IWDS- Tips and Advanced configuration
inWebo becomes TrustBuilder
We are currently rebranding all assets to the new TrustBuilder branding. Please bear with us while we change the branding of the inWebo interfaces and documentation to TrustBuilder. Functionality remains the same.
How to use IWDS graphical interface in Linux environment
To execute IWDS application in Linux you can create a starting .sh script with the following commands:
#!/bin/bash
JAR="/APP/path/IWDS/Iwds.jar"
java -cp ${JAR} com.inwebo.gui.IwdsGuiStartHow to force IWDS to use TLS 1.2 in scripts
IWDS uses Java version 1.8 which natively supports TLS 1.2 and uses it by default, but in some environments cypher must be forced in Java to use TLS 1.2 at startup.
Scripts must include the additional option -Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 to be added in each java command line.
Example for Windows / PowerShell
$javaPath = "C:\java\openlogic-openjdk-jre-8u262-b10-win-64\bin\Java.exe"
Set-Alias java $javaPath
java -Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 -cp "C:\inWebo\Iwds.jar" com.inwebo.Iwds -b "C:\inWebo" -w "C:\IWDSsync\ConsoleAdmin.wsdl" -C "C:\inWebo\Certificate.p12" -p PASSWORD -v getinweboExample for Linux
java -Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 -cp /product/inWebo/Iwds.jar com.inwebo.Iwds --ldap LDAP.PATH -v -b /product/inWebo getldapHow to use multiple IWDS app operating on a same service
This parameter is available in IWDS version 2.4 and higher.
The provisioning_id parameter specifies the user provisioning source. It is useful if you have multiple IWDS instances.
You can specify the provisioning source ID in the IWDS configuration file conf/inwebo.properties. The default value is 1.
When creating an account with API SOAP, the provisioning_id value can be specified in the loginCreateBySource API SOAP (see User Management with SOAP API - loginCreateBySource ). It will update the “Created By” value in IWDS.
To see the users provisioning sources from IWDS graphical interface, go to inWebo > InWebo Objects > inWebo Users tab. Look at the "Created by" column values:
Console → Created by the administration console (
provisioning_id=0)Source #1 → Created by IWDS (default value) (
provisioning_id=1)Source #{
provisioning_idvalue} → Created by another provisioning source. (provisioning_id={value})
When you specify the provisioning_id, make sure that the value:
does not conflict with any other IWDS instance
and does not use standard values (like 0 and 1).
How to use service accounts or other users with IWDS on Windows
When switching between user accounts on Windows, the scripts or the IWDS application may experience difficulties. This situation occurs from time to time because the installation of IWDS is performed for a specific Windows user.
As part of a user change or for adapting to a Windows service account:
It is necessary to review the rights of the IWDS working directory as well as the “/out” and “/log” subdirectories (to make them accessible to this new account)
You must also delete (or copy in .OLD) the contents of these two directories which must have been created by launching IWDS from different Windows accounts
Do not place the IWDS directory in a Windows UAC managed directories like /program /program files and /Windows (which will add additional Adm controls)
Since this new account did not proceed with the installation in itself, it lacks the information of the location of the default directory present in the registry and which now must be specified for each Java command line of the script.
It is necessary to add on each of the IWDS command lines, the -B "working folder" option to specify the root of the IWDS working directory (or --basedir) IWDS - Command-line guide
The default IWDS directory is listed in the user profile registry with this line in the registry HKEY_CURRENT_USER\Software\JavaSoft\Prefs\com\inwebo\gui\utils\base_dir must be modified for the selected user (look for modify a other user registry loads HKU<username> C:\Users<username>\ntuser.dat)
How to upgrade IWDS
Here is the standard upgrade procedure for IWDS:
Stop any IWDS synchronizations that may be running as Windows scheduled tasks or as cron jobs.
Save your IWDS working folder and configuration items:
First of all you must save your working directory → this is the parent directory that contains the configuration, log and synchronization files located themselves in the following 3 directories: ./conf; ./log; ./out. To locate your working directory, go to the top left hand side of the IWDS application ("File" menu > "Change working directory")
Retrieve the certificate and its passphrase / for security (if necessary also take screenshots of LDAP accesses and group mapping) in case there is an incident during the update.
If using a Virtual Machine with snapshots, take a snapshot thereby allowing you to rollback to a working configuration if necessary
Uninstall and reinstall:
Uninstall the previous version of IWDS, without removing your old folders (they should have been copied somewhere for safety)
Reinstall the new version in the same location
Check the configuration:
IWDS should find the previous information from the "working directory" and automatically retrieve the configuration items. If however IWDS doesn't locate the working directory then indicate it via the "file" menu.
Verify that all LDAP connections and group mappings are present.
If everything is OK, perform a diff/sync operation to make sure IWDS is working correct
Perform a diff/sync operation and make sure IWDS is correctly working.
You can delete the back-up.
XML incompatibilities
Some version changes show XML incompatibilities with previous XML file formats located in the /out directory. If you encounter Character errors while parsing the XML files, rename your /out directory to /old and perform a new retrieve/diff/sync cycle.MaxValRange value for Microsoft Active Directory
The MaxValRange value, limits the maximum number of values Active Directory can answer to a request, in our case, this refers to the number of logins. (Default is set to 1500).
It is recommended you verify this value when synchronizing above 1000 users, you can verify and change this value using NTDSUTIL.
It may be necessary to modify this value with the command NTDSUTIL and to increase it to 5000.
Configuration and output file details
All configuration and output files are available in the IWDS working folder for scripting or debugging purposes.
Configuration Files
All these files are located in the “conf” subfolder of your IWDS configuration folder. Click to see the files settings description.
If generated by the GUI, this file is named ldap_<LDAP source name>.properties.
Parameter name | Description |
|---|---|
name | The name you give to your LDAP directory. Spaces are not allowed |
authtype | LDAP authentication mode (Simple or anonymous) |
host | IP address or Domain name of your LDAP directory |
port | LDAP port. Usually 389 |
secure | yes / no. Whether to use LDAPS or not. The ‘port’ parameter is moved to 483 if you use LDAPS |
ldapuser | LDAP user for connection purposes |
ldappassword | LDAP password for the user mentioned above |
basedn | Base DN to use for the LDAP connection |
loginattr | LDAP attribute IWDS looks for to retrieve user login |
login2attr | LDAP attribute IWDS looks for to retrieve user alternate login |
firstnameattr | LDAP attribute IWDS looks for to retrieve user First Name |
lastnameattr | LDAP attribute IWDS looks for to retrieve user Name |
emailattr | LDAP attribute IWDS looks for to retrieve user Email |
usergroupdn | LDAP DN of the group containing TrustBuilder Users |
managergroupdn | LDAP DN of the group containing TrustBuilder Managers |
admingroupdn | LDAP DN of the group containing TrustBuilder Administrators |
searchbyattr | Tells IWDS to retrieve LDAP users in the groups your defined via a specific user attribute (typically the “memberOf” attribute on Active Directory) |
searchattr | Sets attribute for user attribute based search |
searchbygrpmb | Tells IWDS to directly retrieve the users that are members of the groups your defined |
grpmbattr | Sets attribute for group membership based search |
maxdepth | The number of sub-groups levels to parse recursively |
filter_group | Sets the filter to apply on LDAP members to identify groups |
filter_person | Sets the filter to apply on LDAP members to identify persons |
useaduac | allows to use the UAC properties retrieved from an AD user to determine the user TrustBuilder account activation status |
enableldappaging | Activation / Deactivation of LDAP paging |
querypagesize | IWDS can use LDAP paging. This parameter sets how many users IWDS proceeds per page. |
querydelay | Delay (in ms) between 2 LDAP page requests |
filter | LDAP filter for your requests. Example : « objectClass\=Person », to filter out Computers (deprecated – replace by filter_person and filter_group) |
recursegroups | Set to ‘False’ if you have Active Directory. ‘True’ otherwise (deprecated) |
supportmemberof | Set to ‘True’ if you have Active Directory. ‘False’ otherwise (deprecated – replaced by searchbyattr) |
grpattr | (deprecated – replace by grpmbattr) |
Sample file
name=My LDAP
host=xxxx
port=3389
ldapuser=xxxx
ldappassword=xxxx
authtype=simple
secure=no
basedn=DC=adfs,DC=inwebo,DC=com
usergroupdn=cn=inwebo-users,CN=Users,DC=adfs,DC=inwebo,DC=com
managergroupdn=CN=inwebo-managers,CN=Users,DC=adfs,DC=inwebo,DC=com
admingroupdn=CN=inwebo-admins,CN=Users,DC=adfs,DC=inwebo,DC=com
firstnameattr=givenName
lastnameattr=sn
loginattr=samaccountname
login2attr=UPN
emailattr=mail
searchbygrpmb=true
grpmbattr=member
searchbyattr=false
searchattr=memberOf
maxdepth=10
filter_person=objectClass=Person
filter_group=objectClass=Group
useaduac=yes
enableldappaging=yes
querypagesize=100
querydelay=1000“\\” are used to escape special chars. They are automatically added by IWDS GUI.
If a user belongs to the “User” group or "Manager" group, his “status” is set to “not blocked” during the synchronization. If not, it is set to “blocked”.
If a user belongs to “Administrator” group, his “role” is accordingly set during the synchronization and his “status” is set to “blocked”.
Output Files
All these files are located in the “out” subfolder of your IWDS configuration folder.