SurePassID Directory Sync User Guide

SurePassID Authentication Server

SurePass Directory Sync - User Guide

Introduction

SurePass DirectorySync is an automated user provisioning tool that synchronizes users from Active Directory or XML files into SurePass MFA. It eliminates manual user creation and ensures consistent MFA configuration across your organization.

Key Features

• Automated Provisioning: Add users to SurePass by adding them to an AD group
• Role Assignment: Automatically assign administrative roles during sync
• FIDO2 Support: Modern passwordless authentication with Passkeys and Security Keys
• Flexible Tokens: Support for OTP, Push, and FIDO2 authentication methods
• Preview Mode: Test configurations before applying changes
• Multiple Sources: Sync from AD Groups, LDAP filters, XML files, or AD Live
• AD Live Mode: Near real-time synchronization of AD user changes (NEW in 2025.2)

Getting Started

Prerequisites

• SurePass MFA Server with REST API access
• API Key with appropriate permissions (FindUser, AddUser, AddToken)
• Active Directory domain (for AD sync) or XML file (for XML sync)
• Windows Server with .NET Framework 4.8

Quick Start

1. Install DirectorySync on your Windows server
2. Edit the DirectorySync.exe.config file with your settings
3. Run in preview mode to test: DirectorySync.exe
4. Review the logs in the Trace folder
5. Switch to live mode and schedule regular execution

Configuration Overview

All configuration is done through the DirectorySync.exe.config file or command-line parameters.

Parameter Matrix by Sync Source

The following matrix shows which parameters are Required (R), Optional (O), or Not Applicable (-) for each sync source type:

Core Connection Parameters

Active Directory Parameters

XML Sync Parameters

AD Live Sync Parameters

User Provisioning Parameters

Token Creation Parameters

Windows Service Parameters

Profile Configuration Parameters (App.config only)

Legend: R = Required, O = Optional, - = Not Applicable

Note: When running as a Windows Service with sync_source=AdLive, the service uses ad_live_poll_seconds instead of sync_interval_minutes.

Note: When using profiles (use_config_profiles=true), sync settings come from individual profile files, not App.config.

Note: The application automatically detects if running as a Windows Service. No configuration setting is required.

Core Configuration Parameters

Note: In version 2025.2, the command-line parameter names were updated from -ln and -lp to -api_key_id and -api_key for consistency with configuration file naming. The legacy parameters (-ln and -lp) are still supported for backwards compatibility but are deprecated.

Configuration File Location

C:\Program Files\SurePassID\DirectorySync\DirectorySync.exe.config

Profile-Based Configuration (NEW)

For complex deployments with multiple sync configurations, use profile-based configuration.

Profile Location:

%ProgramData%\SurePassID\DirectorySync\Profiles\

Enable Profiles in App.config:

<add key="use_config_profiles" value="true" />
<add key="profiles_list" value="AdGroupSync,AdminUsers" />

App.config vs Profile Settings:

Sample Profiles Included:

• XmlSync.config - XML file sync
• AdGroupSync.config - AD Group sync
• AdLiveSync.config - Real-time AD monitoring
• Fido2Passkey.config - FIDO2 Passkey tokens
• AdminUsers.config - Admin role users
• HelpdeskUsers.config - Helpdesk role users

Profile Path Resolution: | Input | Resolved Path | |-------|---------------| | AdGroupSync | %ProgramData%\SurePassID\DirectorySync\Profiles\AdGroupSync.config | | C:\Custom\Profile.config | C:\Custom\Profile.config |

Using Command Line Parameters

DirectorySync.exe -use_command_line true -sync_source AdGroup -ad_domain_fqdn contoso.com -ad_group "SurePass Users" -api_key_id "your-key-id" -api_key "your-key" -rest_endpoint "https://yourserver/api/mfa/v1"

Synchronization Sources

DirectorySync supports three synchronization sources:

1. Active Directory Group Sync (Recommended)

Monitors an AD group and automatically provisions users when they are added to the group.

Configuration:

<add key="sync_source" value="AdGroup" />
<add key="ad_domain_fqdn" value="contoso.com" />
<add key="ad_group" value="SurePass-MFA-Users" />

How It Works:

1. DirectorySync queries the specified AD group
2. Extracts user information (username, email, name, mobile)
3. Provisions users in SurePass with configured settings
4. Assigns tokens based on configuration

Best For:

• Organizations with existing AD groups for MFA users
• Simple, manageable user provisioning
• Dynamic user populations

2. LDAP Filter Sync

Uses an LDAP query to find users matching specific criteria.

Configuration:

<add key="sync_source" value="AdLdapFilter" />
<add key="ad_domain_fqdn" value="contoso.com" />
<add key="ldap_filter" value="(&(objectClass=user)(department=Sales))" />

Best For:

• Complex user selection criteria
• Multiple attributes-based filtering
• Cross-domain synchronization

3. XML File Sync

Imports users from a pre-formatted XML file.

Configuration:

<add key="sync_source" value="Xml" />
<add key="xml_path" value="C:\Sync\users.xml" />

XML Format:

<?xml version="1.0" encoding="utf-8"?>
<users>
  <user>
    <username>jdoe</username>
    <firstname>John</firstname>
    <lastname>Doe</lastname>
    <email>john.doe@contoso.com</email>
    <mobile>555-1234</mobile>
  </user>
</users>

Best For:

• External HR systems
• Custom integrations
• Migration scenarios

4. AD Live Sync (New in 2025.2)

Monitors Active Directory for real-time user changes using the DirSync control.

Configuration:

<add key="sync_source" value="AdLive" />
<add key="ad_domain_fqdn" value="contoso.com" />
<add key="ad_live_poll_seconds" value="30" />

How It Works:

1. Uses LDAP DirSync control to efficiently detect only changed objects
2. Persists sync state (cookie) to survive service restarts
3. Processes user creates, deletes, enables, and disables
4. Takes configurable action when users are deleted from AD

Best For:

• Near real-time user provisioning
• Immediate response to AD user changes
• Environments requiring quick user lifecycle management

See AD Live Sync Mode for detailed configuration.

User Configuration

User Status

Control whether synchronized users are enabled or disabled:

<add key="sync_user_enabled" value="true" />

User Groups

Assign users to SurePass groups during provisioning:

<add key="sync_user_group" value="Sales Department" />

User Roles (New in 2025.2)

Automatically assign administrative roles during synchronization:

<add key="sync_user_role" value="user" />

Available Roles:

Example Use Cases:

<!-- Provision regular users -->
<add key="sync_user_role" value="user" />

<!-- Provision IT help desk staff -->
<add key="sync_user_role" value="helpdesk" />

<!-- Provision IT administrators -->
<add key="sync_user_role" value="admin" />

Note: If not specified, users are provisioned with no administrative role (standard user).

Token Configuration

Creating Tokens

Enable automatic token creation during user provisioning:

<add key="create_soft_token" value="true" />

Token Types

FIDO2 Tokens (New in 2025.2)

Configure modern passwordless authentication:

<add key="token_type" value="Fido" />
<add key="token_fido2_type" value="Passkey" />

FIDO2 Types:

• Passkey: Platform authenticator with user verification (Face ID, Windows Hello, Touch ID)
• SecurityKey: Hardware security key (YubiKey, Titan Key, etc.)

Example - Passkey Configuration:

<add key="create_soft_token" value="true" />
<add key="token_type" value="Fido" />
<add key="token_fido2_type" value="Passkey" />
<add key="token_enabled" value="true" />

Example - Security Key Configuration:

<add key="create_soft_token" value="true" />
<add key="token_type" value="Fido" />
<add key="token_fido2_type" value="SecurityKey" />
<add key="token_enabled" value="true" />

OTP Token Configuration

For time-based or event-based OTP tokens:

<add key="token_type" value="SurePassIDAuthenticatorMobile" />
<add key="token_otp_type" value="Time" />
<add key="token_time_otp_drift" value="3" />

OTP Types:

• Time - Time-based OTP (recommended)
• Event - Counter-based OTP

Parameters:

• token_time_otp_drift - Time drift tolerance (1-5, default: 5)
• token_event_otp_window - Event window size (>= 30, default: 30)

Token Usage Options (New in 2025.2)

Configure what authentication methods the token supports:

<add key="token_usage_otp" value="true" />
<add key="token_usage_push" value="true" />
<add key="token_usage_push_type" value="Push" />

Push Types:

• Push - Standard push notifications
• Fido2 - FIDO2-based push notifications

Usage Combinations:

Token Notifications

Send activation notifications to users:

<add key="token_activation_notification" value="Email" />

Options: None, Email, Sms

Running DirectorySync

Preview Mode (Recommended for Testing)

Preview mode shows what would happen without making changes:

<add key="mode" value="preview" />

Run DirectorySync and review the logs in Trace\ folder.

Live Mode

Once tested, switch to live mode:

<add key="mode" value="live" />

Silent Mode

For automated execution without console output:

<add key="silent" value="true" />

Execution Modes

DirectorySync supports two execution modes: Console Mode (for scheduled tasks) and Windows Service Mode (for continuous operation).

Option 1: Console Mode with Scheduled Task (Recommended for Most Users)

Run DirectorySync as a console application triggered by Windows Task Scheduler.

Configuration:

<!-- Console mode - just run the executable -->
<add key="use_command_line" value="false" />
<add key="silent" value="true" />
<add key="mode" value="live" />

Setting Up a Scheduled Task:

1. Open Task Scheduler (taskschd.msc)
2. Click Create Task (not Basic Task)
3. General Tab:
   • Name: SurePass DirectorySync
   • Run whether user is logged on or not
   • Run with highest privileges
4. Triggers Tab:
   • New trigger: Daily at 2:00 AM (or your preferred schedule)
   • For more frequent syncs: Every 1 hour, repeat indefinitely
5. Actions Tab:
   • Action: Start a program
   • Program: C:\Program Files\SurePassID\DirectorySync\DirectorySyncClientConsole.exe
6. Settings Tab:
   • Allow task to be run on demand
   • Stop task if it runs longer than 1 hour

PowerShell Example:

# Create scheduled task for daily sync at 2 AM
$action = New-ScheduledTaskAction -Execute "C:\Program Files\SurePassID\DirectorySync\DirectorySyncClientConsole.exe"
$trigger = New-ScheduledTaskTrigger -Daily -At 2:00AM
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName "SurePass DirectorySync" -Action $action -Trigger $trigger -Principal $principal

Best For:

• Periodic synchronization (hourly, daily, weekly)
• Organizations preferring scheduled batch operations
• Simple setup and management

Option 2: Windows Service Mode (Continuous Operation)

Run DirectorySync as a Windows Service for continuous, interval-based synchronization.

Configuration:

<!-- Service mode - install with: DirectorySyncClientConsole.exe install -->
<add key="sync_interval_minutes" value="60" />
<add key="silent" value="true" />
<add key="mode" value="live" />

Service Configuration Parameters:

Note: The application automatically detects if running as a Windows Service using Environment.UserInteractive. No configuration setting is required.

Installing the Service:

Open Command Prompt as Administrator:

# Install the service
DirectorySyncClientConsole.exe install

# Start the service
DirectorySyncClientConsole.exe start

# Check service status
sc query SurePassDirectorySync

Uninstalling the Service:

# Stop the service
DirectorySyncClientConsole.exe stop

# Uninstall the service
DirectorySyncClientConsole.exe uninstall

Service Management via PowerShell:

# Check status
Get-Service -Name "SurePassDirectorySync"

# Start service
Start-Service -Name "SurePassDirectorySync"

# Stop service
Stop-Service -Name "SurePassDirectorySync"

# View service details
Get-WmiObject -Class Win32_Service -Filter "Name='SurePassDirectorySync'" | 
    Select-Object Name, State, StartMode, PathName

Service Features:

• Automatic startup with Windows
• Automatic recovery on failure (restarts after 1, 5, and 10 minutes)
• Runs under Local System account
• Prevents overlapping sync operations

Best For:

• Near real-time synchronization needs
• Environments requiring continuous monitoring
• Hands-off operation after initial setup

Choosing Between Modes

AD Live Sync Mode

AD Live sync mode provides near real-time synchronization of Active Directory user changes to SurePassID. It uses the LDAP DirSync control to efficiently detect only objects that have changed since the last sync.

Overview

Unlike traditional batch sync modes (AdGroup, AdLdapFilter), AD Live mode:

• Polls AD frequently (every 30 seconds by default)
• Only processes changed users (not all users)
• Detects user creates, deletes, enables, and disables
• Persists state across service restarts

Configuration Parameters

Note: The ad_live_monitor_groups parameter is reserved for future use and is not currently implemented.

