AirWatch Hands-on LabsInternal Challenge LabsTM-HOL-CHLG-1900 Lab GuidanceConfigure Directory Services and Workspace ONE Access User Sync

Configure Directory Services and Workspace ONE Access User Sync

You will now configure the Directory Services settings in Workspace ONE UEM to sync corp.local domain users to the Workspace ONE UEM console.  These corp.local domain users will then be synced to Workspace ONE Access once you establish a connection between your Workspace ONE UEM tenant and your Workspace ONE Access tenant.

In the interest of time, some of the Directory Services configuration has been completed for you.  You will review how to setup Directory Services in the Workspace ONE UEM console and confirm the settings are configured correctly to connect to the Active Directory that is provided for in the Hands-On Labs environment.

Continue to the next step.

1. Setup Directory Services

In to the Workspace ONE UEM Console,

  1. Click Groups & Settings
  2. Click All Settings

1.1. Navigate to the Directory Services Settings

  1. Click System
  2. Click Enterprise Integration
  3. Click Directory Services
  4. Ensure the Server tab is selected
  5. Click Override for Current Setting

1.2. Configure Directory Services Manually

A few seconds after clicking Override, you will be presented the choice of using the Directory Services Wizard or configuring manually.

Click Skip wizard and configure manually.

1.3. Confirm the Active Directory Server Settings

The Directory Services configuration should already be populated for you to successfully connect to the Hands-On Labs Active Directory resource provisioned for you.  You will confirm these settings and review the Directory Services page so that you see how to configure Active Directory with Workspace ONE UEM.

  1. Confirm the Directory Type is Active Directory.
  2. Confirm the Server is controlcenter.corp.local.  This is the hostname for the domain controller where Active Directory resides.
  3. Confirm the Port is 389. This is allowing directory services to establish connection to Active Directory without encryption.
  4. Confirm the Protocol Version is 3.

1.4. Confirm the Active Directory Server Authentication Settings

  1. Scroll down to find the authentication settings.
  2. Confirm Use Service Account Credentials is Disabled.
  3. Confirm the Bind Authentication Type is GSS-Negotiate.
  4. Confirm the Bind User Name is CORP\administrator.
  5. Click Change to edit the Bind Password.
  6. Enter VMware1! for the Bind Password.
  7. Confirm the Domain is corp.local.

Normally, you would provide these details for your own Active Directory or LDAP server to integrate with, providing the necessary details required to bind to your server.

1.5. Confirm the Active Directory User Settings

  1. Scroll up to the top to find the User tab
  2. Click the User tab
  3. Confirm the corp.local Base DN is configured as dc=corp,dc=local

In your deployment, you would configured the Base DN for users in the domain you configured in the Server tab.

1.6. Confirm the Active Directory Group Settings

  1. Click the Group tab
  2. Confirm the corp.local Base DN is configured as dc=corp,dc=local
  3. Confirm the Organizational Unit Object Class is container
  4. Click the Advanced tab

In your deployment, you would configured the Base DN for the groups in the domain you configured in the Server tab.

1.7. Confirm the Organizational Unit Attribute and Save

  1. Scroll down to the bottom
  2. Confirm the Organizational Unit attribute is cn
  3. Click Test Connection. and confirm the connection successful with the given server name, bind user name, and password message is displayed

You have successfully configured the Directory Services settings to connect to the provided Active Directory! In your own deployments, you would configure these settings to connect to the LDAP server of your choosing and provide the User and Group details to connect to the desired resources.

1.8. Confirm the Test Connection is Successful

  1. Confirm the connection successful with the given server name, bind user name, and password message is displayed
  2. Click Close to return to the Directory Services settings.

NOTE: If you do not see a successful connection message, return to the Directory Services and ensure the details were entered correctly, including the Bind Password.

1.9. Save and Close the Directory Services Settings

  1. Click Save.
  2. Click the Close (X) button to close the Directory Services settings.

2. Add a User Group

With Directory Services configured to connect to  your provided Active Directory server, you will now add a User Group to the Workspace ONE UEM console to import the corp.local domain users.

