Set up the User Sync tool

As a system administrator, sign in to the Adobe I/O Console, select your organization from the drop-down list on upper right. Click Create New Project.

Click Edit Project on the upper right, and enter a title and description for the project. Click Save.

Click Add API.

In the Add an APi window, filter by Adobe Services, and select User Management API. Click Next.

• Generate a Key Pair:

If you want to use a self-signed certificate with randomized values generated by adobe.io with a validity of 1 year, select Generate a Key Pair. Then, click Generate Keypair.

A config.zip file is downloaded to your local machine containing the certificate_pub.crt file and the private.key. The public certificate is automatically added to your integration and the private.key is used later in the configuration process.

• Upload Your Public Key:

If you have your own public certificate or you have generated it using the steps in Obtain the public and private key section, then select Upload Your Public Key. Scroll down and upload the Public key certificate file. Click Next.

Click Save Configured API.

To view the credential details, navigate to Service Account (JWT).

Create a folder named user_sync_tool in a location on the drive where users with required permissions can access its contents.

Access GitHub and locate the Latest release tag.

Inside this release, find and expand the Assets. Then, locate and download:

• The examples.zip file
• The .zip of the User Sync Tool in the list that matches your OS type

Unzip examples.zip, navigate to config files - basic, and copy these files to user_sync_tool folder: connector-ldap.yml, connector-umapi.yml, and user-sync-config.yml.

From the other zip file, extract the user-sync.exe file and place it inside same user_sync_tool folder.

Locate the private.key that came along with the public certificate and move it to same user_sync_tool folder. So now, the folder contains:

• connector-ldap.yml
• connector-umapi.yml
• private.key
• user-sync.exe
• user-sync-config.yml

Edit the file connector-ldap.yml with a specialized text editor.

Enter the user name, password, host, and base_dn values.

Set search_page_size to 200.

Although most of the times the default filters would do. If you need a custom LDAP query to extract a set of users, modify the all_users_filter config parameter.

Verify the rest of the uncommented settings and what LDAP attributes they point to. Change them according to your needs.

Some deployments have username-based login set up (Username field in Admin Console for a given user is not an email type of value). 

In this case, enable the following line too (remove the # char):
user_username_format: {sAMAccountName}

Replace the sAMAccountName with the right attribute if it's not the one you need to use.

Edit the connector-umapi.yml. This file has access information to your Adobe organization.

Enter the following information from the adobe.io integration you created earlier:

• org_id
• api_key
• client_secret
• tech_acct

Make sure that the priv_key_path contains the exact name of the private key inside the  user_sync_tool folder. 
If the private key is inside same folder with the rest of the UST files, priv_key_path can contain only the name of the file; it works as a relative path.

Edit the user-sync-config.yml file.

Remove # from the default country code line, and enter the appropriate country code. For example:

Edit group mapping in the user-sync-config.yml file. 

For each directory group that must map to an Adobe Product Profile or user group, add an entry inside the groups section. For example:

To change the limit, find  max_adobe_only_users in the user-sync-config.yml file.

If you expect the number of account removals to be more than the set max_adobe_only_users value between User Sync runs, raise the value to cover all account removals.

To turn the file log on or off, edit the log_to_file value in the user-sync-config.yml file.

Review the settings for logs and make any desired changes. For the initial setup it's recommended to use 
log_to_file: True 
file_log_level: debug

Using the following command, navigate to the user_sync_tool folder.

To verify that your configuration is complete, run the following commands:

For Windows:

For UNIX:

-v reports the version, -h provides help on command-line args.

In test mode, run a sync limited to the mapped groups named in the config file, excluding the existing Adobe side accounts.

The command above syncs only the users in the mapped group specified in user-sync-config.yml. If the users don't exist in the Admin Console, it results in an attempt to create the users and add them to any groups that are mapped from their directory groups.

Running user-sync in test mode (-t) only attempts to create the user and not actually do it. The --adobe-only-user-action exclude option prevents removal of any existing user account in the Adobe organization.

Although the invocation_defaults sets the default arguments the tool runs with, you can override them by mentioning them in command line. In test mode, run a sync limited to the mapped groups named in the config file, removing the extra accounts found on Adobe side and not found in the LDAP extraction.

run a simulation not an actual sync and see what would happen.

extract users from LDAP that are results of both all_user_filter and member of the provided directory_group names in the config file.

add/remove users to/from the Adobe side user-groups or PLCs, based on account being or not member of the LDAP mapped groups.

any account found on Adobe side is removed from Users menu and entitlements stripped off if not found in the LDAP extraction and not being excluded from sync.

Read more about command parameters here.

Read about some other usage scenarios here.

To pull out relevant log entries for a summary, create a batch file in the user_sync_tool folder with the invocation of user-sync piped to a scan. For example, create a file run_sync.bat with contents like:

Optionally, set up an email command-line tool.

There is no standard email command-line tool in Windows, but several are available commercially, where you can fill in your specific command-line options.

Set up the Windows task scheduler to run the User Sync tool.

For example, the below code runs the User Sync tool every day starting at 4:00 PM: