML Driver for NT Domain and the Subscriber filter on the DirXML Driver for Exchange.
Restart both drivers.
The changes outlined in Integrating the DirXML Driver for NT Domain and the DirXML Driver for Exchange will ensure the following control flow:
NOTE: Although the examples used DirXML-NTAccountName as the eDirectory attribute to hold the NT account information, you are free to choose any attribute that works for you.
The NT registry tracks some non-user data along with user data. For example, information about workstation objects appears as User objects in the NT User Manager. This information is synchronized to eDirectory unless you filter it out using a style sheet. The following style sheet can be used in the Event Transformation to ensure that only real user objects are synchronized.
<xsl:template match="node()|@*">
<xsl:copy>
<xsl:apply-templates select="node()|@*"/>
</xsl:copy>
</xsl:template> <!-- Test for Non-User user objects like workstations that have a $ in the
name --> <xsl:template match="add[@class-name='User']|modify[@class-
name='User']|sync[@class-name='User']">
<xsl:choose>
<xsl:when test="contains(@src-dn,'$')"/>
<xsl:otherwise>
<xsl:copy>
<xsl:apply-templates select="node() | @*"/>
</xsl:copy>
</xsl:otherwise>
</xsl:choose>
</xsl:template>
</xsl:stylesheet>
The driver allows you to synchronize group information in both the user attributes holding group membership information and the group objects themselves.
This functionality allows you to see which groups a user is a part of, whether you're looking at the user in eDirectory or in NT.
To synchronize group information:
Ensure the groups to be synchronized exist as identically named objects in both eDirectory and in NT.
For example, if you want to synchronize group information for the NT global group, Domain User, you should create a group object named Domain User in eDirectory.
Create a DirXML association between the NT group and the eDirectory group.
In iManager, select eDirectory Administration > Modify Object.
Browse to the eDirectory group that will be synchronized, then click Ok.
Click the DirXML tab, then click Add.
The Add Association dialog box appears.
Specify the DirXML driver for NT in the Integration Driver Object field.
Enter the NT group name in the Associated Object ID field using upper case as shown in the following syntax:
\DOMAINNAME\GROUPNAME
Click OK.
The new association is displayed in the Associations page.
Edit the Schema Mapping policy to map the NT UserLocalGroups and UserGlobalGroups attributes to eDirectory attributes.
Click DirXML Management > Overview, then select the driver set containing the DirXML driver for NT.
Click the driver to display the Driver Overview page.
Double-click the Schema Map policy and map the new attributes.
You can map the NT attributes to any multivalue string attribute. UserGlobalGroups is commonly mapped to the GroupMembership attribute.
If you are publishing data from NT to eDirectory, double-click the Publisher filter icon and add the new attributes.
If you are subscribing to data held in eDirectory, double-click the Subscriber filter icon and add the new attributes.
Click Ok.
Group information will begin to synchronize when the driver is restarted and a change to user information occurs.
NOTE: If you use User Manager to change the group membership attribute values without making changes to any other data, this update does not synchronize immediately. Changes will be synchronized the next time the NT user logs in or the next time user object data changes.
Modify the Subscriber and Publisher Placement policies to match the eDirectory container with the NT domain name you have set up. Placement policies are created when you import the sample driver configuration file.
To modify Placement policies:
In iManager, select DirXML Management > Overview.
Select the driver set containing the driver, then click the driver icon.
The Driver Overview is displayed. Policies can be edited here.
Double-click the Placement policy you want to edit, then make the appropriate changes.
IMPORTANT: All Placement policies must use the slash syntax.
In iManager, select DirXML Management > Overview.
Select the driver set containing the driver, then click the driver icon.
The Driver Overview is displayed. Policies can be edited here.
Double-click the filter icon and add or remove the appropriate attributes.
Select the eDirectory user attributes that you want to synchronize with.
The driver supports the Domain User object. The attributes that the driver supports within the User object are the attributes that are accessible by using the USER_INFO_3 data structure using the NetUser APIs.
The following table lists the supported attributes.
IMPORTANT: Keep in mind that attribute names are case sensitive.
The driver also supports the UserGlobalGroups and UserLocalGroups that are accessible through the NetUserGroup API.
The following table lists the supported attributes:
You can query for GlobalGroup or LocalGroup objects, although you can't synchronize them on the Subscriber or Publisher channel.
The query supports the following attributes.
A query is successful if the SearchClass is GlobalGroup or LocalGroup and any of the following are true:
This feature could be used to synchronize GlobalGroups or LocalGroups in an indirect way. For example, using a style sheet you could configure the driver to query for them when you are migrating users, and create corresponding Group objects in eDirectory. Doing this would allow the MemberOf attribute for an NT user to work for making a user a member of matching groups in eDirectory (this aspect would work without an additional style sheet). To keep the GlobalGroups and LocalGroups mirrored in eDirectory using this method, you would need to migrate again periodically as new groups are added or removed from NT.
In the sample driver configuration, this feature is used if you choose the Role-Based Entitlements option, to allow you to assign a user to a GlobalGroup or LocalGroup in NT as an entitlement. (Using Role-Based Entitlements is a design decision. Don't choose this option unless you have reviewed "Using Role-Based Entitlements" in the Novell Nsure Identity Manager 2 Administration Guide.)