OpenIAM vs. Active Directory reconciliation

[suneet_shah]

Hi everyone,
I just started testing OpenIAM with our MS environment. I was able to set up connector and managed system successfully with the connection to the DC. I although have a problem with reconciliation and don’t know where else to look. The idea is to have all users from AD imported to OpenIAM and be managed from there. For some reason I am not able to reconcile them successfully. Only thing which I see in the logs is Failure of BATCH_TASK_EXECUTE (batch/reconciliation.groovy). I am not sure what else I could set in reconciliation. I am adding some screenshots, I hope those will help you get the idea.
Any help would be appreciated.
Thank you.

• This topic was modified 2 years ago by suneet_shah.

Attachments:

You must be logged in to view attached files.

[suneet_shah]

Hi Roman,
If you want to only import existing AD groups and users, you can do this with the synchronization functionality. There are two out of the box scripts for this which will help you get started.

[Roman Vins]

Hi Suneet,
thanks for such a quick reply! Do you mean AD USER EXAMPLE? When I execute the sync, it says success but also Nothing has been found in target system
Also adding a screenshot of the configuration

Attachments:

You must be logged in to view attached files.

[suneet_shah]

Hi Roman,
Can you try the following:
a) Provisioning -> Connectors – Try to save your AD Powershell connector again. Just view the connector config screen and then click on save
b) Try to sync again and see if there is anything in the audit logs

It’s possible that either the Connector is not receiving messages from the queue or the search filter is not correct.

[Roman Vins]

Unfortunately no luck, also when I check the DC event viewer I see an error.

Attachments:

You must be logged in to view attached files.

[Dmitry Zaporozhec]

In case of using sync, be sure that value on Synchrtonization config is filled for field:
SQL Query / Directory Filter
somethink like following:
Get-MsolUser -All -UserPrincipalName “test@openiam.com”

[Roman Vins]

Ahh, I didn’t know it can be PowerShell as well. We are not using O365 so not Get-MsolUser but Get-ADUser did it’s part. Thanks!

[Author]

Posts