One Identity Manager sends email notifications about various actions taken within the system. Thus, various notifications are sent to requester and approver within the request process. In the same way, notifications about attestation cases are sent or reports delivered by email. Notifications are sent when an actions is successfully or unsuccessfully run during process handling.
You can implement custom notifications in addition to predefined notification processes.
To use the notification system
-
Use the Job Server Editor to set up a Job server as a SMTP host for mail distribution.
-
In the Launchpad, in the Configuration section, select Configure email connection.
-
Click Run.
-
On the home page of the Mail Configuration Wizard, click Next.
-
On the Create connection to the SMTP server page, configure the SMTP server connection to use for sending emails.
-
To test the user account data, click Test connection.
-
SMTP Server: SMTP server for sending email notifications. If a server is not given, localhost is used.
-
User name: User account name for authentication on an SMTP server.
-
Domain: User account domain for authentication on the SMTP server.
-
Password and Password repeat: User account password for authentication on the SMTP server.
-
Port: Port of the SMTP service on the SMTP server. Default: 25
-
Transport encryption: Encryption method for sending email notifications. If none of the following options are given, the port is used to define the behavior (port 25: no encryption, port 465: with SSL/TLS encryption).
Permitted values are:
-
Auto: Identifies the encryption method automatically.
-
SSL: Encrypts the entire session with SSL/TLS.
-
STARTTLS: Uses the STARTTLS mail server extension. Switches TLS encryption after the greeting and loading the server capabilities. The connection fails if the server does not support the STARTTLS extension.
-
STARTTLSWhenAvailable: Uses the STARTTLS mail server extension if available. Switches on TLS encryption after the greeting and loading the server capabilities, however, only if it supports the STARTTLS extension.
-
None: No security for the transport layer. All data is sent as plain text.
-
-
Accept self-signed certificates: Specifies whether self-signed certificates for TLS connections are accepted.
-
Allow server name mismatch in certificates: Specifies whether server names that do not match are permitted by certificates for TLS connections.
-
-
On the Email settings page, you can define the default email address of a sender and a recipient as well as the layout of the email.
-
Recipient address: Default email address of the recipient of the notifications.
-
Sender address: Sender's default email address for sending automatically generated notifications.
Syntax:
sender@example.com
Example:
NoReply@company.com
You can enter the sender's display name in addition to the email address. In this case, ensure that the email address is enclosed in chevrons (<>).
Example:
One Identity <NoReply@company.com>
-
Language: Default language used to send email notifications if a language cannot be determined for a recipient.
-
Language: Default language for sending email notifications.
-
Font: Default font for email notifications.
-
Font size: Default font size for email notifications.
-
Signature: Signature under the salutation.
-
Company: Company name.
-
Link: Link to the company's website.
-
Link display: Display text for the link to the company's website.
-
-
On the Data security page, you can configure the data security settings.
-
Certificate thumbprint: SHA1 thumbprint of the certificate to use for the signature. This can be in the computer's or the user's certificate store. If you want to use a digital signature, enable Certificate thumbprint and enter your thumbprint.
-
Email encryption: Specifies whether emails are encrypted. If you enable this feature, additional settings are shown.
-
Domain controller: Domain controller of the requested domain to use.
-
Domain: Distinguished name of the domain to request.
-
User account:User account for querying Active Directory.
-
Password and Password repeat: Password of the user account.
-
-
On the Email notifications about requests page, make any changes to the general settings for email notifications about requests. In addition, define whether the Approval by mail feature can be used for requests. If you enable this feature, the settings you need are shown.
-
Sender address: Sender's default email address for sending automatically generated notifications.
Syntax:
sender@example.com
Example:
NoReply@company.com
You can enter the sender's display name in addition to the email address. In this case, ensure that the email address is enclosed in chevrons (<>).
Example:
One Identity <NoReply@company.com>
-
Daily notifications about pending approvals: Specifies whether approvers only receive emails once a day if there are requests awaiting their approval decisions.
If this option is not set, approvers immediately receive an email once a request is available for approval. Set this option to reduce the number of email notifications. This will mean that you cannot use the Approval by mail feature.
TIP: To use a template other than the default one for this, change the value in the QER | ITShop | MailTemplateIdents | RequestApproverByCollection configuration parameter in the Designer.
-
IT Shop approval by mail: Specifies whether the Approval by mail feature can also be used for approving requests. If you enable the feature, adjust the required settings. Then you cannot use the Daily notifications about pending approvals feature.
-
User name: Name of the user account for authenticating the mailbox used for approval by mail.
-
Domain: Domain of the user account for authenticating the mailbox used for approval by mail.
-
Password and Password repeat: Password of the user account for authenticating the mailbox used for approval by mail.
-
Web service URL:
-
Mailbox: Microsoft Exchange mailbox to which approvals by mail are sent.
