Setting up and managing domains

A domain is a set of users and groups that User Management uses as a source directory for obtaining user information. User Management supports three types of domains:

Enterprise domains: Consist of users and groups that reside in a third-party storage system, such as an LDAP directory. User Management does not write to the third-party storage system. Instead, User Management synchronizes the user and group information with the User Management database. Enterprise domains also use an external authentication provider, which can be LDAP, Kerberos, SAML, or a custom authentication provider.

Local domains: This type of domain is not connected to a third-party storage system. Instead, users and groups are created locally and reside in the User Management database. Passwords are stored locally, and authentication is done using a local database.

Hybrid domains: This type of domain is not connected to a third-party storage system. Instead, users and groups are created locally and reside in the User Management database. Unlike local domains, hybrid domains use an external authentication provider, which can be LDAP, Kerberos, SAML, or a custom authentication provider.

Adding domains

Add an enterprise domain

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click New Enterprise Domain.

  3. In the ID box, type a unique identifier for the domain and in the Name box, type a descriptive name for the domain. (See Important considerations for domain names and IDs .)

  4. Specify whether to enable account locking. (See Configure account-locking settings .) By default, Enable Account Locking is selected.

  5. Click Add Authentication and, in the Authentication Provider list, select a provider, depending on the authentication mechanism your organization uses. Possible values are LDAP, Kerberos, SAML, or a custom authentication provider.

    If you select LDAP, you can use the LDAP server specified in your directory configuration, or you can choose different LDAP server to use for authentication. If you choose a different server, your users must exist on both LDAP servers.

  6. Provide any additional information required on the page. (See Authentication settings .)

  7. Add a directory or a custom Service Provider Interface (SPI). (See Adding directories or custom SPIs .)

  8. Click Finish and then click OK.

After creating an enterprise domain, manually synchronize the directory or create a trigger to perform a synchronization before User Management can use it. You can then set up a directory synchronization schedule and perform manual synchronization as required. (See Synchronizing directories .)

Add a local domain

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click New Local Domain.

  3. In the ID box, type a unique identifier for the domain and, in the Name box, type a descriptive name for the domain. (See Important considerations for domain names and IDs .)

  4. Specify whether to enable account locking and then click OK. (See Configure account-locking settings .) By default, Enable Account Locking is selected.

Add a hybrid domain

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click New Hybrid Domain.

  3. In the ID box, type a unique identifier for the domain and, in the Name box, type a descriptive name for the domain. (See Important considerations for domain names and IDs .)

  4. Click Add Authentication and, in the Authentication Provider list, select a provider, depending on the authentication mechanism your organization uses. Possible values are LDAP, Kerberos, SAML, or a custom authentication provider.

  5. Provide any additional information required on the page. (See Authentication settings .)

  6. Click OK and then click OK again.

Important considerations for domain names and IDs

Keep in mind the following considerations when choosing a domain name and ID:

General considerations

  • When you are using a database provider other than DB2, the domain ID can contain up to 50 bytes. If you are using single-byte ASCII characters, the limit is 50 characters. If the domain identifier contains multibyte characters, this limit is reduced. For example, if you create a domain whose identifier contains 3-byte characters, the limit is 16 characters. In addition, you cannot create domains that contain 4-byte characters. If you create a domain ID that exceeds this limit, AEM forms will be in an unstable state. To recover from this unstable state, see the " Remove a domain that contains extended or multi-byte characters " on this page.

  • The number of enterprise domains and local domains that can be created within AEM forms depends on the length of each of the domain IDs. When you add an enterprise or hybrid domain, User Management updates the configInstance string in the AuthProviders node of the AEM forms configuration file (config.xml). The configInstance string contains a colon-separated list of the absolute paths of all domains that are associated with the authorization provider. This string has a size limit of 8192 characters. When that limit is reached, you cannot create additional domains.

Considerations when using DB2

When using DB2 for your AEM forms database, the maximum permitted length of the domain ID depends on the type of characters used:

  • 100 single-byte (ASCII) (for example, characters used in English, French, or German languages)

  • 50 double-byte (for example, characters used in Chinese, Japanese, or Korean languages)

  • 25 four-byte (for example, characters used in Traditional Chinese language)

Considerations when using MySQL

When using MySQL as your AEM forms database, the following limitations apply:

  • Use only single-byte (ASCII) characters for the domain ID and domain name. If you use extended ASCII characters, AEM forms will be in an unstable state and may throw an exception if you attempt to delete the domain. To recover from this unstable state, see the " Remove a domain that contains extended or multi-byte characters " topic on this page.

  • You cannot create two domains that have the same name but differ in case. For example, attempting to create a domain named Adobe when a domain named adobe already exists results in an error.

  • User Management cannot differentiate between two domain names that differ only in the use of extended characters. For example, if you create a domain named abcde and a domain named âbcdè , they are considered the same.

Remove a domain that contains extended or multi-byte characters

  1. Export the configuration file, as described in Importing and exporting the configuration file .

  2. Open the configuration file and under the Domains node, locate the node whose name attribute matches the name of the domain created with extended or multi-byte characters. Delete the entire node related to that domain.

  3. In your database, search for the domain in the edcprincipaldomainentity table:

    • Select * from edcprincipaldomainentity.

    • Find the domain name that contains extended or multi-byte characters and set its status to OBSOLETE.

  4. Import the updated configuration file, as described in Importing and exporting the configuration file .

Editing and converting existing domains

You can change the settings for existing domains from the Domain Management page. You can also convert an existing enterprise domain to a hybrid domain.

Edit an existing domain

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the name of the domain to edit.

  3. To change the domain name, change the text in the Name box.

  4. To change the authentication information for an enterprise or hybrid domain, click the appropriate authentication name at the bottom of the page. On the Edit Authentication page, change settings as required. (See Authentication settings .)

  5. To change the directory information for an enterprise domain, click the appropriate directory name at the bottom of the page. On the Edit Directory page, change settings as required. (See Adding directories or custom SPIs .)

  6. When you complete your changes, click OK.

Convert an enterprise domain to a hybrid domain

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the name of the enterprise domain to convert.

  3. Click Convert to Hybrid Domain.

  4. Review the information that appears regarding user and group data and authentication of users, and click OK.

  5. Edit the settings for the hybrid domain and click OK.

Note: If the enterprise domain that you are converting does not contain directory settings, any LDAP authentication settings are lost.

Convert a hybrid domain to an enterprise domain

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the name of the hybrid domain to convert.

  3. Click Convert to Enterprise Domain.

  4. Review the information that appears regarding user and group data and authentication of users, and click OK.

  5. Click Add Directory and configure the required directory information. (See Adding directories or custom SPIs .)

Delete a domain

Use the Domain Management page to mark an existing domain as obsolete.

If you create a domain with the same name as a deleted domain, the deleted domain is reinstated along with the information that it contained. The DefaultDom domain cannot be deleted.

  1. In administration console, click Settings > User Management > Domain Management.

  2. Select the check box for the domain to delete, click Delete, and then click OK.

Configure account-locking settings

When you add a domain, specify whether to enable account locking. When the Enable Account Locking option is selected, user accounts are locked after a specified number of consecutive authentication failures. After a specified length of time, the user can attempt to authenticate again. This feature prevents users from trying various credential combinations to access the system.

Use settings on the Domain Management page to specify the maximum number of authentication failures and the length of time that accounts are locked. These settings apply to all domains that have account locking enabled.

  1. In administration console, click Settings > User Management > Domain Management.

  2. In the Maximum Consecutive Authentication Failures box, enter the number of consecutive times a user can unsuccessfully attempt to log in before their account is locked. The default value is 20.

  3. In the Unlock The Account After (Minutes) box, enter the number of minutes that the user account is locked. After the specified number of minutes, the user can attempt to log in again. The default value is 30.

  4. Click Save.

Configuring authentication providers

Hybrid domains require at least one authentication provider, and enterprise domains require at least one authentication provider or directory provider.

If you enable SSO using SPNEGO, add a Kerberos authentication provider with SPNEGO enabled and an LDAP provider as a backup. This configuration enables user authentication with a user ID and password if SPNEGO is not working. (See Enable SSO using SPNEGO .)

Add an authentication provider

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click an existing domain in the list. If you are adding authentication for a new domain, see Add an enterprise domain or Add a hybrid domain .

  3. Click Add Authentication and, in the Authentication Provider list, select a provider, depending on the authentication mechanism your organization uses.

  4. Provide any additional information required on the page. (See Authentication settings .)

  5. (Optional) Click Test to test the configuration.

  6. Click OK and then click OK again.

Edit an existing authentication provider

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the appropriate domain in the list.

  3. On the page that appears, select the appropriate authentication provider from the list and make changes as required. (See Authentication settings .)

  4. Click OK.

Delete an authentication provider

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the appropriate domain in the list.

  3. Select the check boxes for the authentication providers to delete and click Delete.

  4. Click OK on the confirmation page that appears and click OK again.

Authentication settings

The following settings are available, depending on the type of domain and type of authentication you chose.

LDAP settings

If you are configuring authentication for an enterprise or hybrid domain and select LDAP authentication, you can choose to use the LDAP server specified in your directory configuration, or you can choose a different LDAP server to use for authentication. If you choose a different server, your users must exist on both LDAP servers.

To use the LDAP server specified in your directory configuration, select LDAP as the authentication provider and click OK.

To use a different LDAP server to perform authentication, select LDAP as the authentication provider, and select the Custom LDAP Authentication check box. The following configuration settings are displayed.

Server:
(Mandatory) Fully qualified domain name (FQDN) of the directory server. For example, for a computer called x on the corp.example.com network, the FQDN is x.corp.example.com . An IP address can be used in place of the FQDN server name.

Port:
(Mandatory) The port the directory server uses. Typically 389, or 636 if the Secure Sockets Layer (SSL) protocol is used for sending authentication information over the network.

