1. Prime Service Catalog 12.0
Integration Best Practices – LDAP and SAML Settings

2. Overview
This guide details the prerequisite settings necessary to avoid certain issues that may arise when integrating Prime Service Catalog with UCS Director and/or Cloud Center.
Configuration included are:
Prime Service Catalog + UCS Director – both connected to same LDAP
Prime Service Catalog connected to LDAP + UCS Director not connected to LDAP
Prime Service Catalog + UCS Director connected to LDAP – Cloud Center integrated later
Prime Service Catalog + Cloud Center + SAML + IDP
Prime Service Catalog + Cloud Center + SAML + IDP – UCS Director integrated later

3. Prime Service Catalog + UCS Director – both connected to same LDAP
Issue:
At default, UCS Director imports the user with domain name appended to the login name (Example: user name cloudadmin is imported as and Prime Service Catalog imports the user without in the username. This results in duplicate user accounts created in Prime Service Catalog and causes permission issue.
Solution:
Ensure the following:
When integrating UCS Director, do not check the Sync User with IaaS check box on the Configure Integration screen so users and groups are imported from UCS Director.
Go to Administration module > Directories tab > Mappings and map the Login ID and Person Identification attributes to userPrincipalName.

4. Prime Service Catalog connected to LDAP + UCS Director not connected to LDAP
To enable Prime Service Catalog users to order UCS Director services, ensure the following:
When integrating UCS Director, check the Sync User with IaaS check box on the Configure Integration screen so users and groups are not imported from UCS Director. Users are imported on login event from LDAP mapping.
In Organizational Designer in Prime Service Catalog, define a group for each UCS Director group (Example: In Prime Service Catalog, if the Identifier as UCD on the Configure Integration screen, the group name should be UCSD::UCD::<Group name from UCSD>. Map all the users into one the appropriate groups created.

5. Prime Service Catalog + UCS Director connected to LDAP – Cloud Center integrated later
Issue:
Cloud Center does not support LDAP integration.
Solution:
Ensure the following:
Prime Service Catalog and USC Director are integrated according to the prerequisites found earlier in this guide.
In Prime Service Catalog, create a team or join team by using Team Management so the users will be pushed to Cloud Center.
If not creating or joining team using Team Management, when ordering of Cloud Center application profiles the system uses CliqrAdmin credentials.

6. Prime Service Catalog + Cloud Center + SAML + IDP
Issue:
Prime Service Catalog and Cloud Center are both connected to the same SAML IDP.
Solution:
Ensure the following:
In Cloud Center, do not enable the Import Person on login event from IDP.
In Prime Service Catalog, enable the Import Person on login event from IDP.
Prime Service Catalog, create a team or join team by using Team Management so the users will be pushed to Cloud Center.
If not creating or joining team using Team Management, when ordering of Cloud Center application profiles the system uses CliqrAdmin credentials.

7. Prime Service Catalog + Cloud Center + SAML + IDP – UCS Director integrated later
Issue:
Integrating UCS Director with previously integrated Prime Service Catalog Cloud Center connected to the same SAML IDP
Solution:
Ensure the following:
In Cloud Center, do not enable the Import Person on login event from IDP.
In Prime Service Catalog, enable the Import Person on login event from IDP.
Prime Service Catalog, create a team or join team by using Team Management so the users will be pushed to Cloud Center.
If not creating or joining team using Team Management, when ordering of Cloud Center application profiles the system uses CliqrAdmin credentials.
When integrating UCS Director, do not check Sync User with IaaS on the Configure Integration screen so users and groups are not imported from UCS Director. Users are imported on login event from LDAP mapping.
In Organizational Designer in Prime Service Catalog, define a group for each UCS Director group (Example: In Prime Service Catalog, if the Identifier as UCD on the Configure Integration screen, the group name should be UCSD::UCD::<Group name from UCSD>. Map all the users into one the appropriate groups created.