Configured Password Filter Plugin (Modern Password Sync)
Modern Password Sync requires Quest Directory Sync Password Filter installed in both source and target Active Directory. In a multi-domains forest, at least one Domain Controller per Domain must be configured with Password Filter.
To install the password filter, the following are required
-
One (1) Local Administrator Account for each Microsoft Forest and/or Domain that has permissions to install Password Filter on the Domain Controller.
-
One (1) Domain Controller per domain in a multi-domain forest.
Follow these steps to set up the password filter.
-
Launch the Password Filter installer on the domain controller.
-
Click the Next button.
-
Enter the same Passphrase used during Directory Sync agent installation, the passphrase must be the same for Directory Sync agent to communicate with the Password Filter.
-
Click the Next button.
-
Click the Install button.
-
Select ‘Yes, I want to restart my computer now’ and click the Finish button. Note, the domain controller must be restarted as Password Filter runs during startup.
-
Repeat the above step and install the Password Filter in the target Active Directory Domain Controller.
Setup Templates
Before we can build our workflows, it is best to set up your template(s). Templates contain common mappings and settings used to sync Users, Contacts, Devices, Groups, Office 365 Groups and Microsoft Teams. A template can then be applied to any workflow with a Stage Data step.
For the purpose of this guide, the following template will need to be configured to perform Password Synchronization for User Objects. This guide also assume users will be created in the target Active Directory if there is no match found. Additional templates may be created based on your project requirements.
How to create a Local to Local template
-
Navigate to Templates.
-
Click the New button.
-
Name and describe the template.
-
In our example, we will name our template “Local to Local Password Sync”, click Next.
-
Click Local as the source environment type, click Next.
-
Click Local as the target environment type, click Next.
-
Set CREATE NEW USERS AS = AS-IS.
-
Set UPDATE CREATED USERS= ENABLE.
-
Set UPDATE MATCHED USERS= ENABLE.
-
Set IF TARGET ADDRESS EXISTS setting as OVERWRITE ONCE.
-
Click Next.
-
Set CREATE GROUPS AS = SKIP.
-
Set UPDATE CREATED GROUPS = DISABLE.
-
Set UPDATE MATCHED GROUPS = DISABLE.
-
Click Next.
-
Set CREATE NEW CONTACTS AS = DO NOT CREATE.
-
Set UPDATE CREATED CONTACTS = DISABLE.
-
Set UPDATE MATCHED CONTACTS = DISABLE.
-
Click Next.
-
Set CREATE NEW DEVICES AS = SKIP.
-
Set UPDATE CREATED CONTACTS = DISABLE.
-
Set UPDATE MATCHED CONTACTS = DISABLE.
-
Click Next.
-
Enter a default password, Click Next.
-
Leave the SYNCHRONIZE SID HISTORY checkbox unchecked, click Next.
-
Under mappings, we can leave the settings as default or update them based on your project requirements.
-
Click Next.
-
Click Finish.
How to create a Local to Local template
Setup Templates
Before we can build our workflows, it is best to set up your template(s). Templates contain common mappings and settings used to sync Users, Contacts, Devices, Groups, Office 365 Groups and Microsoft Teams. A template can then be applied to any workflow with a Stage Data step.
For the purpose of this guide, the following template will need to be configured to perform Password Synchronization for User Objects. This guide also assume users will be created in the target Active Directory if there is no match found. Additional templates may be created based on your project requirements.
-
Navigate to Templates.
-
Click the New button.
-
Name and describe the template.
-
In our example, we will name our template “Local to Local Password Sync”, click Next.
-
Click Local as the source environment type, click Next.
-
Click Local as the target environment type, click Next.
-
Set CREATE NEW USERS AS = AS-IS.
-
Set UPDATE CREATED USERS= ENABLE.
-
Set UPDATE MATCHED USERS= ENABLE.
-
Set IF TARGET ADDRESS EXISTS setting as OVERWRITE ONCE.
-
Click Next.