-
Delete behavior: Specifies the way emails are deleted from the inbox.
-
Application ID: Exchange Online application ID for authentication with OAuth 2.0. If the value is not set, the Basic or the NTML authentication method is used.
-
-
On the Email notifications about attestation page, make any changes to the general settings for email notifications about attestations.
-
Sender address: Sender's default email address for sending automatically generated notifications.
Syntax:
sender@example.com
Example:
NoReply@company.com
You can enter the sender's display name in addition to the email address. In this case, ensure that the email address is enclosed in chevrons (<>).
Example:
One Identity <NoReply@company.com>
-
Daily notifications about pending approvals: Specifies whether attestors only receive emails once a day if there are attestation cases awaiting their approval decisions.
If this option is not set, attestors immediately receive an email once an attestation case is available for approval. Set this option to reduce the number of email notifications. Then you cannot use the Approval by mail feature.
TIP: To use a template other than the default one for this, change the value in the QER | Attestation | MailTemplateIdents | RequestApproverByCollection configuration parameter in the Designer.
-
Attestation by mail: Specifies whether the Approval by mail feature can be used. If you enable the feature, adjust the required settings. Then you cannot use the Daily notifications about pending approvals feature.
-
User name: Name of the user account for authenticating the mailbox used for approval by mail.
-
Domain: Domain of the user account for authenticating the mailbox used for approval by mail.
-
Password and Password repeat: Password of the user account for authenticating the mailbox used for approval by mail.
-
Web service URL:
-
Mailbox: Microsoft Exchange mailbox to which approvals by mail are sent.
-
Delete behavior: Specifies the way emails are deleted from the inbox.
-
Application ID: Exchange Online application ID for authentication with OAuth 2.0. If the value is not set, the Basic or the NTML authentication method is used.
-
-
On the Report subscriptions page, you can change the default settings for report subscriptions.
-
Sender address: Sender's default email address for sending automatically generated notifications about report subscriptions. Replace the default address with a valid email address.
Syntax:
sender@example.com
Example:
NoReply@company.com
You can enter the sender's display name in addition to the email address. In this case, ensure that the email address is enclosed in chevrons (<>).
Example:
One Identity <NoReply@company.com>
-
Default report template: Default report that is used as a template for creating simple list reports.
- Store subscription: Specifies whether subscribed reports are saved in a repository. If you enable the feature, adjust the required settings.
-
Report storage share: Path to the repository for subscribed reports. Syntax: \\<Server>\<Share>
-
Storage life time (days) Maximum retention period (in days) that a report is available in the storage share. After this period, reports are deleted.
-
-
On the Email notifications about actions in the target system page, you can enter an email address for notifying about actions in the target system. This might be error or success messages about changes in the target system.
-
<Target system type>: Specifies whether email notifications are sent with error or success messages about changes in target systems of this type. If you enable the feature, enter the email address to send notifications to.
-
-
On the last page of the Mail Configuration Wizard, click Finish.
SMTP connection propertiesIn addition, other configuration parameters could be required for different notification processes. Enable these in the Designer. Some configuration parameters are only available if the module is installed.
|
Configuration parameter |
Meaning |
|---|---|
|
Common | InternationalEMail |
Specifies whether international domain names and unicode characters are supported in email addresses. IMPORTANT: The mail server must also support this function. If necessary, you must override the script VID_IsSMTPAddress |
|
Common | MailNotification | Encrypt | EncryptionCertificateScript |
This configuration parameter contains the script that supplies a list of encrypted certificates (default: QBM_GetCertificates). |
|
Common | MailNotification | NotifyAboutWaitingJobs |
Specifies whether a message should be sent if the process steps have a particular status in the Job queue. |
|
Common | MailNotification | SMTPUseDefaultCredentials |
Specifies which credentials are used for authentication on the SMTP server. If this parameter is set, the One Identity Manager Service login credentials are used for authentication on the SMTP server. If the configuration parameter is not set, the login data defined in the Common | MailNotification | SMTPDomain and Common | MailNotification | SMTPAccount or Common | MailNotification | SMTPPassword configuration parameters is used. (Default) |
|
Common | MailNotification | VendorNotification |
Email address of your company's contact person. The email address is used as the return address for notifying vendors. If the configuration parameter is set, One Identity Manager generates a list of system settings once a month and sends the list to One Identity. This list does not contain any personal data. You can check the latest system information at any time by selecting Help > Info in the menu. The list will be reviewed by our customer support team, who will look for material changes in a proactive effort to identify potential issues before they materialize on your system. The lists may be used by our R&D staff for analysis, diagnosis, and replication for testing purposes. We will keep and refer to this information for as long as your company remains on support for this product. |
|
TargetSystem | ADS | MemberShipRestriction | MailNotification |
Default email address for sending warning emails. |