Creating an Active Directory Source Definition

AD Source Name

Enter a name for the AD source definition. This name will appear in the Source field in the associated Customer Profile record.

Search Root

Enter the directory server machine name or IP address for querying user information in the Active Directory source; precede your entry with the following: LDAP://

Note: Use of secure LDAP is required when authentication is used; port 636 must be used in the Search Root field to resolve the errors that happen during sync. When the Search Root does not contain :636, the Base DN dialog on the Sync Definitions and the Preview dialog on Field Mappings will error and will not synchronize the Customer Approver field. When the Search Root ends with :636, the Customer Approver field for existing customers will be updated to the current Manager in AD.

Domain Controller

If the domain controller that iSupport authenticates against cannot resolve the Secondary Login field, specify the domain controller that can.

This can be the name of the domain controller or the fully qualified DNS name of the domain controller. All of the following examples represent correctly formatted domain controller names:

FAB-DC-01

\\FAB-DC-01

FAB-DC-01.fabrikam.com

\\FAB-DC-01.fabrikam.com

Connect As

Select:

• Anonymous to connect to the data source as an anonymous user.
• Specified User to enter a login for connecting to the data source.

Username

Password

If anonymous Active Directory connections are not allowed in your environment, use these optional fields to enter a username and password for authentication when queries are performed. If anonymous connections are allowed, leave these fields blank.

Active

Select Yes to enable the Active Directory Integration agent that updates the records in Customer Profiles with the information in Active Directory. The agent runs immediately and then continues to run as scheduled in the AD Synchronization Interval field.

AD Synchronization Interval

Select the amount of time in the interval for the synchronization to be performed.

Active

Select Yes to enable the sync definition.

Sync Entries As

Select the type of record that you are synchronizing: Customer Profile, Support Representative Profile, or Asset record. When synchronization occurs, the record will be created if there is an entry in Active Directory that does not exist in iSupport.

• If synchronizing customers, the Enable mySupport Access field will appear. Select Yes to enable the Approved to Access mySupport field by default. If a login name and password exists in the Active Directory record, it will be included in the mySupport login fields for authentication to the mySupport portal. This is not a mapped or synchronized value; it can be edited in iSupport.

  

• If synchronizing support representatives, the Default Primary Group field will appear. Select the iSupport group to assign as the primary group by default; you can use the Create New and View/Edit icons to access the Group configuration screen and configure the roles/permissions, Desktop components, the work items/features involved in global search, work item UI settings, and mySupport chat settings for group members. This is not a mapped or synchronized value; it can be edited in iSupport.

  

• If synchronizing assets, the Default Type field will appear. Select the asset type to assign by default. You can use the Create New and View/Edit icons to access the Asset Type configuration screen and configure a login for running asset scans, optional and custom fields, maintenance/warranty notifications, and count tracking for the asset type. This is not a mapped or synchronized value; it can be edited in iSupport.

  

Base DN

Click this button to select the directory node that contains the data to be synchronized.

Search Filter

Enter the conditions that must be met for returning a specific set of information to iSupport. Note that a filter is required for synchronizing assets, but for customers and support representatives a filter is only needed if the selected Base DN contains unwanted lower level nodes or if the data source's exclusions do not already remove the unwanted nodes.

This feature utilizes LDAP (Light Weight Directory Access Protocol), which defines how information can be accessed in directories. Active Directory supports the LDAP search filter syntax as specified in RFC 1960. For information on LDAP and search filters, see http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx#Examples.

Examples

All users that contain a first and last name:

(&

(objectCategory=Person)

(objectClass=user)

(givenName=*)

(sn=*)

)

All users that contain a first and last name excluding Tom Jones and SQL Account:

(&

(objectCategory=Person)

(objectClass=user)

(givenName=*)

(sn=*)

(!name =Tom Jones)

(!name=SQL Account)

)

All users and contacts that contain a first and last name:

(&

(objectCategory=Person)

(givenName=*)

(sn=*)

(|

(objectClass=user)

(objectClass=contact)

)

)

All users and contacts that contain a first and last name, excluding Tom Jones, Barry White, and SQL Account:

(&

(objectCategory=Person)

(|

(objectClass=user)

(objectClass=contact)

)

(givenName=*)

(sn=*)

(!name =Tom Jones)

(!name=SQL Account)

(!name =Barry White)

)

All users with a valid Microsoft Windows user name (domainname\username):

(&

(objectCategory=Person)

(objectClass=user)

(givenName=*)

(sn=*)

(userPrincipalName=*@*)

(samAccountName=*)

)