Guide Overview

The Incident IQ ADFS App allows administrators to integrate Incident IQ with Active Directory Federation Services (ADFS). It comes with the Incident IQ LocalAd user sync service, which automatically populates user data in iiQ from the active directory server. This allows users to seamlessly log in to Incident IQ using ADFS single sign-on.

The following guide is designed to provide step-by-step instructions on how to install the Microsoft Onsite Active Directory App.

 

Guide Index

You can use the following links below to quickly navigate to a specific section in this document. To quickly return to this index simply use the Return to Index link located at the end of any section.

  1. App Installation
  2. Creating an Active Directory User
  3. Downloading the Service Provider Metadata
  4. Establishing the ADFS Party Trust
  5. Mapping SAML Attributes
  6. Downloading SYNC and Configuration ZIP Files
  7. Configuring the Active Directory Integration
  8. Creating a Scheduled Sync Task

 

App Installation

Before beginning the installation process you will need to ensure you have the following:

  • Ability to create and edit user permission in your active directory.
  • A machine that runs .NET Framework v.4.5.1 or higher and also has network access to reach your district's AD server.

Begin by selecting Incident IQ Apps > Browse on the left navigation bar.

Browse_Apps.png

Click on the Microsoft ADFS app and then select Install to begin.

Microsoft_ADFS_App_Install_1.png

Step one of the installation process simply provides an overview of how installing the Microsoft ADFS app will affect your Incident IQ installation. Select Continue once you are ready to proceed to step two.

Microsoft_ADFS_App_Install_2.png

Step two of the installation process simply provides an overview of how installing the Microsoft ADFS app will affect your Incident IQ installation. Once you have completed your review select Install App to begin the integration process.

Microsoft_ADFS_App_Install_3.png

Once the installation has been completed you can now begin creating an active directory user.

Microsoft_ADFS_App_Install_7.png

[Return to Index]

 

Creating an Active Directory User

Once you've installed the Microsoft ADFS app in Incident IQ, you will now need to create a new user in your Active Directory. This user will need the following roles assigned to it:

  • Replicating directory changes.
  • Replicating directory changes in filtered set.
  • Replicating directory changes all.
  • Read.

warning.pngImportant Note: You will need to complete this step before proceeding. If you are unfamiliar with how to grant these specific permissions to a user then please refer to the following Microsoft help guide on Giving Users Replicating Directory Changes Permissions.

[Return to Index]

 

Downloading the Service Provider Metadata

For the next phase of the ADFS installation, you will need to click on Download Service Provider Metadata under the General section of the Overview tab.

Overview_Tab_2.png

In the new tab, copy the URL in the window that opens with your site's metadata. This link will be used in the next section of your ADFS installation.

ADFS_Metadata_2.png

[Return to Index]

 

Establishing the ADFS Party Trust

On your AD server, begin by running the application ADFS (Active Directory Federated Services). Right-click the Relying Party Trusts node in the tree and click Add Relying Party Trust.

Add_Relying_Party_Trust.png

This will open the Add Relying Party Trust Wizard. From here, make sure to keep the Claims Aware option checked before clicking on Start.

Claims_Aware_1.png

Make sure the "Import data about the relying party published online or on a local network" option remains checked. In the "Federation metadata address" field you will need to paste the URL copied in during the previous section. Once you have the metadata link filled out, click Next.

Claims_Aware_2.png

In this step, you can keep the default name for the relying party or rename it to whatever you would like. Once you are satisfied with the name, click Next.

Claims_Aware_3.png

Leave "Permit everyone" checked on the "Choose an access control policy" section then click Next.

Claims_Aware_4.png

You will not need to do anything in the next step. Simply click Next.

Claims_Aware_5.png

Make sure "Leave Configure claims issuance policy for this application" checked then click Close.

Claims_Aware_6.png

In the Edit Claim Issuance Policy dialog that now is displayed, click Add Rule.

Claims_Inssuance_1.png

In the next step, leave Send LDAP Attributes as Claims selected and click Next.

Claims_Inssuance_2.png

Give the claim rule a name of your choosing (ie. IncidentIQ). In the Attribute store dropdown, select Active Directory.

Claims_Inssuance_3.png

Finally, you will need to map one or more LDAP attributes to send to IIQ that will be used to lookup the user. It’s important that you pick attributes that have the same value in both systems while being unique and available for all users that will be logging in. For most districts, mapping the username and email address will be sufficient. Once mapped, click Finish.

Claims_Inssuance_4.png

When you’re happy with your mapping, click View Rule Language. That will bring up a dialog similar to the one below. Take note of the URLs that start with the following:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/

These are the SAML attributes that will be passed to IncidentIQ and will need to be mapped inside of the Incident IQ ADFS app. This will be covered in the next section. Click OK on all three open dialogs to bring you back to the main ADFS window. This part of the setup is now complete.

[Return to Index]

 

Mapping SAML Attributes

At this point, you will need to map your SAML attributes that were identified at the end of the previous section. Begin by navigating to the Microsoft ADFS app in Incident IQ and selecting the Identity Provider Settings tab.

ADFS_SAML_Mapping_0.png

In the SAML Attribute Mapping section, click on the Add New Map button.

ADFS_SAML_Mapping_1.png

Next, you will need to enter your SAML data URL into the SAML Attribute Name field followed by selecting which user data field this should correspond to in Incident IQ. This process must be repeated for each data field you want to pull from ADFS.

ADFS_SAML_Mapping_2.png

Once you have completed mapping your SAML data URLs, click Save at the bottom of the page.

ADFS_SAML_Mapping_3.png

[Return to Index]

 

Downloading SYNC and Configuration Files

Now you will need to download the application for the AD-iiQ sync. This application will need to be downloaded on a machine that has network access to reach an AD server (you can run it on the AD server itself, but that's not a requirement). Additionally, the machine that runs the app will need to have the .NET framework v4.5.1 or higher.

You can download this file from the Microsoft Onsite Active Directory (v2) app in Incident IQ. To access this file, begin by selecting Incident IQ Apps > Manage on the left navigation bar.

Manage_Apps.png

On the Installed Apps tab, find the Microsoft ADFS app and click on Manage.

Manage_ADFS_App.png

This will take you to the app Overview tab. From here, you will need to click on Download Local AD Synchronization Executable to download the executable zip file.

Overview_Tab_1.png

Next, you will need to download the UserSync.conf file. In the Overview tab, click on the Download Configuration Template button.

Overview_Tab_3.png

[Return to Index]

 

Configuring the Active Directory Integration

After you have created your AD user and downloaded the necessary files, you will now need to extract the Microsoft AD Connectors file. Once all files have been extracted, move the UserSync.conf file into the unzipped folder containing sync application.

Next, run the application titled IncidentIQ.Connectors.MicrosoftAd.exe. This will open up a new application window.

Settings_Configuration_0.png

In the top section of the application window, you will need to modify the following default settings: ADUsername, ADPassword, ADDomain, and ADIp.

warning.pngImportant Note:All fields must be kept inside of quotation marks. Data entered without these quotations will not configure properly.

Settings_Configuration_1.png

The ADPassword value should be encrypted. To get the encrypted value to fill into the settings, click the Common tab and enter the AD password in the text field labeled Clear text. Copy the Encrypted value and paste it as the value for the ADPassword setting.

Settings_Configuration_2.png

Once all of your settings have been entered, click Save configuration.

Settings_Configuration_3.png

After you've confirmed that the configuration has successfully saved, click Run now.

Settings_Configuration_4.png

Running the application can take a while depending on the number of users in your AD (syncing about 10,000 users takes roughly 10-15 minutes). Upon completion, you will see a message stating "Completed sending data to IncidentIQ."

[Return to Index]

 

Creating a Scheduled Sync Task

To schedule the sync to occur automatically, you'll need to create a task in Windows Task Manager. You can do so by searching for Administrative Tools and selecting Task Scheduler. This will open the Task Scheduler window.

Task_Scheduler_1.png

In the Task Scheduler window, start by clicking on Action > Create Basic Task...

Task_Scheduler_2.png

This will open the Create Basic Task Wizard. At the very least, you will need to provide a name for the new task. You can also add a task if desired. Once complete, click Next.

Task_Scheduler_3.png

In the next step, you will be asked to select when this task should Trigger. We recommend running it daily (overnight) for the most accurate user data. Please ensure you set the task to run regardless of whether a user is logged in or not on the server. Once complete, click Next.

Task_Scheduler_4.png

For the next step, you will need to specify what action the task will take when running. Select Start a Program and then click on Next.

Task_Scheduler_5.png

When specifying the action to perform, locate the file IncidentIQ.Connectors.MicrosoftAd.exe in the Program/script file browser. Supply the argument -usersync in the Add arguments field. And finally, you will need to indicate the path you unzipped the files to in the Start in field. Once complete, click Next.

Task_Scheduler_6.png

In the final step, you may review all of the settings of your task. Once you have completed your review, click Finish to complete the task set up.

Task_Scheduler_7.png

[Return to Index]

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.