Sync groups and users

In this step example of the connector-based federation setup for Omnissa Connect, you create an internal directory for a company called ACME that stores the users and groups you sync from your Active Directory.

Sync groups and users from a single or multiple Active Directory domains

• Select the Single AD domain option when all users and groups you want to give federated access to Omnissa Connect are in a single AD domain. If you have multiple AD domains and there is no trust between these domains, use this option. Once federation is set up, you have the option to add a new directory for each additional AD domain.
• Select Multiple AD domains when the users and groups you want to give federated access to Omnissa Connect are across different AD domains, you have multi-forest Active Directory configured, and trust is established between the different domains.

Synced groups and users display in Groups

After enterprise federation is activated, the groups and users that you sync in this step of the federation workflow appear on the Groups page in the Omnissa Connect console. You can access the page by navigating to Identity and Access Management > Groups. You can sync additional groups and users for your enterprise after the federation setup is activated.

Omnissa accounts

All federated accounts must be synced to allow users' access to Omnissa Connect with their corporate accounts.

• Don't need Omnissa accounts
  • Synced users are not asked to create Omnissa accounts upon login.
  • Enterprise Administrators who are added to the special Management Organization after the domain is federated, don't need to create an Omnissa account.
• Do need Omnissa accounts
  • Enterprise Administrators who are also Owners or who are invited to complete the federation setup before the domain is federated, have to create an Omnissa account.

Prerequisites

• If your Active Directory requires access over SSL/TLS, you must upload the domain controller's intermediate (if used) and Root CA certificates.
• For group and user syncs, you must use any service or user account which has a read privilege on Active Directory and a non-expiring password for Bind User DN/Name to connect to Active Directory.

Caution: If your company security policy requires you to use a service account with an expiring password, and the password expires before it is renewed, groups and users are not synced. If sync is interrupted, you must reestablish the connection between your Active Directory and the Omnissa Access connector.

Other considerations

• The bind user DN and bind DN credentials that you enter must follow the syntax presented in the examples.
• The minimum attributes to sync groups and users are first name, last name, email, user name, and domain. If your enterprise uses User Principal Name (UPN) to authenticate users, this attribute must have a value for the sync as well. User passwords are never synced. Only the User and Group DNs configured in this step are synced, not your entire AD.
• Users who are not synced will fail user authentication after the enterprise federation is activated.
• Synchronization fails if the minimum required attributes, such as first name, last name, email, user name, domain, and UPN (if used), are missing.
• If you get an exception error for bind user DN, you can ignore it. For all other errors, you must troubleshoot your setup.

Procedure

1. In Omnissa Connect, in the Sync groups and users section of the Set up Enterprise Federation page, select Start.
   The Add a directory section displays.
2. In the Directory Name text box, enter a name for the internal directory you are about to create.
   • You can provide any name for your enterprise directory, it does not need to match the name you use internally.
3. You can keep the default Single AD domain and No menu items selected.
4. Select Next.
   The Provide bind user credentials section of the workflow expands.
5. Provide the bind user administrator credentials of the service account that will be used to sync groups and users from the enterprise Active Directory.
   • Here is an example of how you define the bind user distinguish name (DN). Let's say the bind user DN for your enterprise directory service is admin@acme.com. See how the syntax of the user name is defined in the federation setup:
     1. In the Bind User DN text box, enter CN=admin, DC=acme, DC=com.
        The Base DN text box is automatically populated to display DC=acme, DC=com.
     2. In the Bind User Password text box, enter the password for the bind user administrator.
6. Select Next.
   The Sync groups section of the workflow expands.
7. Enter the Group Distinguish Name (DN) for groups you want to sync.
   • Use syntax similar to what you entered in bind user step of this task to define specific user groups from your enterprise directory, such as CN=Users, DC=acme, DC=com.
8. Select the Select Groups link.
   • A pop-up window appears and displays all available group results for the Group DN criteria you entered.
   • If your search results in more than 1000 groups, you can return to Group Distinguish Name step and refine your search criteria.
9. Select the groups that you want to sync for the federation setup, then select Save.
   • The federation workflow page is refreshed and displays the number of groups added for sync in this step.
   • You can add more groups by selecting Add.
10. Select Next.
11. In the Sync users section that expands, enter the User DNs that you want to sync.
    • Use syntax similar to what you entered in Group Distinguish Name and the bind user steps of this task to define specific users from your enterprise directory, such as CN=admin, CN=users, DC=acme, DC=com.
    • All groups and users that you added are now displayed in the Review groups and users section.
    • To test the federation setup and validate the user log in with your enterprise Identity Provider, make sure to add and successfully sync groups and users who are going to test the federation setup, including yourself.
12. Select Sync.
13. Select the Check Sync Status to update the Sync in progress status display.
    • To see the updated status of the sync, you must select Check Sync Status.
    • When syncing is successful, the status changes to green.
14. Select Continue.

What to do next

You are now ready to configure your corporate IdP for enterprise federation with Omnissa Connect.