# Manage IDS Connections

You add, edit, remove, and synchronize connections between MiCollab and directory server domain controllers to support IDS on MiCollab. The following conditions apply:

- Before you add a directory server connection, ensure that the Integrated Directory Services account is active on the directory server and that you have entered the account User name and Password correctly.

- When you add a new connection, the Defer all operations box is checked by default.

- Multiple OUs within the same domain are allowed through one connection:
  For example, to search for objects in the SDS and HR groups,

OU=SDS, OU=RandD, DC=mitel, DC=com; OU=HR, DC=mitel, DC=com;

- Multiple OUs across different domains are NOT supported with one connection:
  For example: ou=sales,dc=canada,dc=mitel,dc=com ou=rnd,dc=france,dc=mitel,dc=com

- An IDS connection is locked to one domain.

- Active Directory Authentication can only be enabled for one IDS connection.

- As per the security settings of Microsoft, Port 636 must be used for connection with Active Director server over LDAP.

Note: LDAPs are not supported in co-located mode.

## IDS Connection Examples

- IDS Connection for MiVoice Business with users and contacts synchronized from Active Directory

- IDS Connection for MiVoice 5000 with contacts synchronized from Active Directory

- IDS Connection for MiVoice 5000 with contacts synchronized from a MiVoice 5000 Directory Service

- IDS Connection for MiVoice MX-ONE with contacts synchronized from Active Directory

- IDS Connection for MiVoice 5000 for Authentication only

- IDS Connection for Mitel MetaDirectory

- IDS Connection for Mitel InAttend (BluStar)

## Add a Connection

1. Under Configuration, click Integrated Directory Service.

2. Click Add connection. The Add Integrated Directory Service connection page opens.

3. Complete the fields to create a connection. See Add Integrated Directory Services Connection in the table below for field descriptions. At a minimum, you must

   - enter the FQDN or IPv4 Address of the primary directory server

   - enter the primary directory server username (distinguishedName) and password,

   - enable Synchronization, and then schedule a synchronization interval.

It's recommended that you enable the Defer all operations option to send all operations to the detained updates queue for the initial synchronization. This option allows you to validate all the updates and then apply or discard updates as required.

4. If Active Directory Authentication is required, set the Connection Method. Set the Connection Method to either TLS or TSL/SSL. The Connection Method cannot be UnSecured.

5. If desired, partition the MiCollab Client corporate directory.

6. To apply the default attribute mappings, leave the Use Default Attribute Mappings box checked. To assign this connection with custom attribute mappings, clear the box and modify the attribute mappings as required.

7. Click Save. The system verifies the connection. If the connection fails, an error message is displayed.

## Edit a Connection

1. Under Configuration, click Integrated Directory Service.

2. In the Actions column for the desired domain, click Edit. The Integrated Directory Service connection page opens.

3. Edit the fields. See Add Integrated Directory Services Connection in the table below for field descriptions.

4. Click Save. The system verifies the connection. If the connection fails, an error message is displayed.

5. If Authentication was enabled, you are prompted to enter a temporary end-user login password to allow users to log in. Enter a temporary password, confirm the password and then click Save. The system automatically sends users a Service (Welcome) email with the temporary password.

6. Perform a Full IDS Synchronization. Ensure that the Re-initialize on next cycle box is checked when you perform the sync. If you perform a sync with this box unchecked, any existing entries in Active Directory that were not previously synchronized may be skipped.

## Remove a Connection

1. Under Configuration, click Integrated Directory Service.

2. In the Actions column for the desired domain, click Remove.

3. Click Remove.

4. If Authentication was enabled, you are prompted to enter a temporary end-user login password to allow users to log in. Enter a temporary password, confirm the password and then click Save. The system automatically sends users a Service (Welcome) email with the temporary password.