Security Note: The ad_live_ldap_password is automatically masked when displaying configuration parameters in logs.

Basic Configuration Example

<appSettings>
  <!-- API Configuration -->
  <add key="api_key_id" value="your-key-id" />
  <add key="api_key" value="your-api-key" />
  <add key="rest_endpoint" value="https://yourserver/api/mfa/v1" />
  
  <!-- AD Live Sync -->
  <add key="sync_source" value="AdLive" />
  <add key="ad_domain_fqdn" value="contoso.com" />
  <add key="ad_live_poll_seconds" value="30" />
  <add key="ad_live_deleted_user_action" value="Disable" />
  
  
  <!-- Install as service: DirectorySyncClientConsole.exe install -->
  <add key="mode" value="live" />
</appSettings>

Deleted User Actions

When a user is deleted from AD, you can configure what action to take in SurePassID:

Example:

<add key="ad_live_deleted_user_action" value="Disable" />

Filtering by OU

Monitor only specific Organizational Units:

<!-- Monitor only specific OUs (semicolon-separated) -->
<add key="ad_live_monitor_ous" value="OU=Employees,DC=contoso,DC=com;OU=Contractors,DC=contoso,DC=com" />

<!-- Or monitor all OUs -->
<add key="ad_live_monitor_ous" value="*" />

Event Processing Control

Enable or disable processing of specific event types:

<!-- Process all events (default) -->
<add key="ad_live_process_disables" value="true" />
<add key="ad_live_process_deletes" value="true" />
<add key="ad_live_process_enables" value="true" />

<!-- Or disable specific events -->
<add key="ad_live_process_deletes" value="false" />  <!-- Don't delete users, even if deleted from AD -->

State Persistence

AD Live mode maintains a state file to remember:

• The DirSync cookie (to get only changes since last sync)
• The domain controller being used
• Sync statistics

<!-- Custom state file path -->
<add key="ad_live_state_path" value="C:\ProgramData\SurePassID\AdLiveState.json" />

<!-- Or use default (relative to install directory) -->
<add key="ad_live_state_path" value="AdLiveState.json" />

Interval Configuration

AD Live mode uses ad_live_poll_seconds instead of sync_interval_minutes:

Example - Frequent polling:

<add key="sync_source" value="AdLive" />
<add key="ad_live_poll_seconds" value="15" />  <!-- Poll every 15 seconds -->
<!-- Install as service: DirectorySyncClientConsole.exe install -->

AD Permissions Required

The service account running DirectorySync needs:

• Read access to the monitored OUs
• "Replicating Directory Changes" permission on the domain (for DirSync control)

To grant DirSync permission:

# Run on a Domain Controller as Domain Admin
dsacls "DC=contoso,DC=com" /G "DOMAIN\ServiceAccount:CA;Replicating Directory Changes"

LDAP Credentials (Optional)

By default, AD Live sync uses the Windows service account credentials (Negotiate/Kerberos) to connect to Active Directory. For scenarios where explicit credentials are needed, you can configure LDAP bind credentials.

When to Use:

• Cross-domain scenarios
• Service running under LocalSystem
• Testing with a specific AD account
• Environments without Kerberos delegation

Configuration:

<add key="ad_live_ldap_username" value="DOMAIN\svc_dirsync" />
<add key="ad_live_ldap_password" value="YourSecurePassword" />

Username Formats:

• DOMAIN\username (down-level)
• username@domain.com (UPN)

Security: The password is automatically masked in logs (shows only last 4 characters).