SSL:
(Mandatory) Specifies whether the directory server uses SSL when sending data over the network. The default is No. When set to Yes, the corresponding LDAP server certificate must be trusted by the Java™ runtime environment (JRE) of the application server.

Binding
(Mandatory) Specifies how to access the directory.
Anonymous:
No user name or password is required.

User:
Authentication is required. In the Name box, specify the name of the user record that can access the directory. It is best to enter the full distinguished name (DN) of the user account, such as cn=Jane Doe, ou=user, dc=can, dc=com . In the Password box, specify the associated password. These settings are required when you select User as the Binding option.

Retrieve Base DNs:
(Not mandatory) Retrieves the base DNs and displays them in the drop-down list. This setting is useful when you have multiple base DNs and need to select a value.

Base DN:
(Mandatory) Used as the starting point for synchronizing users and groups from the LDAP hierarchy. It is best to specify a base DN at the lowest level of the hierarchy that encompasses all users and groups that need to be synchronized for services. Do not include the user’s DN in this setting. To synchronize a particular user, use the Search Filter setting.

Populate page with:
(Not mandatory) When selected, populates attributes on the User and Group settings pages with corresponding default LDAP values.

Search Filter:
(Mandatory) The search filter to use to find the record that is associated with the user. (See Search Filter Syntax .)

Kerberos settings

If you are configuring authentication for an enterprise or hybrid domain and select Kerberos authentication, the following settings are available.

DNS IP:
The DNS IP address of the server where AEM forms is running. On Windows, you can determine this IP address by running ipconfig /all at the command line.

KDC Host:
Fully qualified host name or IP address of the Active Directory server that is used for authentication.

Service User:
If you are using Active Directory 2003, this value is the mapping created for the service principal in the form HTTP/<server name>. If you are using Active Directory 2008, this value is the login ID of the service principal. For example, assume that the service principal is named um spnego , the user ID is spnegodemo , and the mapping is HTTP/example.corp.yourcompany.com . With Active Directory 2003, you set Service User to HTTP/example.corp.yourcompany.com . With Active Directory 2008, you set Service User to spnegodemo . (See Enable SSO using SPNEGO .)

Service Realm:
Domain name for Active Directory

Service Password:
Service user’s password

Enable SPNEGO:
Enables the use of SPNEGO for single sign-on (SSO). (See Enable SSO using SPNEGO .)

SAML settings

If you are configuring authentication for an enterprise or hybrid domain and select SAML authentication, the following settings are available. For information about additional SAML settings, see Configure SAML service provider settings .

Please select a SAML Identity Provider Metadata file to import:
Click Browse to select a SAML identity provider metadata file generated from your IDP and then click Import. Details from IDP are displayed.

Title:
Alias to the URL denoted by the EntityID. The title is also displayed on the login page for enterprise and local users.

Identity Provider Supports Client Basic Authentication:
Client Basic Authentication is used when the IDP uses a SAML Artifact Resolution profile. In this profile, User Management connects back to a web service running at the IDP to retrieve the actual SAML assertion. The IDP may require authentication. If the IDP does require authentication, select this option and specify a user name and password in the boxes provided.

Custom Properties:
Enables you to specify additional properties. The additional properties are name=value pairs separated by new lines.

The following custom properties are required if artifact binding is used.

  • Add the following custom property to specify a username that represents the AEM forms Service Provider, which will be used to authenticate to the IDP Artifact Resolution service. 

    saml.idp.resolve.username=<username>

  • Add the following custom property to specify the password for the user specified in saml.idp.resolve.username . 

    saml.idp.resolve.password=<password>

  • Add the following custom property to allow the service provider to ignore the certificate validation while establishing the connection with the Artifact Resolution service over SSL. 

    saml.idp.resolve.ignorecert=true

Custom settings

If you are configuring authentication for an enterprise or hybrid domain and select Custom authentication, select the name of the custom authentication provider.

Just-in-time provisioning of users

Just-in-time provisioning creates a user in the User Management database automatically after the user is successfully authenticated via an authentication provider. Relevant roles and groups are also assigned dynamically to the new user. You can enable just-in-time provisioning for enterprise and hybrid domains.

This procedure describes the way traditional authentication works in AEM forms:

  1. When a user tries to log in to AEM forms, User Management passes their credentials sequentially to all available authentication providers. (Login credentials include username/password combination, Kerberos ticket, PKCS7 signature, and so on.)

  2. The authentication provider validates the credentials.

  3. The authentication provider then checks whether the user exists in the User Management database. The following statuses are possible:

    Exists
    If the user is current and unlocked, User Management returns authentication success. However, if the user is not current or is locked, User Management returns authentication failure.

    Does not exist
    User Management returns authentication failure.

    Invalid
    User Management returns authentication failure.

  4. The result returned by the authentication provider is evaluated. If the authentication provider returned authentication success, the user is allowed to log in. Otherwise, User Management checks with the next authentication provider (steps 2-3).

