Configuring Access Manager for Automatic Hybrid Azure AD Join

  1. Configure the Active Directory userstore if the existing Active Directory user store’s search context does not contain the computers DN.

    1. Click Devices > Identity Servers > Edit > Local > User Stores > New.

    2. Specify user store’s IP address and credentials, replica details, and add the search context where domain joined computers exists. For example, CN=computers, DC=cloudtest, DC=info.

      For more information about configuring a user store, see Configuring Identity User Stores.

  2. Create a Kerberos class. See Creating the Authentication Class, Method, and Contract.

  3. Create a Kerberos method for the existing Kerberos class.

    1. Click Devices > Identity Servers > Edit > Local > Methods > New.

    2. Specify a name, select the Kerberos class, and then select the user store created in Step 1.

    3. Click OK.

  4. Configure WS-Trust STS.

    1. Click Devices > Identity Servers > Edit > WS-Trust > STS Configuration.

    2. Under Authentication Methods, move the Kerberos method created in Step 3 from Available Authentication Methods to Selected Authentication Methods.

    3. Click OK.

  5. Edit Identity Server’s web.xml.

    For information about how to edit a file, see Modifying Configurations.

  6. Add the NetIQSTS12MEX Servlet with the following details:

    <servlet>
  <servlet-name>NetIQSTS12MEX</servlet-name>
  <jsp-file>/jsp/mex.jsp</jsp-file>
  <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
  <servlet-name>NetIQSTS12MEX</servlet-name>
  <url-pattern>/wstrust/sts/mex</url-pattern>
</servlet-mapping>

    NOTE:Ensure to comment out the following Servlet mapping:

    <!--
<servlet-mapping>
  <servlet-name>NetIQSTS</servlet-name>
  <url-pattern>/wstrust/sts/mex</url-pattern>
</servlet-mapping>
-->