How AD Live Differs from AD Group Sync

Configuration Examples

Example 1: Basic AD Group Sync with Standard Users

<appSettings>
  <!-- API Configuration -->
  <add key="use_command_line" value="false" />
  <add key="api_key_id" value="your-key-id" />
  <add key="api_key" value="your-api-key" />
  <add key="rest_endpoint" value="https://yourserver/api/mfa/v1" />
  
  <!-- Sync Source -->
  <add key="sync_source" value="AdGroup" />
  <add key="ad_domain_fqdn" value="contoso.com" />
  <add key="ad_group" value="SurePass-Users" />
  
  <!-- User Settings -->
  <add key="sync_user_enabled" value="true" />
  <add key="sync_user_group" value="" />
  <add key="sync_user_role" value="user" />
  
  <!-- Token Settings -->
  <add key="create_soft_token" value="true" />
  <add key="token_type" value="SurePassIDAuthenticatorMobile" />
  <add key="token_usage_otp" value="true" />
  <add key="token_usage_push" value="true" />
  <add key="token_usage_push_type" value="Push" />
  <add key="token_otp_type" value="Time" />
  <add key="token_time_otp_drift" value="3" />
  <add key="token_enabled" value="true" />
  
  <!-- Execution Settings -->
  <add key="mode" value="preview" />
  <add key="silent" value="false" />
</appSettings>

Example 2: Passkey Authentication for All Users

<appSettings>
  <!-- API Configuration -->
  <add key="use_command_line" value="false" />
  <add key="api_key_id" value="your-key-id" />
  <add key="api_key" value="your-api-key" />
  <add key="rest_endpoint" value="https://yourserver/api/mfa/v1" />
  
  <!-- Sync Source -->
  <add key="sync_source" value="AdGroup" />
  <add key="ad_domain_fqdn" value="contoso.com" />
  <add key="ad_group" value="SurePass-Passkey-Users" />
  
  <!-- User Settings -->
  <add key="sync_user_enabled" value="true" />
  <add key="sync_user_role" value="user" />
  
  <!-- Passkey Token Settings -->
  <add key="create_soft_token" value="true" />
  <add key="token_type" value="Fido" />
  <add key="token_fido2_type" value="Passkey" />
  <add key="token_enabled" value="true" />
  
  <!-- Execution Settings -->
  <add key="mode" value="live" />
  <add key="silent" value="true" />
</appSettings>

Example 3: Help Desk Staff with Admin Roles

<appSettings>
  <!-- API Configuration -->
  <add key="use_command_line" value="false" />
  <add key="api_key_id" value="your-key-id" />
  <add key="api_key" value="your-api-key" />
  <add key="rest_endpoint" value="https://yourserver/api/mfa/v1" />
  
  <!-- Sync Source -->
  <add key="sync_source" value="AdGroup" />
  <add key="ad_domain_fqdn" value="contoso.com" />
  <add key="ad_group" value="IT-HelpDesk" />
  
  <!-- User Settings -->
  <add key="sync_user_enabled" value="true" />
  <add key="sync_user_group" value="Help Desk" />
  <add key="sync_user_role" value="helpdesk" />
  
  <!-- Token Settings -->
  <add key="create_soft_token" value="true" />
  <add key="token_type" value="SurePassIDAuthenticatorMobile" />
  <add key="token_usage_otp" value="true" />
  <add key="token_usage_push" value="false" />
  <add key="token_otp_type" value="Time" />
  <add key="token_enabled" value="true" />
  
  <!-- Execution Settings -->
  <add key="mode" value="live" />
  <add key="silent" value="true" />
</appSettings>

Example 4: LDAP Filter for Specific Department

<appSettings>
  <!-- API Configuration -->
  <add key="use_command_line" value="false" />
  <add key="api_key_id" value="your-key-id" />
  <add key="api_key" value="your-api-key" />
  <add key="rest_endpoint" value="https://yourserver/api/mfa/v1" />
  
  <!-- Sync Source -->
  <add key="sync_source" value="AdLdapFilter" />
  <add key="ad_domain_fqdn" value="contoso.com" />
  <add key="ldap_filter" value="(&(objectClass=user)(department=Sales)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" />
  
  <!-- User Settings -->
  <add key="sync_user_enabled" value="true" />
  <add key="sync_user_group" value="Sales" />
  <add key="sync_user_role" value="user" />
  
  <!-- Token Settings -->
  <add key="create_soft_token" value="true" />
  <add key="token_type" value="SurePassIDAuthenticatorMobile" />
  <add key="token_usage_otp" value="true" />
  <add key="token_usage_push" value="true" />
  <add key="token_usage_push_type" value="Push" />
  <add key="token_otp_type" value="Time" />
  <add key="token_enabled" value="true" />
  
  <!-- Execution Settings -->
  <add key="mode" value="live" />
  <add key="silent" value="true" />
</appSettings>

