Onboarding the Active Directory Application

Provision users from Verify to on-premises Active Directory.

Before you begin

The adapter for Microsoft Active Direcorty must be installed. See Installing the adapter for Microsoft Active Directory.
IBM Verify Bridge for Provisioning created with Verify. See Configuring through the Verify user interface.
Deployment and configuration of the on-premises components must be completed. Deploying the on-premises components.

Procedure

Log in as administrator on Verify.
Select Applications > Applications and click Add application.
In the Select application type pop up, search for Active Directory and select to create application of type Active Directory.
Click Add application on the pop up.
In the Add applications page, select the General tab specify the required details.

Note: The Sign-on tab is not available because it is not applicable for applications of type Active Directory.
Select the Account lifecycle tab.

Specify the provisioning and deprovisioning policies.


Parameters	Description
Provision accounts	Provision accounts is Disabled by default which means the account creation is performed outside of IBM® Verify. Select the Enabled option in order to automatically provision an account when the entitlement is assigned to a user. Password generations and email notification features are available for the account created using IBM Verify.
Deprovision accounts	Deprovision accounts is Disabled by default which means account removal is performed outside of IBM Verify. Select the Enabled option in order to automatically deprovision an account when entitlement is removed from a user.
Account password	Sync user's Cloud Directory password This option is available if Password sync is enabled on the Cloud Directory. It uses the Cloud Directory password when a regular user is provisioned to the application. Federated users receive a generated password when provisioned to the application. Generate password This option generates a random password for the provisioned account. The password is based on the Cloud Directory password policy. None This option provisions the account without a password.
Send email notification	This option is available when you select the Generate password option. When you select the Send email notification option an email notification with the auto generated password is sent to your email address after the account is provisioned successfully.
Grace period (days)	Set the grace period in days for which deprovisioned account will be kept as suspended before deleting it permanently.
Deprovision action	Delete the account. This fields is available only if the deprovision accounts field is enabled.

Specify the API authentication details.
- Agent URL: Url of the adapter agent installed with Active Directory on premises. For example, http://<Adapter_host>:<adapter_port>
- Agent user ID: User ID of the on-premises Active Directory adapter. (agent)
- Agent password: Password of the on-premises Active Directory adapter. (agent)
Provide the Verify Bridge details.
Associate the Verify identity agent that you created in Configuring through the Verify user interface.
Optional: Specify the target details.
- User base DN:
- Group base DN:
Note: Specify the DN of the group object of Active Directory. An example DN for a user named CSantana whose object is stored in the cn=Users container in a domain that is named Company.com is cn=CSantana,cn=Users,dc=Company,dc=com.
Set value as :
```
User base DN: cn=Users,dc=Company,dc=com
Group base DN: CN=Users,dc=Company,dc=com
```
Click Test Connection to test the connection to the Active Directory adapter on premises.
The connection needs to be successful to provision or reconcile accounts on the Active Directory application.
Map the attribute names of the target Active Directory attributes to particular attributes of the Cloud Directory.
Select the Keep value updated check box for the attributes that need to be updated on the target.
Select the Account sync tab.
In the Adoption policy section, add one or more attribute pairs that need to match for the account sync process to assign Active Directory accounts to their respective account owners on Verify.
In the Remediation Policies section, choose a remediation policy to remediate non-compliant accounts manually.
Click Save.
After the application is saved, specify the provisioning options on the Entitlements tab.
Note:
The recon failure threshold is set as 15% by default. It ensures that if more than 15% of account found deleted between successive account sync, then the account sync result is discarded, and the operation is halted.

If there is a higher % of deleted records (typically with smaller data volume- the smaller data change will contribute to higher % deviation), adjust the value appropriately. By setting the failure threshold value to 100%, the % deviation will be ignored, and the account sync operation will be completed.

You can change failure threshold value by adding environmental variable RECONCILIATION_FAILURETHRESHOLD_VALUE:"100” (the value can range from 0 to 100) under identity-brokerage environments section in docker-compose yml file. Once done, re-spin the container if it is already running.

For example:
```
identity-brokerage:
image: ibmcom/identity-brokerage
container_name: identity-brokerage
depends_on:
- ib-init
- ibdb
environment:
LICENSE_ACCEPT: "yes"
HOSTNAME: "identity-brokerage"
DB_SERVICE_NAME: "ibdb"
TRACE: "enabled"
SCIM_USER: "<>"
SCIM_USER_PASSWORD: "<>"
RECONCILIATION_FAILURETHRESHOLD_VALUE: "75"
 
```