PingOne Users and Groups Synchronization in WebADM

Overview & Concepts

Overview and Concepts

Building a Unified IAM Infrastructure
In large organizations, consolidating Identity and Access Management (IAM) systems from different vendors across various locations is a daunting and often impractical task. This is especially challenging for corporate groups and companies that frequently acquire new subsidiaries, resulting in fragmented information systems. Consolidation projects are typically long, costly, and rarely yield the expected results, leaving behind a mix of well-integrated systems and legacy systems that still need to function.

RCDevs addresses these challenges by offering a federated approach to IAM and Identity Provider (IdP) management. The RCDevs solution federates multiple IAM systems, integrating them into a cohesive meta-IAM platform. This top-level meta-IAM provides a unified view of all the underlying IAM systems, allowing seamless integration with cloud or on-premises services like email, VPNs, and OpenID Connect (OIDC). With this approach, there's no need for complex IdP cascading or password management, simplifying the IAM consolidation process.

For example, consider a corporate group, MyCorp, which has acquired two companies—one using Okta and the other using local Active Directory (AD) systems—while MyCorp itself uses PingOne. RCDevs creates a meta-IAM that aggregates these disparate systems into a unified platform. This enables cross-IAM application access policies, unified UPN naming conventions, and centralized IdP services across the entire organization.

WebADM and External IAM Integration
With the introduction of WebADM version 2.3.20, RCDevs enhanced its platform with native integration capabilities for external IAM providers. This feature allows organizations to synchronize accounts and groups from their cloud IAM providers into WebADM’s LDAP tree. The synchronization is one-way—from the external IAM provider to WebADM—preserving group memberships and allowing external identities to be added to locally defined groups within WebADM.

This functionality is especially beneficial in scenarios like mergers and acquisitions, where multiple IAM systems need to be unified. By synchronizing identities from various sources, WebADM creates a centralized user directory, enabling consistent security policies, seamless IT management, and group-based access control across the entire organization.

The benefits of this approach include simplified identity management, enhanced security and compliance, flexible group management, cost efficiency, scalability, and an improved user experience through a unified access platform.

In summary, RCDevs and WebADM provide powerful tools for overcoming the complexities of managing multiple IAM systems, enabling a cohesive, secure, and scalable identity management infrastructure.

Actions/permissions required on PingOne

To perform operations such as locking a user account, checking or changing a PingOne user's password, and retrieving user and group information using PingOne APIs from WebADM, you'll need specific API permissions. These permissions must be granted through a Worker application in PingOne, and the application must have the appropriate permissions described later in this documentation.

Worker App Registration

From the PingOne admin console, go to Applications-->Applications.
Click on the + button next to the Applications header.

Provide a name in Application Name field, and select Worker in Application Type section. Then, click on Savebutton.

Enable the worker application using the Enable toggle.

Permissions & Roles

One permission must be granted in order to allow all synchronisation features in WebADM for PingOne.

Go to Applications-->Applications, select created worker, and open Roles tab.

Click on Grant Roles, this will display the list of available roles.

Search for and expand Identity Data Admin role, and select corresponding environment.

Click on Save.

Granting the above role to the Worker will enable following features of WebADM:

• Synchronize Users and Groups Information: synchronize users and groups from PingOne within the WebADM Framework
• Password verification with Salesforce: validate a user's password using PingOne for authentication that started with OpenOTP and a synced PingOne account.
• User Account Lockout: this permission is essential when using the Account Lockout feature in OpenOTP Badging. It is required if you've implemented an account lockout policy that prevents access when the user is not badged-in. The account will remain locked at the PingOne level, until the user badges-in with the OpenOTP Token application or from the User Self-Service Desk web application.
• Password Reset/Update: passwords for PingOne accounts synced in WebADM can be changed through the WebADM Framework. The system supports applying password policies, leak protections, and weak password detection to PingOne accounts. Resetting a user's password from a third-party application requires admin rights due to the sensitivity and potential impact of this operation. In PingOne, the permissions required to perform these actions generally involve administrative privileges.

