SurePassID Directory Sync Guide

SurePassID Authentication Server

This guide explains how to install, configure, and use the SurePassID Directory Sync application to synchronize user data from existing directory services.

• Directory Sync Application: Updates user information like names, phone numbers, and emails; does not sync passwords.

• Installation: Download, unzip the installer from the link, verify the digital signature.

• Configuration: Sync Active Directory user info with SurePassID via command line or config files.

• Running the App: Document provides command line syntax and options for user management and token creation.

• SurePassID MFA Server: API keys needed for user sync and permissions when creating tokens.

• Security: Requires TLS 1.2 or TLS 1.3 for secure data transmission.

What is the Directory Sync Application?

The SurePassID Directory Sync App updates user details like First Name, Last Name, Phone Number, and Email from existing directory services. Note that SurePassID never synchronizes passwords.

Installing the Directory Sync Application

To install the Directory Sync application, you must first download and unzip the installer from here:

https://downloads.surepassid.com/DS/SPDS.zip

After downloading the file, uncompress the file and run the installer file.

The installer and application are digitally signed by SurePassID. Verify this during installation.

Next, the installation screen will appear.

Follow the prompts until you get to the User Access Control screen**.**

You must verify that the publisher is SurePassID Corp. If not, then press the No button.

When you press the Yes button the application will be installed.

When installation is complete you will see the following screen:

Press the Finish button to complete the installation**.**

Configuring the Directory Sync Application

The Directory Sync app synchronizes Active Directory user info with the SurePassID directory. It's located in the SurePassID Directory Sync folder as DirectorySync.exe. The app can also create mobile tokens for users and notify them via email or SMS, streamlining onboarding and termination processes.

Directory sync options can be set via the command line or by editing the DirectorySync.exe.config file in the installation directory. The use_command_line option in this config file determines the method used. If set to true, all sync options must be specified on the command line, ignoring other config values.

Running the Directory Sync Application

C:\Program Files (x86)\SurePassID Corp\SurePassID Directory Sync 2025

To run the Directory Sync app from the command line use the following syntax:

Usage: Directory Sync [options]

Outlined below are the available options. Bold values represent the default selections if no preferences are specified:

Using the Directory Sync App with SurePassID MFA Server

To sync users from external sources into SurePassID, specify your SurePassID account by using the Application Key Identifier (–api_key_id) and Application Key (–api_key) options.

It is advisable to generate a new application key for Directory Sync, enabling more straightforward identification of synchronization activities.

If you are syncing users without creating tokens for them, the API Key must be granted the following permissions:

• FindUser (find_user)

• AddUser (add_user)

If you are adding soft tokens for these users, ensure the following permissions are allowed:

• AddOathDevice (add_oath_device)

Here’s how to add an API key:

For more information about API keys, see this Knowledgebase Article and associated videos.

Creating LDAP Filters (-sync_source=AdLdapFilter)

Developing AD LDAP filters can be complex and necessitates an understanding of Active Directory specifics. Numerous resources address this subject, making it overwhelming and time-consuming to start from the beginning. For comprehensive information, please refer to the Microsoft article on this topic.

Creating a Query Filter - Win32 apps | Microsoft Learn

The Active Directory User Interface in Windows is capable of assisting you in the creation of LDAP filters.

Using Saved Queries in ADUC MMC (Active Directory User and Computers) | Windows OS Hub

Here are some useful LDAP filters for the domain bestmfaever.net with root OU=rootOU and SurePassID.

All Domain Admins:

(&(objectClass=User)(memberOf=CN=Domain Admins,OU=Groups,OU=rootOU, DC= bestmfaever,DC=net))

All Domain Users:

(&(objectCategory=person)(objectClass=user)(primaryGroupID=513))

All users in the MFA group:

(&(objectClass=User)(memberOf=CN=MFA,OU=Groups,OU=rootOU,DC= bestmfaever,DC=net))

Is there any easier way to sync users. Yes, there is. Using Active Directory Groups

Using Active Directory Groups (-sync_source=AdGroup)

Here is a method to configure SurePassID to automatically sync users and optionally add soft tokens for them.

1. Create an Active Directory Group for users requiring MFA, called the MFA group.

2. Schedule a PowerShell script named `PowerShellAddUsersToMFAGroupTask` to automatically add new users to the Active Directory MFA group daily or nightly, depending on your company's requirements.

3. Set up the Directory Sync options:

DirectorySync

–rest_endpoint=your_mfa_server

–api_key_id=apikeyid

–api_key=apikey

-sync_source=AdGroup

-ad_group=MFA

(add other options that are not included here)

4. Please create a scheduled task named `SurePassIDSyncAdUserTask` for the DirectorySync options from step 3. Ensure that this task runs subsequent to the completion of `PowerShellAddUsersToMFAGroupTask`.

Users are automatically on-boarded when added to the Active Directory.

Security Considerations

Directory Sync App requires TLS 1.2 or TLS 1.3 for transport security.

For Support