Sigh.... Adobe Licensing

[DalekSec]

It's that wonderful time of year! No i don't mean Christmas i mean it's time to update our Adobe.....

 

We currently have Device licenses (Of which we have 120 used across 2 sites), which are now defunct as far as i'm aware. Leaving us with 2 choices the Shared Device Licenses or Named user license.

 

The user license does look appealing but the issue we have is that we need it across 2 sites which have separate local ADs but are joined in Azure AD. I spoke to the reseller who said we would need to merge the two ADs, i wasn't to sure if he knew what i meant when i mentioned Azure AD. I did find this: https://helpx.adobe.com/uk/enterprise/using/sso-setup-azure.html which seems to suggest we can but i don't want to go ahead with the order and it turns out you can't!

 

Has anyone setup Adobe licensing with Azure AD? If not think we will go with the new type of Device licenses

 

Thanks

 

Dalek

Edited December 2, 2019 by DalekSec

[robyholmes]

I'm not sure but from when I set it up it just needs access to your Azure AD for authentication. So as long as your Azure AD is a single tenancy with both domains in it, it should work.

 

However you'll find even if you go with 'Shared Device Licences' all your users still need an account. So its licenced per machine but you still need to login to use it. So your going to need to create users either way and doing it via Azure AD is certainly easier than creating them in Adobe Console.

[mdrabble]

I user Adobe User Licences here (first year of doing this) and have 650 licences - which is enough for all KS3, KS4 and KS5 exam classes and Staff who need Adobe. This leaves me with some spare to assign as needed.

 

Set up Adobe to use Azure for Authentication and then I do the following:

 

I assign users to local AD Groups which are then sync'd to Azure using AD Connect.

 

I then run the Adobe User Sync tool (also have it schedules to run at midnight) which then adds users from the Azure Group into Adobe Group and assigned the relevant Licences/Package.

 

Users then sign in using Federated ID and their Office 365 details.

 

Seems to work well and had no real issues.

Edited December 2, 2019 by mdrabble

[CyberDrac]

Has anyone found a reasonable Google GSuite solution, we have the link in place, but it doesn't integrate with groups in the same way that Azure AD does, and so the only way to maintain groups in Adobe is regular manual CSV imports ... less than ideal.

 

Any thoughts appreciated.

[howartp]

Has anyone found a reasonable Google GSuite solution, we have the link in place, but it doesn't integrate with groups in the same way that Azure AD does, and so the only way to maintain groups in Adobe is regular manual CSV imports ... less than ideal.

 

Any thoughts appreciated.

 

Do you use SalamanderSoft? We do, and are about to contact them to setup the groups for us.

 

Peter

[Arthur]

the only way to maintain groups in Adobe is regular manual CSV imports ... less than ideal.

I just followed Adobe's instructions for setting up the User Sync Tool with G Suite and it syncs with AD groups without any issue.

 

My user-sync-config.yml file looks like this...

 

# This is the main configuration file for User Sync from Adobe.

adobe_users:
 exclude_identity_types:
   - adobeID
   - enterpriseID

 exclude_adobe_groups:
   #- "Sample Product Profile"
   #- "Sample User Group"

 exclude_users:
   #- ".*@special.com"
   #- "freelancer-[0-9]+.*"

 connectors:
   umapi: "connector-umapi.yml"

directory_users:
 user_identity_type: federatedID
 default_country_code: GB
 connectors:
   ldap: "connector-ldap.yml"
 groups:
   - directory_group: "[color="#FF0000"]Staff[/color]"
     adobe_groups:
       - "Default Spark with Premium Features for K-12 - 2 GB configuration"
       - "Staff"
   - directory_group: "[color="#FF0000"]Students[/color]"
     adobe_groups:
       - "Default Spark with Premium Features for K-12 - 2 GB configuration"
       - "Students"
   - directory_group: "Adobe Admin Console Administrators"
     adobe_groups:
       - "_support_admin"

limits:
 max_adobe_only_users: 200

logging:
 log_to_file: True
 file_log_directory: Logs
 file_log_name_format: '{:%Y-%m-%d}.log'
 file_log_level: info
 console_log_level: info

invocation_defaults:
 adobe_only_user_action: preserve
 adobe_only_user_list:
 connector: ldap
 process_groups: Yes
 strategy: sync
 test_mode: No
 update_user_info: No

 user_filter:
 
 users: mapped

 

All of our users are in one of the highlighted groups.

 

Edit. This is my connector-ldap.yml file...

