This article describes the architecture of AD Connect Sync Plus. The system is designed to provide a centralized web-based solution for the synchronization of identity data. With AD Connect Sync Plus identities and passwords can be synchronized between various on-premises Active Directories with centralized monitoring, logging, and reporting. Communication between the source and destination Active Directories is carried securely over the internet through SSL and HTTPS.

AD Connect Sync Plus can be divided into three main components:

• AD Connect Sync Plus Portal
• AD Connect Sync Plus Agent
• AD Connect Sync Plus Password Filter

AD Connect Sync Plus Portal

AD Connect Sync Plus Portal is a web-based application and one of the main components of the solution. It is further divided into two components; a web-based portal to manage and access the platform and a HUB component to manage connections and synchronization.

Portal

The portal provides a central location for all administrators and users to login into their respective management interfaces and administer their accounts. Installation of the portal creates a site for the portal in IIS and names it ADCS Plus Portal. All administrator roles can then login with their credentials, into the portal, and manage their accounts. Similarly, the users can login into the portal and view their accounts. The portal also allows Portal Admins (global admins) to define global settings for the application. Moreover, the portal furnishes central logging and reporting for all Active Directories (source and target) in the system.

HUB

The HUB serves as a bridge between Active Directories. It receives data from the source Active Directory and relays it to the target. It basically is a Windows service and gets installed with the AD Connect Sync Plus Portal installer on the control server. The domain controllers of the Active Directories (source and target) do not communicate directly with the HUB, rather mediation servers in between, push synchronization data towards the HUB. The mediation servers parse data and push the last modified objects towards the HUB. The HUB then routes data towards the destination. 

The HUB also notifies entities (Active Directories) of new updates and generates sync logs and error reports. Another important function of the HUB is to monitor and ensure the high availability of the mediation servers. It is the responsibility of the HUB to ensure that there is always an active mediation node pushing data to the HUB.

AD Connect Sync Plus Agent

AD Connect Sync Plus Agent is the second component of the solution. It serves as a mediation agent for connecting the AD Connect Sync Plus Portal with the intended source and target domain controllers. It transmits and receives data to/from the domain controllers over LDAPS. It is installed on the mediation agent servers and is further divided into three components; a sync service to manage synchronization, a desktop configuration utility to accept configuration settings, and an update service for monitoring and installing new updates. 

Sync Service

The sync service is responsible for synchronizing data. It’s a Windows service and fetches data from the linked DC and sends it to the HUB at scheduled intervals. It also receives data from the HUB to update in the linked DC. The sync service also maintains a record of connected ADs and authentication information. In addition, it also receives new software update notifications.

Configuration Utility

The configuration utility is a desktop interface for accepting various configuration settings. It accepts the domain controller details of the DC to which the data is to be sent/received. It also accepts the organizational unit (OU) details whose data is to be synchronized.

Update Service

The update service monitors for new updates and installs them when they are available. It is a Windows service, and auto updates the AD Connect Sync Plus agent when new updates (builds) are available. 

AD Connect Sync Plus Password Filter

AD Connect Sync Plus Password Filter is a password hook for capturing password changes in the Active Directory, in real-time and storing them securely within the DC to be fetched and used later by the sync service. It is the third component of the solution and is installed on the DC machine.