Configure AD account provisioning in Self-service

Set up AD Account Provisioning so users can create an Active Directory account from the Self-service panel. Segura™ names each account with a username mask and creates it on a target device. These requests are approved automatically.

Requirements

• Self-service enabled. More information in Configure Self-service.
• A domain registered in Segura.
• A target device in that domain, such as a domain controller, where Segura creates the account.
• A credential with permission to create accounts in the domain, to use as the authentication credential.
• At least one global approver, to receive the provisioning emails.

Configure the provisioning settings

1. In Segura™, on the navigation bar, hover over the Product Menu and select Settings.
2. In the side menu, select Access control > Access Self-service > Settings.
3. In Request types, turn on Enable AD Account Provisioning request. The provisioning fields appear.
4. Fill in the provisioning fields. Domain, Target device, and Authentication credential are required:
   1. Credential type: the type of credential Segura creates.
   2. Domain: the domain of the new account.
   3. Target device: the device where Segura creates the account.
   4. Change plugin: the plugin used to change the password or credential. Required when you select a template.
   5. Credential creation template: the template for the new credential, if any. It must belong to the selected change plugin.
   6. Authentication credential: the credential Segura uses to create the account.

Define the username mask

The username mask sets the name of each account. Combine fixed text with two markers:

• [#VARIABLE#]: replaced by the variable the user picks as Identification.
• [#USERNAME#]: replaced by the requester's username.

For example, the mask [#VARIABLE#]_[#USERNAME#] with the variable adm creates the account adm_jdoe for the user jdoe.

1. In Username mask, enter the mask. This field is required.
2. In Variables, click Add and enter a value. Repeat for each value users can pick.

Each variable appears to users as an Identification option. Variables cannot be empty or repeated. Segura ignores uppercase and lowercase when it compares them.

Click Save.

Verify your results

1. Open Desktop > Access Self-service > Panel and select the AD Account Provisioning card.
2. Pick an Identification, write a justification, and submit the request.
3. On the panel, in My requests, check the request status. The request shows Pending while Segura runs the provisioning, then Executed or Error. When it shows Executed, the account exists in the domain.

If the request shows Error:

1. Open Actions and select Details. Note the execution code.
2. Find the operation with that code in the operations report to see why it failed.
3. Check the domain, target device, and authentication credential in the settings.
4. Ask the requester to restart the request. Only the requester can restart it: on the panel, in My requests, they open Actions and select Restart execution.

Related topics

• Self-service settings
• Self-service requests
• About Active Directory