Synchronizing User Directories

Note

This feature required Enterprise Edition

Genian NAC 6.0 can use an LDAP directory as a source of user and organizational information. LDAP synchronization allows user accounts to be created locally and used for administration or policies. LDAP synchronization is commonly used with Microsoft Active Directory (AD) systems.

Creating Synchronization with AD

Go to Preferences in the top panel
Go to User Authentication > Data Synchronization in the left Preferences panel
Click Tasks > Create

Under General

For ID, type unique name.
For Update Interval, select the specified time or periodic interval for this Synchronization.
For Applying Policy, select Enabled for applying change after Synchronization. If there are several synchronization settings, you can set it to Disabled and enable only the last one.
For Environment, Input is not required for basic synchronization tasks. However, it is used when defining variable values to be commonly referenced within a separate custom shell script executed for integration with external systems.

Warning

Configuration Caution: Incorrect environment variable declarations can lead to malfunctions in the integration script or system errors. Before configuration, please ensure that the variables are correctly processed within the script.

Usage Scenario: Log Level Control Used when you want to control simple operation options such as Log Level or Retry Count during external script execution.
```
export LOG_LEVEL='ERROR'
```
For Query, Enter the SQL query to be executed immediately after information synchronization is complete. This is used when secondary processing is required based on specific conditions using the synchronized information.

Warning

Risk of Data Loss: This feature directly affects the database. In particular, the use of UPDATE or DELETE statements may result in irreversible data loss.

Usage Scenario: Account Lock Processing based on Employment Status Used when you want to automatically disable the NAC account of resigned (or on-leave) employees according to the 'Employment Status' code after information synchronization.

Prerequisites 1. Create a field to manage employment status (e.g., USER_CUSTOM08) in [Settings] > [Property Management] > [Custom Fields] > [User Custom Fields]. 2. Assign the user custom field created in step 1 to [Additional Info] under [User Information] in [Information Synchronization].

Writing Example If the value of USER_CUSTOM08 is '001' (Resigned/On-leave, etc.), update USER_STATUS to '0' (Disabled).
```
UPDATE USER
SET USER_STATUS = 0
WHERE USER_CUSTOM08 = '001';
```

Under Database

For Type, section LDAP
For Server Address, type IP Address or FQDN of Active Directory server
For Server Port, type AD LDAP service port. by default LDAP port is 389. if you use LDAPS (LDAP over SSL) default port is 636.
For SSL Connection, select On if you use LDAPS.
For DB Username, type Bind DN of Active Directory. Normally, you can use email format like administrator@company.com
For DB Password, type Bind DN user's password

Under User Information

For Table Name, type base distinguished name (DN) of users. For example: CN=Users,DC=company,DC=com
For Where Clause for DB, type (&(objectClass=user)(objectCategory=person)) for filtering person object.
For Column Name for Username, type sAMAccountName
For Column Name for Full Name, type displayName
For Column Name for Department, type $distinguishedName, IF(LOCATE('OU=',$)>0,SUBSTRING($,LOCATE(',',$)+1),'')
For Column Name for Memberships, type memberOf
For any other extra information, you can use LDAP attribute name for each column name.

Under Department Information

For Table Name, type base distinguished name (DN) of organizationUnit (OU). For example: DC=company,DC=com
For Where Clause for DB, type objectClass=organizationalUnit for filtering OU object.
For Sort Criteria, type @NAMEPATH for ordering based on department name.
For Column Name for Department ID, type distinguishedName
For Column Name for Department, type name
For Column Name for Parent Dept., type $distinguishedName, SUBSTRING($,LOCATE(',',$)+1)
Click Save at the bottom

Attention

Active Directory does not provide a userPassword attribute, so user passwords cannot be synchronized. Therefore, separate linkage should be set. check the LDAP (Active Directory)