NetID Synchronization Software to Change for Active Directory

As part of the retirement of the SNAP system, the method of synchronizing NetIDs and passwords from SNAP into Active Directory will be changing. Forest administrators should contact NUIT to coordinate this change.

The current SNAP-to-AD synchronization of identities and passwords will be replaced with a commercial identity management product, Radiant Logic, which NUIT has purchased, installed, tested, and implemented.

All forests currently synchronized to SNAP must be moved to the new software before August 2007. NUIT will work with each forest administrator to create a transition plan and schedule. In general, the issues requiring attention include:

1. Communication to the forest will be over LDAPS, so domain controllers will require an SSL certificate.
2. The SNAP scheme places code on the domain controller which can invoke "user exit" scripts for several events, including user creation, user deletion, and password changes. The new software does not have code on the domain controller and thus cannot invoke scripts. For special processing of new users, we recommend that new users be created in a special, dedicated OU, and that a local script run periodically to check for User objects in that OU, process them, and move them elsewhere.
3. The SNAP scheme can create a home directory owned by a user on a file server accessible to the domain controller. The new software cannot create home directories. According to feedback, folder redirection is now preferred over explicitly setting a home directory in AD.

• Converting AD Forests from SNAP Synchronization to Radiant Logic ( PDF)
• Enabling LDAPS on a Domain Controller ( PDF)
• Enabling LDAPS on a Domain Controller Examples ( ZIP)

Contact Albert Lunde to set up a consultation on your particular situation.