Example 5: AD Live Sync with Real-Time User Lifecycle (New in 2025.2)

<appSettings>
  <!-- API Configuration -->
  <add key="use_command_line" value="false" />
  <add key="api_key_id" value="your-key-id" />
  <add key="api_key" value="your-api-key" />
  <add key="rest_endpoint" value="https://yourserver/api/mfa/v1" />
  
  <!-- AD Live Sync Source -->
  <add key="sync_source" value="AdLive" />
  <add key="ad_domain_fqdn" value="contoso.com" />
  
  <!-- AD Live Settings -->
  <add key="ad_live_poll_seconds" value="30" />
  <add key="ad_live_state_path" value="AdLiveState.json" />
  <add key="ad_live_deleted_user_action" value="Disable" />
  <add key="ad_live_monitor_ous" value="*" />
  <add key="ad_live_user_filter" value="(&amp;(objectClass=user)(objectCategory=person))" />
  <add key="ad_live_process_disables" value="true" />
  <add key="ad_live_process_deletes" value="true" />
  <add key="ad_live_process_enables" value="true" />
  
  <!-- User Settings -->
  <add key="sync_user_enabled" value="true" />
  <add key="sync_user_role" value="user" />
  
  <!-- Token Settings -->
  <add key="create_soft_token" value="true" />
  <add key="token_type" value="SurePassIDAuthenticatorMobile" />
  <add key="token_usage_otp" value="true" />
  <add key="token_usage_push" value="true" />
  <add key="token_enabled" value="true" />
  
  
  <!-- Install as service: DirectorySyncClientConsole.exe install -->
  <add key="mode" value="live" />
  <add key="silent" value="true" />
</appSettings>

Key Points for AD Live:

• Uses ad_live_poll_seconds instead of sync_interval_minutes
• Should be installed as a Windows Service: DirectorySyncClientConsole.exe install
• Automatically detects and processes user lifecycle events
• State file persists between restarts

Troubleshooting

Viewing Logs

Logs are stored in the Trace\ subfolder:

C:\Program Files\SurePassID\DirectorySync\Trace\SurePassDirectorySync<YYYYMMDD>.log

Common Issues

No Users Found

Symptom: "Active Directory query did not return any users"

Solutions:

• Verify AD group name is correct (case-sensitive)
• Check LDAP filter syntax
• Ensure DirectorySync service account has permission to read AD
• Test AD connectivity from the server

API Connection Failed

Symptom: "Checking connection to endpoint FAILED"

Solutions:

• Verify rest_endpoint URL is correct
• Check API key and API key ID
• Ensure firewall allows outbound HTTPS to SurePass server
• Validate API key has required permissions

Users Not Being Added

Symptom: "Username was not added"

Solutions:

• Check if user already exists in SurePass
• Verify API key has AddUser permission
• Review error code in log file
• Ensure required user fields (email, mobile) are populated in AD

Token Creation Failed

Symptom: "Token for username was not added"

Solutions:

• Verify API key has AddToken permission
• Check token configuration parameters
• For FIDO2: Ensure SurePass server supports FIDO2
• Review error code (131 = permission denied)

Validation Errors

OTP Parameter Errors

Error: "TokenOtpDriftUnit is invalid"

Solution: Set token_time_otp_drift between 0-5 (typically 1-3)

Error: "TokenOtpWindow is invalid"

Solution: Set token_event_otp_window >= 30

Role Configuration Errors

Error: "Option sync_user_role is set to an invalid value"

Solution: Use one of: user, helpdesk, helpdeskmgr, admin, superadmin

Getting Help

1. Review log files in Trace\ folder
2. Run in preview mode to test configuration
3. Check event log for detailed error messages
4. Contact SurePass support: support@surepassid.com

FAQ

Q: Can I sync users from multiple AD groups?

A: Not directly in one sync job. Create multiple configuration files and scheduled tasks for each group with different settings.

Q: What happens if a user is removed from the AD group?

A: For standard sync modes (AdGroup, AdLdapFilter, Xml), DirectorySync only adds users. The ad_disable_group parameter is configured for future support of automatic user disabling.

For AD Live mode, user removals are automatically detected and processed based on the ad_live_deleted_user_action setting (Disable, Delete, or None).

