IDM 3.6.1-3.5.1 Active Directory driver version 3.5.7 Patch 2

abstract

Patch update for the Novell Identity Manager Active Directory driver. This will take the driver version to 3.5.7. You must have IDM 3.5.1 or later to use this driver. This patch adds support for Exchange 2010.

details

Overview: Active Directory driver patch for the IDM 3.5.1, 3.6.0 and 3.6.1 versions of IDM. Driver version will be updated to 3.5.7.

System Requirements: Novell Identity Manager 3.5.1 or higher.

Installation:

1. Stop the driver and the remote loader service if running remote loader.

2. Copy over the patched ADDRIVER.DLL
If running locally:
Copy the patched ADDRIVER.DLL from the \x86 directory to \Novell\NDS\ on Windows 2003 32-bit.
Copy the patched ADDRIVER.DLL from the \x64 directory to \Novell\NDS\ on Windows 2008 64-bit.
If the driver is running on remoteloader:
Copy the patched ADDRIVER.DLL from the \x86 directory to \Novell\RemoteLoader\ on Windows 2003 32-bit.
Copy the patched ADDRIVER.DLL from the \x64 directory to \Novell\RemoteLoader\ on Windows 2008 64-bit.

3. Copy the patched PassSyncConfig.cpl to \Windows\System32 directory.
Use the PassSyncConfig.cpl from the \x86 directory if on a 32-bit system.
Use the PassSyncConfig.cpl from the \x64 directory if on a 64-bit system.
In prior patches or versions, this file may have been copied to the Windows\SysWOW64 directory. If so, remove the PassSyncConfig.cpl from that directory.

Step 4-6 is to fix problems with the driver and Exchange.
4. Stop the IDM_AD_Ex2007_Service

5. Copy the two Exchange service files to \Novell\RemoteLoader if driver is running remote or \Novell\NDS if driver is local.
The file names are IDMExService.exe and IDMExManagementServer.dll

6. Start the IDM_AD_Ex2007_Service.

7 Start the remote loader if running remote loader. Then start the driver.
If running the driver locally, stop all drivers and restart eDirectory.

8. Configure password filters if necessary. See documentation.


Technical Support Information:

Current Fixes since IDM 3.6.1
- Fixed an issue where the AD Driver does not delete the user in AD when the option "Allow Exchange mailbox delete" is set to No. Bug 566638

- Added support for Exchange 2010. To provision mailboxes in Exchange 2010, the EXCH 2010 option has to be selected. The on-line documentation will be updated to show these changes.
To change an existing driver, update the driver parameters with the following NEW XML code and remove the OLD code. Below is both the new and the old code.

PLEASE export the driver before making these changes.

NEW

<definition display-name="Exchange Management interface type (use-cdoexm/use-exch-2007/use-exch-2010)" id="108" name="exch-api-type" type="enum"> <description>Exchange mailboxes can be controlled by calls into the Microsoft Exchange management system instead of regular attribute synchronization. When enabled, the driver shim intercepts changes to the Active Directory homeMDB attribute and uses the selected option for provisioning Exchange. The RUS option relies upon the Recipient Update Service (RUS) to propagate account information to Exchange. The CDOEXM option enables the use of Collaboration Data Objects for Exchange Management subsystem. The EXCH 2007 and EXCH 2010 options implies use of Exchange 2007 and Exchange 2010 and requires installation of the IDM Exchange service. Refer to the user guide for details. The EXCH 2007 and EXCH 2010 options are incompatable with Exchange 2000 or 2003. The value you choose here is recorded in the driver shim configuration.</description> <enum-choice display-name="CDOEXM">use-cdoexm</enum-choice> <enum-choice display-name="EXCH 2007">use-exch-2007</enum-choice> <enum-choice display-name="EXCH 2010">use-exch-2010</enum-choice> <enum-choice display-name="RUS">default</enum-choice> <value>use-exch-2010</value> </definition>

OLD
<definition display-name="Exchange Management interface type (use-cdoexm/use-post-cdoexm)" id="108" name="exch-api-type" type="enum"> <description>Exchange mailboxes can be controlled by calls into the Microsoft Exchange management system instead of regular attribute synchronization. When enabled, the driver shim intercepts changes to the Active Directory homeMDB attribute and uses the selected option for provisioning Exchange. The RUS option relies upon the Recipient Update Service (RUS) to propagate account information to Exchange. The CDOEXM option enables the use of Collaboration Data Objects for Exchange Management subsystem. The post-CDOEXM options implies use of Exchange 2007 or newer and requres installation of the IDM Exchange service. Refer to the user guide for details. The post-CDOEXM is incompatable with Exchange 2000 or 2003. The value you choose here is recorded in the driver shim configuration.</description> <enum-choice display-name="CDOEXM">use-cdoexm</enum-choice> <enum-choice display-name="post CDOEXM">use-post-cdoexm</enum-choice> <enum-choice display-name="RUS">default</enum-choice> <value>use-post-cdoexm</value> </definition>


