Synchronize Active Directory to ADAM with ADAMSync (step-by-step)
I have created two sets of step-by-step instructions. The first is for someone who may be already somewhat familiar with using ADAM and ADAM tools, the second is for those who would prefer a little more detail.
Here is the first set of step-by-step instructions (if you'd like more detail see the second set of step-by-step instructions below).
Before we begin you must setup the environment. Create a partition using dsmgmt:
create nc dc=MySchool,dc=edu contoso-sp:389
To use Active Directory to ADAM Synchronizer for the first time
1. Click Start, point to All Programs, click ADAM, and then click ADAM Tools
Command Prompt to open a command window in the ADAM directory.
2. To extend the ADAM schema to match the default Windows Server 2003 schema objects in Active Directory, at the command prompt, type the following command on a single line, and then press ENTER:
ldifde -i -s localhost -c CN=Configuration,DC=X #ConfigurationNamingContext -f MS-AdamSchemaW2k3.ldf
3. To extend the ADAM schema to include schema objects that are required by Active Directory to ADAM Synchronizer, at the command prompt, type the following command on a single line, and then press ENTER:
ldifde -i -s localhost:389 -c CN=Configuration,DC=X #ConfigurationNamingContext -f MS-AdamSyncMetadata.ldf
4. Modify the configuration file MS-AdamSyncConf.xml with the appropriate parameters:
· Replace the value of <source-ad-name> with the name of the source Active Directory domain controller, for example, <source-ad-name>SeattleDC1</source-ad-name>.
· Replace the value of <source-ad-partition> with the distinguished name of the source domain, for example, <source-ad-partition>dc=fabrikam,dc=com</source-ad-partition>.
· Replace the value of <source-ad-account> with the name of an account in the Domain Admins group of the source domain, for example, <source-ad-account>administrator</source-ad-account>.
· Replace the value of <account-domain> with the fully qualified name of the source domain, for example, <account-domain>fabrikam.com</account-domain>.
· Replace the value of <target-dn> with the name of the partition of the target ADAM instance, in this case, <target-dn>o=microsoft,c=US</target-dn>.
· Replace the value of <base-dn> with the base distinguished name of the source domain, for example, <base-dn>dc=fabrikam,dc=com</base-dn>. Important Do not delete any unused fields from this file.
5. Install the configuration file. At a command prompt, type the following command, and then press ENTER:
ADAMSync /install localhost:389 %windir%\ADAM\MS-AdamSyncConf.xml
6. Synchronize the data from the Active Directory forest to the ADAM configuration set. At a command prompt, type the following command, and then press ENTER:
ADAMSync /sync localhost:389 "o=microsoft,c=US" /log
The /log option displays detailed information about the status of the synchronization. You can also use ADAM ADSI Edit to verify that the data has been synchronized.
That's It!
The next set of instructions is a step-by-step for accomplishing the same thing, but includes more detail.
Jeff’s AD-to-ADAM Sync Instructions
Step 1 (Installing ADAM)
You can install an ADAM instance either by using the Active Directory Application Mode Setup Wizard or by using the ADAM unattended installation process.
Below demonstrates installing ADAM using the Active Directory Application Mode Setup Wizard.
To install ADAM
1. To install ADAM, log on as an administrator, click Start, point to Control Panel, and then click Add or Remove Programs. 2. Click Add/Remove Windows Components. 3. Select the check box next to Active Directory Services, and then click Details. 4. Select the check box next to Active Directory Application Mode (ADAM) , click OK, and then click Next. 5. Review the message that appears. Based on the contents of message, do one of the following: · If the message "You have successfully completed the Windows Component Wizard" appears, click Finish. · If an error message appears, make a note of the error, click Finish, and then review the ADAM event messages in Event Viewer.
Step 2 (Create an ADAM Instance)
You have create multiple ADAM instances to support multiple application directories by assigning each ADAM instance a different Instance Name and Port #. The first ADAM instance will default to 389 (Since Active Directory also uses port 389, you should not install ADAM on the Domain Controller.) Then every subsequent ADAM instance you create will increment by 1 starting at 50000 and assign the SSL port # to 50001 (for example: 50000/50001, 50002/50003, etc…), but you can configure it to use which ever port #s you chose.
To create an ADAM instance you have two options: a. Create an ADAM Instance using a command line tool “dsmgmt.exe” àORß b. Create an ADAM Instance using the “ADAM Setup Wizard”
Option A (To install an ADAM instance by using Command line tool “dsmgmt.exe”) [To avoid Naming Violation schema errors later, create the new ADAM instance as a DC such as DC=MySchool or DC=MySchool,DC=edu] 1. First we will simply list all the existing Naming Contexts to see what is installed. NOTE: Be sure to use the port # of the local ADAM Instance you are working with…. In this case it’s 389 because this is the first ADAM instance I’m creating (every ADAM instance will have a different port #)… For the following command however, the port # doesn’t matter so much because it’s really looking at the ADAM configuration context which is shared by all ADAM instances, but it is still a good practice to use the appropriate port # especially later when we start importing schemas.
[Continue to Create a new ADAM instance] 2. Now we can create a new Naming Context (called “dc=MySchool,dc=edu”) by running the following command: (NOTE: you can also delete any existing Naming Contexts by running “delete NC dc=xyz,dc=com DomainDNS NULL”… assuming you replace dc=xyz,dc=com with the name of the Naming Context you wish to delete.)
Option B (To install an ADAM instance by using the Active Directory Application Mode Setup Wizard)
Note If the Active Directory Application Mode Setup Wizard does not complete successfully, an error message describing the reason for the failure appears on the Summary page. If an error occurs in the Active Directory Application Mode Setup Wizard before the Summary page, you can review the error message that appears. In addition, you can click Start, click Run, and type either of the following: %windir%\Debug\adamsetup.log %windir%\Debug\adamsetup_loader.log The Adamsetup.log and Adamsetup_loader.log files contain information that can help you troubleshoot the cause of an ADAM setup failure. |
Step 3 (Create a place to log synchronization events)
3. Must first ensure that the c:\windows\adam\logs directory exists or is created prior to running the following. (Simply create a new directory called “logs” under c:\windows\adam\ .)
Step 4 (Define Schema Elements for Synchronization)
1. Define the Objects and Attributes you’d like to have synchronized from Active Directory to your ADAM instance. You have two options…
a. Use the ADSchemaAnalyzer tool to select specific Objects and Attribute to synchronize. NOTE: This tool is good for comparing schemas, but there is also an ADAM Schema mmc snap-in that provide you the ability to add/remove attributes to the Class Objects prior to running ADAMsync (I will discuss this further at the end of Step 6).
àORß
b. Import the AdamSchemaW2K3.LDF and bring over all the default Windows 2003 AD objects and attributes.
<This option is by far easier!>
Option A (Use the ADSchemaAnalyzer Tool)
You can use ADSchemaAnalyzer to help migrate the Active Directory schema to ADAM, from one ADAM instance to another, or from any LDAP-compliant directory to an ADAM instance. You can use ADSchemaAnalyzer to load a target (source) schema, mark the elements you want to migrate, and then export them to the base ADAM schema. You can also compare the two schemas.
Important
When using ADSchemaAnalyzer to create an LDIF file, you should load both a target and a base schema. Otherwise, the resulting LDIF file might not be usable by the ldifde tool
To create an LDIF file with ADSchemaAnalyzer
1. Click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then, at the command prompt, type:
adschemaanalyzer
2. To load a target schema, click File, and then click Load target schema, and then do one of the following:
a. To load the domain Active Directory schema as the target schema, in the dialog box, type your user name, password, and domain, and then click OK.
b. To load a different schema (such as the schema of an Active Directory forest or an another LDAP-compliant directory), in the dialog box, type the server name and port of the directory containing the target schema, type your user name ,password, and domain as needed, and then click OK.
It should look as follows: (NOTE: Use the name of your Domain Controller server… no need to specify the port in this case because AD defaults to 389)
3. To load the schema of your ADAM instance as the base schema, click File, click Load base schema, and then in Server[:port] , type the server name and port of the ADAM instance.
4. In the dialog box, click OK.
(NOTE: Use the name of the computer where ADAM is installed and the Port (ie. MyADAMServer:389). Be sure to use the appropriate port on which this particular ADAM instance is running.)
5. In the resulting tree, mark all elements that you want to export to your base schema by right-clicking the element and selecting one of the following options:
a. Auto automatically marks an element as included or excluded in the export. If an element is marked as Auto (included) , you can right-click that element, and then click Why auto included? to see the reverse dependency tree for the element.
b. Included marks an element so that it is included in the export. ADSchemaAnalyzer marks all related elements, such as superclasses, auxClasses, must/may contains, defaultObjectCategory, and possSuperiors. ADSchemaAnalyzer includes propsets for included attributes and back-links for links.
c. Excluded marks an element so that it is not included in the export. You can block certain paths in the dependency graph. For example, you might want to import domainDns, but not samAccountDomain (which is an auxClass of domainDns). You can exclude a complete element, such as the samAccountDomain class, or you can exclude a relationship; for example, you can remove the auxClass reference from the domainDns class. If you exclude a relationship, any other classes that reference that element continue to include it.
d. Present means that the element is present on the target server. By default, the top class is marked as present.
(NOTE: If after you load both the target and base schemas you notice some that there were some “mismatch” errors reported on certain Objects/Atributes or you notice some Objects/Atributes appear in Red Text you may experience a problem later when running ADAMSync (ie you receive an “Object Class Violation”)… in this case see my comments about how to resolve this problem using the ADAM Schema mmc snap-in at the end of Step 6.)
In my case I just select the “user” class to import only user information, which as a dependency automatically includes memberOf information from the “group” class.
- To create the LDIF file, click File, and then click Create LDIF file. (For example: I saved my LDIF file as “JeffsUserClassOnly.LDF”, I’ll be using this file in the next step when I use ldifde.exe to import the target schema elements from AD (as defined in this LDF file) into my base ADAM schema.)
- Run the ldifde.exe command line tool to import the new schema elements from AD into ADAM using the LDF file you created in the previous steps:
(NOTE: You’ll notice that JeffsUsersClassOnly. LDF refers to my custom LDF file we just created above, adam-poc refers to the computer name where I running ADAM on currently, and 389 refers to the port # for this particular ADAM instance we are working with currently.)
C:\WINDOWS\ADAM>ldifde -i -j c:\windows\adam\logs -f JeffsUsersClassOnly.LDF -s adam-poc -t 389 -c "cn=configuration,dc=x" #configurationNamingContext Connecting to "adam-poc" Logging in as current user using SSPI Importing directory from file "JeffsUsersClassOnly.LDF" Loading entries................................................................. ................................................................................ ................................................................................ ............... 239 entries modified successfully. The command has completed successfully |
Now go to “Step 5”!
Option B (Import the AdamSchemaW2K3.LDF) <easiest option!>
This option brings over everything from AD to your ADAM instance, so it may be overkill, but at least you don’t have to figure out what Objects and Attributes dependencies are required for to meet your specific needs. This is good for testing purposes, perhaps later prior to going into production you may want to consider synchronizing only a subset of these Objects and Attributes. NOTE: You may need to use the “-t” parameter to specify the port # for your ADAM Instance if it is anything other than 389, otherwise it will simply default to 389… I specified it below only as a best practice.
C:\WINDOWS\ADAM>ldifde -i -j c:\windows\adam\logs -f MS-AdamSchemaW2K3.LDF -s adam-poc -t 389 -c "cn=configuration,dc=x" #configurationNamingContext Connecting to "adam-poc" Logging in as current user using SSPI Importing directory from file "MS-AdamSchemaW2K3.LDF" Loading entries................................................................. ................................................................................ ................................................................................ ................................................................................ ................................................................................ ................................................................................ ......................................... 1009 entries modified successfully. The command has completed successfully |
Now go to “Step 5”!
Step 5 (Import Metadata & Install Configuration File for ADAMSync)
1. Import the AdamSyncMetadata.LDF file to extend the ADAM configuration schema to support AD specific objects and attributes.
C:\WINDOWS\ADAM>ldifde -i -j c:\windows\adam\logs -s adam-poc –t 389 -c CN=Configuration,DC=X #ConfigurationNamingContext -f MS-AdamSyncMetadata.LDF Connecting to "adam-poc" Logging in as current user using SSPI Importing directory from file "MS-AdamSyncMetadata.LDF" Loading entries.......... 9 entries modified successfully. The command has completed successfully |
- Copy the existing defaut configuration file for ADAMSynch “MS-AdamSyncConf.XML”
C:\WINDOWS\ADAM>copy MS-AdamSyncConf.XML ADAMSyncDemo.XML 1 file(s) copied. |
- Modify XML file used as the config point for ADAMSynch. You can use “Notepad.exe” to make modifications by running the following command Notepad should load the XML file appropriately.
C:\WINDOWS\ADAM>notepad.exe adamsyncdemo.xml |
- For this example we will make minimal changes to the XML file as follows and then Save it:
<?xml version="1.0"?> <doc> <configuration> <description>Sample Adamsync configuration file</description> <security-mode>object</security-mode> <source-ad-name>DC-POC</source-ad-name> <source-ad-partition>dc=POC,dc=edu</source-ad-partition> <source-ad-account></source-ad-account> <account-domain></account-domain> <target-dn>dc=MySchool,dc=edu</target-dn> <query> <base-dn>dc=POC,dc=edu</base-dn> etc....
|
NOTE:
· <description> = This may contain ADAM Instance & Application specific information that describe what this configuration file is used for.
· <source-ad-name> = This is the computer name of the Domain Controller server you are synchronizing from… in my case my domain controller server name is DC-POC
· <source-ad-partition> = This allows you to specify which partition othe Active Directory you are synchronizing from. (For example: dc=BusinessSchool,dc=MyUniversity,dc=edu)
· <target-dn> = This is the root ADAM directory partition you are synchronizing to.
· <base-dn> = This is the root Active Directory domain partition you are synchronizing from.
- Install XML File into ADAM by running the following command, modifying the <serverName>:<port#> as follows:
C:\WINDOWS\ADAM>adamsync /install adam-poc:389 ADAMSyncDemo.XML Done. |
Step 6 (Synchronize ADAM with AD using ADAMSync)
- Run the adamsync tool modifying the <serverName>:<port#> and naming context dc=xyz,dc=edu as follows:
C:\WINDOWS\ADAM>adamsync /sync adam-poc:389 dc=MySchool,dc=edu |
That’s It! If successful. you won’t see anything printed out on the screen… it will just return to a command prompt. Congratz!!! J
However if you do get an error you should have the results written to a log file by using the /log parameter as follows:
adamsync /sync adam-poc:389 dc=MySchool,dc=edu /log c:\windows\adam\logs\mysync.log
NOTE: If you are importing the entire AD to ADAM that has several thousand objects/attributes this log file will grow huge, so be aware of this… and don’t run the logging in production sync scenarios for the sake of resource consumption.
You may confirm that the synchronization was successful by running the ADAM ADSI Edit tool.
Important Note: If your adamsync fails and you run it with the /log switch as described above and find the following error message:
Processing Entry: Page 3, Frame 1, Entry 22, Count 1, USN 0 Processing source entry <guid=d2db15678418e546bd1c58a98e0e6c60> Processing in-scope entry d2db15678418e546bd1c58a98e0e6c60. Adding target object CN=NuckollsJeff,OU=Admin,OU=Schools,OU=CentralIT Users,OU=CentralIT,dc=MySchool,dc=edu. Adding attributes: sourceobjectguid, objectClass, sn, title, description, physicalDeliveryOfficeName, givenName, initials, instanceType, info, company, sAMAccountName, mail, lastagedchange, Ldap error occured. ldap_add_sW: Object Class Violation. Extended Info: 0000207D: UpdErr: DSID-0315119D, problem 6002 (OBJ_CLASS_VIOLATION), data -1777014404 . Ldap error occured. ldap_add_sW: Object Class Violation. Extended Info: 0000207D: UpdErr: DSID-0315119D, problem 6002 (OBJ_CLASS_VIOLATION), data -1777014404 . Saving Configuration File on DC=MySchool,DC=edu Saved configuration file.
|
Then you will want to review the Objects/Attributes that are causing the error, in this case its listed in the above error (sn, title, description, physicalDeliveryOfficeName, givenName, initials, instanceType, info, company, sAMAccountName, mail, lastagedchange)
Resolution:
To recover from this error do the following:
1. Start à Run "mmc /a"
2. When the mmc console opens select File à Add/Remove Snap-in...
a. Select Add
b. When the Add/Remove Snap-in window opens select "ADAM Schema" from the list, then click Add
c. Expand the Classes list, scroll down to the Person class
d. right-click, select Properties
e. Click on the Attributes tab, then Add the following:
· sn
· Title
· Description
· physicalDeliveryOfficeName
· givenName
· initials
· instanceType
· info, company
· sAMAccountName
· lastagedchange
· displayNamePrintable (even though this one didn’t show up in our error message, you should add this one regardless)
Now try running AdamSync /sync again! Successfully this time! J