## Connection details

Parameter | Description | Default Value
Add a connection | Click to create a connection to a directory service | Not applicable
Manage detained entries (#) | Click to access the Bulk User Provisioning tool in the User and Services application and manage any detained updates. Note: The number of detained updates are indicated on the button. | Not applicable
Domain | Read only field that displays the domain name of the MiCollab server | Domain name of the local MiCollab
Last synchronization | Read-only field. Displays the date and time of the last synchronization between the MiCollab IDS client and the directory server. The date and time is obtained from the MiCollab server (MSL). | Time format is day, month, year.
Status | Indicates the current synchronization connection status. Created: The connection has been created. No synchronization have been attempted Initializing: The synchronization operation is initializing and has not begun to process user updates. Started: The synchronization operation has begun. User updates are being processed. Stopped: The synchronization operation has been manually aborted. Finished: The synchronization operation has completed. | Not applicable
Summary | Read only summary of the following: Percentage complete: If a synchronization in progress, this field indicates the progress. Current synchronization status Number of update errors | Not applicable
Synchronization enabled | Indicates if periodic synchronization with the directory server is enabled. | Disabled
Authentication enabled | Indicates if Active Directory Authentication enabled. | Disabled
Actions | Click the Edit link to modify a directory server connection. Click the Remove link to remove a directory server connection. Click the Sync link to initiate an immediate synchronization operation the directory server. This operation checks for any database changes on the directory server since the previous synchronization and applies the updates to the MiCollab database. After performing a synchronization, click the Access Detained Updates link to go to the Bulk User Provisioning tool and manage any failed or detained IDS operations. Note: The Action links are disabled while the system is in the process of enabling or disabling Active Directory Authentication for users. | Not applicable

## Add Integrated Directory Service connection

Parameter | Description | Default Value
Directory server type | Select the directory server type: Active Directory, MiVoice 5000 / MiVoice 5000 Manager, Generic LDAP or ForgeRock Directory Services. The type must be the same for both the Primary and Secondary directory servers.
Directory Server Type | Supported Platforms | Supported Functionality
Active Directory | MiVoice Business, MiVoice Office 250, or Non-Mitel PBX | User synchronization Contact synchronization User authentication
MiVoice MX-ONE, or MiVoice 5000 | Contact synchronization User authentication
MiVoice 5000 | MiVoice 5000 | Contact synchronization
MiVoice 5000 Manager | MiVoice 5000 Network | Contact synchronization
Generic LDAP | MiVoice Business, MiVoice Office 250, or Non-Mitel PBX | User synchronization Contact synchronization User authentication
MiVoice MX-ONE, or MiVoice 5000 | Contact synchronization User authentication
ForgeRock Directory Servcies | MiVoice Business, MiVoice Office 250, or Non-Mitel PBX | User synchronization Contact synchronization
MiVoice MX-ONE, or MiVoice 5000 | Contact synchronization
| Active Directory
Primary directory server` | Enter the FQDN or IPv4 address of the directory server for the IDS connection. By default, the MiCollab system always connects to the primary directory server during a synchronization operation. Note: This is a mandatory field. | Not assigned
Secondary directory server | Enter the FQDN or IPv4 address of a secondary/backup directory server for the IDS connection. The secondary directory server acts as a backup to the primary server whenever the primary is unreachable. The secondary must be a replica of the primary; otherwise, the synchronization will be problematic. On each interval, the connection always attempts to use the primary server followed by the secondary server. This ensures that the connection reverts to the primary server after the issue has been resolved. Note: This field does not apply to MiVoice 5000 or Generic LDAP integrations. | Not assigned.
Enable synchronization | Check to allow automatic (scheduled) synchronization with the directory server. The 'Enable synchronization' check box should not be checked for MiVoice 5000 or MiVoice MX-ONE. | Disabled
Synchronization Schedule | A set of fields that allow you to schedule synchronizations to occur regularly on a pre-defined time interval. Select the interval on a per-minute/hour/day/week/month basis from drop-down menus. Set the time of the synchronization in 24-hour format During a scheduled synchronization, the system checks for any database changes on the directory server since the previous synchronization and applies the updates to the MiCollab database. Note: To perform a full synchronization, you must check the Re-initialize on the next cycle box. | Daily at midnight 00:00
Enable authentication | Check to enable Active Directory authentication of end user passwords. To support Authentication, the Enable synchronization option above must also be enabled. Note: The 'Enable authentication' check box should not be used for MiVoice 5000 and Generic LDAP. | Disabled
Authentication Only | Check to enable Active Directory Authentication of end user passwords only. If this box is checked the IDS connection will only support authentication and will not perform any user or contact data synchronization. The 'Authentication Only' check box is not supported for use in a MiVoice Business integration because it disables synchronization and synchronization is the only method for the IDS connection ID and Distinguished Name to be recorded in the database. Note: If both Active Directory authentication and user or contact data synchronization is required, check the Enable authentication option above and disable this option. | Disabled
Authentication for AD LDS | Check to allow user configuration and to create users through AD LDS. This will cause the authentication to login with the samAccountName only. | Disabled
Skip USNChanged Attribute | Check to enable IDS script to query all users (that are created over multiple ADs) irrespective of whether the users have USNChanged attribute or not. | Disabled
Domain (Domain Name or Connection Name) | For IDS connections that use Active Directory or Generic LDAP, specify the unique domain name used by the directory server. For integrations to Active Directory, the same domain must be used for both the primary and secondary directory server. For IDS connections to the MiVoice 5000 directory service or MiVoice 5000 Manager (AM4750), specify the name of the connection. Note: This is a required field. | Blank
Distinguished name (Directory Server Username) | Enter the directory server username (in Distinguished name format) required to access the synchronization account on the directory server. Example: Distinguished Name format – cn=luum, cn= users, dc=ids, dc=com | Blank
Password | Enter the user password required to access the synchronization account on the directory server. | Blank
LDAP port | Enter the LDAP port number on the directory server. The default value, 636, is the standard LDAP port for secure connection of IDS. | 636
Global catalogue port | Global Catalogue (GC) provides a centralized LDAP user view across all domains. The feature provides one connection point for this information. However, the view is limited to a subset of all user attributes. When this option is in use, it reduces the number of fields that are mapped to the MiCollab user records. When a GC LDAP port is specified, only the following user fields are available for synchronization with MiCollab: telephoneNumber (Prime DN) ObjectGUID (User ID) samAccountName (Login) distinguished name (Domain) mail (Email) sn (Last Name) givenName (First Name) Note: If you specify a port for this field, the IDS connections ignore the LDAP port set above. Note: This field does not apply to MiVoice 5000 or Generic LDAP integrations. | Blank
Connection method | Select the security method used to connect to the directory server. The following options are available. This setting determines the level of security in the connection between MiCollab and Active Directory: Unsecured - No encryption TLS - Encrypted, LDAP over Transport Layer Security SSL - Encrypted, LDAP over Secure Socket Layer Upgraded to Secure (LDAP with start TLS) Secure (LDAPS) Unsecured means that the passwords that are being authenticated between MiCollab server and the Active Directory server are not encrypted and could be read by "sniffing" traffic between them. Note that in the case of the MiVoice 5000, there is no authentication, so passwords, other than the administrator account to log into the MiVoice 5000 directory are not being transmitted. Both TLS and SSL are secure and prevent anyone from easily sniffing the traffic between MiCollab and Active Directory. TLS is the recommended setting. Secure (LDAPS) is recommended while applying the Microsoft security changes on the Active Directory when the sites must be moved from unsecure to secure LDAP. Secure (LDAPS) should be selected when the default LDAP port is 636. LDAP over TLS can also use port 389 to establish a secure connection but it still requires a certificate to be added to the domain controllers. Note: For MiVoice 5000 integrations, this field is disabled and set to Unsecured. Note: Active Directory supports two methods for establishing an SSL/TLS-protected connection to a DC. The first is to connect a DC on a protected LDAPS port (TCP ports 636 and 3269 in AD DS). The second is to connect to a DC on a regular LDAP port (TCP ports 389 or 3268 in AD DS, and a configuration-specific port in AD LDS), and later sending an LDAP_SERVER_START_TLS_OID extended operation [RFC2830]. Note: Global catalog ports (3268/3269) are not supported in external directory search. Regardless of the means by which an SSL/TLS-protected connection is established, the IDS client performs a bind using the credentials configured against the connection before searching the directory. | TLS