  5. Authentication failure is returned if no available authentication provider validates the user credentials.

When just-in-time provisioning is enabled, new users are created dynamically in User Management if one of the authentication providers validates their credentials. (After step 3 in the procedure above.)

Without just-in-time provisioning, when a user is successfully authenticated but is not found in the User Management database, the authentication fails. Just-in-time provisioning adds a step in the authentication procedure to create the user and assign roles and groups to the user.

Enable just-in-time provisioning for a domain

  1. Write a service container that implements the IdentityCreator and AssignmentProvider interfaces. (See Programming with AEM forms .)

  2. Deploy the service container to the forms server.

  3. In administration console, click Settings > User Management > Domain Management.

    Select an existing domain or click New Enterprise Domain.

  4. To create a domain, click New Enterprise Domain or New Hybrid Domain. To edit an existing domain, click the name of the domain.

  5. Select Enable Just In Time Provisioning.
    Note: If the Enable Just In Time Provisioning checkbox is missing, click Home > Settings > User Management> Configuration > Advanced System Attributes and then click Reload.

  6. Add authentication providers. While adding authentication providers, on the New Authentication screen, select a registered Identity Creator and Assignment Provider. (See Configuring authentication providers .)

  7. Save the domain.

Configuring directories

For each enterprise domain you configure, specify the directories that the authentication provider queries for user information. You can configure multiple directories for a domain.

Adding directories or custom SPIs

For each enterprise domain you configure, specify the directories that the authentication provider queries for user information. You can add a directory to an existing enterprise domain or to a new enterprise domain that you are adding. You can configure multiple directories for a domain. You can also configure a domain to use a custom Service Provider Interface (SPI) for synchronization.

Add a directory

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click New Enterprise Domain or select an existing enterprise domain.

  3. Click Add Directory.

  4. In the Profile Name box, type a name to distinguish this directory and then click Next.

  5. Configure the directory server settings. (See Directory settings .)

  6. To verify that a connection can be made to the LDAP server, click Test. If the test fails, review the exception in the Application Server log file to determine the root cause of the failure. Click Close and then click Next.

  7. Select User Settings and configure the settings as required. (See Directory settings .)

  8. To verify that the base DN and other configured attributes collect the correct batch of users, click Test. LDAP attempts to retrieve the first 200 records by using the provided settings (such as the base DN, search filter, and all attributes).

    If users are returned, the results show the values that are assigned to each field as per the attribute set. If the test fails because of a non-existent server name, incorrect authorization information, or incorrect attributes, the following error message appears: "The search criteria specified did not return any result". To determine the root cause of the failure, review the exception in the Application Server log file. Click Close and then click Next.

  9. Select Group Settings and configure the settings as required. (See Directory settings .)

  10. To verify that the base DN and other configured attributes collect the correct batch of groups, click Test. If groups are returned, the results show the values that are assigned to each field as per the attribute set. Click Close.

Add a custom SPI

For information about creating a custom SPI, see "Developing SPIs for AEM forms" in Programming with AEM forms . To make a newly deployed custom SPI available for association with the domain, restart the server.

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click New Enterprise Domain or select an existing enterprise domain.

  3. Click Add Directory.

  4. Type a name in the Profile Name box, select Custom SPI Provider, and then click Next.

  5. Select a custom user provider from the list and click Next.

  6. Select a custom group provider from the list and click Finish.

Edit a directory

You can edit the details of a directory that you previously configured.

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the appropriate domain in the list and, on the page that appears, select the appropriate directory from the list.

  3. Configure the directory, user, and group settings as required. (See Directory settings .)

  4. Click OK.

Delete a directory

When you synchronize your domains after deleting a directory, all users and groups in that directory are marked obsolete in the database. They will not be returned in any search from Administration Console.

Note: Enterprise domains require at least one authentication provider and directory provider.

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click the appropriate domain in the list.

  3. Select the check box for the appropriate directory and click Delete.

  4. Click OK on the confirmation page that appears and click OK again.

Directory settings

When you add a directory to a domain, specify the following directory settings.

Server:
(Mandatory) Fully qualified domain name (FQDN) of the directory server. For example, for a computer called x on the corp.adobe.com network, the FQDN is x.corp.adobe.com . An IP address can be used in place of the FQDN server name.

Port:
(Mandatory) The port that the directory server uses. Typically 389, or 636 if the Secure Sockets Layer (SSL) protocol is used for sending authentication information over the network.

SSL:
(Mandatory) Specifies whether the directory server uses SSL when sending data over the network. The default is No. When set to Yes, the corresponding LDAP server certificate must be trusted by the Java™ runtime environment (JRE) of the application server.

Binding
(Mandatory) Specifies how to access the directory.
Anonymous:
No user name or password is required. An anonymous user may be able to fetch only a limited amount of data. This option may be useful for initial testing.

User:
Authentication is required. In the Name box, specify the name of the user record that can access the directory. It is best to enter the full distinguished name (DN) of the user account, such as cn=Jane Doe, ou=user, dc=can, dc=com . In the Password box, specify the associated password. These settings are required when you select User as the Binding option.

Name:
Name that can be used to connect to the LDAP database when anonymous access is not enabled. For Active Directory 2003, specify [domain name] \ [userid] . For Sun™ One, eDirectory or IBM Tivoli Directory Server, specify the fully qualified name of the user, such as uid=lcuser,ou=it,o=company.com .

Password:
Password that corresponds with the name you specified to connect to the LDAP database when anonymous access is not enabled.

Populate Page With:
When selected, populates attributes on the User and Group settings pages with corresponding default LDAP values.

Retrieve Base DNs:
Retrieves the base DNs and displays them in the drop-down list. This setting is useful when you have multiple base DNs and need to select a value.

Enable referral:
This setting is applicable when your organization uses multiple Active Directory domains organized in a hierarchical structure and you have specified directory settings for only the parent domain. In this situation, when you select this option, User Management can access user and group details from the child domains.
Note: Click Test to verify that a connection can be made to the LDAP server. To determine the root cause of any failures, review the exception in the Application Server log file.

User settings

Unique Identifier:
(Mandatory) A unique and constant attribute used to identify users. Use a non-DN attribute as the unique identifier because a user’s DN may change if they move to another part of the organization. This setting depends on the directory server. The value is objectGUID for Active Directory 2003, nsuniqueID for Sun™ One, and guid for eDirectory.
Important: Ensure that you enter an attribute that is guaranteed to be unique in your organization. Entering an incorrect value can cause serious system problems.

Base DN:
Set as the starting point for synchronizing users and groups from the LDAP hierarchy. It is best to specify a base DN at the lowest level of the hierarchy that encompasses all users and groups that need to be synchronized for services.

If you selected the Enable referral option in the Directory settings, set the Base DN option to the dc part of the DN. For the referral to work, the search span must include both parent and child domains.

Note: Do not include the user’s DN in this setting. To synchronize a particular user, use the Search Filter setting.

Although Base DN is a mandatory setting in administration console, some directory servers such as IBM Domino Enterprise Server may require an empty BaseDN. To specify an empty Base DN, export the config.xml file, edit the setting in the config.xml file, and then reimport it. (See Importing and exporting the configuration file .)

Search Filter:
(Mandatory) The search filter to use to find the record that is associated with the user. You can perform a one-level search or a sub-level search. (See Search Filter Syntax or RFC 2254.) Additional information for the Microsoft AD schema, see Active Directory Schema .

Description:
Schema attribute for the description of the user

Full Name:
(Mandatory) Schema attribute for the full name of the user

Login ID:
(Mandatory) Schema attribute for the user’s login ID

Last Name:
(Mandatory) Schema attribute for the user’s last name

Given Name:
(Mandatory) Schema attribute for the user’s first name

Initials:
Schema attribute for the user’s initials

Business Calendar:
Enables you to map a business calendar to a user, based on the value for this setting (the business calendar key ). Business calendars define business and non-business days. AEM forms can use business calendars when calculating future dates and times for events such as reminders, deadlines, and escalations. The way you assign business calendar keys to users depends on whether you are using an enterprise, local, or hybrid domain. (See Configuring Business Calendars .)

If you are using an enterprise domain, you can map the Business Calendar setting to a field in the LDAP directory. For example, if each user record in your directory contains a country field, and you want to assign business calendars based on the country where the user is located, specify the country field name as the value for the Business Calendar setting. You can then map the business calendar keys (the values defined for the country field in the LDAP directory) to business calendars in forms workflow.

The amount of space used to display the name of the business calendar key in the forms workflow pages is limited. Limit the name of the business calendar key to less than 53 characters to avoid having it truncated on those pages.

Modify Timestamp:
To enable delta directory synchronization, set this value to modify TimeStamp . (See Enable delta directory synchronization .)

Organization:
Schema attribute for the name of the organization to which the user belongs.

Primary Email:
Schema attribute for the primary email address of the user.

Secondary Email:
Schema attribute for the secondary email address of the user.

Telephone:
Schema attribute for the user’s telephone number.

Postal Address:
Schema attribute for the user’s mailing address.

Locale:
Schema attribute that contains the ISO locale information. The value is a two-letter language code or a language and country code.

Time Zone:
Schema attribute that contains the time zone where the user is located. The value is a string such as City/Country .

Enable Virtual List View (VLV) Control:
An LDAP control that enables AEM forms to retrieve data in batches from the directory server. If you are using Sun One as your LDAP directory and the directory contains many users, enabling VLV creates an index that User Management can use when searching users. This feature is useful when using a normal user account that can synchronize only a limited amount of data. You can also enable VLV for groups. If you select Enable Virtual List View (VLV) Control, specify a name in the Sort Field box.
Note: To enable VLV, configure Sun One. (See Configure User Management to use Virtual List View (VLV) .)

Sort Field:
If you selected Enable Virtual List View (VLV) Control, specify the attribute name used to sort the index. This attribute name (such as uid) is the one you specified when you created an index for VLV on the directory server.

Group settings

Unique Identifier:
(Mandatory) A unique and constant attribute used to identify groups. Use a non-DN attribute as the unique identifier. This setting depends on the directory server. The value is objectGUID for Active Directory 2003, nsuniqueID for Sun One, and guid for eDirectory.
Important: Ensure that you enter an attribute that is guaranteed to be unique in your organization. Entering an incorrect value can cause serious system problems.

Base DN:
(Mandatory) Base distinguished name of the directory.

Although Base DN is a mandatory setting in administration console, some directory servers such as IBM Domino Enterprise Server require an empty BaseDN. To specify an empty Base DN, export the config.xml file, edit the setting in the config.xml file, and then reimport it. (See Importing and exporting the configuration file .)

Search Filter:
(Mandatory) The search filter to use to find the record that is associated with the group. You can perform a one-level search or a sub-level search.

Description:
Schema attribute for the description of the group

Full Name:
(Mandatory) Schema attribute for the full name of the group

Member DN:
(Mandatory) Schema attribute for the distinguished name of members within a group

Member Unique Identifier:
Unique identifier for a user or group that is a member of the selected group. This value depends on the directory server. The value is objectSID for AD2003, nsuniqueID for Sun One, and guid for eDirectory.

If Member DN is specified with a non-DN attribute, User Management uses Member Unique Identifier to query LDAP to collect the user’s DN as it corresponds to a unique identifier value.

If DN is specified as a unique identifier, you do not need to configure Member Unique Identifier.

Organization:
Schema attribute for the name of the organization to which the group belongs

Primary Email:
Schema attribute for the primary email address of the group

Secondary Email:
Schema attribute for the secondary email address of the group

Modify Timestamp:
To enable delta directory synchronization, set this value to modify TimeStamp . (See Enable delta directory synchronization .)

Enable Virtual List View (VLV) Control:
An LDAP control that enables AEM forms to retrieve data in batches from the directory server. If you are using Sun One as your LDAP directory and the directory contains many groups, enabling VLV creates an index that User Management can use when searching groups. This feature is useful when using a normal user account that can synchronize only a limited amount of data. You can also enable VLV for users. If you select Enable Virtual List View (VLV) Control, specify a Sort Field Name.
Note: To enable VLV, configure Sun One. (See Configure User Management to use Virtual List View (VLV) .)

Sort Field Name:
If you selected Enable Virtual List View (VLV) Control, specify the attribute name used to sort the index. This attribute name is the one you specified when you created an index for VLV on the directory server.
Note: Click Test to verify that the user and group settings are collected based on the base DN and search criteria. If users and groups are returned, the results show the values that are assigned to each field as per the attribute set.
Note: User Management does not support duplicate user IDs within a domain; only one user with the user ID is synchronized.

Configure User Management to use Virtual List View (VLV)

Directory synchronization is an important requirement for User Management. The users and groups are synchronized from an enterprise directory to the AEM forms database for assigning roles and permissions. The number of users varies from 100 to 100000+ depending on the requirements, and it poses an engineering challenge to synchronize data efficiently.

The LDAP protocol provides a mechanism to query large data sets in a paginated way by using request controls. When using Microsoft Active Directory, LDAP to AEM forms database synchronization uses PagedResultsControl for retrieving data in batches of a particular size. The Sun ONE Directory Server does not support this control. To complete a paginated query against the Sun ONE Directory Server, use the Virtual List View (VLV) control. This control involves both directory server-side configuration and client-side implementation.

Note: This section describes using the VLV control for the Sun ONE Directory Server. However, you can use this control for any directory server that supports VLV control.

  1. When configuring the directory, select Enable Virtual List View (VLV) Control on both the User Settings page and the Group Settings page. When you select the check box, you must also specify a sort name in the Sort Field box. The default value is uid. (See Adding directories or custom SPIs or Edit a directory .)

  2. Use Sun ONE administration console or a command-line script to create the LDAP VLV entries for users and groups. If you use a command-line script, you can use the sample users and groups LDIF files. (See Configuring the Sun ONE Directory Server for VLV .)

  3. Stop the server and create the required index. (See Create the Directory Server Index for VLV .)

Configuring the Sun ONE Directory Server for VLV

Creating a VLV requires a pair of entries that include the vlvSearch and vlvIndex object classes. The vlvSearch entry includes a search base and the vlvFilter attribute, which specifies the object class that contains the attributes you intend to sort. The vlvIndex object class includes the vlvSort attribute, which specifies one or more attributes to sort and the order to sort them in. (A minus sign (-) denotes reverse alphabetical order). Using VLV with AEM forms requires separate entries for users and groups.

Note: The Object entries can be created by using the Sun ONE graphical user interface (GUI) or through a command-line script. For instructions about creating the Object entries using the GUI, see the Sun ONE documentation.

Here is a sample script LDIF for VLV entry for users: 

dn: cn=lcuser,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 
objectclass: top 
objectclass: vlvSearch 
cn: lcuser 
vlvBase: dc=corp,dc=adobe,dc=com 
vlvScope: 2 
vlvFilter: (&(objectclass=inetOrgPerson)) 
aci: (target="ldap:///cn=lcuser,cn=userRoot,cn=ldbm database,cn=plugins,cn=config")(targetattr="*")(version 3.0; acl "Config" 
;allow(read,search,compare) userdn="ldap:///all"; ) 
dn: cn=lcuser,cn=lcuser,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 
cn: lcuser 
vlvSort: cn 
objectclass: top 
objectclass: vlvIndex

Create the object entries using a script

  1. The sample script has an LDAP entry named lcuser . This entry is for VLV-related configuration for user synchronization in AEM forms. Modify the following properties accordingly:

    Entry name: The entry name in this sample is lcuser . If lcuser is changed, it must be changed in all areas of the sample script.

    vlvBase: The Base DN specified on the User Settings page.

    vlvFilter: The Search Filter specified on the User Settings page.

    vlvSort: The Sort Field specified in the VLV settings section of the User Settings page. A VLV control requires you to specify a sort control. This field is used as the sort parameter for the vlv index created.

    aci: The access control specified in the sample script grants any authenticated user the right to access the VLV indexes for read, search, and compare operations. The administrator can restrict access to a binding user, which is configured in the Directory Server Settings page specified in the User Management user interface. If permissions are not given, user search cannot use the VLV, and the LDAP server throws a permission exception.

    Note: As a convention, the vlvIndex entry name is also set to lcuser , but you can give it a different name. Use the same name in the vlvindex tool. (See Create the Directory Server Index for VLV .)

  2. Using the ldapmodify tool provided with Sun ONE Server, create a similar entry for groups by using the group's Base DN, Search Filter and Sort Field respectively:

    server directory\shared\bin>ldapmodify -v -a -h host -p port -D "admin user" -w "password" -f "LDIF file location"

    For example, type the following text:

    D:\tools\ldap\sun\shared\bin> -v -a -h localhost -p 55850 -D "uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot" -w "admin" -f "D:\tools\ldap\data\vlv feature\users.ldif"

Create the Directory Server Index for VLV

After configuring the directory settings and creating the LDAP VLV entries for users and groups, stop the server and create the required index.

  1. After creating object entries, stop the Sun ONE Server.

  2. Using the vlvindex tool, generate the index by typing the following text:

    directory server instance \vlvindex.bat -n userRoot -T lcuser

    The following output is generated: 

    D:\tools\ldap\sun\shared\bin>..\..\slapd-chetanmeh-xp3\vlvindex.bat -n userRoot -T livecycle 
[21/Nov/2007:16:47:26 +051800] - userRoot: Indexing VLV: livecycle 
[21/Nov/2007:16:47:27 +051800] - userRoot: Indexed 1000 entries (5%). 
[21/Nov/2007:16:47:27 +051800] - userRoot: Indexed 2000 entries (9%). 
... 
[21/Nov/2007:16:47:29 +051800] - userRoot: Indexed 20000 entries (94%). 
[21/Nov/2007:16:47:29 +051800] - userRoot: Indexed 21000 entries (99%). 
[21/Nov/2007:16:47:29 +051800] - userRoot: Finished indexing.

    The vlvindex tool is present in the directory server instance directory. If the Sun ONE Server has two instances running server1 and server2, the vlvindex tool is located in Sun ONE server directory \server1 directory. The value for parameter -T is the value of the cn attribute of the vlvindex entry created previously in the sample LDIF. In this case, it is lcuser .

  3. If VLV is also enabled for groups, create the corresponding index for the groups. Verify whether the indexes are created by running the following command:

    sun one server directory \shared\bin>ldapsearch -h hostname -p port no -s base -b "" objectclass=*

    Output such as the following sample data is generated: 

    D:\tools\ldap\sun\shared\bin>ldapsearch.exe -h localhost -p 55850 -s base -b "" objectclass=* 
ldapsearch.exe: started Tue Nov 27 16:34:20 2007 
version: 1 
dn: 
objectClass: top 
namingContexts: dc=corp,dc=adobe,dc=com 
supportedExtension: 2.16.840.1.113730.3.5.7 
... 
vlvsearch: cn=MCC ou=testdata dc=corp dc=adobe dc=com, cn=userRoot,cn=ldbm dat 
    abase,cn=plugins,cn=config 
vlvsearch: cn=lcuser,cn=userRoot,cn=ldbm database,cn=plugins,cn=config 
vlvsearch: cn=Browsing ou=testdata,cn=userRoot,cn=ldbm database,cn=plugins,cn= 
    config 
1 matches

Synchronizing directories

To synchronize domains, you can choose to do a manual or scheduled synchronization. A manual synchronization synchronizes any selected domains. A scheduled synchronization synchronizes all domains.

Directory synchronization is used to pull details from the directory servers that you specified in your directory settings into the User Management database. Later, you can also do a manual synchronization if changes or updates occur on the directory servers. For example, you can do a manual synchronization if users and groups are added or changes are made to a user’s account.

You can also set a daily synchronization schedule to automatically synchronize the User Management database with changes or updates to the source directory servers. However, be aware that this process uses network and server resources. Choose low-usage time periods and avoid scheduling unnecessary synchronizations that tie up system and network resources. To minimize unnecessary synchronizations, use the immediate synchronize option instead.

You can also specify whether to push user and group information into Adobe LiveCycle Content Services 9 (deprecated) when synchronizing domains.

Note: Do not create multiple local users and groups while an LDAP directory synchronization is in progress. Attempting this process may result in errors.
Important: If the domain synchronization process is interrupted (for example, the application server is shut down during the process), wait awhile before you attempt to synchronize the domain. To evaluate the status of synchronization, look at the state. If User Management acquired a lock before shutdown, wait 10 minutes for the lock to release after server restart. If the synchronization status is "In Progress" but synchronization is interrupted or stalled, User Management retries the synchronization after 3 minutes. After three failed attempts, User Management declares the synchronization a failure and releases the lock.
Note: Adobe® LiveCycle® Content Services ES (Deprecated) is a content management system installed with LiveCycle. It enables users to design, manage, monitor, and optimize human-centric processes. Content Services (Deprecated) support ends on 12/31/2014. See Adobe product lifecycle document . To know about configuring Content Services (Deprecated), see Administering Content Services .

Enable delta directory synchronization

Delta directory synchronization improves the efficiency of directory synchronization. When delta directory synchronization is enabled, User Management synchronizes only users and groups that have been added or updated since the last synchronization.

User Management performs the following steps when delta directory synchronization is enabled:

  • Fetch all users from the directory servers but update the User Management database with only the users whose timestamp has changed.

  • Fetch all groups but update the User Management database with only the groups whose timestamp has changed.

  • Fetch group members only for the groups whose timestamps have changed and update the User Management database with that information.

Note: Users and groups who were removed from the directory are not deleted from the User Management database until you perform a full directory synchronization.

  1. In administration console, click Settings > User Management > Domain Management.

  2. Under Delta Synch, select the check box and click Save.

  3. Edit the directory settings for each of the enterprise domains that will use the delta directory synchronization feature. On the User Settings and Group Settings pages, locate the Modify Timestamp setting and enter modify TimeStamp as the value. For details about editing enterprise domains, see Editing and converting existing domains .

Enable or disable detailed logging during synchronization

By default, User Management logs detailed statistics during the synchronization process.

  1. In administration console, click Settings > User Management > Configuration > Configure Advanced System Attributes.

  2. Under Synch Statistics Logging, deselect the check box to disable the detailed logging or select it to enable logging, and then click Save.

Configure the directory synchronization retry option

You can configure User Management to periodically check for any failed directory synchronization attempts. User Management then tries to complete the failed synchronizations.

  1. In administration console, click Settings > User Management > Configuration > Configure Advanced System Attributes.

  2. Under Synch Finisher Cron Expression, enter a cron expression that represents the interval at which User Management retries failed synchronizations. The cron expression usage is based on the Quartz open source job-scheduling system, version 1.4.0. (See Class CronTrigger .)

    The default is 0 0/13 * ? * *, which means the check occurs every 13 minutes.

Manually synchronize directories

  1. In administration console, click Settings > User Management > Domain Management.

  2. (Optional) To push user and group information into Content Services (Deprecated), select the Select This Option For Pushing Users And Groups Into Registered External Principal Storage Providers option. This option also applies when adding new users and groups through the Users and Groups page.

  3. Select the check box for each enterprise domain to synchronize and click Sync Now.

    If you select multiple domains, the domain synchronization for all domains can be run at the same time. However, if you select the domains separately, only one domain synchronization can run at a time.

Schedule directory synchronization

  1. In administration console, click Settings > User Management > Domain Management.

  2. Schedule synchronization:

    • To enable automatic synchronization on a daily basis, under Scheduler, select Occurs. Select Daily from the list and type the time in the 24-hour format in the corresponding box. When you save your settings, this value is converted to a cron expression, which is displayed in the Cron Expression box.

    • To schedule synchronization on a particular day of the week or month, or in a particular month, select Cron Expression and type the appropriate expression in the box. For example, synchronize at 1:30 A.M. on the last Friday of the month.

The cron expression usage is based on the Quartz open source job-scheduling system, version 1.4.0. (See Class CronTrigger .)

  • To turn off automatic synchronization, select Occurs and select Never from the list.

  • (Optional) To push user and group information into Content Services (Deprecated), select the Select This Option For Pushing Users And Groups Into Registered External Principal Storage Providers option. This option also applies when adding new users and groups through the Users and Groups page.

  • Click Save.

Stop all directory synchronizations currently in progress

  1. In administration console, click Settings > User Management > Domain Management.

  2. Click Abort. This button is displayed only while a directory synchronization is in progress.

// Ethnio survey code removed