Previous fixes in IDM 3.6.1-3.5.1 Active Directory driver version 3.5.6 Patch 1

Active Directory driver Fixes
- eDirectory becomes unresponsive when we stop the AD driver. Bug 541375

- AD driver not properly handling a multi-valued description attribute. Bug 133631

- enable-incremental-values ignored/not working in 2008 domain/forest functional level. Bug 533958

- Exchange 2007 Exception When Moving a Mailbox, (Changing homeMDB attribute). Bug 482861

- Active Directory Driver reports changes on computer objects in AD even though not in the filter. Bug 499307

- Exchange 2007 -DomainController option being passed with no value. Bug 501954

- AD Password changes periodically not published and remain in registry on the RL. Bug 510318

AD Password Sync Fixes
- "Error copying files (3)" when installing PWFILTER.DLL. Bug 519024

Active Directory driver Enhancements
Added support for Windows 2008 R2. Bug 549466

Fixes in IDM 3.6.1
- Driver-Active Directory Add support for Windows 2008 server running in a 2008 functional level. Bug 499382

- Driver-Active Directory Unlocalised text "Warning" present in Jobs Results tab. Bug 486949

- Driver-Active Directory Incorrect tooltip on OK button in Identity Manager Library / Mapping Tables Dialog. Bug 486804

- Driver-Active Directory Subscriber Password payload on an add event returns wrong XML document on Publisher. Bug 408306

- Driver-Active Directory MD: JPN : PreCfg : UserID "Administrator" is translated in example. Bug 254763

- Remote Loader hangs when issuing Enable-Mailbox command via AD driver. Bug 417504

- The AD Driver failed to provision Exchange 2007 accounts on Windows 2008 (x64). The error presented in trace is "Exchange 2007 Exception. code:0x0000274d Connnection Error. Make sure service is Running"

Fixes in IDM 3.6.0
- Driver-Active Directory MD - All_Lang- Unlocalised text when you create a new driver. Bug 393862

- Driver-Active Directory AD driver won't stay running. Bug 385606

- Driver-Active Directory AD Driver crashes after reconnect from network failure. Bug 381457

- Driver-Active Directory Bad wording and grammar in MAD driver preconfig. Bug 376542

- Driver-Active Directory Need way to specify LDAP port(s) for ADAM. Bug 330245

Fixes made from 3.5.1 shipping to 3.6

- When forcing Powershell to the same DC as the driver, the DomainController parameter was missing in the last AD patch. It has been added. Bug 364791

- AD Driver now forces Powershell to same DC as the driver. Before there were replication delays that would cause "object could not be found" errors. This only happened when the driver was talking to one DC but the IDM exchange service was talking to another. Bug 364791 (same bug as above)

- Fixed memory leak in AD Query mechanism. Bug 301558

- Fixed issue where Password sync install does not update correct registry key for 64bit filter. During the install of the 64bit password filter to the domain controllers the registry keys for Host Names was only created in hklm/SOFTWARE/Wow6432Node/Novell/PwFilter and no entry was added in hklm/SOFTWARE/Novell/PwFilter. Bug 344553

- Implemented the LDAP Incremental values control feature. Requires the Window 2003 domain be in the "Windows Server 2003" functional level.

The following new driver parameter must be added to the access options section
of the AD driver configuration. This is only needed for drivers created with the IDM 3.5.1 driver pre-configs.
<definition display-name="Enable DirSync Incremental Values" hide="false" id="115" name="enable-incremental-values" type="enum"> <description>Ordinarily the publisher will receive all member values of a group when one or more has changed. This option reports only the added or deleted member values during the poll interval. Requires 2003 Forest functional mode.</description> <enum-choice display-name="Yes">yes</enum-choice> <enum-choice display-name="No">no</enum-choice> <value>yes</value> </definition>

See the IDM 3.5.1 Active Directory documentation for more details. A new section 'Optional Configuration Parameters' section 5.5 will be added to the documentation in the next posting of the documentation for this driver. Bug 330245