User Profile Synchronization

User Profile Synchronization

Synch.jpgTo sync Active Directory changes to the MOSS user profile database, select the Push changes in AD to MOSS User Profile check box, and then enter SharePoint account information that has the “Manage User Profile” permission in order to read and update user profile information.

For detailed insight into Active Directory Domain Services, see this TechNet article from Microsoft.

User Directory Display Options

User Directory Display Options

Return to User Directory Configuration

ControllingWhatUsersSee.jpgWhat a user sees on the web part is dependent on how you configure the web part. The display options will allow your end users to see the organization or alphabetical buttons; you do have the choice to hide them by clicking on the checkbox. Below is a table containing the list of columns that appear in this section of the tool pane configuration that lets you control what users see or do not see based on your configuration choices here.

Column Description
Hide the Organization Option from the left Panel. To hide the Organization option from the tree pane, select or de-select the respective check box.
Hide the Alphabetical Option from the left Panel. To hide the Alphabetical option from the tree pane, select or de-select the respective check box.
Hide Disabled Active Directory User Objects. For Active Directory mode, the check box is available to hide or show Disabled Active Directory user objects.
Display My Profile First. This is the default but if you choose to unclick the box, then the users will see their own profile either alphabetized or in the organizational hierarchy as selected above.
Show My Profile Link. You can opt to hide or show the link to the user’s My Profile page.
Always display this text when user profile fields have no data. To display static text in any field in the user’s profile that does not have data, enter your preferred verbiage in the text box provided. If you do not want to display any text, then simply leave this text box blank.
Tree Paging Size To set the number of items that display in the tree pane, enter a number in the Tree Paging Size text box. If you do not enter a number, then the web part will show all users. If you have hundreds of users, this may take some time to show in the web part. Entering a number below 50 keeps the response time reasonable as well as the
Set Display Size for Profile Image: Enter in the height and width in pixels to display profile images when available.

Read User Profile From…

Read User Profile From…

Return to User Directory Configuration

SharePoint Portal Server configuration

SPS.jpgIf you are using the SharePoint Portal Server option, you must enter a SharePoint account that must have the “Manage User Profile” permission in order to be able to read and update user profile information. You must also select whether you want to use the search available from User Directory to search user profiles or the MOSS people search, if it is configured.

Active Directory Services configuration

ReadUserProfiles.jpgIf you are using Active Directory Services (ADS), you must enter a domain administrator account that has Read and Write permissions to the ADS database.

NOTE: The domain administrator account is required to connect to Active Directory.

Allow Users To Edit Profile

If you select to read user profiles from Active Directory Services, then you have the option of allowing users to edit their own profiles. If this check box is enabled, a user can edit their profile without the required administrative account rights.

Understand Who Can Modify a User Profile for Active Directory Profiles: All users can view other user profiles.
Only domain users who have Read and Write permissions can edit another user’s profile. The Domain Administrator group has this right by default.

Site Group(s) Permitted to Update User Profiles

Site Group(s) Permitted to Update User Profiles

Return to User Directory Configuration

User Group Permission

SiteGroups.jpgIf you selected to read user profiles from Active Directory earlier in this configuration, then you have the option of selecting the user groups allowed to update to user profiles. The Web Part displays the site groups on SPS 2003 and SharePoint Groups on MOSS 2007 on the site where the Web Part is installed. You can choose from the default groups as well as any custom groups you may have created. Select a group that has permission to UPDATE the user accounts. Only the users in this site group can modify user profile information. Please read the Security Considerations section for additional information.

Security Considerations

User Directory requires you to provide credentials for accounts that have read and write access to either the Active Directory or the SharePoint User Profile. In order to ensure User Directory is being used without compromising security in your domain, the following must be considered:

Active Directory (AD) Access Domain Account

This domain account is used to read and update the Active Directory profile data. This account must belong to a group that has Read and Write permission to the Active Directory user profile. To check if the account has the appropriate permissions, do the following steps:

Step Action Result
1. Open the Active Directory Users and Computer console application. hw08024.jpg
2. Select View and check the Advanced Features.
3. Select a Forest or Organization Unit, right click and select Properties.
4. Select the Security tab.
5. Make sure that the Access Account you are using has the Read and Write permissions to read and update the particular object.

Understand Who Can Modify a User Profile for Active Directory Profiles

  • All users can view other user profiles.
  • Only domain users who have Read and Write permissions can edit another user’s profile. The Domain Administrator group has this right by default.

Picture Library for User Profile Images

Picture Library for User Profile Images

Return to User Directory Configuration

PictureLib.jpgSelect a Picture Library to store user profile images. Images of your users can be stored in Active Directory Services, but you and your users might find it simpler to use a SharePoint picture library so that images can be updated easier and more often.

  • Select the Save User Profile Image to SharePoint Library instead of AD check box in the configuration tool pane and enter in a site URL.
  • Click Connect and then select a Picture Library from the libraries available on that site.

When you choose SharePoint mode, end users will be able to type in the URL to a profile image already stored in a SharePoint Library from the Picture field when editing their profile.

Organizational Unit Path

Organizational Unit Path

Return to User Directory Configuration

ADchoice.jpg If you selected to read user profiles from Active Directory Services, then you have the option of entering a specific or multiple Organizational Units (OU) as your data source.

OrgUnitPath.jpgEnter the full path of an OU in Active Directory that you want to use as the tree view root directory. The tree will start at the lowest OU level specified in this text box.

For example: If you enter CRM/BambooSolutions/BusinessCenter the tree will only show the OU “BusinessCenter” at the tree top level node. The alphabet view of the tree and search results only show users belonging to this “BusinessCenter” OU branch.

Select the Expand selected OU as default check box if you are showing only one OU (i.e. not multiple OUs separated by a semicolon) and want to automatically expand the OU to its first sublevel OUs when the Organization view is accessed by users.

Shown below is an example of what users will see based on the choices you configure in this tool pane.
ViewOfOU.jpg

Advanced Search Columns for User Directory

Advanced Search Columns for User Directory

Return to User Directory Configuration

AdvancedSearch.jpgThe Search selections display the user profile attributes that can be used in the Advanced Search window. You can select which fields can be used as the search criteria, by adding the fields from the left pane to the right pane. Highlight more than one column on the left Available Columns box and click the > symbol to move them into the Search Columns box on the right. (If you click the double symbol >>, then all the Available Columns move into the Search Columns box.)

AdvSearchBox.jpgIn the example above, we selected five columns which show in the sample image here. Depending on the columns you configure to show, end users will be able to search on those columns in the Advanced Search tool in the web part as displayed here.