Deployment Guide for Directory Connector

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Deployment Guide for Directory Connector

Chapter Title

Manage Directory Connector

Results

Updated:
January 27, 2023

Chapter: Manage Directory Connector

Manage Directory Connector

Upgrade to the Latest Software Release

To keep your deployment in compliance and get the latest features, functionality, bug fixes, and security enhancements, you must always upgrade to the latest version of Directory Connector. If you do not upgrade to the latest version that's available, you may experience issues, such as Directory Connector no longer synchronizing properly or being on a version that doesn't support the mandatory TLS 1.2 requirement.

Directory Connector automatically notifies you when a new version is available. Always upgrade to the latest version to avoid problems. You also see a notification in the Windows task bar.


Tip

Although you can manually install connector software updates updates, we recommend that you follow the steps in Set Automatic Upgrades to let the app manage your upgrades automatically.

Before you begin

  • We recommend performing an upgrade at your earliest convenience during a maintenance window.

  • Prepare one hour for the upgrade and note that provisioning and deprovisioning will not work during this time.

Procedure

Step 1

Either click on the notification in the Windows taskbar, or right-click on the Directory Connector icon in the Windows taskbar to start the upgrade process.

Step 2

Follow the instructions to complete the upgrade.

Step 3

Relaunch the connector and sign in with your admin credentials.
Step 4

Verify the version number of the software under Help > About.

What to do next

For a fresh installation of Directory Connector, you can download the zip file and then follow the installation steps in this guide.

Configure General Settings for Directory Connector

Use this procedure to configure general settings as needed, such as the name of the server running Directory Connector, the log levels, automatic upgrades, and the preferred settings for the domain controllers. The name of the connector appears on the dashboard in the connectors section, along with any other connectors that are running.

Procedure

Step 1

From Directory Connector, go to Configuration, and then click General.

Step 2

In the Connector Name field, enter the connector name. This field shows only the computer name that is currently running the connector.

Step 3

Choose the log level from the drop-down. By default, the log level is set to info. The available log levels are:

  • Info (Default)—Shows informational messages that highlight the progress of the application at a high level. Use this setting if you want to receive reports after all full syncs.

  • Warn—Shows potentially harmful situations.

  • Debug—Shows detailed informational events that are most useful to debug an application. When you see any issue, set this log level and send the event log to support when you open a case.

  • Error—Shows error events that might still allow the application to continue running. When you choose this option, sync reports are only sent when errors are reported.

Caution 

These settings affect the sync report that gets emailed out. If you set the log level to Error, then only errors are reported in the sync report; if no errors exist, the sync report is not sent out. Change the setting to Info, then you receive sync reports after full sync. (Keep in mind that for incremental sync, no reports are sent out when no errors are reported.)

Step 4

Choose the Preferred Domain Controllers to set the order of domain controllers for synchronizing identities.

The domain controllers are accessed from top to bottom. If the top controller is unavailable, choose the second controller on the list. If no controller is listed, you can access the primary controller.

Step 5

Check Automatically upgrade to the new Cisco Directory Connector version if you want automatic upgrades to occur.

It's always important to keep your Cisco Directory Connector software up to date to the latest version. We recommend that you check this setting to allow automatic upgrades to the software to be installed silently when they're available.

Step 6

Check LDAP over SSL to use the secure LDAP (LDAPS) as the connection protocol.

Note 

If you don't check LDAP over SSL, Directory Connector continues to use the LDAP connection protocol.

LDAP (Lightweight Directory Application Protocol) and Secure LDAP (LDAPS) are the connection protocols used between an application and the Domain Controller within the infrastructure. LDAPS communication is encrypted and secure.

Configure the Connector Policy

You can set the maximum number of deletes that can occur during synchronization. Running synchronization does not delete objects from your on-premises Active Directory. All objects are deleted only from the cloud.

For example, you set 1 as the delete threshold trigger value. When you do full or incremental sync, if the number of users you want to delete is more than the setting, the directory connector shows a warning. If you click Override Threshold, you can start full or incremental sync successfully, but you will see this override notice the next time you run the policy.

Procedure

Step 1

From Directory Connector, click Configuration, and then choose Policy.

Step 2

Check the Enable delete threshold trigger box if you want to add a threshold trigger.

Choosing this option triggers an alert if the number of deletes exceeds the threshold. When the deletion account exceeds the one that you define, the synchronization fails.
Step 3

Enter the maximum number of deletes that you want. The default is 20.

Note 

We recommend that you do not increase the default value.
Step 4

Click Apply.

Set the Connector Schedule

You can set the times that you want to synchronize your Active Directory. Failover is used for high availability (HA). If one connector is down, we switch to another standby connector after the predefined interval.

Procedure

Step 1

From Directory Connector, click Configuration, and then choose Schedule.

Step 2

Specify the Incremental Synchronization Interval in minutes.

By default, an incremental synchronization is set to occur every 30 minutes. The full incremental synchronization does not occur until you initially perform a full synchronization.

Step 3

Change the Send Reports per… time value if you want the change how often reports are sent.

