Active Directory (AD) is a Microsoft directory service that manages network resources efficiently. It centralizes authentication, authorization, and network management tasks, providing a unified environment for user and computer management. AD simplifies IT administration, enhances security through access controls, and facilitates seamless communication across a network, making it a crucial component for enterprise environments.

Versions: 8.0.0 P1

Prerequisites​

Before configuring this connector, create a service account in Active Directory and grant it the appropriate permissions for provisioning.

The AFX Active Directory connector creates, updates, and deletes user accounts and manages group membership. The service account used by this connector requires read/write access to Active Directory.

See Scenario 2: Read/Write Service Account in the Active Directory Service Account guide.

Connector Settings​

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to AFX > Connectors.
3. Click on Create Connector and select the Active Directory connector template.
4. Enter the details as shown below under General tab.
   
   
   
5. Click on the Settings tab and enter the required connection details.
   
   
   
6. Provide the DN settings as show below. The Account DN Suffix and Group DN Suffix are the default locations for accounts and groups respectively.
   
   
   
7. If Create Account verb with dynamic OU placement is required, DN Suffix Mappings¹ can be configured as show below. In the example below, US is the country code from HR source and OU=US,OU=Users,DC=company,DC=com is the desired OU for account placement.1️⃣
   
   
   
   .
8. Click OK.
9. Verify the settings using Test Connector Settings option.

Supported Verbs​

Create an Account​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

Below are some additional input parameters that are required in special situations.

Command Output Parameters

Additional Use Cases

🟠 Dynamic DN​

During the account creation the account can be placed in specific Organizational Units (OU) dynamically based on one or more attributes from the HR sources or key passed through account template.

Examples

• Place users in OUs based on country code from HR system.
• Place users in OUs based on the department and office location attributes collected from HCM.

Solution

1. Add DN Suffix Mappings in the Settings tab.
2. Add AFX_DN_Suffix_Key¹ to the Create Account verb.
3. Read the distinguishedName output parameter in the Create Account verb.

Items marked by 1️⃣ in this guide are related to this use case.

🟠 Change Password on First Logon​

When creating a new account, it may be necessary for users to change their password during their initial login. This can be accomplished by configuring specific input parameters within the Create Account verb.

The input parameters required are as follows:

Add Account to Group​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

Remove Account from Group​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

Create a Group​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create a Group and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

🔴 🟠 ⚫ ⚪ 🟣 🟢 🟡 🔵

CON004

Okta is a cloud-based IAM platform that offers secure user authentication, SSO, and authorization. It simplifies identity management, access control, and provisioning for organizations. With Okta, businesses can enhance security, streamline user experiences, and enable seamless access to applications and data. It supports multifactor authentication and integrations with various systems, enabling secure digital transformation and centralized identity management.

Versions: 8.0.0 P1

Overview​

It is recommended that you review the Okta Collector Guide before proceeding with this connector configuration.

Connector Settings​

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to AFX > Connectors.
3. Click on Create Connector and select the RESTful Web Service connector template.
4. Enter the details as shown below under General tab.
   
   
   
5. Click on the Settings tab and enter the required connection details.
   
   
   
6. Click on Add More Parameters.
7. Enter the details for scope as shown below and click OK.
   
   
   
8. Provide the offline_access okta.users.manage okta.groups.manage in the Scope field.
9. Similarly add another parameter state with value rsagl.
10. Click on Get OAuth 2.0 Access Token and authorize.
11. Click OK.

Supported Verbs​

Create an Account​

API Reference: https://developer.okta.com/docs/reference/api/users/#create-user-with-password

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{
  "profile": {
    "firstName": "${FirstName}",
    "lastName": "${LastName}",
    "email": "${Email}",
    "login": "${Account}"
  },
  "credentials": {
    "password": {
      "value": "${Password}"
    }
  }
}

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

Add Account to Group​

API Reference: https://developer.okta.com/docs/reference/api/groups/#add-user-to-group

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Add Account to Group and configure as shown below.
   The API call does not require a request body nor does it return a response (HTTP/1.1 204 No Content). To fulfill the connector requirements, the body must contain {} and Accept header must be set to */*.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{}

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

Remove Account from Group​

API Reference: https://developer.okta.com/docs/reference/api/groups/#remove-user-from-group

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Remove Account from Group and configure as shown below.
   The API call does not require a request body nor does it return a response (HTTP/1.1 204 No Content). To fulfill the connector requirements, the body must contain {} and Accept header must be set to */*.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{}

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

Disable an Account​

API Reference: https://developer.okta.com/docs/reference/api/users/#deactivate-user

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Enable an Account and configure as shown below.
   The API call does not require a request body nor does it return a response (HTTP/1.1 204 No Content). To fulfill the connector requirements, the body must contain {} and Accept header must be set to */*.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{}

3. Click OK. 4. Run the Test Connector Capabilities to verify the verb.

📓 References​

• User API Documentation
• OAuth2 Scopes
• OAuth Setup
• Deactivate and delete user accounts

Eletive is a People Success Platform that gathers real-time employee engagement surveys, performance management, OKR goal-setting, 360-feedback, and 1:1s in one intuitive and user-friendly tool. Eletive automates and streamlines tedious admin tasks, so HR, managers, and team members can focus on the business goals.

Versions: 7.5.2

Connector Settings​

Steps

1. Login to RSA Identity G&L console as System Administrator.
2. Navigate to AFX > Connectors.
3. Click on Create Connector and select the RESTful Web Service connector template.
4. Enter the details as shown below under General tab.
   
   
   
5. Click on the Settings tab and enter the required connection details.
   
   
   
6. Click on Add More Parameters.
7. Enter the details for APIKey as shown below and click OK.
   
   
   
8. Provide the API key in the API Key field and click OK.
   
   
   
   .

Supported Verbs​

Create an Account​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Create an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:extension:eletive:2.0:User"
  ],
  "externalId": "${Account}",
  "userName": "${Email}",
  "name": {
    "familyName": "${LastName}",
    "givenName": "${FirstName}"
  },
  "emails": [
    {
      "type": "work",
      "value": "${Email}",
      "primary": true
    }
  ],
  "locale": "en",
  "preferredLanguage": "en",
  "userType": "Users",
  "active": true,
  "urn:ietf:params:scim:schemas:extension:eletive:2.0:User": {
    "participateInSurvey": true,
    "Manager": {
      "email": "${ManagerEmail}",
      "externalId": "${ManagerID}"
    },
    "Country": "${Country}",
    "Email": "${Email}",
    "userType": "${EmpType}"
  }
}

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

Enable an Account​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Enable an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "add",
      "path": "active",
      "value": true
    }
  ]
}

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

Disable an Account​

Steps

1. Edit the connector and navigate to Capabilities tab.
2. Click on Disable an Account and configure as shown below.

Command Input Parameters

🔒 = Encrypted ✔️ = Required

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "add",
      "path": "active",
      "value": false
    }
  ]
}

3. Click OK.
4. Run the Test Connector Capabilities to verify the verb.

References​

• User Provisioning - SCIM 2.0

CON003