Chatee ahora con Soporte

Obtener ayuda en vivo
Completar registro

Iniciar sesión

Solicitar precios

Comuníquese con Ventas

Identity Manager 8.2 - Administration Guide for Connecting to SharePoint

Navegación de contenido

Managing SharePoint environments

Architecture overview One Identity Manager users for managing SharePoint Claims-based authentication

Setting up SharePoint farm synchronization

Users and permissions for synchronizing with a SharePoint farm Setting up the synchronization server Creating a synchronization project for initial synchronization of a SharePoint farm Special synchronization cases for valid permissions Displaying synchronization results Customizing the synchronization configuration

How to configure SharePoint synchronization Configuring synchronization of several SharePoint farms Changing system connection settings of SharePoint farms

Editing connection parameters in the variable set Editing target system connection properties

Updating schemas

Speeding up synchronization with revision filtering Post-processing outstanding objects Configuring the provisioning of memberships Configuring single object synchronization Accelerating provisioning and single object synchronization Help for analyzing synchronization issues Disabling synchronization Synchronizing single objects Ignoring data error in synchronization

Basic data for managing a SharePoint environment

Authentication modes Prefixes Zones and alternative URLs SharePoint site templates SharePoint permissions SharePoint quotas SharePoint languages Editing a server

Main data for a Job server Specifying server functions

Target system managers Setting up account definitions

Creating an account definition

Main data for an account definition

Creating manage levels

Main data for manage levels

Creating a formatting rule for IT operating data Collecting IT operating data Modify IT operating data Assigning account definitions to employees

Assigning account definitions to departments, cost centers, and locations Assigning account definitions to business roles Assigning account definitions to all employees Assigning account definitions directly to employees Assigning account definitions to system roles Adding account definitions to the IT Shop

Assigning account definitions to a target system Deleting an account definition

SharePoint farms

General main data of a SharePoint farm Editing synchronization projects

SharePoint web applications SharePoint site collections and sites

SharePoint site collections

General main data of a site collection Specifying categories for inheriting SharePoint groups

SharePoint sites

General main data of a site Address data for a site Site design properties Additional tasks for managing sites Passing on permissions to child sites

Setting up SharePoint site collections and sites

SharePoint user accounts

Supported user account types Entering main data of SharePoint user accounts

Group authenticated user account main data User authenticated user account main data

Additional tasks for managing SharePoint user accounts

Displaying the SharePoint user account overview Assigning SharePoint groups directly to a SharePoint user account Assigning SharePoint roles directly to user accounts Assigning extended properties

Using custom authentication modes Assigning employees automatically to SharePoint user accounts

Editing search criteria for automatic employee assignment

Deleting and restoring SharePoint user accounts

SharePoint roles and groups

SharePoint groups

Entering main data of SharePoint groups Assigning SharePoint groups to SharePoint user accounts

Assigning SharePoint groups to departments, cost centers and locations Assigning SharePoint groups to business roles Assigning SharePoint user accounts directly to a SharePoint group Assigning SharePoint roles to SharePoint groups Adding SharePoint groups to system roles Adding SharePoint groups to the IT Shop Adding SharePoint groups automatically to the IT Shop

Additional tasks for managing SharePoint groups

Displaying an overview of SharePoint groups Effectiveness of group memberships SharePoint group inheritance based on categories Assigning extended properties to SharePoint groups

Deleting SharePoint groups Default solutions for requesting SharePoint groups

Adding SharePoint groups SharePointRequesting Groups Memberships

SharePoint roles and permission levels

Entering main data of SharePoint permission levels Additional tasks for managing SharePoint permission levels

Displaying the SharePoint permission level overview Assigning permissions

Special synchronization cases for valid permissions Entering main data of SharePoint roles Assigning SharePoint roles to SharePoint user accounts

Assigning SharePoint roles to departments, cost centers and locations Assigning SharePoint roles to business roles Assigning SharePoint user accounts directly to a SharePoint role Assigning SharePoint groups to SharePoint roles Adding SharePoint roles to system roles Adding SharePoint roles to the IT Shop

Additional tasks for managing SharePoint roles

Displaying the SharePoint rules overview Effectiveness of SharePoint roles Assigning extended properties to SharePoint roles

Deleting SharePoint roles and permission levels

Permissions for SharePoint web applications

SharePoint permission policies SharePoint user policies

Reports about SharePoint objects

Overview of all assignments

Configuration parameters for managing a SharePoint environment Default project template for SharePoint

Entering main data of SharePoint user accounts

Each SharePoint user account represents an object from an authentication system. This object can be a group or a user. The group authentication and user authenticated user accounts are select separately in the navigation system.

