Skip to main content

Configure the Active Directory target

Provisioning tutorial · Step 2 of 10

Connect the target environment where NIM will provision accounts.

In this step, we'll add an AD target system and configure its data model.

Add the AD target system​

  1. Go to Systems > Overview.

  2. Click Add.

  3. Select Active Directory for System Type.

  4. Enter a System Name. For this example, AD.

  5. Click Save.

  6. The new system is added to the Configured Systems pane.

  7. Click Configure.

  8. Enter your AD Domain. For example, t4edemo.com.

  9. Click Test Connection. If NIM can successfully communicate with your AD domain, a success message is returned.

  10. Click Save.

  11. Go to the Configuration tab.

  12. Choose the Search Base—the root organizational unit NIM will work from. For this example, select t4edemo.com/docs.

    Keep the default search base if NIM should work across the entire domain.

  13. Select the checkbox for each data table to collect from AD. For this example, we'll select Groups , Memberships , OrganizationalUnits , and Users .

  14. Click Save.

  15. Click Collect to collect data for the AD system.

tip

If an AD table has no columns after collection, confirm that the selected search base contains at least one user, group, and group membership.

  1. Expand this system's table list and go to one of the tables to confirm that data has been collected.

Select attributes to collect​

  1. Expand this system's table list and go to the Users table. Then go to the Settings tab.
  2. By default, the following user attributes are collected from AD: cn, distinguishedName, Enabled, givenName, objectClass, objectGUID, objectSid, path, sAMAccountName, sn, and userPrincipalName. For this example, we'll additionally collect the employeeID:
  3. Click Save.
  4. Collect the AD system again. Also collect the CSV system if its data may have changed.
tip

Collect after changing a system configuration or data model. Frequent collection keeps the vault current.

Assign primary keys​

The next step is to assign primary keys to tables, like we did for the CSV system.

  1. Expand this system's table list and go to the Users table. Then go to the Columns tab.

  2. We'll select the objectGUID as this table's Key, and distinguishedName as its Display Name.

  3. Click Save.

  4. Repeat for the remaining data tables:

    TableKeyDisplay name
    UsersobjectGUIDdistinguishedName
    OrganizationalUnitsobjectGUIDdistinguishedName
    Memberships——
    GroupsobjectGUIDdistinguishedName
tip

Do not set a key or display name for Memberships. It is a junction table between users and groups and has no single unique identifier.

  1. Finally, collect this system's data again, by going to the Overview and clicking Collect.

Set up intra-system relations​

The final step is to establish relations between tables in this system, like we did for the CSV system.

There is only one table in our AD target system that needs intra-system relations — the Memberships table, which stands in between users and groups.

  1. Expand the AD system's table list and go to the Memberships table. Then go to the Relations tab.

  2. Manually add these relations:

    Memberships fieldRelated fieldCardinality
    groupGroups.objectGUIDN → 1
    memberUsers.objectGUIDN → 1
    groupMemberships.memberN → N

tip

Unlike the CSV source, Active Directory relations must be added manually; Determine Relations Automatically is not available here.

  1. Click Save.
  2. Collect both systems' data once again, by going to the Overview and clicking Collect for each system.
Last updated on