Microsoft AD Bridge

The domain to which the AD Bridge client is connected is determined from the domain of the signed-in user who is installing the AD Bridge client on the Windows Server.

Active Directory must be configured for an SSL Connection. Try connecting ldp.exe with Active Directory on SSL. To verify the SSL connection:

the AD Bridge server might become disconnected to IAM because of network connectivity issues. After connectivity has been restored an email notification is sent.

The "LDAP Server unavailable" error occurs when the server on which the AD Bridge client in installed is unable to connect to the Active Directory Domain Controller through LDAP. Verify that the Active Directory services are running (In Windows Services list, check the status for AD DS Domain Controller service.) and then try to connect using the client utility ldp.exe.

AD Bridge has one-way communication with IAM. This means that IAM can't directly communicate with the server on which AD Bridge is installed. Instead, AD Bridge frequently polls IAM to check whether any operation (like sync) is pending. An "AD Bridge Unreachable" message means that the polling is not being performed. The following are some reasons that the AD Bridge might be unreachable.

• The AD Bridge is not installed.
• The AD Bridge is installed but unable to reach to IAM over the internet.
  • Check your connection/proxy settings.
  • Test the connectivity using the AD Bridge user interface.
• The background service is stopped.
  • Start Identity Cloud Service Microsoft Active Directory Bridge Service from Windows Services.
  • Ensure that the Startup type is Automatic.

When you see the message "No active sync" in the Console, you can safely ignore it.

This message doesn't indicate that there is an issue. It means that currently a sync is not in progress. The next sync will run according to the interval set for the domain through the configuration page. Or, it can be triggered manually.

Since the incremental sync only reads changed data, a sync can happen very fast and it might appear that the "No active sync." message never disappears. You can always verify the last sync status from the Import page for that particular domain.

Moving the Domain Controller should not cause any issues. Verify Domain Controller connectivity by using the Test Connectivity option in the AD Bridge user interface. If there's an issue in the AD Bridge to Domain Controller (LDAP) communication, then click Detect Domain Controller to further detect whether the Domain Controller is accessible.

The following screen shots are examples of successful connection tests.

The cause depends on which of the three authentication methods (listed below) are being used to sign in Active Directory (AD) users. These methods can be changed using the domain configuration page. Sign in functionality works differently in each case.

• Local Authentication (default): After the sync, users will get a welcome notification to change the password for their account. They need to use the provided username (from AD) and password they set to sign in to their account.

  Action to take: Check whether the user is present in IAM. (The user sync might have failed because of invalid data.) If the user exists, try resetting the password from IAM.

• Delegated Authentication: With local authentication, you can enable delegation from AD. With delegated authentication, users won't create a password but instead use their existing AD passwords to sign in. IAM delegates the user authentication to AD through AD Bridge.

  Action to take: Check whether the user is present in IAM. Also, check whether the user is active in AD and that the password is not expired.

• Federated Authentication: This method uses a third-party service like Microsoft AD FS to authenticate the user.

  Action to take: Check the configuration of the third-party service.

Use the following screen shots as a guide.

When you are unable to enable federation, check whether Delegated Authentication is enabled. If Delegated Authentication is enabled, Federated Authentication cannot be enabled. To enable it, use the following steps:

When you can't enable delegated authentication, use the following steps:

When you want to change your sign in username to an email address, use the following step:

AD Bridge records updates in Active Directory using synchronization tokens and an update sequence number (USN). The previous highest USN value is stored in and any time an incremental sync is run; IAM reads the data from the stored USN to the latest USN.

Sometimes, because of factors such as a Domain Controller change, USN numbers get corrupted (if a new DC has large USN value than previous DC) causing users not to sync. A Full sync doesn't use tokens that is why the users appear in a Full sync.

Attribute mappings can be changed at any time. Ensure that you perform a Full sync after saving the new configuration. User data will be updated by the Full sync. If you don't do a Full sync, existing user data remains the same and new users will have updated data.

You can suppress some auto-generated emails and notifications.

IAM keeps a mapping of all the AD users (IAM identifier mapped to AD identifier). When the user is removed from the active sync because of, for example, a new filter condition, the record in IAM is kept and just the mapping is removed. The removal of mapping is called delinking.

This case is different from deletion as user is not deleted from AD, if filters are reset, the user will be linked again.

To find out how many AD bridges you can install for your identity domain type, see IAM Identity Domain Object Limits.

Only one Bridge can be installed on the same Windows Server machinea single Bridge can be installed. To use High Availability (HA), you need multiple machines connected to the same AD Domain.

When a new version of the AD Bridge client is available:

• You should always upgrade.
• Make sure you don't the current version again. Reinstalling the current version removes the existing Bridge and may lead to authentication and sync failures.

You do not need to uninstall the existing AD Bridge to upgrade to a newer version.

You can verify the version number from the AD Bridge user interface.

Existing data is not be impacted because of an upgrade, and you can perform an incremental sync. Also, the sync schedule won't be affected, and next sync will be performed as configured.

We do not recommend that you downgrade your AD Bridge client.

If you decide to downgrade the client, you must uninstall the current one AD Bridge client which can lead to a downtime of services (sync, delegated authentication, etc.).

You can then install the version you want.

• Check the OU configuration on the Directory Integrations page. You need to select the OUs for groups and users separately. Even if you have the same OU for groups and users, select them separately. Make sure to save the configuration page after you make the changes.
• Confirm the filter used in users/groups on the configuration page. Use PowerShell to execute the filter and check whether your users are visible there.
• Check the network connectivity from AD Bridge client to IAM. (Only if some all records are failing.)
• Check the IDBridge log file ("View logs" from AD Bridge user interface). Look for an error like the following:
  

When you need to take a thread dump of the AD Bridge service on an AD Bridge machine, follow these steps.

Filters can prevent new users and groups from syncing into IAM.

In all these cases, the authentication request fails unless the password caching is enabled and the password is available in the cache.

For first three scenarios, the service will recover when the downstream system/connectivity issue resolves.

For the last scenario, the service will recover after the concurrent request load decreases.

If password caching is enabled and there isn't a cached password, or if the cache password is expired, then the next time the user sucessfully logs in to the system the password is stored.

The default expiration for a password is five days, but you can change this in delegated authentication settings.

When AD bridge installation fails, this is due to:

• Exceeding the number of identity domains for your identity domain type.
• Exceeding the number of AD Bridge clients for your identity domain type.

To find out how many identity domains or AD bridges you can install for your identity domain type, see IAM Identity Domain Object Limits.

Note that the Directory User Attribute input is not a dropdown selection, but a suggestive text box. You can write anything to the text box, even if that attribute is not present in your AD.

Ensure you type the correct attribute exactly (including the uppercase and lowercase characters) the way the attribute name appears in Active Directory.

If you don't do this, you will not see an error at mapping save time, but your AD sync will be impacted, and it will not be able to pull this attribute from Active Directory.

A partially configured domain indicates that no OU is selected on the configuration page. Any OU selection for users, groups or both is required for configuring domain for sync. Till then there is nothing to import and import will stay disabled.