Step 4

Check Enable Full Sync Schedule to specify the days and times on which you want a full synchronization to occur.

Step 5

Specify the Failover Interval in minutes.

Step 6

Click Apply.

Multiple Domain Scenarios

The way multiple domain works is based on domain priority. For objects that have the same key value in different domains, after synchronization, the data from the higher priority domain rewrites the data from lower priority domain.

Objects that have same key value are linked into one record in the database.

The key value for "User" is Email address; the key value for "Group" is Group name.

Example Use Case for Multiple Domains

This example assumes an organization with two domains—example1.com and example2.com, in order of priority.

  • Add user1(email: user@example1.com) to the Active Directory of example1.com.

  • Add group1(Group name: Test) to the Active Directory of example1.com.

  • Add user2(email: user@example2.com) to the Active Directory of example2.com.

  • Add group2(Group name: Test) to the Active Directory of example2.com.

Synchronization on example1.com

As a use case, user2 and group2 are synchronized to the cloud and appear in https://admin.webex.com, whereas user1 and group1 are not.

If you do a full or incremental synchronization for example1.com, user1 and group1 are synchronized. Also, user2 and group2 are overwritten by user1 and group1's information.

User1 links to user2 as the same record in the database; group1 links group2 as the same record in the database.

Synchronization on example1.com and example2.com

As a use case, user2 and group2 are synchronized to the cloud and appear in https://admin.webex.com, whereas user1 and group1 are not.

Consider these steps:

  1. Delete user1 and group1 on the Active Directory for example1.com.
  2. Do a full or incremental synchronization for example1.com.

    Result: the user's information is not changed in https://admin.webex.com. User2 isn't linked to user1, and group2 isn't linked to group1.

  3. Do an incremental synchronization for example2.com.

    Result: the user's information is not changed in https://admin.webex.com.

  4. Do a full synchronization for example2.com.

    Result: user2 and group2’s information is listed in https://admin.webex.com.

Synchronize a New Domain And Preserve an Existing Domain

If you want to synchronize a new domain (B) while maintaining the synchronized user data on another existing domain (A), ensure that you install Directory Connector for domain (B) synchronization on a supported Windows server. The connector binds to the new domain after the initial setup, and the user information under domain (A) remains unaffected.

Every domain must have its own active connector. Consider two domains with the following setup: domain A with connectors (ca1) and (ca2) for local high availability (HA); domain B with connector (cb1). (ca1)and (ca2) serve domain A. In this scenario, one connector is active and the other is standby (HA). This design keeps the domain synchronized, because one connector is always active. So, cb1 is the active connector for domain B, because domain A already has an active connector (ca1 or ca2).

Set the Domain Priority

Use this procedure to change the priority of your Active Directory domains. Domain priority lets you determine the primary domain, secondary domain, and so on. This helps when two users from two different domains have the same email value synchronized to one organization.

Do not use this procedure if you have a single domain listed in the Directory Connector. If you try, the connector shows you a message, stating that domain priority is not required.

Before you begin

To avoid errors, install or upgrade to the latest version of Cisco directory connector. You must download it from https://admin.webex.com.

Procedure

Step 1

From Cisco directory connector, click Dashboard.

Step 2

Go to Actions, and then click Set Domain Priority.

Step 3

Highlight one domain in the list, click Up or Down to change this domain's priority, and then click Save to save this change.

Note 

The domains are sorted by priority from top to bottom.

Switch Domains

Use this procedure to rebind the Cisco directory connector to a different domain.

Before you begin

  • Make sure no synchronization tasks are running before you switch domains.

  • To avoid errors, install or upgrade to the latest version of Cisco directory connector. You must download it from https://admin.webex.com.

Procedure

Step 1

From Cisco directory connector, click Dashboard.

Step 2

Go to Actions, and then click Switch Domain.

Step 3

After reading the caution, if you understand the affect this change has on your deployment and you're still sure, click Yes.

If you switch a domain, then you are signed out of the current Cisco directory connector, other domains in the connector are unregistered, and the connector information on that computer is deleted.

Step 4

Sign back in to the Cisco directory connector and rebind the domain.

Turn Off Directory Synchronization

If you need to stop synchronization from Directory Connector, you can temporarily turn it off from Control Hub.

Procedure

Step 1

From the customer view in https://admin.webex.com, go to Management > Organization Settings, scroll to Directory Synchronization, and then choose one:

  • Click more and then click Turn Off next to the connector instance that you want to turn off.
  • Click Turn Off All Directory Synchronizations to stop synchronization from all connector instances.
Step 2

After you read the prompt, click Turn Off.

Synchronization stops until you reenable it from Directory Connector.

Remove User Attribute Mapping

Use Directory Connector to remove the mapping for Active Directory attributes previously mapped to the cloud and synchronized to Webex. After you remove the attribute mapping, the attribute values are removed from the cloud and no longer synchronized to Webex. Those values can then be edited manually.

Procedure

Step 1

From Directory Connector, click Dashboard.

Step 2

Go to Actions, and then click Utilities > Remove User Attribute Mapping.

Step 3

Select the mapping to remove from the Attribute Name list.