PingOne configuration on WebADM

The PingOne configuration on WebADM consists of:

• Create a container, organizational unit, or organization object in your LDAP tree where the PingOne tenant will be synced. Within this object, you can optionally create two additional containers: one for users and one for groups.
• Creating a WebADM User Domains and configuring the tenant information of your PingOne tenant.

Container Creation

Let's first create the container where objects will be synced in.

Login on the WebADM Administrator Portal with a super_admin account, and click on the Create tab.
In this example, we create an OrganizationalUnit named PingOne inside an existing Organization object named External Providers.

Click Proceed and select the location of the OU. I created it within an organization object named External Providers, but you can place it wherever you prefer. Name your object, optionally provide a description, and click Proceed, followed by Create Object.
Your Organizational Unit should then be created and visible at the location you specified.

Domain Creation and Configurations

Username/UPN Concepts

The WebADM User Domain creation involves configuring the following key settings:

• The User Search Base
• The UPN Mode and optionally the UPN Suffix when the UPN Mode is set to Explicit.
• The Directory Synchronization settings

When configuring the UPN Mode, you are determining how the login name value will be synced in the login attribute.

Example for Clarification

Consider the UPN (User Principal Name) of a PingOne account: testaccount@xxxxx.onmicrosoft.com.

• testaccount is the UPN prefix.
• xxxxx.onmicrosoft.com is the UPN suffix.

UPN Mode: Implicit vs Explicit

The UPN Mode can be set to either Implicit or Explicit. Here's how each mode works:

1. Implicit Mode:
   In this mode, the testaccount value (the UPN prefix) will be stored in the login attribute. With this mode, users can authenticate using two different methods:

   • By providing username=testaccount and domain=WebADM_Domain_Name to the OpenOTP APIs.
   • By constructing a UPN with the WebADM Domain Name they belong to and logging in as username@WebADM_Domain_Name.

This mode is the most flexible.
The UPN suffix can also be configured to work with the full UPN, even if it's not synced into the uid attribute.
With Active Directory backend configured with WebADM, you must set UPN Mode to Implicit. Explicit mode can not work, as the UPN prefix is synced into the sAMAccountName and the full PingOne UPN is synced into the UserPrincipalName.

2. Explicit Mode:
   In this mode, the full UPN (testaccount@xxxxx.onmicrosoft.com) will be stored as the login attribute. In this case, users must use the full UPN as their username to log in. The testaccount value (UPN prefix) alone cannot be used for authentication.

If the directory backend configured with WebADM is Active Directory, and you attempt to sync PingOne accounts into Active Directory, the prefix of the UPN will be synced into the sAMAccountName attribute, while the entire PingOne UPN will be synced into the UserPrincipalName attribute.

Now that you fully have the concepts, we can continue by creating the WebADM User Domain object and configuring the information for PingOne.

Go to the Admin tab, select User Domains, and click Add Domain. Provide a common name to identify the cloud provider, such as PingOne, and optionally add a description. Then, click Proceed followed by Create Object.

The domain object will be created, and you will enter the User Domain configurator. In the first section, configure the User and Group Search Bases to point to the Organizational Unit (OU) you previously created. In the UPN Suffix field, enter your PingOne UPN ending with onmicrosoft.com. This information can be retrieved from your tenant.

Scroll down to the Directory Synchronization section.

• In the Provider setting, select PingOne.
• In the Tenant ID setting, enter your tenant identifier, which can be retrieved from your PingOne directory.
• In the Client ID setting, enter the unique identifier assigned to your registered application within the directory.
• In the Secret Key setting, enter the private key associated with the application. This key, used together with the client ID, verifies the application's identity.
• Choose the Sync Options that best suit your preferences for password synchronization, ensuring they align with the permissions granted to the application.
• Finish by setting the Sync Period. By default, synchronization occurs every hour.

When the configuration is complete, click Apply to save your settings. You will be redirected to the Registered LDAP Domains menu, where your PingOne domain should appear with a Sync Now button.
Click this button to start the synchronization process.

If any objects cannot be synced for any reason, an error message will appear in the synchronization output. For more details, consult the WebADM Server logs.
Objects that have been successfully synced will appear in the left LDAP tree, as shown in the screenshot below:

That's it. The synced identities and groups can now be used with WebADM, along with its dependencies and integrations.