CA Service Management

Hi team,

is there a way how to configure CA EEM as a proxy for one MS Active Directory and for another CA EEM (or other LDAP)?

The customer has internal analysts in the Active Directory and external users are in the separate DB. The idea was to store external users in CA EEM (EEM2 in internal user store mode) and use another CA EEM (EEM1) as a proxy for the Active Directory and the EEM2. The basic concept is in the picture below.

Maintaining the external users in the internal AD is not the option for the customer.

Thank you for your ideas,

Jakub 

I'm not sure about EEM, but the included CA Directory can act as a frontent for other LDAP Servers. I think I've done such a setup in the past - AD mapped to an OU and another DSA (CA Directory) mapped to another OU, unified under the same DSA (CA Directory). EEM was configured to look up identitied under the new - umbrella - DSA.

* Connect to Other LDAP Servers - CA Directory - 12.0.15 - CA Technologies Documentation 

* Prefix Mapping - CA Directory - 12.0.15 - CA Technologies Documentation 

Hi Cristy,

thank you so much for your reply... 

Do you have some hints or maybe documentation from your previous project where some basic steps are described? I've never worked with CA Directory and with LDAP generally. I've red some parts of CA Directory documentation, but I'm not able even to find and start the JXweb tool. 

Another question - how can I find which version of CA Directory goes with CA EEM 12.6.0.5? On the CA wiki there are many versions from 12 to 14.

Have a great day and thanks again,

Jakub

Jakub,

There's a really old doc on this item, maybe that gives you some ideas: Using CA Directory to point CA Service Desk to mul - CA Knowledge 

Keep in mind, CA Directory team does not support this approach anymore

_R

Finally, I tried another approach for maintaining external users instead of another EEM - Microsoft Active Directory Lightweight Directory Services (AD LDS - previously known as ADAM). The main reason was that CA EEM supports integration to multiple MS AD domains and AD LDS can be set as one of them - so no CA Directory black magic is needed and everything can be done easily via CA EEM interface.

Steps to set up EEM - AD LDS integration

1. Install AD LDS feature (step by step manual can be found here: http://www.rebeladmin.com/2018/02/step-step-guide-setup-active-directory-lightweight-directory-services-ad-lds/)
2. Open ADSI Edit, connect to the new LDAP and create a new LDAP user
   • don't forget to enable the user and set up the password
   • add the user to the Readers group
3. In CA EEM create custom LDAP Attribute Mapping schema
   • Since AD LDS uses name attribute instead of SAMAccountName, following changes in the ootb mapping need to be done
   • 
4. Add the new external LDAP Directory to the CA EEM (use the new attribute map)
5. Now my EEM is connected to two LDAP, the first one is standard MS AD, the second is AD LDS
6. To be sure that everything is set up correctly, try to log in CA EEM as AD LDS and as MS AD user.

mitu, Raghu.Rudraraju, thanks so much for your ideas,

Jakub

Jakub_Kolacny ........

Thanks for sharing with the rest of the community!

Thank you for sharing the details Jakub.  I'm sure this will help others too in future.

The CA Directory approach above was doing a similar thing, it serves as a light weight directory.

_R