The Rapid Identity SSO Integration App allows administrators to facilitate logins through Rapid Identity single-sign-on in Incident IQ.
There are two ways to integrate Rapid ID with iiQ:
Rapid ID’s API
Active Directory data
This will enable districts to automatically populate and update user data in iiQ based on information from your local active directory server or through Rapids IDs API.
What is the difference between integrating with Active Directory data versus Rapid IDs API?
When the API service is activated, admins will have the ability to map custom user attributes directly from Rapid ID instead of Active Directory. This includes group mappings for user fields such as Role, Location, Department, etc. This also includes custom attributes defined in Rapid ID - a guide for creating and managing these from Rapid Identity can be found here.
When the API service is activated, the “Start full sync” option will initiate a direct call to Rapid ID’s API to trigger a sync instead of “syncing” the most recent data pushed to iiQ from the district’s local server (AD).
Creating an Active Directory User
If you are integrating Rapid ID via Active Directory please ensure you have the following:
An active directory vendor account that has the following permissions:
Replicating directory changes.
Read.
A machine that runs .NET Framework v.4.5.1 or higher and has network access to your district’s AD server.
Important Note: You will need to complete this step before proceeding. If you are unfamiliar with granting these specific permissions to a user, please refer to the following Microsoft help guide on Giving Users Replicating Directory Changes Permissions.
Installation
The following steps to install Rapid Identity SSO integration are the same whether you are integrating via API or Active Directory.
To install the Rapid Identity SSO integration app, begin by selecting Incident IQ Apps > Browse on the left navigation bar. Scroll down to the Single Sign-On section and click on the Rapid Identity SSO app.
On the Rapid Identity SSO app page, click on Install.
Once the installation has been completed, click on Manage App Settings and continue to the next section to configure your Rapid Identity SSO installation.
Configuration
When accessing the Rapid Identity SSO for the first time after installation, you will only see the Overview tab and two selectable options: Enable User Login and Enable User Sync.
After selecting both options, click Save.
From here, you will need to determine which service you would like to use:
Rapid ID’s API
Active Directory data
The next step will be dependent on which service you are going to be integrating with. Select the option you would like to move forward with.
See the following section of the guide for the next steps based on your selection
API
Active Directory
API
After selecting the Activate API Service option, then select the Change Settings button in order to populate app authorization credentials.
A help guide for generating these credentials from Rapid Identity can be found here.
Active Directory
From here, more options appear on the app tabs list. Click on Sync Executable. You may need to refresh your page first if you do not see these tab options.
This page will assist you in setting up your connector app configuration file. At the very least, you will need to provide the following information:
AD Username (You will want to use the service account created in [section 1] of this document)
AD Password
AD Domain (Example: district.k12.tx.us)
AD Server IP (12.3.4.56)
If desired, you may also set up OU exclusions to prevent account information stored within select AD OUs from being brought over during system syncs. Please note that setting up filters is optional and can be updated anytime.
Additionally, you can enable the sync to copy over additional AD Attributes such as Student/Employee ID and Grade if those data points exist in AD. As with OU filters, this setting is optional and can be updated anytime.
Once you enter your configuration information, click on Download Executable to download the connector app. Please note that you will want to download this connector app to a device that has access to your AD server and runs overnight.
After downloading the connector file, you will want to run a manual sync to test the connection and download user data to Incident IQ. To do this, run the IncidentIQ.Connectors.MicrosoftAd application (ignore the CONFIG and PDB files in this case.) In the connector app window that appears, click Run now.
If the app runs successfully, a user data packet will be sent to Incident IQ that can then be used to run a system sync.
Establishing the IDP/ISP Connection with Rapid Identity
At this point, you will need to set up the SSO functionality of the Rapid Identity SSO app. To do so, begin by going to the app Overview tab and clicking on the Download Service Provider Metadata button.
Log in to Rapid Identity as an Administrator and select the ‘IDP Configuration’ option under ‘Configuration.’
Click the ‘Register New Service provider’ menu.
Provide a name to the Service provider, paste the Incident IQ metadata file content, and then Save.
Finally, copy the provided metadata URL.
Once you have your Rapid Identity SSO metadata URL, you will need to paste this link into the URL field under the Identity Provider Settings tab within the Rapid Identity SSO app in Incident IQ.
Additionally, further down in this tab, you will need to map the SAML attributes required for login. (Usually login_id, username, email, sAMAccountName, etc.)
After this tab has been configured, the Role mappings and Location mappings will need to be completed to map users to locations and roles within iiQ by OUs, groups, or any additional attribute that captures the location or role for each user.
Creating a Scheduled Sync Task
To schedule the sync to occur automatically, you’ll need to create a task in Windows Task Manager. You can do so by searching for Administrative Tools and selecting Task Scheduler. This will open the Task Scheduler window.
In the Task Scheduler window, start by clicking on Action > Create Basic Task...
This will open the Create Basic Task Wizard. At the very least, you will need to provide a name for the new task. You can also add a task if desired. Once complete, click Next.
In the next step, you will be asked to select when this task should Trigger. We recommend running it daily (overnight) for the most accurate user data. Please ensure you set the task to run regardless of whether a user is logged in or not on the server. Once complete, click Next.
For the next step, you will need to specify what action the task will take when running. Select Start a Program and then click on Next.
When specifying the action to perform, locate the file IncidentIQ.Connectors.MicrosoftAd.exe in the Program/script file browser. Supply the argument -usersync in the Add arguments field. And finally, you will need to indicate the path you unzipped the files to in the Start in field. Once complete, click Next.
In the final step, you may review your task’s settings. Once you have completed your review, check the Open the Properties dialog for this task when I click Finish option and then click the Finish.
In the sync properties window, you will need to check Run whether user is logged on or not, as well as Run with highest privileges. Click OK to complete the sync setup.
---
Hannah Bailey - Director, Customer Engagement