CA Service Management

  • 1.  CA EEM as a proxy for MS AD and another EEM

    Posted 12-05-2018 04:50 AM

    Hi team,

    is there a way how to configure CA EEM as a proxy for one MS Active Directory and for another CA EEM (or other LDAP)?

     

    The customer has internal analysts in the Active Directory and external users are in the separate DB. The idea was to store external users in CA EEM (EEM2 in internal user store mode) and use another CA EEM (EEM1) as a proxy for the Active Directory and the EEM2. The basic concept is in the picture below.

     

    Maintaining the external users in the internal AD is not the option for the customer.

     

    Thank you for your ideas,

    Jakub 

     



  • 2.  Re: CA EEM as a proxy for MS AD and another EEM

    Posted 12-05-2018 06:54 AM

    I'm not sure about EEM, but the included CA Directory can act as a frontent for other LDAP Servers. I think I've done such a setup in the past - AD mapped to an OU and another DSA (CA Directory) mapped to another OU, unified under the same DSA (CA Directory). EEM was configured to look up identitied under the new - umbrella - DSA.

     

    * Connect to Other LDAP Servers - CA Directory - 12.0.15 - CA Technologies Documentation 

    * Prefix Mapping - CA Directory - 12.0.15 - CA Technologies Documentation 



  • 3.  Re: CA EEM as a proxy for MS AD and another EEM

    Posted 12-05-2018 11:48 AM

    Hi Cristy,

    thank you so much for your reply... 

     

    Do you have some hints or maybe documentation from your previous project where some basic steps are described? I've never worked with CA Directory and with LDAP generally. I've red some parts of CA Directory documentation, but I'm not able even to find and start the JXweb tool. 

     

    Another question - how can I find which version of CA Directory goes with CA EEM 12.6.0.5? On the CA wiki there are many versions from 12 to 14.

     

    Have a great day and thanks again,

    Jakub



  • 4.  Re: CA EEM as a proxy for MS AD and another EEM

    Broadcom Employee
    Posted 12-05-2018 12:08 PM

    Jakub,

     

    There's a really old doc on this item, maybe that gives you some ideas: Using CA Directory to point CA Service Desk to mul - CA Knowledge 

     

    Keep in mind, CA Directory team does not support this approach anymore

     

    _R



  • 5.  Re: CA EEM as a proxy for MS AD and another EEM
    Best Answer

    Posted 12-07-2018 02:06 PM

    Finally, I tried another approach for maintaining external users instead of another EEM - Microsoft Active Directory Lightweight Directory Services (AD LDS - previously known as ADAM). The main reason was that CA EEM supports integration to multiple MS AD domains and AD LDS can be set as one of them - so no CA Directory black magic is needed and everything can be done easily via CA EEM interface.

     

    Steps to set up EEM - AD LDS integration

    1. Install AD LDS feature (step by step manual can be found here: http://www.rebeladmin.com/2018/02/step-step-guide-setup-active-directory-lightweight-directory-services-ad-lds/)
    2. Open ADSI Edit, connect to the new LDAP and create a new LDAP user
      • don't forget to enable the user and set up the password
      • add the user to the Readers group
    3. In CA EEM create custom LDAP Attribute Mapping schema
      • Since AD LDS uses name attribute instead of SAMAccountName, following changes in the ootb mapping need to be done
    4. Add the new external LDAP Directory to the CA EEM (use the new attribute map)
    5. Now my EEM is connected to two LDAP, the first one is standard MS AD, the second is AD LDS
    6. To be sure that everything is set up correctly, try to log in CA EEM as AD LDS and as MS AD user.

     

    mitu, Raghu.Rudraraju, thanks so much for your ideas,

    Jakub



  • 6.  Re: CA EEM as a proxy for MS AD and another EEM

    Broadcom Employee
    Posted 12-07-2018 02:30 PM

    Jakub_Kolacny ........

     

    Thanks for sharing with the rest of the community!



  • 7.  Re: CA EEM as a proxy for MS AD and another EEM

    Broadcom Employee
    Posted 12-07-2018 02:30 PM

    Thank you for sharing the details Jakub.  I'm sure this will help others too in future.

     

    The CA Directory approach above was doing a similar thing, it serves as a light weight directory.

     

    _R