After you have entered the main data, you can run the following tasks.
Managing SharePoint environments
Architecture overview
One Identity Manager users for managing SharePoint
Claims-based authentication
Setting up SharePoint farm synchronization
Users and permissions for synchronizing with a SharePoint farm
Setting up the synchronization server
Creating a synchronization project for initial synchronization of a SharePoint farm
Special synchronization cases for valid permissions
Displaying synchronization results
Customizing the synchronization configuration
Basic data for managing a SharePoint environment
How to configure SharePoint synchronization
Configuring synchronization of several SharePoint farms
Changing system connection settings of SharePoint farms
Updating schemas
Speeding up synchronization with revision filtering
Post-processing outstanding objects
Configuring the provisioning of memberships
Configuring single object synchronization
Accelerating provisioning and single object synchronization
Help for analyzing synchronization issues
Disabling synchronization
Synchronizing single objects
Ignoring data error in synchronization
Pausing handling of target system specific processes (Offline mode)
Authentication modes
Prefixes
Zones and alternative URLs
SharePoint site templates
SharePoint permissions
SharePoint quotas
SharePoint languages
Editing a server
Target system managers
Setting up account definitions
SharePoint farms
SharePoint web applications
SharePoint site collections and sites
Creating an account definition
Creating manage levels
Creating a formatting rule for IT operating data
Collecting IT operating data
Modify IT operating data
Assigning account definitions to employees
Assigning account definitions to departments, cost centers, and locations
Assigning account definitions to business roles
Assigning account definitions to all employees
Assigning account definitions directly to employees
Assigning account definitions to system roles
Adding account definitions to the IT Shop
Assigning account definitions to a target system
Deleting an account definition
SharePoint site collections
SharePoint sites
SharePoint user accounts
General main data of a site
Address data for a site
Site design properties
Additional tasks for managing sites
Passing on permissions to child sites
Setting up SharePoint site collections and sites
Supported user account types
Entering main data of SharePoint user accounts
Additional tasks for managing SharePoint user accounts
SharePoint roles and groups
Displaying the SharePoint user account overview
Assigning SharePoint groups directly to a SharePoint user account
Assigning SharePoint roles directly to user accounts
Assigning extended properties
Using custom authentication modes
Assigning employees automatically to SharePoint user accounts
Deleting and restoring SharePoint user accounts
SharePoint groups
Permissions for SharePoint web applications
Reports about SharePoint objects
Configuration parameters for managing a SharePoint environment
Default project template for SharePoint
Entering main data of SharePoint groups
Assigning SharePoint groups to SharePoint user accounts
SharePoint roles and permission levels
Assigning SharePoint groups to departments, cost centers and locations
Assigning SharePoint groups to business roles
Assigning SharePoint user accounts directly to a SharePoint group
Assigning SharePoint roles to SharePoint groups
Adding SharePoint groups to system roles
Adding SharePoint groups to the IT Shop
Adding SharePoint groups automatically to the IT Shop
Additional tasks for managing SharePoint groups
Displaying an overview of SharePoint groups
Effectiveness of group memberships
SharePoint group inheritance based on categories
Assigning extended properties to SharePoint groups
Deleting SharePoint groups
Default solutions for requesting SharePoint groups
Entering main data of SharePoint permission levels
Additional tasks for managing SharePoint permission levels
Special synchronization cases for valid permissions
Entering main data of SharePoint roles
Assigning SharePoint roles to SharePoint user accounts
Assigning SharePoint roles to departments, cost centers and locations
Assigning SharePoint roles to business roles
Assigning SharePoint user accounts directly to a SharePoint role
Assigning SharePoint groups to SharePoint roles
Adding SharePoint roles to system roles
Adding SharePoint roles to the IT Shop
Additional tasks for managing SharePoint roles
Displaying the SharePoint rules overview
Effectiveness of SharePoint roles
Assigning extended properties to SharePoint roles
Deleting SharePoint roles and permission levels
Additional tasks for managing SharePoint groups
Displaying an overview of SharePoint groups
Use this task to obtain an overview of the most important information about a group.
To obtain an overview of a group
- Select the SharePoint > Groups category.
- Select the group in the result list.
- Select the SharePoint group overview task.
Effectiveness of group memberships
When groups are assigned to user accounts an employee may obtain two or more groups, which are not permitted in this combination. To prevent this, you can declare mutually exclusive groups. To do this, you specify which of the two groups should apply to the user accounts if both are assigned.
It is possible to assign an excluded group at any time either directly, indirectly, or with an IT Shop request. One Identity Manager determines whether the assignment is effective.
NOTE:
- You cannot define a pair of mutually exclusive groups. That means, the definition "Group A excludes group B" AND "Group B excludes groups A" is not permitted.
- You must declare each group to be excluded from a group separately. Exclusion definitions cannot be inherited.
The effectiveness of the assignments is mapped in the
Example: The effect of group memberships
- The groups A, B, and C are defined in a site collection.
- Group A is assigned through the "Marketing" department, group B through "Finance", and group C through the "Control group" business role.
Jo User1 has a user account
By using suitable controls, you want to prevent an employee from
|
Effective group |
Excluded group |
|---|---|
|
Group A |
|
|
Group B |
Group A |
|
Group C |
Group B |
|
Employee |
Member in role |
Effective group |
|---|---|---|
|
Pat Identity1 |
Marketing |
Group A |
|
Jan User3 |
Marketing, finance |
Group B |
|
Jo User1 |
Marketing, finance, control group |
Group C |
|
Chris User2 |
Marketing, control group |
Group A, Group C |
Only the group C assignment is in effect for Jo User1. It is published in the target system. If Jo User1 leaves the "control group" business role at a later date, group B also takes effect.
The groups A and C are in effect for Chris User2 because the groups are not defined as mutually exclusive. If this should not be allowed, define further exclusion for group C.
|
Employee |
Member in role |
Assigned group |
Excluded group |
Effective group |
|---|---|---|---|---|
|
Chris User2
|
Marketing |
Group A |
|
Group C
|
|
Control group |
Group C |
Group B
Group A |
Prerequisites
-
The QER | Structures | Inherite | GroupExclusion configuration parameter is set.
In the Designer, set the configuration parameter and compile the database.
NOTE: If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.
-
Mutually exclusive groups belong to the same site collection.
To exclude a group
-
In the Manager, select the SharePoint > Groups category.
-
Select a group in the result list.
-
Select the Exclude groups task.
-
In the Add assignments pane, assign the groups that are mutually exclusive to the selected group.
- OR -
In the Remove assignments pane, remove the groups that are no longer mutually exclusive.
- Save the changes.
SharePoint group inheritance based on categories
Every user account can be assigned to one or more categories. Each group can also be assigned to one or more categories. The group is inherited by the user account when at least one user account category items matches an assigned group. The group is also inherited by the user account if the group or the user account is not put into categories.
NOTE: Inheritance through categories is only taken into account when groups are assigned indirectly through hierarchical roles. Categories are not taken into account when groups are directly assigned to user accounts.
| Category item | Categories for user accounts | Categories for groups |
|---|---|---|
| 1 | Default user | Default permissions |
| 2 | System users | System user permissions |
| 3 | System administrator | System administrator permissions |
Figure 3: Example of inheriting through categories.
To use inheritance through categories
- Define the categories in the site collection.
- Assign categories to user accounts through their main data.
- Assign categories to groups through their main data.