Deployment Guide for Directory Connector

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Deployment Guide for Directory Connector

Chapter Title

Manage Synchronized User Accounts in Control Hub

Results

Updated:
August 10, 2017

Chapter: Manage Synchronized User Accounts in Control Hub

Manage Synchronized User Accounts in Control Hub

Run an Incremental Synchronization

An incremental synchronization queries your Active Directory and looks for changes that occurred since the last synchronization. This step then bundles those changes and sends them to the connector service. The changes include users attribution modification and when a user is added or deleted.

This synchronization doesn't put as much load on servers and doesn't take as much time as a full synchronization. After you do your initial full synchronization, we recommend the incremental option for subsequent synchronizations.

Before you begin

  • You must set up an auto-assign license template before you use it on new Webex App users that you synchronized from Active Directory.

  • Note these exceptions that incremental synchronization doesn't support (follow Do a Full Synchronization of Active Directory Users Into the Cloud instead):

    • In the case of an updated avatar but no other attribute change, incremental sync won't update the user's avatar to the cloud.

    • For new configuration changes on attribute mapping, base DN, filter, and the avatar setting, incremental sync won't work and these require a full synchronization.

Procedure

Step 1

From Directory Connector, click Dashboard.

Note

 

When you enable synchronization, Directory Connector asks you to perform a dry run first.

Step 2

From Actions, click Synchronization Mode > Enable Synchronization if not already enabled.

By default, an incremental synchronization is set to occur every 30 minutes (on versions 3.4 and earlier) or every 4 hours (on versions 3.5 and later), but you can change this value. The incremental synchronization does not occur until you initially perform a full synchronization. When a new incremental time interval is up, the program checks the changes based on the last timestamp.

Step 3

From Actions, click Sync Now > Incremental.

For any changes that you make to users in Active Directory (for example, display name), Control Hub reflects the change immediately when you refresh the user view, but the Webex App reflects the changes 72 hours from when you perform the synchronization.

Tip

 

You can try to clear the local cache for the Webex App by following these directions: Windows or Mac.

  • During the synchronization, the dashboard shows the synchronization progress; this may include the type of synchronization, the time it started, and what phase in which the synchronization is currently running.

  • After synchronization, the Last Synchronization and Cloud Statistics sections are updated with the new information.

  • If errors occur during the synchronization, the status indicator ball turns red.

Step 4

For information about errors, click Launch Event Viewer from the Actions toolbar to view the error logs.

What to do next

If you have multiple domains, do this step on other Directory Connector instances you've installed.

Recover Accidentally Deleted Users

Directory Connector has checks and balances to prevent unintentional deletion of users. Unfortunately, accidents happen; you may have incorrectly configured an LDAP filter in Active Directory, which deleted some users when synchronized to the cloud. The soft delete feature can help you recover from these accidents and reestablish the user accounts in Control Hub.

By default, this function is enabled for all organizations. When users are deleted in the cloud, for example, because of a mismatched object issue after a synchronization from Directory Connector, the users can be recovered. If you saw a mismatched objects notice or noticed that users got deleted, you may be able to recover them if you act fast.


Note

Users are marked as Inactive in Control Hub when the corresponding accounts are deleted in Active Directory. The background cloud service retains the users for up to 7 days. During this period, you can still use Cisco Directory Connector to recover users. We recommend that you recover these users as soon as possible.

Users that are disabled in Active Directory are also marked as Inactive in Control Hub, but the user account is not deleted after 7 days.

Procedure

Step 1

From the customer view in https://admin.webex.com, go to Users, and confirm whether a specific user account is in an Inactive state or is unlisted.

For more information, see User Statuses and Actions in Control Hub.

Step 2

If users were deleted in Control Hub or you notice users in an Inactive state, go to Active Directory, add the missing user accounts, and then do a dry run synchronization in Directory Connector.

The goal with Directory Connector is to create an exact match between user information in Active Directory and in the cloud.

Step 3

Do a full synchronization to resynchronize the temporarily deleted user accounts to Control Hub.

The users are recovered and go to the original status, including their account status and service assignments.

What to do next

Return to Control Hub, go to Management > Users, and confirm that the previously deleted user accounts are appearing in the user list.