Q: What's the difference between AD Group sync and AD Live sync?

A:

• AD Group sync runs periodically (hourly/daily) and provisions users who are members of a specific AD group.
• AD Live sync polls AD frequently (every 30 seconds by default) and detects all user changes (creates, deletes, enables, disables) across monitored OUs.

Use AD Group sync for batch provisioning. Use AD Live sync for real-time user lifecycle management.

Q: Can I change a user's role after they're provisioned?

A: Yes, manually through the SurePass admin console. DirectorySync sets roles only during initial provisioning.

Q: Do I need to restart DirectorySync after configuration changes?

A: No, configuration is read from the file each time DirectorySync runs.

Q: Can users have multiple token types?

A: No, each user gets one token. The token type is determined by the sync configuration.

Q: What's the difference between Passkey and SecurityKey?

A: Passkey uses platform authenticators (Windows Hello, Touch ID) with user verification. SecurityKey uses external hardware keys (YubiKey) for 2FA mode.

Q: How often should I run DirectorySync?

A: Depends on your needs:

• Real-time needs: Every 15-30 minutes
• Standard: Once or twice daily
• Low volume: Daily or weekly

Q: Can I test without affecting production?

A: Yes! Use mode="preview" to see exactly what would happen without making any changes.

Q: What permissions does the API key need?

A: Minimum:

• FindUser - Check if user exists
• AddUser - Create users
• AddToken - Create authentication tokens

Q: Should I use Console Mode or Service Mode?

A: Console Mode (scheduled task) is recommended for most users - it's simpler and uses fewer resources. Use Service Mode only if you need near real-time synchronization (syncing every few minutes).

Installation Verification

After installation, verify DirectorySync is working correctly using the included verification scripts.

Verification Scripts Location

The installation includes verification scripts in the Tools\Installation Verification Scripts folder:

C:\Program Files\SurePassID\DirectorySync\Tools\Installation Verification Scripts\
    - README.txt                    # Detailed test instructions
    - RunVerificationTests.ps1      # PowerShell verification script
    - RunVerificationTests.bat      # Batch file launcher

Running Verification Tests

Using PowerShell (Recommended):

cd "C:\Program Files\SurePassID\DirectorySync\Tools\Installation Verification Scripts"

.\RunVerificationTests.ps1 `
    -ApiKeyId "your-api-key-id" `
    -ApiKey "your-api-key" `
    -RestEndpoint "https://your-surepassid-server/api/mfa/v1"

Using Batch File:

cd "C:\Program Files\SurePassID\DirectorySync\Tools\Installation Verification Scripts"
RunVerificationTests.bat

What the Tests Verify

The verification scripts test:

1. Help Display - Verifies the application runs and displays usage information
2. API Connectivity - Tests connection to your SurePass server
3. XML Sync Preview - Tests user import from XML file in preview mode
4. Token Configuration - Verifies token creation settings (SurePassID Authenticator, FIDO2)
5. Error Handling - Confirms proper error messages for invalid configurations

Test Results

Each test shows:

• [PASS] - Test completed successfully
• [FAIL] - Test failed (review output for details)

Example Output:

================================================================================
VERIFICATION SUMMARY
================================================================================

[PASS] Help Display
[PASS] Basic XML Preview
[PASS] Token Creation Preview
[PASS] FIDO2 Passkey Preview
[PASS] Invalid Credentials (expected failure)

Results: 5 passed, 0 failed
All verification tests passed! Installation is verified.

Optional Live Test

The verification script supports an optional live test that creates actual test users:

.\RunVerificationTests.ps1 `
    -ApiKeyId "your-api-key-id" `
    -ApiKey "your-api-key" `
    -RestEndpoint "https://your-surepassid-server/api/mfa/v1" `
    -RunLiveTest

Warning: The live test creates real users in your SurePass system. Only run this in a test environment or if you're prepared to clean up the test users.

Support

For additional help:

• Email: support@surepassid.com
• Documentation: https://docs.surepassid.com
• Administrator Guide: See ADMINISTRATOR_GUIDE.md
• Release Notes: See RELEASE_NOTES.md

The software and information contained herein are proprietary to, and comprise valuable trade secrets of, SurePassID Authentication, Inc., which intends to preserve as confidential trade secrets such software and information.