CA Service Management

Expand all | Collapse all

Different Active Directories in one EEM-SM

  • 1.  Different Active Directories in one EEM-SM

    Posted Mar 13, 2017 07:40 PM

    Hello,

     

    We have a current SDM client which acquired a company and it is now integrating it into the same SDM instance. Is it possible to use 2 or more active directories in one same SDM instance? Has anyone done this?

     

    What would be the best way to accomplish this?

     

    Best Regards.



  • 2.  Re: Different Active Directories in one EEM-SM

    Posted Mar 14, 2017 11:27 AM

    Hi Luis,

    When you talk about "using Active Directories" in SDM, are you talking about importing/syncing user information into SDM, or are you talking about Authentication purposes?   Also the title of your post mentions "EEM-SM" - so I am not sure if you are using EEM for authentication or not.   So a few things to consider here.   If you are talking about using LDAP functionality to import and update users in SDM from Active Directory, YES, in SDM 14.1.03, you can connect SDM to multiple LDAP directories to import and sync users from.  The key is that the userIDs must be unique across the multiple AD's.   If you are talking about Authentication of users in SDM, this is different, especially if you are using EEM.  If you are using EEM for authentication, then you would need to add both Active Directories into EEM, which you CAN do as well.  Then EEM can authenticate users from both AD's.   

    For information about using SDM with LDAP, please take a look at this section of the documentation: How to integrate CA SDM with LDAP - CA Service Management - 14.1 - CA Technologies Documentation 

    Hope this helps,

    Thanks,

    Jon I.



  • 3.  Re: Different Active Directories in one EEM-SM

    Posted Mar 14, 2017 03:13 PM

    Thanks for your response Jon,

     

    We need to do it from EEM since the client needs the clients to have acces not only to SDM but also Service Catalog and USS. Is this possible as well? Do you have any info or documentation about how to use several ADs within EEM?

     

    Regards



  • 4.  Re: Different Active Directories in one EEM-SM

    Posted Mar 15, 2017 05:59 AM

    Hi,

    Yes possible, you will find all the info you need around EEM in the wiki:

     

    Support for Multiple Active Directory Domains - CA Embedded Entitlements Manager - 12.51 - CA Technologies Documentation 

     

    Hope this help

    /J



  • 5.  Re: Different Active Directories in one EEM-SM

    Posted Mar 16, 2017 09:32 AM

    Yes you can use multiple domain with EEM for authentication or sync with SDM. 

     

    Here is a quick doc about how you can setup EEM to use like "Proxy" ldap server with multiple domain.

     

    First you have to configure a proxy server for EEM. (Normally on the same server as your EEM installation) (file EXEMPLE.DXC from my zip file)

    Second 

    Secondly, you must add the number of AD instances you want to process with your proxy server. (file EXEMPLE.DXG from my zip file)

    Subsequently, you add the number of domain ldap that you wish to be able to process by your proxy server. (file EXEMPLEAD1.DXC, EXEMPLEAD2.DXC etc.)

     

    Once the proxy server is available and online (just to follow the document as an attachment) you must configure directly in EEM the use of the new proxy server (it in the file EXAMPLE.DXC)

     

    Afterwards, in SDM you have to change the configuration of SDM to use the new proxy server that you just created with EEM. EEM will do some kind of cascade query through the various ldap directory you have added (EXEMPLEAD1.DXC, EXEMPLEAD2.DXC etc.)

     

    I used this configuration for several years with 2 different domains during an acquisition.  I even kept this configuration of the proxy server even though today the two domains are merged. We never knows when the next acquisition;)

    I hope I have answered your question. Do not hesitate if you need more information.

    Thanks

    Rémy

    Attachment(s)



  • 6.  Re: Different Active Directories in one EEM-SM

    Posted Apr 07, 2017 11:21 AM

    Thanks for the great docs!  Is this supported?

     

    J.W.



  • 7.  Re: Different Active Directories in one EEM-SM

    Posted Apr 14, 2017 03:59 PM

    I hope an engineer from CA has given us this documentation and we have been running for over 3 years this way.

    I tried to reproduce as accurately as possible the documentation we had. I hope this has helped you.

     



  • 8.  Re: Different Active Directories in one EEM-SM

    Posted May 24, 2017 11:08 AM

    CA Support says support would be limited on this solution.  :-{

     

    I will pull this into a DEV and see if the customers are willing to use it.

     

    Thanks,

     

    J.W.



  • 9.  Re: Different Active Directories in one EEM-SM

    Posted Jun 08, 2017 02:47 PM

    Weird... a CA Architect give me the solution for us. 

     

     



  • 10.  Re: Different Active Directories in one EEM-SM

    Posted Apr 07, 2017 11:30 AM

    At this time, NTLM authentication is not supported when EEM is configured for multiple domains.  See MWNiebuhr Michael Niebuhr's Idea at:

     

    NTLM / Kerberos support for Multiple Domains. 

     

    J.W.



  • 11.  Re: Different Active Directories in one EEM-SM

    Posted Apr 07, 2017 11:53 AM

    Hello,

     

    Our client now has a new problem. They need to use LDAP for some users and Local Authentication (PIN) for some other users.

     

    This is because some user do not exist in an Active Directory and they have to create them in EEM since they need those users to log in in SDM, Service Catalog and USS.

     

    Is this possible?

     

    Regards.



  • 12.  Re: Different Active Directories in one EEM-SM

    Posted Apr 07, 2017 07:09 PM

    Please note that EEM can be configured to use its own internal user store OR reference from an external LDAP Directory (like AD) but NOT BOTH at the same time.



  • 13.  Re: Different Active Directories in one EEM-SM

    Posted Apr 19, 2017 05:31 PM

    You can use alternatively a LDAP toll and connect EEM to it

     

    Top 4 open source LDAP implementations | Opensource.com 



  • 14.  Re: Different Active Directories in one EEM-SM

    Posted May 24, 2017 11:01 AM

    In addition to the Open Source solutions TMACUL provided, if you are a Microsoft shop then there is the Lightweight Directory Service which is separate from AD and can be installed on any server. 

     

    Active Directory Lightweight Directory Services (AD LDS) Overview [LH] 

     

    J.W.