How to Provision SHIELD ID Users/Groups Inbound
Inbound provisioning (synchronization) is conducted in the Security365 management center.
Overview of Synchronization Methods
SHIELD ID can synchronize user/group information from the following three sources:
- MS Azure- Users/Groups in the Microsoft 365 environment
- SCI server- User/Group Information of SCI Server
- Local Active Directory- On-premises AD/LDAP server
Each synchronization method follows the common steps as follows:
- Log in as an administrator to the Security365 Management Center
- [Settings] → Move to the [Inbound Provisioning] tab
- Select and configure the synchronization settings
- Synchronization Execution and Result Verification
Microsoft Sync
How to set up Microsoft
- Microsoft365 Sync SettingsSelect.
- Select a synchronization method:
- Full Group Synchronization: Synchronize all groups and users
- Partial Group Synchronization: Synchronize only specific groups and subgroups
- Save the settings and run synchronization.
Synchronization Options
Full Group Synchronization
- Synchronize all groups in Microsoft 365 and the users belonging to those groups.
- (✔️ Optional) Check the user affiliation group path on the log page after the personnel linkage.
Partial Group Synchronization
- Synchronize only a specific group, all groups belonging to it, and the users belonging to those groups.
- You can limit the synchronization scope by selecting only the necessary groups.
SCI Server Synchronization
How to Configure SCI Server
- SCI Server Account Synchronization SettingsSelect.
- Enter the following information:
- SCI server IP, Port: Service address for retrieving user/group information
- domain: Domain information to append after the SCI server ID
- Save the settings and run synchronization.
Main Configuration Items
| item | Explanation | Note |
|---|---|---|
| SCI server IP, Port | User/Group Information Service Address | It is the service address, not the SCI server IP. |
| domain | Domain to be added to the SCI server ID | SHIELD ID only supports email format IDs. |
Reference: The SCI server ID is generally not in the form of an email, so domain information must be added to convert it into an email format.
For example: domainsoftcamp.co.krset togdhongID isgdhong@softcamp.co.krwill be saved.
Local Active Directory Synchronization
How to Set Up Local Active Directory
- Local Active Directory Synchronization ConfigurationSelect.
- Configure the settings required for integration.
- Save the settings and run synchronization.
Settings Item
※ All items areEssentialThis is an input item.
Server Configuration
| item | Explanation | Note |
|---|---|---|
| Server Type | Types of Directory Servers | Active Directory (default): Microsoft AD server LDAP: OpenLDAP, ApacheDS, and other general-purpose servers |
| Server URL | Server Address | Communication via LDAP or LDAPS protocol |
| Base DN | Directory search starting point | DC: Domain Component (Domain Component) DN: Distinguished Name (Distinguished Name) |
Administrator Authentication
| item | Explanation | Note |
|---|---|---|
| Admin ID | Account to access the AD server | Example: cn=Administrator,dc=SOFTCAMP,dc=co,dc=us |
| Admin Password | Password for the above account | Encrypted Storage |
Search Options Configuration
| item | Explanation | Note |
|---|---|---|
| Search Scope | Setting the scope of the account/group to search | ONELEVEL (default): Search only one level below the specified DN SUBTREE: Search the entire subtree |
| Page Size | LDAP Paging Unit | Recommended: 500~1000 |
| Referral | Whether to allow external domain connections | FOLLOW (default): follows external domains IGNORE: ignores |
| Connection Timeout | Maximum time to attempt server connection (ms) | Example: 3000 |
| Read Timeout | Response Wait Time (ms) | Example: 3000 |
User Search Configuration
| item | Explanation | Note |
|---|---|---|
| Base DN | OU DN where the user account is located | Example: ou=Users,dc=SOFTCAMP,dc=co,dc=kr |
| Mapping Filter | User Object Filter | AD example: (&(objectClass=person)(objectCategory=user)) LDAP example: (objectClass=inetOrgPerson) |
| Login Filter | Attributes to use for login | AD: sAMAccountName LDAP: uid |
| ID Attribute | Unique ID for internal identification | For example: employeeNumber, uid |
| Name Attribute | User Name Attribute | For example: cn, displayName |
| Relative DN Attribute | User DN Last Configuration Attribute | Example: cn |
| Email Attribute | Email Properties | AD: userPrincipalName LDAP: mail |
Group Search Configuration
| item | Explanation | Note |
|---|---|---|
| Use of Group Mapping | Select to enable group information synchronization | Use Do not use (default) |
| Group Base DN | Group search starting position | Example: ou=Groups,dc=SOFTCAMP,dc=co,dc=us |
| Group Mapping Filter | Group Target Filter | AD: (objectClass=group) LDAP: (objectClass=groupOfNames) |
| Group Name Attribute | Group Name Attribute | Example: cn |
| Group Description Attribute | Group Description Property | For example: description |
| Group Member Attribute | Group Member Attributes | AD: member LDAP: uniqueMember |
Common Settings
Scheduling Synchronization Settings
- To perform synchronization tasks automatically at a specific time every day, enable the automatic synchronization cycle setting.
- Default: Disabled
- Select the start time.
- 00:00 AM ~ 11:50 PM10-minute unitcan be selected
- Click the save button.
Check Synchronization Results
After synchronization is complete, you can check the results through the following menu:
- [User]: Check synchronized user list
- [group]: Check synchronized group list