-
Set CREATE GROUPS AS = SKIP.
-
Set UPDATE CREATED GROUPS = DISABLE.
-
Set UPDATE MATCHED GROUPS = DISABLE.
-
Click Next.
-
Set CREATE NEW CONTACTS AS = DO NOT CREATE.
-
Set UPDATE CREATED CONTACTS = DISABLE.
-
Set UPDATE MATCHED CONTACTS = DISABLE.
-
Click Next.
-
Set CREATE NEW DEVICES AS = SKIP.
-
Set UPDATE CREATED CONTACTS = DISABLE.
-
Set UPDATE MATCHED CONTACTS = DISABLE.
-
Click Next.
-
Enter a default password, Click Next.
-
Leave the SYNCHRONIZE SID HISTORY checkbox unchecked, click Next.
-
Under mappings, we can leave the settings as default or update them based on your project requirements.
-
Click Next.
-
Click Finish.
Setup Workflows
Follow these steps to create two (2) new workflows for reading, matching, staging and writing data.
How to create a one-way sync workflow for Local to Local
-
Navigate to Workflows.
-
Click the New button.
-
Name and describe the template, click Next.
-
Select the two (2) local Active Directory environments created previously, click Next.
-
Select ONE-WAY SYNC, click Next.
-
The screen presented next will be a pre-configured set of workflow steps to facilitate the flow of objects and attributes between your directories.
-
Start at the top of the steps, 1. Read From. Click the Select button.
-
Select the two (2) environments created previously the click OK.
-
Move to Match Objects
-
This is the step where you will decide on how to match existing objects across your local Active Directories
-
Matching is conducted by pairing sets of attributes to find corresponding objects.
-
Your two (2) environments may already have some attributes that can be used to find similar objects between the different directories, or you may need to set some to ensure accurate matching.
-
For the purpose of Password Synchronization, it is most important that existing objects are correctly matched to perform Password Synchronization.
-
Click the Select button to configure the Match Objects criteria for your source Local environment and target Local environment.
Figure 1: Example Match Objects Criteria
-
Select your source local environment from the drop-down menu.
-
Select your target local environment from the drop-down menu.
-
Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria.
-
Choose the sAMAccountName attribute for the source and target fields.
-
To add more attribute pairs, click the Add Attribute button.
-
Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.
-
In our case we are adding three (3) additional attribute pairings to our criteria
-
cn – This attribute was added to ensure we can match existing objects based on CN.
-
UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string.
-
Mail – This attribute was added to ensure we can match existing objects based on Mail.
Note: Matching attributes should be reviewed and adjusted based on actual project scope; there isn’t a set matching rule that will fit all scenarios.
-
Ensure Match Across all object types is not checked in this case.
-
There is no need in this guide to Add Another Pair, click OK to close this configuration.
-
Drag a Stage Data workflow task from the left panel to the right under the Stage Data task mentioned above. Click the Select button to configure the fourth STAGE DATA workflow task for your target local to source local synchronization rule.
-
Select the “Local to Local Password Sync” template, click Next.
-
Select the source local environment as your source, click Next.
-
Select the target local environment as your target, click Next.
-
Select the default target domain name, click Next.
-
Select the source Organizational Units that will be in scope of the project by click on the ADD OUS button.
-
In the new OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox, click OK to close the pop-up.
-
Configure any Stage Data filter you like by double-clicking on the OU in the OUs list, it is highly recommended to set up a filter to limit the scope to perform a test on the first sync as part of the validation. Click Next.
Figure 2: Example Source OU setup.
-
Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.
Figure 3: Example Target OU setup.
-
Click Finish.
-
Click the Select button to configure the WRITE TO workflow task. Ensure the target environment is selected, click OK.
-
Click Next.
-
Configure the workflow sync interval, select Manual for now and we can set up a sync schedule once the test sync has completed. Click Next.
-
Setup any workflow alert you may wish to configure, for now, click SKIP.
-
Click Finish.