  1. Click Accounts
  2. Click User Groups
  3. Click List View
  4. Click Add
  5. Click Add User Group

2.1. Search for the Users Organizational Unit

You want to import the Users organizational unit, so you will modify the search to find this group.

  1. Select Directory for the Type
  2. Select Organizational Unit for the External type
  3. Enter Users for the Search Text
  4. Click Search

2.2. Confirm Group Name and Save

  1. Confirm that the Users group was found. The distinguished name will be CN=Users,DC=corp,DC=local.
  2. Select Custom for the User Group Settings.

2.3. Configure User Group Settings

  1. Select Enabled for Auto Sync with Directory
  2. Select Enabled for Auto Merge Changes
  3. Select Enabled for Add Group Members Automatically
  4. Click Save

2.4. Sync the Active Directory Users

  1. Click the checkbox by the Users group to select it
  2. Click Sync
  3. Click OK when asked if you wish to continue with the sync
  4. Click Refresh
  5. Confirm that the Users column shows 9 synced users.
    NOTE: It may take a few minutes for all users to finish syncing.  Periodically click the Refresh button as needed until all 9 users are synced.
    TIP: If you click the number in the Users column, it will show you the corp.local Active Directory users that were imported into the Workspace ONE UEM console.

You have now successfully established a connection to the Hands-On Labs provided Active Directory using the AirWatch Cloud Connector and imported the corp.local users into the Workspace ONE UEM console!  Now you will configure the integration to the Workspace ONE Access tenant you have and sync these imported users.

Continue to the next step.

3. Setup Integration with Workspace ONE Access

Integrating with Workspace ONE Access requires you provide your Workspace ONE Access administrator login details to the Workspace ONE UEM console.

  1. Click Getting Started
  2. Expand the Getting Started section
  3. Click Workspace ONE
  4. Scroll down to find the Identity and Access Management section and click Configure for the Connect to VMware Identity Manager task

3.1. Continue to the Credentials Page

Click Continue at the Overview page to proceed to the Credentials page.

3.2. Enter the Workspace ONE Access Connection Details

  1. Enter your Tenant URL in the Tenant URL field, replacing {YOUR_TENANT_NAME} with the tenant name that was assigned to you.
    NOTE: Details on retrieving your Tenant URL were listed in the Login to the Workspace ONE Access Console section, please return to that step if you do not remember your Tenant URL.
    IMPORTANT: Please ensure that there is no trailing slash at the end of your Tenant URL or additional characters to avoid any connection issues.
  2. Enter Administrator for the Username.
  3. Enter VMware1! for the Password.
  4. Click Test Connection and ensure the Test Connection Successful message is displayed.
  5. Click Save.

3.3. Open All Settings

  1. Click Groups & Settings
  2. Click All Settings

3.4. Enable Active Directory Basic for Workspace ONE Access

  1. Click System
  2. Click Enterprise Integration
  3. Click VMware Identity Manager
  4. Click Configuration
  5. Select Enabled for Active Directory Basic

NOTE: The Active Directory Basic setting allows support for a single directory to synchronize to Workspace ONE Access without requiring the VMware Identity Manager Connector.  This is only recommended for simple deployments! You are using this configuration to simplify the setup process for Single Sign-On access into Workspace ONE Access.

3.5. Provide Credentials for Directory Configuration

  1. Enter Administrator for the Admin Username
  2. Enter VMware1! for the Admin Password
  3. Click Test Connection and confirm that the Connection successful with the given URL, Username and Password prompt displays
  4. Click Next

3.6. Configure the Directory and Attributes

  1. Enter corp.local for the Directory name
  2. Click Save

No custom attribute mappings are required for this lab.  If you required custom mappings, you would configure those mappings here.

3.7. Confirm the Directory Sync Completed

  1. Confirm that the Directory Sync started and shows User Sync Succeeded
  2. Click Close (X) to exit the Workspace ONE Access Configuration settings

4. Confirm User Sync in Workspace ONE Access

  1. Return to the Workspace ONE Access Administration Console tab
  2. Click Users & Groups
  3. Click Groups
  4. Confirm that the [email protected] group has synced with 5 users

0 Comments

Add your comment

E-Mail me when someone replies to this comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.