Identity Manager 8.1.4 - Administration Guide for Connecting to Active Directory

Name of the group. The group identifier is used to form the group name for previous group name (pre Win2000) versions.

Domain in which to create the group.

Container in which to create the group.

Distinguished name of the group. The distinguished name is determined by template from the name of the group and the container and cannot be edited.

The display name is used to display the group in the One Identity Manager tools user interface.

Name of the group for the previous versions. The group name is taken from the group identifier.

Structural object class representing the object type. By default, you set up groups in One Identity Manager with the object class GROUP.

List of classes defining the attributes for this object. The object classes listed are read in from the database during synchronization with the Active Directory environment. However, in the input field, you can add object classes and auxiliary classes that are used by other LDAP and X.500 directory services.

Manager responsible for the group.

To specify an account manager

1. Click next to the field.
2. In the Table menu, select the table that maps the account manager.
3. In the Account manager menu, select the manager.
4. Click OK.

Specifies whether the account manager can change memberships for these groups.

Group's email address

Value for evaluating the risk of assigning the group to user accounts. Enter a value between 0 and 1. This input field is only visible if the QER | CalculateRiskIndex configuration parameter is activated.

For more detailed information, see the One Identity Manager Risk Assessment Administration Guide.

Text field for additional explanation.

Text field for additional explanation. Abbreviations for combinations of group type and group area are added in the comment and should not be changed.

Group type. Authorizations are issued through security groups. User accounts, computers, and other groups are added to security groups and which makes administration easier. Security groups are also used for email distribution groups.

Group type. Distribution groups can be used as email distribution groups. Distribution groups do not have any security.

Group scope. Universal groups can be used to make cross-domain authorizations available. Universal group members can be user accounts and groups from all domains in one domain structure.

Group scope. Local groups are used when authorizations are issued within the same domain. Members of a domain local group can be user accounts, computers, or groups in any domain.

Group scope. Global groups can be used to make cross-domain authorizations available. Members of a global group are only user accounts, computers, and groups belonging to the global group’s domain.

Specifies whether the group can be requested through the IT Shop. If this option is set, the group can be requested by the employees through the Web Portal and distributed with a defined approval process. The group can still be assigned directly to hierarchical roles.

Specifies whether the group can only be requested through the IT Shop. If this option is set, the group can be requested by the employees through the Web Portal and distributed with a defined approval process. Direct assignment of the group to hierarchical roles or user accounts is not permitted.