 

# This is a sample configuration file for the ldap connector type.

username: "[email protected]"
password: "c@#JzHupjbFixz@Z7Ds@fo$sCE7wixGwxcs@7cB7vq"
host: "ldap://example.net:3268"
base_dn: "DC=example,DC=net"

search_page_size: 2000
require_tls_cert: False

all_users_filter: "(&(objectClass=user)(objectCategory=person)(userPrincipalName=*@example.net)(mail=*@example.net)(!(sAMAccountName=*exam*))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"

group_filter_format: "(&(objectCategory=group)(cn={group}))"
group_member_filter_format: "(memberOf:1.2.840.113556.1.4.1941:={group_dn})"

user_email_format: "{mail}"
user_username_format: "{mail}"
user_country_code_format: "{c}"

 

Note. All of Adobe's comments from the sample files have been removed for brevity, but you may want to keep these so you know what each setting does.

Edited December 3, 2019 by Arthur

[CyberDrac]

Do you use SalamanderSoft? We do, and are about to contact them to setup the groups for us.

 

Peter

Yes, we do use SalamanderSoft, and we were hoping that Google Groups created from AD groups created by Salamandersoft (such as class groups) would be available for selection in the Adobe Admin Console, but it looks like we may need to go back to the source and use the User Sync Tool from Adobe and pull them from AD directly. Not a terrible state of affairs since they are effectively the same, but annoying that they didn't put the effort into GSuite integration that they put into AD and AAD integration.

[CyberDrac]

I just followed Adobe's instructions for setting up the User Sync Tool with G Suite and it syncs with AD groups without any issue.

 

My user-sync-config.yml file looks like this...

 

# This is the main configuration file for User Sync from Adobe.

adobe_users:
 exclude_identity_types:
   - adobeID
   - enterpriseID

 exclude_adobe_groups:
   #- "Sample Product Profile"
   #- "Sample User Group"

 exclude_users:
   #- ".*@special.com"
   #- "freelancer-[0-9]+.*"

 connectors:
   umapi: "connector-umapi.yml"

directory_users:
 user_identity_type: federatedID
 default_country_code: GB
 connectors:
   ldap: "connector-ldap.yml"
 groups:
   - directory_group: "[color="#FF0000"]Staff[/color]"
     adobe_groups:
       - "Default Spark with Premium Features for K-12 - 2 GB configuration"
       - "Staff"
   - directory_group: "[color="#FF0000"]Students[/color]"
     adobe_groups:
       - "Default Spark with Premium Features for K-12 - 2 GB configuration"
       - "Students"
   - directory_group: "Adobe Admin Console Administrators"
     adobe_groups:
       - "_support_admin"

limits:
 max_adobe_only_users: 200

logging:
 log_to_file: True
 file_log_directory: Logs
 file_log_name_format: '{:%Y-%m-%d}.log'
 file_log_level: info
 console_log_level: info

invocation_defaults:
 adobe_only_user_action: preserve
 adobe_only_user_list:
 connector: ldap
 process_groups: Yes
 strategy: sync
 test_mode: No
 update_user_info: No

 user_filter:
 
 users: mapped

 

All of our users are in one of the highlighted groups.

 

Thank you so much for that, it looks like this will have to be the route we take as there isn't a feature parity between AD/AAD vs GSuite integrations with regards to groups

[jezi55]

Hello, we recently moved to Adobe CC shared device licence and we authenticate students and staff through our AD Federation Server, quite simple once you find the right resources, im happy to share if you need anything.

[Arthur]

Thank you so much for that, it looks like this will have to be the route we take as there isn't a feature parity between AD/AAD vs G Suite integrations with regards to groups

Something else you might also need to do is to increase the search_page_size in connector-ldap.yml since the default is 1000 (which was too small for my secondary school).

[free780]

I just did a powershell script to construct a CSV. There is now an Adobe cloud connector if your on AzureAD so you don't need the user sync tool.

[DalekSec]

Thanks guys, looks like we need to get the Azure AD connector working either way then!

[Arthur]

There is now an Adobe cloud connector if your on Azure AD so you don't need the user sync tool.

Do you reckon that will have a G Suite connector at some point too?

 

Getting rid of the Sync Tool would be fantastic!

[DavidYoung]

Do you reckon that will have a G Suite connector at some point too?

 

Getting rid of the Sync Tool would be fantastic!

There is a Gsuite connector. Trouble is it doesn't sync groups yet.