Delete Users Permanently After Soft Delete

After performing a dry run, you can choose to permanently delete users that were soft deleted on the next synchronization.

Procedure

Step 1

After a dry run is complete, select Soft-deleted Objects.

Step 2

Check the checkbox next to the users that you want to delete.

Step 3

Select Done.

What to do next

On the next synchronization, the users that you checked will be permanently deleted.

Change a Webex App Email Address

If you want to change user email addresses and your organization uses the Directory Connector, you change those email addresses in Active Directory. This procedure covers how to change a Webex App email address for a single domain and a process for changing the domain.


Caution

If you only want to change email or some value for one user, don't delete the user from Active Directory and then recreate a new one with same email. This cloud interprets this action as a totally new user account and the user's spaces and other data in the cloud will be lost.

Procedure

  • To change user email addresses without changing the domain:

    1. Open the user account (example, user1@example.com) in Active Directory and change the email address (example, user2@example.com).

    2. Resume synchronization on the Directory Connector.

      After the next synchronization, the changes appear in your user list in Control Hub and for users in the Webex App after the cache refreshes.


      Note

      There is no loss of data or spaces using this method. The user's unique identifier is set in the cloud after the first synchronization. All subsequent synchronizations are based on this identifier.

  • In a multiple domain deployment with Directory Connector, to change user email addresses while changing the domain (consider example1.com the old domain and example2.com the new domain):

    1. For the old user account (user1@example1.com), note the Active Directory attribute that maps to the uid cloud attribute. You need to use this same Active Directory value for the new account. For this example, we'll use user1@example1.com as the on-premises attribute to map to uid in the cloud.

    2. Pause synchronization on the Directory Connector for example1.com and example2.com domains.

    3. Create a new user account in example2.com and use the same attribute from above. (For example, user1@example1.com).

    4. On the Directory Connector, resume synchronization for example2.com

      Before proceeding, verify that the user1@example2.com account synchronizes into Control Hub. We recommend that you instruct the user to verify the email change in Webex App and that all data (spaces, messages, meetings, files, and so on) are retained.


      Caution

      There is no loss of data or spaces using this method, but in the new user account, you must ensure that the Active Directory attribute that maps to the cloud uid attribute is preserved from the old user account. If you change the Active Directory value, the new account does not retain the data from the old account.

    5. After you verify the email address change and the data are intact, delete the old user account on example1.com, and then use Directory Connector to resume synchronization for example1.com.


      Note
      At this point, you can safely update the email address in the new Active Directory domain for user1@example2.com.

Directory Connector doesn't limit the email domain change. However, when the user resynchronizes to the cloud, the user state depends on if the new domain is verified in your organization. If the domain is not verified in your organization, the user's status changes to Pending after the full synchronization. For more information, see Manage Your Domains.

If your organization does not use the Directory Connector, you can change your Webex App email addresses through the account settings page. See Change the Email Address for Your Account for steps that users can follow to change their emails.

Change the Active Directory Domain

You can use this procedure to create new domains and email addresses. They synchronize with the identity service in the cloud.

Procedure

Step 1

Set up a new Active Directory (AD) domain.

Step 2

Disable synchronizations on all your connectors.

Step 3

Uninstall all your connectors.

Step 4

Open a case to change the domain.

In the case submission, make sure to request the removal of the domain configuration and all synchronization attributes in your organization.

Note

 

Before you open a case to change the domain, make sure that you don't have a synchronization running. Don't change any user email addresses in Active Directory until the case resolves.

Step 5

After the case is resolved:

  1. Install the Directory Connector on the same server as the one with the new Active Directory domain.

  2. Configure the Directory Connector so that its point to the new Active Directory domain.

    If there are existing users in Control Hub (https://admin.webex.com), ensure that users with matching email addresses are also present in Active Directory. If your organization has disabled the softDelete toggle in DirSync, user email addresses that are in Control Hub but not in Active Directory risk deletion.

Perform a test run with the Directory Connector before doing the actual synchronization.

Domain Claim

A domain claim occurs if you claim an email domain for an organization so that any sideboarded account is created in the paid customer organization and not the free consumer organization. You can only do a domain claim through a support case (see the link below for more information).