Default query string | Enter the default query string used for filtering LDAP searches. Note: The Active Directory default setting processes all user accounts and contact records. The MiVoice 5000 default setting processes all internal and external contact records. | Active Directory defaults to |(ObjectClass=user)(ObjectClass=contact) MiVoice 5000 directory service and MiVoice 5000 Manager (AM7405) defaults to |(ObjectClass=peopleRecord)(ObjectClass=contactRecord) Generic LDAP defaults to (ObjectClass=person)
Search scope | The Search scope determines the set of directory server data that is applied to MiCollab database during a synchronization event. Select one of the following: Sub-tree : include all child objects as well as the base object. Object: limit the search to the base object. The maximum number of objects returned is always one. One level: limit the search to the immediate children of a base object, but exclude the base object itself. Note: This field does not apply to MiVoice 5000 integrations. | Sub-tree
Query page size | Enter the maximum page size of the LDAP search. The permitted range is 100 to 1000 records per page. Note: This field does not apply to MiVoice 5000 integrations. | 400
Chase LDAP referrals | If the directory server does not hold the target requested by an LDAP search, it will return a referral message that redirects the MiCollab client to another directory server. Check the box to act on the referral message or clear the box to ignore it. Note: This field does not apply to MiVoice 5000 integrations. | Disabled
Search context | Enter the distinguished name of the default location used to search objects on the directory server. If there are multiple locations, use semi-colons to separate the entries. For example, to search for objects in the SDS and HR groups, enter: OU=SDS, OU=RandD, DC=mitel, DC=com; OU=HR, DC=mitel, DC=com; Leave the field blank to begin the search at the domain root container. | Blank
External Search | Check this box to select this connection for use with an external search database, for example Mitel Metadirectory. See Configure Access to External Directory for details. | Unchecked for Active Directory, MiVoice MX-ONE, MiVoice 5000, or MiVoice 5000 Manager server types. Checked for Generic LDAP server type.
External search base | Enter the name of the external search database. The MiCollab Client searches this database when a MiCollab Client user looks up a corporate contact. Note: For external search on Active Directory, multiple OUs in the external search base field is NOT supported. | Blank
External search query string | Enter a query string to narrow the search criteria and reduce the number of results from the external directory search, for example: "objectClass=person". | Blank
Public Line Prefix | Public line prefix is the trunk prefix that will be replaced in the number before external lookup and external reverse lookup. For example: 0, 9 (In Nordic countries) etc. | Blank
International Dialing Prefix | International dialing prefix is the international call prefix that will be replaced in the number before external lookup and external reverse lookup. For example: 00, 011, 010, 0011, 810 etc. | Blank
Partition search attribute | Select the IDS mapping attribute that you want to use to partition the directory. See Partition the Corporate Directory for details. | Blank
Partition method | Select organizational unit to partition the directory based on groups (Organizational unit) or across the entire LDAP directory (Attribute). | Organizational unit or Attribute. Default is Organizational unit.
Enable reverse lookup | Enable reverse lookup resolves number to name at call-to or call-from an external number. Note: Lookup/Reverse lookup is not supported if conference call is between external users. Check to enable LDAP reverse lookup function. Before performing the external reverse lookup, MiCollab Client server will replace the two parameters, that is publicLinePrefix and internationDialingPrefix from the searched string. If any of the prefix is found, then the best match is found otherwise an exact match happens. | Unchecked for Active Directory. Checked for Generic LDAP server type.
Dial Digit Count | Dial Digit Count is enabled when the Enable Reverse lookup parameter is checked. The configuration parameters, publicLinePrefix and internationDialingPrefix will not work with Dial Digit Count. If any one of the parameter is configured then the dial digit count setting will get disabled. Prefix settings will override the dial digit count setting. |
Remove leading digits count | It is used to strip as many digits as configured before lookup. Enter the number of leading digits to be removed in the LDAP search. Note: Removing leading digits count field is applicable only for reverse lookup functionality and NOT for external search. | 0
Re-initialize on next cycle | This option effectively forces a full synchronization on the next scheduled sync event. A full synchronization queries the directory server for the entire set of users. This option can be used to recover the MiCollab database from the directory server. It will most likely result in a large number of detained user updates. | Unchecked
Defer all operations | When synchronization occurs the system automatically sends all operations to the detained updates queue. Use this option if you want to preview the synchronization updates in the detained updates queue. From the queue, you can view, apply, modify, or cancel (delete) the updates as required. See Resolving Detained and Failed Updates for instructions. | Checked
Use Default Attribute Mappings | By default, this box is checked and the default attribute mappings are applied to a new connection. Note that you can set the default settings (see Set Default IDS Attribute Mappings) NOTE: In case of ForgeRock Directory Services, the Use Default Attribute Mappings box should be unchecked To use custom settings, clear the check box and enter the required attributes. See Set Default IDS Attribute Mappings for a description of the attribute fields.