welcome back to the ascent and to our very first
episode so today we're going to be talking all
about the ACC directory services kind of getting things
set up but we wanted to do just an additional intro for you because we
previously recorded this at not as good of quality we're still
learning this whole recording thing so uh you you'll transition we're not
youtube styles right we're not quite there yet so
we the content is great but just some of the
the quality is a little bit uh so so so um hope that doesn't mess things up too
much for you but just wanted to introduce
it properly um yeah yeah yeah we we kind of learned in our first two
episodes that instead of doing a zoom recording between us that we could just
record things locally and stitch it together
but hey we're not youtube stars we didn't really google this beforehand
content's great people are okay um but you'll
watch the first episode and probably number two
slight bit grainy but it all gets better from that gets better from there
it all does all right so sit back relax enjoy
enjoy episode one what we're going to do um
is the the component that we need to do all of the integration into directory
services from the Workspace ONE UEM side is a
component called the Airwatch Cloud Connector
um so on the screen here I've got my tenant I've signed in I've actually just
done a little bit of branding i've just put
our our company in modern peak it's uh brooks' idea here and lives out in
colorado and so what we've done is we've got a
tenant here we've got um a getting started wizard this is a
good way to start um often if you don't have the expertise
so at the moment to go through the the console components the wizards
really help you through all of those different steps so you can actually set
up the mobile device management wizard or the Workspace ONE wizard to go
through all of those configurations um Brooks and I like showing you the
hardware so we're going to go through and do this
the old-school way show you all of the different bells and whistles that you
need and how they all work
so we need to go firstly configure directory services which involves
installing an on-premises component that talks back to your active
directory so it talks over LDAP and it's a component called the
um the Airwatch Cloud Connector and to get the installer for it you go into
groups and settings uh and then you go into all settings and
you go into system and then you go into enterprise
integration and you go into cloud connector and what this will do
you just go set this to enable um you set the cloud connector to do things
like auto update so as your console version
updates if there are new features and functions
that go into the AirWatch Cloud Connector the console will actually
update the cloud connector to match the version that's coming from the console
that's usually a good best practice from here so what i'm going to do is download
the cloud connector install um it asked me for a password six digit
password you really need to put this into the installer when it comes up
it's just a validation step make sure that it's connecting to the right
environment and you'll see the the cloud connector
install will will come down and we can um configure it very shortly
if you don't see the installer link right there just click save on that
screen and then it will pop up and allow you to download it let's
found that out yeah exactly um and then if you've got
other the cloud connector does a bunch of different functions as well
um so the two big ones we typically see from customers are
connecting to directory services and then connecting to an internal
certificate authority so say you have a Microsoft CA and
you're using that to issue user certificates um you can connect
the AirWatch Cloud Connector to your internal CA
and use the ACC to generate certificates based upon a request template that you
define and that makes it really easy for
onboarding a device and a certificate comes down
and the ACC is pretty cool that it allows you to do certain life cycles so
renew a certificate um when it comes to a point of uh
close to expiry date and also when you unenroll the device you can set it to
revoke the certificate as well and the device doesn't have to have a
line of sight directly to your CA yeah it can it can be on the internet
and the ACC will kind of talk between the UEM and the
certificate authority yep exactly and then other components
that the ACC does is i've seen customers integrate this into syslog
services as well so they can connect it back to a syslog service
um and then there are some other additional functions that you can do by
connecting it to non-Microsoft CAs as well
but you'll see that the Airwatch Cloud Connector install is done if I go into
my downloads folder here you'll see it i'm going to run this as administrator
always a good practice to do it that way um so i'm actually on the server that
i'm going to do the ACC install on um obviously you want to if you've
downloaded this let's say locally to your machine you want to transfer that
install file across to the right machine that you want to be installing it on
so i'm going to go through next here i'm going to accept that end user licensing
agreement i'm going to install it in the default
directory um for the ACC and if I had a proxy in my environment i
would just select the outbound proxy and then go put in my proxy details
and as part of this right so in our environment we don't have a proxy
but this this component like a lot of those on-premises components are proxy
aware so you can configure that as part of the installation i'm going to hit
install to complete that and this will run through the remainder of the
installation of the Airwatch Cloud Connector
so this will run through the install what's nice about this is once it
completes it will start up the services um by the
way i have skipped a step as part of this um one of
the key requirements for the Airwatch Cloud Connector is to have
NET framework already on the server um if it
isn't there that's not a problem ACC will actually say you need to install
.NET before the acc runs um .NET is 110 MB to install and it takes
10 to 15 minutes altogether to download and do
upon that it will do a reboot so it'll reboot and then the ACC install will
kick off automatically afterwards and give you that please click next and then
the end you use the licensing agreement page
so i'm going to hit finish here you'll see the acc install has been done
a good practice um if you if you want to is to go in and set the
view log file um and just make sure that that installs
happened successfully i am going to cheat though
and just go into the general tab and then you can actually test the
connection and make sure the ACC is talking outbound
to your cloud instance so if i do a test connection here
you'll see that i have reached the cloud connector on my
and this is my particular server here so now to reboot the server
um so only if you don't have TLS 1.2 enabled
um it will actually at the at the end of the install it will turn it on
and then kick off a reboot cycle and then the test connection will work
so the acc install will will run you through
um upon its configuration of TLS 1.2 it'll reboot the machine it'll ask you
to reboot the machine to successfully complete the install
um but i've done done a few of those things in the past so
uh the net framework was already there so i didn't have to do that reboot cycle
and TLS 1.2 was already there so i didn't have to do that either
so now that i have a cloud connector in this environment i'm ready to
start configuring the directory now if you do the directory services
option in here there's a wizard um you'll actually get an option for a
wizard to go do I want to go configure it through
that way um it's sad to say but in five and a half years of working at
VMware I've actually never done the wizard
um I always force people to go down the manual step just because you can see
what configuration options you've got available to you
and any customizations that you want to do you can do it as part of this process
so the directory type I'm selecting here you've got a couple of different LDAP
options we're going to go through and do Active Directory because we are
connecting this to AD and the first thing you're going to
get asked for is your server and this is your one of your
domain controllers here so i'm going to remove
that and i'm going to put in there's my
server my encryption type I'm just using straight LDAP i'm not using
secure LDAP so I'm using port 389 and I'm going to use my bind
authentication as gss negotiate and then what i need to do is provide a
credential for the ACC to use to go talk to active
directory and at the minimum the permissions that
we need is read access only um we don't need to write attributes to
id we're simply reading things that exist
in Active Directory and feeding it back into the Workspace ONE
UEM console so I've got my bind username this is a service account that
I've created I mean for testing you could use your own account but
obviously you want something that doesn't have a password that expires or
or needs to be changed very regularly so i'm going to go with a bind username
there that's a service account that i've created
and then in my bind password here I've got
I'm going to go put in password for my service account
and then i'm going to put in the netbios name of my domain here
so i've got that and then it's going to pick up my
server from here if i scroll a little further down this page here
i've got some options for doing things like SAML for authentication so if i
want to enroll my devices but i have an existing
identity provider that i want to connect this
to i can actually go in and enable and set
Workspace ONE UEM as a SAML service provider for a for an IdP
um and that's something we'll get into in another episode
and the same thing with Azure AD integration it's incredibly important
for the outer box enrollment workflow it's
also very important to go connect this to your azure
environment so again another thing we'll go through because
it is such a critical piece to that modern windows 10
workflow
and one thing to note is we sort of skipped over this part but
we're setting this up at the sort of top level OG for our
our company organization group you can see the little modern peak llc at the
top there that's usually how customers do it
sometimes they'll create another sub one call it production and then you can
create some ou's or ogs that inherit all that so
just kind of be mindful of that in the future
that it's important to make sure that this is set at a place where every other
organization group can use it um so childs can inherit but if it's a sibling
like on the equal level then it's it's not going to inherit that
and then as well the Azure AD integration it is required to put it at
the same place as this that we're doing right now
so um yeah you want to just make sure they're
the same so if you have like oh I want Windows 10 way down on this other OG but
i put up the ACC up here that's going to be
problematic because you may not be able to set it lower so we
like to keep it kind of at the top and kind of keep it
fairly simple OG structure but we'll have a whole different episode on
kind of best practice OG stuff so stay tuned for more that yeah
especially the OG but it's really interesting because you know for
those organizations that are going through mergers and acquisitions and
pick up new organizations um a lot of how you connect to
directories is all based upon trust so you can have one acc the ghost talks
out to multiple ADs assuming that there's trust between
them if there isn't however you're going to need to put it in a separate
organization group with its own separate AirWatch Cloud Connector
but a topic that we could go into significantly more detail than we'll in
another episode
so we've got the the server components done um
if i was to hit save down the bottom here it actually doesn't work until i
fill the rest of it out so i'm actually going to go right back up
to the top and there's there's a user tab and a group tab
and if you've done everything correctly on the server side this will actually go
through and do a search on the base dn and you'll see that as it will do it'll
pick up my base dn from the server details if i had made a
mistake this would actually come up blank
should just prove a point if i did that dot co
go into user click on it and you'll now notice
that it's not going to pull anything so it's it's telling me that i've actually
made a mistake in my server configuration details
so i'm going to go fix that really quickly i'm going to go into my user tab
and you'll notice now that i have the ability to go choose
my base DN so there's my base DN it's done um and I
can do that from here if i needed different user
parameters to put in I can do that one I do like doing is automatically
sync enabled or disabled user status so in the you know in in the case of
like moves adds and changes and say someone leaves the organization
and you mark their account as as as not active
we can sync in the status of that flag that user as inactive
and then um perform an enterprise wipe if required on the device
so there's a couple of safeguards that allow you to to make that admin
experience a little bit easier
um so i've done the user tab let me go to the group tab do exactly the same
thing here um again it's just going to pick the same search filter you'll see
that I've got my base dn and is as dc equals modern peak.com
so there we go we've got our base dns in now I can hit save
and you'll see that the configuration saves successfully but more
importantly if i go into the test connection from here
um you'll see that i've got a domain status that says uh
can successfully connect given that username find username and password so i
am able to authenticate to the to the domain more importantly if i go search
for a user so if i go search for myself and hit
check user as a directory user you'll see that all of my user
attributes that I wanted from my active directory are there
and which means as I enroll that device in
all of these attributes will be synced from my active directory
into my Workspace ONE UEM console for that user
yeah pretty cool yeah if you um if you go in here and for whatever
reason you click test connection it doesn't pop up the screen and it sort of
errors out just on the main screen uh just save and
go back into the console ui and try it again i've seen sometimes
that kind of bugs out yeah so it's supposed to do a separate
pop-up window for the test there yep exactly and if you're having issues
um logs are your best friend so let's go
into the ACC if you go into where you
downloaded you've got your AirWatch Cloud Connector
installation log here so if i go open this up
if you had problems with your install as it went through you'll see it in here
you'll see why that aired out and then if you want to actually go monitor
some of the logs on your ACC you just go see
VMware AirWatch logs cloud connector and there's your
cloud connector log you'll be able to see what's happening
on the cloud connector and troubleshoot any connections that you may have
or or why a user sync didn't work
correctly that's that that was that was an ACC
install pretty straightforward to do um we'll do a we'll do a uh
a connection to a certificate authority at some point in the future but it's a
good starting point it's a great way to go through with this
and the last thing you want to do from here just really prove a point I know
the test connection did it but if I go into accounts
go into users and add a user here um you'll notice that i've got it set to
basic so i actually have to go change the settings
so at the moment it's saying i can only use basic users
so let me go into groups and settings first all settings
i'm going to go devices and users general and i'm going to go into
enrollment and i currently have enrollment set let
me override these settings here enrollment's currently set to use basic
i want to change that to directory auth as well
so i can use my directory users to authenticate here
i'll hit save and now i should be able to go back to the accounts
to the user tab and then now i've got the option to go
get a directory user and let me just go try Brooks
how do these users get automatically added to the console
um so they can get at automatically out of the console a couple of different
ways uh one of them is as you enroll the
device if that user record doesn't exist in the console
it will get added into the console automatically and the other
option is to do uh syncing in something like a user group
and a user group in Workspace ONE terms is really
maps back to an ad security group in ad terms
so what you could do is you can import an ad security group and then
fill in all the users and it would grab not only the group
but all of the user objects that are in there
yeah so to test you you do small groups and then
for production you would eventually add one or multiple
groups to make sure that all users get added
and then like Adarsh said if for whatever reason there's a they do a domain
enrollment with the domain user and it's not there it'll just go ahead and create
a new one and then uses the object guide attribute
it's kind of the main source anchor um so that will become a little more
important once we start talking identity manager Workspace ONE Access as
well as Azure AD
that was it that's all i had so awesome well thanks Adarsh uh pretty
basic video to start just talking about step one of mini and
then in future videos we'll start adding more components and getting
into more complex enrollments and deployment scenarios
thanks for watching