To edit the properties of a group authenticated user account

Select the SharePoint > User accounts (group authentication) category.
Select the user account in the result list and run Change main data.
- OR -

Click in the result list.
Edit the user account's resource data.
Save the changes.

To edit the properties of a user authenticated user account.

Select the SharePoint > User accounts (user authentication) category.
Select the user account in the result list and run the Change main data task.
- OR -

Click in the result list.
Edit the user account's resource data.
Save the changes.

To manually assign or create a user authenticated user account for an employee

Select the Employees > Employees category.
Select the employee in the result list and run the Assign SharePoint user accounts task.
Assign a user account.
Save the changes.

Detailed information about this topic

Group authenticated user account main data

Table 20: Configuration parameters for risk assessment of user accounts
Configuration parameter	Effect when set
QER \| CalculateRiskIndex	Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database. If the parameter is enabled, values for the risk index can be entered and calculated.

Enter the following main data of a group authenticated user account.

Table 21: Group authenticated user account main data
Property	Description
Employee	Employee that uses this user account. The input field is only displayed if no authentication object is assigned. Select the employee from the menu. You can create a new employee for a user account with an identity of type Organizational identity, Personalized administrator identity, Sponsored identity, Shared identity, or Service identity. To do this, click next to the input field and enter the required employee main data. Which login data is required depends on the selected identity type.
Site collection	Site collection the user account is used in.
Group authenticated	Specifies whether the user account's authentication object is a group.
Authentication object	Authentication object referencing the user account. Each SharePoint user account represents an object from an authentication system trusted by the SharePoint installation. If this authentication system is managed as a target system in One Identity Manager, the SharePoint object used for authentication can be saved as the authentication object in the user policy. The authentication object is assigned during automatic synchronization. You can assign an authentication object when setting up a new user account in the Manager. The authentication object cannot be changed after saving. The following authentication objects can be assigned to a group authenticated user account: Active Directory groups with the type "Security group" from the domain assigned to the farm or a trusted domain LDAP groups from the domain assigned to the farm
Authentication mode	Authentication mode used for logging in on the SharePoint server with this user account. The login name of new user accounts depends on the authentication mode. The authentication mode is set by a template. The value depends on the Claims-based authentication option of the associated web application. If you have defined custom authentication modes, select your authentication mode in the menu. NOTE: Modify the template for this column (SPSUser.UID_SPSAuthSystem) to assign a custom authentication mode to user accounts.
Display name	Any display name for the user account. By default, the display name is taken from the authentication object display name. Enter the display name by hand if no authentication object is assigned.
Login name	User account login name. It is found using a template. Enter the login name by hand if no authentication object is assigned. NOTE: Modify the template for this column (SPSUser.LoginName) to assign a custom authentication mode to user accounts.
Email address	User account email address. It is formatted using templates from the authentication object's email address.
Risk index (calculated)	Maximum risk index value of all assigned SharePoint roles and groups. The property is only visible if the QER \| CalculateRiskIndex configuration parameter is set. For detailed information, see the One Identity Manager Risk Assessment Administration Guide.
Category	Categories for the inheritance of groups by the user account. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories. Select one or more categories from the menu.
Advice	Text field for additional explanation.
Identity	User account's identity type Permitted values are: Primary identity: Employee's default user account. Organizational identity: Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas. Personalized administrator identity: User account with administrative permissions, used by one employee. Sponsored identity: User account to use for a specific purpose. Training, for example. Shared identity: User account with administrative permissions, used by several employees. Assign all employees that use this user account. Service identity: Service account.
Privileged user account.	Specifies whether this is a privileged user account.
Administrator	Specifies whether the user account is a site collection administrator.
Auditor	Specifies whether the user account is a site collection auditor.

Detailed information about this topic

Authentication modes
Specifying categories for inheriting SharePoint groups
Supported user account types
One Identity Manager Identity Management Base Module Administration Guide

User authenticated user account main data

Table 22: Configuration parameters for risk assessment of user accounts
Configuration parameter	Effect when set
QER \| CalculateRiskIndex	Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database. If the parameter is enabled, values for the risk index can be entered and calculated.

Enter the following main data of a user authenticated user account.

Table 23: User authenticated user account main data
Property	Description
Employee	Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu. If an authentication object is assigned, the connected employee is found through the authentication object by using a template. If there is no authentication object assigned, the employee can be assigned automatically or manually. You can create a new employee for a user account with an identity of type Organizational identity, Personalized administrator identity, Sponsored identity, Shared identity, or Service identity. To do this, click next to the input field and enter the required employee main data. Which login data is required depends on the selected identity type.
Manage level	Manage level of the user account. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.
Account definition	Account definition through which the user account was created. Use the account definition to automatically fill user account main data and to specify a manage level for the user account. One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account. NOTE: The account definition cannot be changed once the user account has been saved. NOTE: Use the user account's Remove account definition task to reset the user account to Linked status. This removes the account definition from both the user account and the employee. The user account remains but is not managed by the account definition anymore. The task only removes account definitions that are directly assigned (XOrigin=1). NOTE: If employees obtain their SharePoint user accounts through account definitions, the employees must own user accounts in the Active Directory domain or LDAP domain. This domain is stored in the SharePoint farm in which the SharePoint user accounts are to be created.
Site collection	Site collection the user account is used in.
Group authenticated	Specifies whether the user account's authentication object is a group. This option is disabled for user authenticated user accounts.
Authentication object	Authentication object referencing the user account. Each SharePoint user account represents an object from an authentication system trusted by the SharePoint installation. If this authentication system is managed as a target system in One Identity Manager, the SharePoint object used for authentication can be saved as the authentication object in the user policy. The authentication object is assigned during automatic synchronization. You can assign an authentication object when setting up a new user account in the Manager. The authentication object cannot be changed after saving. The following authentication objects can be assigned to a user-authenticated user account: Active Directory user accounts from the domain that is assigned to the farm or a trusted domain LDAP user accounts from the domain assigned to the farm User accounts that refer to the default SIDs of an Active Directory environment cannot reference an authentication object in One Identity Manager. NOTE: The SharePoint user account is also created if the user account that is used as the authentication object is disabled or locked.
Authentication mode	Authentication mode used for logging in on the SharePoint server with this user account. The login name of new user accounts depends on the authentication mode. The authentication mode is set by a template. The value depends on the Claims-based authentication option of the associated web application. If you have defined custom authentication modes, select your authentication mode in the menu. NOTE: Modify the template for this column (SPSUser.UID_SPSAuthSystem) to assign a custom authentication mode to user accounts.
Display name	Any display name for the user account. By default, the display name is taken from the authentication object display name. Enter the display name by hand if no authentication object is assigned.
Login name	User account login name. It is found using a template. Enter the login name by hand if no authentication object is assigned. NOTE: Modify the template for this column (SPSUser.LoginName) to assign a custom authentication mode to user accounts.
Email address	User account email address. It is formatted using templates from the authentication object's email address.
Risk index (calculated)	Maximum risk index value of all assigned SharePoint roles and groups. The property is only visible if the QER \| CalculateRiskIndex configuration parameter is set. For detailed information, see the One Identity Manager Risk Assessment Administration Guide.
Category	Categories for the inheritance of groups by the user account. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories. Select one or more categories from the menu.
Advice	Text field for additional explanation.
Identity	User account's identity type Permitted values are: Primary identity: Employee's default user account. Organizational identity: Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas. Personalized administrator identity: User account with administrative permissions, used by one employee. Sponsored identity: User account to use for a specific purpose. Training, for example. Shared identity: User account with administrative permissions, used by several employees. Assign all employees that use this user account. Service identity: Service account.
Privileged user account.	Specifies whether this is a privileged user account.
Groups can be inherited	Specifies whether the user account can inherit groups through the linked employee. If the option is set, the user account inherits groups through hierarchical roles, in which the employee is a member, or through IT Shop requests. If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups. If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.
Roles can be inherited	Specifies whether the user account can inherit SharePoint roles through the linked employee. If the option is set, the user account inherits SharePoint roles through hierarchical roles, in which the employee is a member, or through IT Shop requests.
Administrator	Specifies whether the user account is a site collection administrator.
Auditor	Specifies whether the user account is a site collection auditor.

Detailed information about this topic

Setting up account definitions
Authentication modes
Specifying categories for inheriting SharePoint groups
Assigning employees automatically to SharePoint user accounts
Supported user account types
One Identity Manager Identity Management Base Module Administration Guide

Additional tasks for managing SharePoint user accounts

After you have entered the main data, you can run the following tasks.

Displaying the SharePoint user account overview

Assigning SharePoint groups directly to a SharePoint user account

Assigning SharePoint roles directly to user accounts

Assigning extended properties

Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Términos de uso Privacidad Cookie Preference Center