Hi
@Robert Graham,
I think I could have done a better job of describing my problem... I am not trying to sync passwords, just identities.
To explain what I am trying to set up, I am using Bridge for Directory Sync to copy identities into Verify SaaS. Authentication is being handled by Bridge [for Authentication].
My problem was that the identities synced to Verify SaaS by the Bridge for Directory Sync were useless because the default configuration puts them in a realm not linked to any identity providers. I then tried purging the users from Verify SaaS and edited the default sync configuration, setting Bridge for Directory Sync to instead provision users into the realm associated with Bridge for Authentication identity source. But even then I was still having problems:
a) If JITP was disabled, users were still not able to authenticate because Verify SaaS acted as though the users did not exist in Verify SaaS. Or,
b) if JITP was enabled, users could authenticate, but a duplicate user was being created in Verify SaaS.
The problem turned out to be
Identity Linking. What was happening is the
Cloud Directory was my default identity provider, and the other identity providers had
Identity Linking enabled. If I disable Identity Linking and JITP on the Bridge for Authentication identity provider, users are able to authenticate, and no duplicate users are being created. As far as the users (and their properties) are concerned, those were correctly being kept in sync by Bridge for Directory Sync.
Problem solved! Well, almost...
I am now running into a different problem - I have two identity providers. They are
i) Bridge for Authentication and
ii) ADFS. If users are working on-premise they are likely authenticating with ADFS. If they're working remotely, they are likely authenticating with Bridge for Authentication. As such, the same users exist in both identity providers. I am trying to figure out a way to utilise Identity Linking so that each synced user is represented once in Verify SaaS. That user's group membership and identity should be managed/synced by Bridge for Directory Sync.
Any advice would be greatly appreciated.
------------------------------
Timothy
------------------------------
Original Message:
Sent: Fri August 12, 2022 09:08 AM
From: Robert Graham
Subject: IBM Security Verify Bridge for Directory Sync not working as expected
Hi Timothy, The Bridge for Directory Sync for Active Directory does NOT sync passwords. The best method of implementation for the bridge would be to also deploy the Active Directory Identity Agent. This will enable learning of the AD password upon authentication if you enable this feature. If you do not enable password learning then using the agent for authentication will continue to rely on AD for the password. Which is also fine and its one less place to audit for passwords.
I did a presentation on this during the Virtual Master Skills University this year. Link is here: https://www.securitylearningacademy.com/course/view.php?id=6789 (just need IBMid to view)
This might help clear up why and when to use this bridge. To quickly answer your question, its really meant to sync the users/groups/attributes from AD to ISV SaaS and keep these in sync for many scenarios, like using Windows Login Agent for MFA into Windows and linux agent for linux servers (I cover this also).
If you would like to discuss this in person, we will be in Hollywood Florida at the Master Skills University. More info here: https://www.ibm.com/training/events/msu2022
Hopefully this helps
------------------------------
Robert Graham
Cloud Security Consultant
IAM Modernization
IBM Expert Labs
US
Original Message:
Sent: Thu August 11, 2022 02:32 PM
From: Timothy
Subject: IBM Security Verify Bridge for Directory Sync not working as expected
I am finding the IBM Security Verify Bridge for Directory Sync is not working as expected. I am trying to use it to sync users from AD into Verify SaaS so that we can keep them, their groups, and account status in sync with changes made in AD.
Based on my experience, users created by Bridge for Directory Sync are essentially useless. They exist in Verify, but there appears to be no way to associate them with an identity provider. And because of that, there is no way for an end-user to sign in as one of those synced users.
As part of my troubleshooting, I tried purging all users and using Bridge for Directory Sync to re-sync those users this time under a realm linked to an identity provider. When I do that, the newly-created users are still unusable and don't appear to be linked to the identity provider, despite being uploaded to the same realm.
Overall the Bridge for Directory Sync is not working as expected. I am able to get Bridge for Directory Sync to sync the users to Verify. But once that's done there doesn't appear to be a way to *use* those users. We can't authenticate. We can't associate them with an identity provider.
Has anyone else experienced the same issue? Am I missing what Bridge for Directory Sync is meant to do?
------------------------------
Timothy
------------------------------