Configuring Trusted Agent for LDAP Connections

role administrators minimum version 2023 1 configure and synchronize employee profiles from your ldap active directory server to add a new ldap connection and push policy settings this procedure must be completed prior to installing trusted agent as described in install trusted agent docid\ a0haynshu5n26tgcudpss also note that in the current version of , you can add only one trusted agent connection in the configuration console, select extend > integration tools > trusted agent connections the trusted agent connections form is displayed use this form to configure a new connection or edit an existing one click new trusted agent connection to open the trusted agent connections form enter the connection settings in the configuration section of the trusted agent for connections form field description setting name a unique name for this ldap server connection policy type select ldap server the ldap domain controller host ip address base dn optional the distinguished name for the ldap object in the ldap server this value is not case sensitive user name if the server requires authentication, enter the ldap domain server name password if the server requires authentication, enter the ldap domain server password encryption method select an encryption method no encryption use ssl encryption (ldaps\ //) use starttls extension authentication type select an authentication type for no encryption method, select ntlm for ssl or tls method, select simple (basic) authentication api key optional the signalr api key required to enable external authentication the signalr api key is required if you want to enable users to login externally, if you do not want to enable external authentication this key is not required for information on signalr, see https //learn microsoft com/en us/aspnet/signalr/overview/getting started/introduction to signalr https //learn microsoft com/en us/aspnet/signalr/overview/getting started/introduction to signalr to generate the api key, see step 4 below paste the generated api key into this field when the key is provided, and the ldap settings are pushed successfully, the enable authentication switch is displayed this switch can be toggled on after the trusted agent is installed if you toggle the switch on before the trusted agent is installed a warning is displayed see enable external authentication docid\ wfpurw9ip9cetalczxuql optional generate a signalr api key to enable external authentication this step is only required if you want to enable external authentication for information on signalr, see https //learn microsoft com/en us/aspnet/signalr/overview/getting started/introduction to signalr https //learn microsoft com/en us/aspnet/signalr/overview/getting started/introduction to signalr a in the configuration console, select security controls > api keys b in the api keys workspace, select add key group c in the name field, enter signalr, and then enter a brief description in the description field d click save key group e select the signalr group in the key groups list f in the api keys pane, select add api key g select the activated checkbox if not already selected h enter a description, on behalf of, and role information if required i click save key j copy the generated api key identifier to the clipboard k return to the trusted agent for ldap connections form, and then paste the key into the api key field click push policy settings while the ldap settings for the trusted agent are being processed, the status is displayed as pending the push policy settings button changes to update policy settings , and is disabled while the settings are being processed the ldap settings push can take up to 20 minutes to complete click refresh to check if the push has completed when completed successfully, the status is displayed as success a pop up message is also displayed occasionally the status may revert to pending if this happens, push the ldap settings again by clicking update policy settings , and then click refresh the status changes to success if the push fails, a failed pop up message is displayed if a failed push occurs, check your settings are correct, and then push the settings again if the push still fails, refresh the page in the browser, and push the settings again when processing is complete, an enrollment key, comprising of the tenant id and activation key, is displayed in the enrollment key field under the download url for installer (windows) section, click download to download the installer files copy the ivanticloudagent exe and ivanticloudagent exe options files to the server on the private network where trusted agent is to be installed when completed successfully, proceed to installing the trusted agent before continuing with the remaining procedures in this topic, refer to install trusted agent docid\ a0haynshu5n26tgcudpss connect trusted agent to the directory server and test the connection prior to testing the connection, ensure that the agent status is displayed as "success" on the trusted agent connection page, and that trusted agent is installed successfully on the machine in the private network in the configuration console, select extend > integration tools > ldap settings the ldap settings list is displayed click add new the connect to directory form is opens select use trusted agent provided the trusted agent is running, selecting this checkbox automatically populates the settings fields with the trusted agent connection settings for security reasons, the password field displays "not set" the password is not shown click test connection a message is displayed to inform you if the connection is successful or has failed if an error is displayed, return to the connection settings to determine the error, edit and test again if successful, click next when you click next the select directory info to sync form is displayed use this form to select and add the root nodes to synchronize see configure root nodes, save and synchronize directory information and enable external authentication docid\ wfpurw9ip9cetalczxuql below if the connection test failed, you can find error information on the failed connection in trusted agent monitoring for more information, see trusted agent monitoring and logging docid\ yge08xvtschfzydigjb73 configure root nodes, save and synchronize directory information and enable external authentication when you have a successful connection, you need to select the directory root nodes (employees) to connect, save the ldap settings, and then synchronize the settings to import their data connecting the root nodes click root dse to expand the list select the nodes you want to connect and synchronize scroll down to the end of the page, click add selected node as root , and then click select sample entry check at the top of the page if the selected nodes are displayed under root ldap node(s) and sample ldap entry to extract fields from click next to move to the field mapping form for this version, changes to field mapping are optional, you can skip the field mapping process if not required and move directly to completing the synchronization if changes to the field mapping are required, see mapping fields docid\ cu xe1esqwc mz5p2w2ce click next , then click next again to display the completed form this form displays the save and synchronize now functions save and synchronize the ldap settings save the ldap settings before synchronizing them click save to save the ldap settings click ok in the ldap wizard message dialog click synchronize now the ldap sync dialog appears click ok once you have established the ldap connection, and the connection is validated, you can use a workflow to schedule synchronization of the ldap connection, and to notify users if the synchronization is started or has failed see example using a workflow to schedule ldap synchronization docid\ lcg6q ahrwefwhyfeosyf you can also synchronize existing ldap connections from the ldap settings list by selecting sync now in the action column enable external authentication if you configured an api key for the ldap connection, toggle on the enable auth switch in the trusted agent connections form to enable external authentication for imported employees open the trusted agent connections form toggle the enable auth switch on a success message is displayed when external authentication is enabled for the connection you can return to the trusted agent ldap connections form at any time to disable or re enable external authentication if the enable external authentication generates an error, check the following trusted agent is installed, see install trusted agent docid\ a0haynshu5n26tgcudpss you have generated a signalr api key you have entered the correct api key (signalr api key) in the trusted agent connections form check the ldap import log, verify employee import and external authentication check the ldap import log select extend > integration tools > ldap import log click refresh to update the list and check that your ldap import is logged this may take a few minutes to update if the ldap import is queued click refresh again to refresh the list view the trusted agent monitoring logs if you want to verify the status of all the operations performed while setting up the trusted agent see trusted agent monitoring and logging docid\ yge08xvtschfzydigjb73 verify employee import you can verify all selected employees have been imported by the trusted agent connection to the employee workspace from the administrator dashboard, open the employee workspace check the list of employees and verify that the employees you imported are present in the list use the employee workspace search function to quickly locate each entry verify external authentication if you have configured external authentication to enable external login for employees, check employee records to verify that their external login is enabled from the administrator dashboard, open the employee workspace select an employee that you imported and open the employee record check the following the enable external auth checkbox is checked the employee user name and the trusted agent instance appears in the login for external auth entry repeat step 2 and 3 above to verify additional records as required synchronizing existing ldap settings for trusted agent this feature enables you to verify and synchronize an existing trusted agent ldap connection from the ldap settings list if you have made alterations to an existing trusted agent ldap configuration, you can use the verify config option on the ldap settings page to validate the alterations made to the ldap configuration when running verify config from the ldap settings page, this prompts you to select the appropriate root node or directory within the configuration this step is vital as it ensures that any changes made to the trusted agent ldap configuration are saved, and accurately validated by choosing the correct root node, you guarantee that your ldap configuration remains consistent and functional this process also safeguards the integrity of workflows within the system ensuring that ldap configuration changes are correctly validated helps prevent any disruptions or breakages in workflows that rely on ldap data the sync now function for the trusted agent ldap connection listed in the ldap settings page is disabled if the connection configuration settings are not verified to verify and synchronize existing trusted agent ldap settings in the configuration console, select extend > integration tools > ldap settings the ldap settings list is displayed select verify config for the ldap connection the ldap settings configuration opens follow the configuration pages displayed, selecting next to move through the process, ensuring the correct root nodes or directories are selected save the ldap configuration you can synchronize the ldap connection in the settings page, or use the sync now function displayed in the ldap settings list