Skip to content

Latest commit

 

History

History
96 lines (68 loc) · 10.6 KB

README.md

File metadata and controls

96 lines (68 loc) · 10.6 KB
Raw

HelloID-Conn-Prov-Target-NTFS

Important

This repository contains the connector and configuration code only. The implementer is responsible to acquire the connection details such as username, password, certificate, etc. You might even need to sign a contract or agreement with the supplier before implementing this connector. Please contact the client's application manager to coordinate the connector requirements.

Table of contents

Introduction

HelloID-Conn-Prov-Target-NTFS-Folder is a _target connector that allows you to manage the NTFS folders and permissions. If you need to adjust the permissions on the folders created by the HelloID built-in AD connector (Home, TsHome, Profile or TsProfile), the Post AD action script can be used. For creating or managing folders not created by HelloID, the GrantPermission and RevokePermission scripts can be used.

The following lifecycle actions are available:

Action Description
correlateonly/create.ps1 PowerShell create lifecycle action
permissions/HomeFolder/grantPermission.ps1 PowerShell grant lifecycle action
permissions/HomeFolder/revokePermission.ps1 PowerShell revoke lifecycle action
permissions/HomeFolder/permissions.ps1 PowerShell permissions lifecycle action
configuration.json Default configuration.json
correlateonly/fieldMapping.json Default fieldMapping.json
postAdAction/postAdAction.create.SetDirectoryPermissions.Set-ACL Set permissions to the already created NTFS folder using the command Set-ACL used in the Create Post Action of the built-in Microsoft Active Directory Target Connector
postAdAction/postAdAction.create.SetDirectoryPermissions.icacls Set permissions to the already created NTFS folder using the command ICACLS used in the Create Post Action of the built-in Microsoft Active Directory Target Connector

Getting started

Provisioning PowerShell V2 connector

Correlation configuration

The correlation configuration is used to specify which properties will be used to match an existing account within NTFS to a person in HelloID.

To properly setup the correlation:

  1. Open the Correlation tab.

  2. Specify the following configuration:

    Setting Value
    Enable correlation True
    Person correlation field PersonContext.Person.ExternalId
    Account correlation field employeeId

Tip

For more information on correlation, please refer to our correlation documentation pages.

Field mapping

The field mapping can be imported by using the fieldMapping.json file.

Prerequisites

  • The HelloID Service account requires the following permissions:
    • Local admin on the fileshare/ntfs server.
    • Full Control on the share itself (Share permissions, not NTFS permissions on the folder(s)).
    • Full Control on all folders on the share (NTFS permissions, so not Share permissions on the Share).
    • Optionally, the following policies:
      • Local Policies > User Rights Assignment > Manage auditing and security log
      • Local Policies > User Rights Assignment > Back up files and directories
      • Local Policies > User Rights Assignment > Restore files and directories

Remarks

Important

The revoke scripts use the stored account data if the AD account is removed before archiving the folder. The default target connector name NTFS is used. Please change the name on rows 54 and 55 if you use a different target connector name.

Getting help

Tip

For more information on how to configure a HelloID PowerShell connector, please refer to our documentation pages

Tip

If you need help, feel free to ask questions on our forum

HelloID docs

The official HelloID documentation can be found at: https://docs.helloid.com/