Active Directory Edition

Overview

Active Directory Edition (ADEdition) provides a set of predefined flows for delegated administration, along with security reports for Active Directory. These can be used out-of-the-box or serve as a foundation for building custom flows tailored to your requirements.

Prerequisite

• A server with the latest version of FortifiedID Control installed
• An Active Directory environment configured and accessible

Configuration

Download and add ADEdition

1. Download ZIP containing ADEdition
   1. Click https://share.fortifiedid.se/index.php/s/rs3R9EPFYoz2Bp5 to download ADEdition.zip
   2. Unzip the file. It should contain an flows folder with a number of flows
2. Add ADEdition flows to Fortified ID Control
   1. Go to drive:\path\FortifiedID\mgmt-center\data\customer\control\config\modules\flows
   2. Drop all flows into this folder
3. Refresh Management Center Control to verify you can see the flows
   1. In Configuration and Flows there should be a category called ADEdition

Update globals to match your Active Directory

All flows in ADEdition uses globals so it should be easy to map all flows to your Active Directory environment.
Change values below to map your environment.

1. Open Management Center Control

2. Click Configuration tab

3. Expand Misc settings

4. Click Globals

5. Add the following keys, see example below.
   Note. The different paths below are just examples, if you like you create the same structure in your environment or just change to whatever you have.

     "ad_edition_name" : "ad_edition",
     "ad_edition_host" : "127.0.0.1",
     "ad_edition_port" : 636,
     "ad_edition_use_ssl" : true,
     "ad_edition_ssl_trust_all" : true,
     "ad_edition_base_dn" : "OU=FortifiedID_Control,DC=company,DC=local",
     "ad_edition_bind_dn" : "your_admin_account",
     "ad_edition_bind_password" : "your_admin_password",
     "ad_edition_userprincipalname_suffix" : "@company.local",
     "ad_edition_add_users_dn" : "OU=users,OU=FortifiedID_Control,DC=company,DC=local",
     "ad_edition_add_groups_dn" : "OU=groups,OU=FortifiedID_Control,DC=company,DC=local"

6. Change values above to match your environment

7. Click Update

Add an LDAPClient module

All flows in ADEdition uses globals so it should be easy to map all flows to your Active Directory environment.
Change values below to map your environment.

1. Open Management Center Control

2. Click Configuration tab

3. Expand Modules and click + to add a new module

4. Add an LDAPClient

5. Click JSON mode and paste the data below. It will work with the data added to globals.json above.

   {
     "name": "LdapClient",
     "enabled": true,
     "instances": 1,
     "config": {
       "name": "${globals.ad_edition_name}",
       "connection": {
         "host": "${globals.ad_edition_host}",
         "port": "${globals.ad_edition_port}",
         "bind_dn": "${globals.ad_edition_bind_dn}",
         "bind_password": "${globals.ad_edition_bind_password}",
         "use_ssl": "${globals.ad_edition_use_ssl}",
         "ssl_trust_all": "${globals.ad_edition_ssl_trust_all}"
       }
     },
     "display_name": "AD Edition"
   }

6. Click Update

Update english language file

A number of the example forms have some language keys that is not default.

1. Open Management Center Control
2. Click Configuration tab
3. Expand Misc settings and Languages
4. Click English and att the language keys below

5. {
     "displayName.label": "Name",
     "adCreateGroupFindOwner.label": "Owner",
     "description.label": "Description",
     "mail.label": "Mail",
     "mobile.label": "Mobile",
     "chooseRole.label": "Choose role",
     "givenName.label": "First name",
     "adCreateUserFindManager.label": "Choose mananger",
     "adEditUserFindManager.label": "Manager",
     "sn.label": "Last name",
     "chooseGroupType.label": "Choose group type",
     "current_accountExpires.label": "Current account expires",
     "accountExpires_add_180_days_from_today_display.label": "New account expires",
     "sAMAccountName.label": "UserID",
     "adEditGroupOwner.label": "Owner",
     "adGroupMissingOwner.label": "Select owner",
     "adUserMissingOwner.label": "Select mananger",
     "useraccountcontrol_picker.label": "Account status",
     "days_since_last_logged_in.label": "Days since last login",
     "private_mobile.label": "Private mobile",
     "forms.datagridwidget.whenCreated_widget": "Account created",
     "forms.datagridwidget.accountExpires_widget": "Account expires",
     "forms.datagridwidget.displayName": "Name",
     "forms.datagridwidget.cn": "Name",
     "forms.datagridwidget.mail": "Mail",
     "forms.datagridwidget.mobile": "Mobile",
     "forms.datagridwidget.sAMAccountName": "UserID",
     "forms.datagridwidget.description": "Description",
     "forms.datagridwidget.lastLogonTimestamp_widget": "Last logon",
     "forms.datagridwidget.manager": "Manager",
     "forms.datagridupdatewidget.displayName": "Name",
     "forms.datagridupdatewidget.cn": "Name",
     "forms.datagridupdatewidget.sAMAccountName": "UserID",
     "forms.datagridupdatewidget.description": "Description",
     "extend_expire_date_for_displayname_step2": "# Extend expire date with 6 months\nExtend expire date with 6 months for user **{{displayName}}**?",
     "extend_expire_date_for_displayname_summary": "# Extend expire date with 6 months\n**{{displayName}}** has a new expire date: **{{new_expire_date}}**",
     "edit_active_directory_group_step2": "# Edit group\nChange data for selected group: **{{cn}}**",
     "edit_active_directory_group_summary": "# Edit group\nGroup **{{cn}}** has been updated",
     "ad_group_managedby_missing_step_2": "# Select group owner\nSelected group: **{{cn}}**",
     "nok_name.label" : "Next Of Kin - Name",
     "nok_name.description" : "Add name of next of kin",
     "nok_mobile.label" : "Next Of Kin - Mobile",
     "nok_mobile.description" : "Add mobile number for next of kin",
     "nok_mobile.error.required" : "Mobile number required",
     "nok_mobile.error.format" : "The mobile number must not contain special characters",
     "edit_active_directory_user_summary" : "## Selected user {{displayName}} is now updated",
     "edit_active_directory_user_step2" : "## Selected user: {{displayName}}",
     "forms.modalselectwidget.cn": "Name",
     "forms.modalselectwidget.displayName": "Name",
     "adEditGroupOwner.forms.modalselectwidget.sAMAccountName": "UserID",
     "adCreateGroupFindOwner.forms.modalselectwidget.sAMAccountName": "GroupID",
     "adEditUserFindManager.forms.modalselectwidget.sAMAccountName": "UserID",
     "forms.modalselectwidget.sAMAccountName": "UserID",
     "findActiveDirectoryGroups.forms.datagridwidget.managedBy": "Group owner",
     "adCreateUserFindManager.forms.modalselectwidget.sAMAccountName": "UserID",
     "forms.modalselectwidget.mail": "Mail address"
   }

Deploy settings to Control

1. Click settings button top right corner in Management Center.
2. Click Deploy
3. Changes will be saved and service restarted.

Test ADEdition

How to test the flows in AD Edition

1. In Management Center for Forms -> Configuration -> Flows you can see all flows for ADEdition. If you click one of the flows on your right side you can see the name of the different flows. for example
   &#xNAN;"name": "ad_edition_group_create"
2. Go to a browser and paste that name to the end of the URL to forms, for example:
   https://localhost:8450/forms/ad\_edition\_group\_create