Use case: Map existing AD groups to roles in ForgeRock Identity Cloud

Author:

Lucy Billington

Created at:

Jun 2023

Updated at:

Jun 2023

Use case overview

In ForgeRock Identity Cloud, Active Directory (AD) groups are assigned to roles either dynamically through a mapping between the two identity stores or statically through the UI or REST.

In this use case, we’ll demonstrate how the relationship between AD groups and Identity Cloud roles can be managed by:

  • Using AD groups to control ForgeRock role membership

  • Using ForgeRock roles to control membership of existing AD groups

Pre-configuration

AD groups and users

For the examples in this use case, an AD group called 2d has been configured, with the following group members:

  • 2d-user1

  • 2d-user2

  • 2d-user3

Connectors

A Remote Connector Server (RCS) has been deployed and connected to Identity Cloud. See Sync identities for further information.

A connector to Active Directory has already been configured. See LDAP connector for further information.

Mappings

See Resource mapping for further information on setting up a mapping between an external resource and Identity Cloud.

For the examples in this use case, the following two mappings have been created:

  • A mapping from AD to Identity Cloud: System/AD/Account → managed/Alpha_user

  • A mapping from Identity Cloud to AD: managed/Alpha_user → System/AD/Account

System/AD/Account → managed/Alpha_user

https://backstage-community-prod.storage.googleapis.com/original/2X/7/7f633ea1c47f57b026626ac84f2b4f875723b7e2

The following attributes have been mapped (Attributes Grid):

https://backstage-community-prod.storage.googleapis.com/original/2X/6/64b117f6bc90ca21988b21d919206b9ee68ffb6e

The following correlation query has been configured (Association > Association Rules > Correlation Queries > Add Correlation Query):

https://backstage-community-prod.storage.googleapis.com/original/2X/a/ac271f643119682ffbf0eadfef736110bf5db242

Managed/Alpha_user → System/AD/Account

This mapping is linked to systemADAccount_managedAlpha_user.

https://backstage-community-prod.storage.googleapis.com/original/2X/3/36d4c1521064babd08bf8b101aa86360cf97ac20

The following attributes have been mapped (Attributes Grid):

https://backstage-community-prod.storage.googleapis.com/original/2X/e/e1a775f63d0a7e0f24a49577c22d3d0dfd98662b

The following Situational Event Script has been created (Behaviors > Situational Event Scripts > onCreate):

https://backstage-community-prod.storage.googleapis.com/original/2X/6/62cb41152be3df654b13fcde406e7055d347c954

Reconcile the mappings

For both the mappings, behaviors (Behaviors > Policies) were set to Default Actions and the mappings have been Reconciled.

Use AD groups to control ForgeRock role membership

With this configuration, adding a user to a group in AD and then reconciling the mapping will result in that user appearing in a specified AD group member’s role in Identity Cloud.

  1. Sign in to the Identity Cloud admin UI using your admin tenant URL, in the format https://<tenant-name>/am/XUI/?realm=/#/.

  2. Go to Native Consoles > Identity Management > Configure > Mappings > <mapping>. In our example, we’ve selected systemAdAccount_managedAlpha_user.

  3. Go to Properties > Attributes Grid > Add property.

  4. Add the property ldapGroups `→ frIndexedMultivalued5`.

  5. Click Reconcile to reconcile the mapping.

  6. In the Identity Cloud admin UI, go to Identities > Manage > Alpha realm - Users and select an AD group user, for example, 2d-user1.

  7. Click the Raw JSON tab and copy the group name string, for example: "CN=2d,OU=groups,OU=orgUnitName,DC=server,DC=domainComponent,DC=org"

  8. Go to Identities > Manage > Alpha realm - Roles > New Alpha realm - Role.

  9. Create a role, similar to this example:

    • Name: AD Group members

    • Description: Role consisting of members of the AD Group

    • Settings > Condition > Set up (toggle on A conditional filter for this role) > Advanced editor:

      /frIndexedMultivalued5 co "CN=2d,OU=groups,OU=orgUnitName,DC=server,DC=domainComponent,DC=org"

      https://backstage-community-prod.storage.googleapis.com/original/2X/8/83984104d662e58ca1536f6cb0c35e7ad76b737f

  10. Click Save.

  11. Click the Role Members tab and notice that all three users in the AD 2d group (2d-user1, 2d-user2, and 2d-user3) are now role members.

Adding another user to that group in AD, then reconciling, will result in that user appearing in the 2d AD Group members role in Identity Cloud.

Use ForgeRock roles to control membership of existing AD groups

With this configuration, adding a user to a role in Identity Cloud will result in that user getting membership of a specified AD group.

  1. In Active Directory, create a new group called static and make note of the distinguishedName of this group (in the Attribute Editor), similar to this: CN=static,OU=groups,OU=orgUnitName,DC=server,DC=domainComponent,DC=org.

  2. Sign in to the Identity Cloud admin UI using your admin tenant URL, in the format https://<tenant-name>/am/XUI/?realm=/#/.

  3. Go to Identities > Manage> Alpha realm - Assignments > New Alpha Realm - Assignment and create an assignment:

    a. Enter a name and description for the assignment, and select the mapping.

    In our example, the assignment will be applied to the mapping, managed/alpha_user > system/AD/account.

    https://backstage-community-prod.storage.googleapis.com/original/2X/d/d9c395ec647fc3a1f185d09607d7a7e6c07dc30b

    b. Click Next.

    c. Click Add an attribute.

    d. Select an attribute from the drop-down list, and enter a value for the attribute, similar to this: * Target system attribute: ldapGroups * Value: Enter the distinguishedName of the static group, for example ["CN=static,OU=groups,OU=orgUnitName,DC=server,DC=domainComponent,DC=org"]

    + https://backstage-community-prod.storage.googleapis.com/original/2X/6/6e7f046c3d559844aa6fcc80400e6c3c5afe304c

    + e. Click Save.

  4. Go to Identities > Manage > Alpha realm - Roles > New Alpha realm - Role and create a role:

    a. Enter a name for the role ( Static role in our example). You don’t need to add any role assignments or time constraints. Click Next.

    b. Click Managed assignments > Add Managed Assignments.

    c. Select the Static AD group assignment that you just created and click Save.

    https://backstage-community-prod.storage.googleapis.com/original/2X/6/636f06f8cef14be1c9a7f6a024ed8f8c2018a2f4

  5. Add a new role member to the role you just created.

Notice that the new user gets the group membership in AD.

Additional resources

Documentation:

Training videos: