aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
LDAP User Synchronization
had
both
values for the email address attribute. Retrieving accounts which have one or the other value
therefore requires two profiles.
3.
To help manage source and destination organizational hierarchies (see next section).
With multiple Synchronization Profiles, synchronizations are completed in series, i.e. not simultaneously, and are
grouped according to their LDAP Server and Bind DN to optimize re-use of connections and authentications.
If a server cannot be contacted, further synchronizations from the same server are skipped until the next scheduled
synchronization.
More than one Synchronization Profile can be applied to a particular User Account record, although this is not
recommended, because it may cause User Account Properties on the aXsGUARD Identifier to alternate between
different values synchronized from the different profiles.
14.8
Managing Source and Destination Hierarchies
LDAP Synchronization of User Accounts does not map the LDAP hierarchical structure onto the aXsGUARD
Identifier. User Accounts from the Search Base in the LDAP Server hierarchy are synchronized to a single
destination address in the aXsGUARD Identifier hierarchy as defined in the Synchronization Profile. The
Synchronization Profile can be configured to either synchronize all User Accounts at and below the Search Base, or
only User Accounts one level below the Search Base.
User Accounts can be synchronized to different destination domains and/or organizational units in the aXsGUARD
Identifier through separate definitions of Synchronization Profiles as shown in the example below.
Example
Synchronization Profiles 1 and 2 in the image below are both configured to synchronize from the LDAP Server Search Base 'Domain
A, Organizational Unit A1', to the aXsGUARD Identifier destination address 'Domain A, Organizational Unit A1'.
With
Profile 1
, the option to synchronize all User Accounts at and below the Search Base is configured. Users 1 to 9 are
synchronized to the single destination address in the aXsGUARD Identifier hierarchy. No sub organizational units are created below
the Organizational Unit A1 at the destination.
With
Profile 2,
the option to synchronize only User Accounts at one level below the Search Base is configured. Users 1 to 3 are
synchronized to the single destination address in the aXsGUARD Identifier hierarchy. Users 4 to 9 are not synchronized and no sub
organizational units are created below the Organizational Unit A1 at the destination.
To create the sub organizational units A1a and A1b requires the following two Synchronization Profiles to be configured as shown in
the second image below:
With Profile 3,
the option to synchronize all User Accounts at and below the Search Base is configured. User Accounts 4 to 6 from
the LDAP Server Search Base 'Domain A, Organizational Unit A1, Sub organizational Unit A1a' are synchronized to the same
destination address on the aXsGUARD Identifier.
With Profile
4,
the option to synchronize all User Accounts at and below the Search Base is configured.
User Accounts 7 to 9 from
the LDAP Server, Search Base 'Domain A, Organizational Unit A1, Sub organizational Unit A1b' are synchronized to the same
destination address on the aXsGUARD Identifier.
©
2009 VASCO Data Security
86