Step 4

Under Affected User Scope, select one of the following:

  • Only Directory Connector-synced users: the mapping will be removed only from users that Directory Connector previously synchronized.
  • All users: the mapping will be removed from all Active Directory users.
Step 5

Click Apply.

Manage Profile Pictures

Use Directory Connector to update user profile pictures or to remove blank user profile pictures.

Procedure

Step 1

From Directory Connector, click Dashboard.

Step 2

Go to Actions, and then click Utilities > Manage Profile Pictures.

Step 3

Under Actions, select one of the following:

  • Remove profile pictures for empty avatar sources: if the Active Directory profile picture is blank, this option ensures that the user profile pictures are removed from the cloud, even if the user has previously uploaded their own picture in Webex.
  • Re-upload from the synced source to override cached pictures: Directory Connector uses the same Active Directory as previous to update the profile pictures for all users. This ensures there is no mismatch between the profile pictures in Active Directory and the cloud.
Step 4

Click Apply.

Uninstall and Deactivate Directory Connector

After you uninstall an instance of Directory Connector, you must deregister it. Completely remove a Directory Connector for any of these scenarios:

  • You don't want to use directory synchronization any more.

  • You don't want to use one of multiple directory connectors (high availability).

  • You want to change the domain and install another connector.

Before you begin

  • You may have multiple instances of Directory Connector set up for high availability (HA) or multiple domain synchronization. Disable the synchronization if you are uninstalling the only or last remaining instance of Directory Connector.

  • Save and close any important work before you uninstall Directory Connector.

Procedure

Step 1

From your Windows machine, go to Control Panel, and then click Programs and Features.

Step 2

From the program list, click Directory Connector, choose Uninstall, and then follow the prompts.

You might have to reboot your system to complete the uninstallation.
Step 3

From the customer view in https://admin.webex.com, go to Management > Organization Settings, scroll to Directory Synchronization, click more and then click Deactivate next to the directory connector instance that you want to uninstall.

Step 4

After you read the prompt, click Deactivate.

Unless there's another Directory Connector in a high availability (HA) deployment, user accounts are not synchronized any more.

Run the Diagnostic Tool

You can use the built in diagnostic tool to troubleshoot your Directory Connector deployment. This tool is installed as part of Directory Connector 3.4 onwards.

If synchronization didn't work properly, you may have a configuration or network error. This tool tests your connection to LDAP so that you can diagnose errors yourself before contacting support. If the tool returns any error, you can send the detailed log results to support.

Procedure

  • To run tests for Active Directory Domain services:

    1. Go to the start menu, locate Cisco Directory Connector, click Cisco Directory - Diagnostic. Click the AD-DS tab, enter your Domain then click Load Domain Controllers.

    2. Choose one Domain Controller from the list.

      Don't change the entry later, because incremental search must always run on the same Domain Controller.

    3. By default, all paths are searched, but you can choose one Attribute and then click Test to check that value.

    4. Configure more filters in the Active Directory Queries section, such as either or both Users and Group objects and search filters.

    5. Check Auto Fill Cookie to automatically generate a cookie for a search.

    6. Click Query to start a new incremental or complete search. This search may take a few seconds.

    7. When the test is complete, click Save to save a log entry, which you can send to the support team for analysis when you open a ticket.

  • To run tests for Active Directory Lightweight Directory services:

    1. Go to the start menu, locate Cisco Directory Connector, click Cisco Directory - Diagnostic. Click the AD-LDS tab, enter your Host and Port, and then click Load Partitions.

    2. Choose a Partition from the list and then click Connect.

    3. By default, all paths are searched, but you can choose one Attribute and then click Test to check that value.

    4. Configure more filters in the Active Directory Queries section, such User, UserProxy, and UserProxyFull and search filters.

    5. Check Auto Fill Cookie to automatically generate a cookie for a search.

    6. Click Query to start a new incremental or complete search. This search may take a few seconds.

    7. When the test is complete, click Save to save a log entry, which you can send to the support team for analysis when you open a ticket.

  • To run tests for the Lightweight Directory Access Protocol (LDAP):

    1. Go to the start menu, locate Cisco Directory Connector, click Cisco Directory - Diagnostic. Click the LDAP RAW tab, enter your Root Path, Filter, and choose an entry from Attributes then click Load Partitions.

    2. Check the following options as needed:

      • ObjectSecurity—If this option is present, the caller requires no rights and can see only objects and attributes that are accessible to the caller. If this option is not present, the caller has the right to replicate changes.

      • ParentsFirst—Ensures that all parents of the children come before their children.

    3. Choose a value for ExtendedDN.

      This value is used with an extended LDAP search to request an extended form of object Distinguished Name.

    4. Choose a value for ReferralChasing.

      A referral chase is initiated when a domain controller returns a referral from a query—for example, for details of a query result that may be outside the namespace (such as group members in another domain or forest).

    5. Click Query to start a new incremental or complete search. This search may take a few seconds.

    6. When the test is complete, click Save to save a log entry, which you can send to the support team for analysis when you open a ticket.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco