Checklist for Upgrading

To upgrade the Active Directory driver, use the following checklist. If you are not an expert with Identity Manager, you might want to engage a capable consultant.

• To use Password Synchronization 2.0, add the driver manifest and password policies.

  See Upgrading an Existing Driver Configuration to Support Identity Manager Password Synchronization.

• For continued use of Password Synchronization 1.0, add legacy polices to the existing driver configuration.

  See Upgrading Password Synchronization 1.0 to Password Synchronization Provided with Identity Manager.

• Remove the structured formatting of the sAMAccountName in the existing driver's style sheets.

  sAMAccountName was a structured attribute in the DirXML^® 1.1a Active Directory 2.0 driver. In the new Active Directory 3.0 driver, it is a string.

  Old format:

     <value type="structured"> 
      <component name="nameSpace">0</component> 
      <component association-ref="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" 
  name="volume"/> 
      <component name="path">jsmith</component> 
     </value>

  New format:

    <add-attr attr-name="sAMAccountName"> 
     <value type="string">jsmith</value> 
    </add-attr>

• Upgrade driver configuration parameters.

  We recommend the use of the following settings by default:

  <?xml version="1.0"?> 
  <driver-config name="Active Directory Driver"> 
      <driver-options> 
         <pollingInterval display-name="Polling Interval (min.)" 
         id="100">1</pollingInterval> 
         <auth-method display-name="Authentication Method" 
         id="101">Negotiate</auth-method> 
           		<signing display-name="Use Signing (yes/no)" id="102">no</signing> 
           		<signing display-name="Use Signing (yes/no)" id="102">no</signing> 
         <use-ssl display-name="Use SSL (yes/no)" id="104">no</use-ssl> 
         <pub-heartbeat-interval display-name="Heart Beat" id="105">0</ 
         pub-heartbeat-interval> 
         <pub-password-expire-time display-name="Password Sync Timeout 
         (minutes):" id="106">60</pub-password-expire-time> 
         <use-CDOEXM display-name="Use CDOEXM for Exchange (yes/no)" 
         id="107">no</use-CDOEXM> 
      </driver-options> 
  </driver-config>

• Convert the authentication ID to either the Sam Account Name (for example, jsmith) or the domain name/account name format (for example, domain/jsmith).
• Change the mapping of the Login Disabled attribute from userAccountControl to
  dirxml-uACAccountDisable.
• If you are provisioning Exchange accounts, change the driver parameter for CDOEXM to Yes, then remove the following four hard-coded attributes from your existing driver configuration style sheets:
  • msExchHomeServerName
  • legacyExchangeDN
  • homeMTA
  • msExchMailboxSecurityDescriptor