If the Directory Connector is active and the domain is claimed, sideboarded accounts are not created either in the customer organization or in the free consumer organization. Only the Directory Connector may provision accounts for the organization from Active Directory. The information stored on Active Directory is the original source. If you attempt to sideboard an account, the invited user receives an error. The only way that an invited user can be added to a Webex App space is by first using the Directory Connector to provision the account into Control Hub.

Convert Free Webex App Users in a Directory Synchronized Organization

You can only use unique email addresses in the Webex App directory. If your users have signed up for the free version of Webex App, their account exists in the free consumer organization. To manage users in this organization using Directory Connector, migrate (convert) them to the customer organization before you turn on the Directory Connector. Then you add the users to Active Directory with the exact email address and then synchronize to the cloud.

If you do not convert the accounts before activation, turn off the Directory Connector in order to convert them.

If you attempt to convert a user while directory synchronization is enabled, the error message "<email address> could not be converted" appears. To avoid the problem, you can use these steps as a workaround.


Caution

Some claimed users may show up with the movedfrom attribute when doing a dry run. These users will be in the Deleted Object list instead of MismatchedObject. You'll need to add those users to your AD list if you want to move them to your organization.

If you don't add those users, they'll all be deleted the next to you synchronize to the cloud.

Procedure

Step 1

Disable the directory synchronization from the Directory Connector.

Step 2

Follow the Convert Unlicensed Users in Control Hub procedure to convert the user from the free consumer organization to the enterprise organization.

This step adds the user to your organization and the account appears in Control Hub. Directory Connector makes Active Directory the single source of truth for user accounts and the goal is to have an exact match between Active Directory and Control Hub. Ensure that there are matching users in Active Directory for any recently-converted users before reenabling synchronization. A Dry Run sync can be used to ensure that there are no remaining unmatched users.

Step 3

On the Directory Connector, do a dry run synchronization. When the dry run completes, check the Add Objects tab. Verify that any users that you converted are not deleted.

Caution

 

You must do a dry run before reenabling synchronization to make sure that any converted user accounts appear in Active Directory. If you turn on synchronization and accounts only reside in Control Hub, Directory Connector is case-sensitive and deletes converted users that it detects with mismatching email addresses (for example, user1@example.com and User1@example.com).

If any converted users are deleted, they lose all their Webex App spaces.

Step 4

When you are sure that the next synchronization will not remove any accounts, reenable directory synchronization from the Directory Connector.

Converted user accounts are not activated automatically if you didn't verify a domain. For example, if you turned on the auto-assign license template and then turned on Directory Connector without domain verification, converted users are inactive in the cloud backend until they confirm their email addresses.

Sideboarded Webex App User Accounts

When you invite another user to a space in Webex App, if the invited user does not have a Webex App account, an account is created for them ("sideboarded"). By default, accounts that are created this way are added to the free consumer organization.

If you want to manage the sideboarded account using the Directory Connector, you must convert the account.

Change Webex App Username Format After Directory Synchronization

By default, Directory Connector maps the displayName attribute in Active Directory to the displayName attribute in the cloud.

After performing a directory synchronization, you may find that usernames display in the format <lastName, firstName>.

This username may appear if the displayName attribute in Active Directory is configured that way. When the attribute is mapped to displayName in the cloud, names show up in the format <lastName, firstName> in Control Hub.

To change the format, in the Directory Connector attribute mapping screen: map the Active Directory attribute givenName sn (or sn givenName) to displayName in Cisco Cloud Attribute Names.

Alternatively, map the attribute sn givenName to displayName:

You can also use the Customize Attribute option, if you want to map your own custom attribute expression to displayName.

For example, enter givenName + "" + sn (first name, space, last name) as the expression. This maps the two attributes in Active Directory to displayName in the cloud.

Allow Users to Change Display Names in Webex Meetings

You can unmap the displayName attribute from syncing to the cloud in Directory Connector if you want to allow users to edit their preferred display names. Users can enter a display name to show during Webex meetings instead of their first and last name. Administrators can also change the display name for a user manually in Control Hub.

Procedure

Step 1

From Directory Connector, click Configuration, and then choose User Attribute Mapping.

Step 2

Select displayName under Cisco Cloud Attribute Name.

Step 3

Select Do not synchronize this attribute.

What to do next

Users can now edit their display names from their Webex site.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco