PowerShell
The PowerShell application template allows you to provision users to a PowerShell instance.
Register the application
-
In the Advanced Identity Cloud admin console, go to Applications, and click Browse App Catalog.
-
In the Browse App Catalog modal, select an application, and click Next.
Select the latest application version.
-
Review the Application Integration information, and click Next.
-
In the Application Details window, specify the name, description, application owners, and logo for the application.
-
To make the application an Authoritative source of identity data, select the Authoritative check box. This option is not available for every application.
-
Click Create Application.
Configure provisioning
You can use the PowerShell Connector Toolkit to create connectors that can provision any Microsoft system, including but not limited to Active Directory, Microsoft SQL, MS Exchange, SharePoint, Office365, and Azure. Any task performed with PowerShell can be executed through connectors based on this toolkit.
The PowerShell Connector Toolkit lets you develop connectors in PowerShell that address the requirements of your Microsoft Windows ecosystem. The framework is included with the .NET RCS server. Note that the framework itself is not a connector.
The Powershell Connector toolkit is built-in to the .NET RCS server.
Connectors created with the PowerShell Connector Toolkit run on the .NET platform and require the installation of a .NET connector server on the Windows system. To install the .NET connector server, refer to Sync identities.
| The PowerShell connector combines a command-line shell and scripting language, built on the .NET Framework. For more information, refer to PowerShell Documentation. |
-
In the Advanced Identity Cloud admin console, on the Provisioning tab:
-
If setting up provisioning for the first time:
-
If you have not done so already, create an application.
-
On the Provisioning tab, click Set up Provisioning.
-
-
When editing existing settings in the Connection area, click Settings.
-
-
Configure the following fields:
Field Description Active Directory Host
The host name or IP address of the Active Directory server.
Active Directory Port
The port number on which the remote resource listens for connections.
Login
The user account in the remote resource that is used for the connection.
Password
The password of the user account that is used for the connection
Authenticate Script
The name of a script file that uses a custom PowerShell script to implement the ICF authenticate operation. The ICF authenticate operation lets an application authenticate an object on the target system, usually with a unique identifier (username) and a password.
To reference a script, use the format
C:\path\to\script\script.ps1.Create Script
The name of a script file that uses a custom PowerShell script to implement the ICF create operation. The ICF create operation lets an application create objects on the target system.
To reference a script, use the format
C:\path\to\script\script.ps1.Delete Script
The name of a script file that uses a custom PowerShell script to implement the ICF delete operation. The ICF delete operation lets an application delete objects on the target system.
To reference a script, use the format
C:\path\to\script\script.ps1.Schema Script
The name of a script file that uses a custom PowerShell script to implement the ICF schema operation. The ICF schema operation lets an application describe the types of objects that it can handle on the target system and the operations and options that the connector supports foreach object type.
To reference a script, use the format
C:\path\to\script\script.ps1.Search Script
The name of a script file that uses a custom PowerShell script to implement the ICF search operation. The ICF search operation lets an application search for objects on the target system.
To reference a script, use the format
C:\path\to\script\script.ps1.Sync Script
The name of a script file that uses a custom PowerShell script to implement the ICF sync operation. The ICF sync operation lets an application poll the target system for synchronization events created by changes to target objects.
To reference a script, use the format
C:\path\to\script\script.ps1.Test Script
The name of a script file that uses a custom PowerShell script to implement the ICF test operation. The ICF test operation lets an application test the connector configuration against the target system.
To reference a script, use the format
C:\path\to\script\script.ps1.Update Script
The name of a script file that uses a custom PowerShell script to implement the ICF update operation. The ICF update operation lets an application update (modify or replace) objects on the target system.
To reference a script, use the format
C:\path\to\script\script.ps1.UID attribute name
The attribute on the resource that contains the object
UID.NAME attribute name
The attribute on the resource that contains the object
NAME.Substitute UID and NAME in query filter
Enable if the
UIDandNAMEshould be replaced by the value defined in theNameAttributeNameandUidAttributeNamein the query filter. -
Optionally, click Show advanced settings to set any of the following options:
Field Description Variables Prefix
To avoid variable namespace conflicts, define a prefix for script variables. All variables are injected into the script under that prefix and can be used with the dotted notation.
The default value is
Connector.Query Filter Type
To define the format used when injecting the query into the connector, set a query filter type by clicking one of the following:
-
Map - The query filter is a map.
-
Ldap - The query filter is in LDAP search format, for example,
(cn=Joe). -
Native - The query filter is a native OpenICF query filter.
-
AdPsModule - The query filter is compatible with the Active Directory PowerShell module,
Get-ADUser Filter.
Reload script on execution
To reload the script from disk every time the connector executes the script, enable this setting.
This can be useful for debugging. In production, disable this setting.
Use Interpreter’s Pool
To leverage the PowerShell RunSpace Pool, enable this setting.
Min interpreter pool size
The minimum size of the interpreter pool. The default value is
1.Max interpreter pool size
The maximum size of the interpreter pool. The default value is
5.Pool cleanup interval
To specify the interval (in minutes) to discard unused interpreter instances. To avoid cleaning up unused interpreter instances, set this property to
0. The default value is60.PS Modules to Import
An array of additional PowerShell modules that must be imported
Custom Properties
An array of Strings that define custom configuration properties. Each property uses the format
name=value.Exclude Unmodified
Select this option to synchronize only the modified properties on a target resource.
-
-
Click Connect.
-
Verify the information in the Details tab.
Provision side tabs
The object type determines the side tabs that display on the Provisioning tab.
Use the object type list to select an object type, such as Group.
Afterward, you can configure properties in the different sub-tabs under the Provisioning tab.
| Provisioning tab | Description | Related sections |
|---|---|---|
Details |
View and manage an application, including name, ID, and native type. |
Select the specific application from Provision settings for an application. |
Properties |
View and manage properties for the selected object type. |
|
Data |
View data about the selected object type. |
|
Mapping |
View and manage mappings from the Advanced Identity Cloud admin console properties to external system properties and from external system properties to the Advanced Identity Cloud admin console properties. |
|
Reconciliation |
Preview mappings on target applications between external systems and the Advanced Identity Cloud admin console, and reconcile the data between the two systems. View and manage rules for the users and groups that use your application. View and manage schedules for Full and Incremental reconciliation. |
|
Privacy & Consent |
Manage end-user data sharing and synchronization. |
|
Rules |
View and manage provisioning rules for mappings between Advanced Identity Cloud and a target application. |
|
Advanced Sync |
Create and manage mappings between an identity profile and an application or between applications. |