The following users are identified for using
-
Installation user
The installation user is needed for the initial installation of a
-
Administrative user
The administrative user is used by components of One Identity Manager that require authorizations at server level and database level, for example, the Configuration Wizard, the DBQueue Processor, or the One Identity Manager Service.
-
Configuration user
The configuration user can run configuration tasks within One Identity Manager, For example,
-
End users
End users are only assigned permissions at database level in order, for example, to complete tasks with the Manager or the Web Portal.
For more information about minimum access levels for One Identity Manager tools, see the One Identity Manager Authorization and Authentication Guide.
Permissions for installation users
A SQL Server login and a database user with the following permissions must be provided for the installation user.
SQL Server:
-
Member of dbcreator server role
The server role is only required if the database is created using the Configuration Wizard.
-
Member of securityadmin server role
This server role is required to create SQL Server logins.
-
view server state permissions with the with grant option option and alter any connection permissions with the with grant option option.
The permissions are required to check connections and close these if necessary.
-
alter any server role permissions
The permissions are required to create the server role for the administrative user.
msdb database:
-
alter any user permissions
The permissions are required to create the necessary database users for the administrative user.
-
alter any role permissions
This permission is required to create the necessary database role for the administrative user.
module database:
-
alter any user permissions
The permissions are required to create the necessary database users for the administrative user.
-
alter any role permissions
This permission is required to create the necessary database role for the administrative user.
-
Run permissions with the with grant option option for the xp_readerrorlog procedure
The permissions are required to find out information about the database server's system status.
One Identity Manager database:
-
Member of the db_owner database role
This database role is only required if you wish to use an existing database or a schema update is performed when installing the schema with the Configuration Wizard.
Permissions for administrative users
During the installation of
SQL Server:
-
OneIMAdminRole_<DatabaseName> server role
-
alter any server role permissions
The permissions are required to create the server role for the configuration user.
-
view any definition permissions
The permissions are required to link the SQL Server logins for the configuration user and the end user with the corresponding database users.
-
-
<DatabaseName>_Admin SQL server login
-
Member of the OneIMAdminRole_<DatabaseName> server role
-
view server state permissions with the with grant option option and alter any connection permissions with the with grant option option.
The permissions are required to check connections and close these if necessary.
-
msdb database:
-
OneIM_<DatabaseName> database user
-
Member of the OneIMRole_<DatabaseName>database role
-
The database user is assigned to the <DatabaseName>_Admin SQL server login.
-
module database:
-
OneIMRole_<DatabaseName> database role
-
Run permissions for the xp_readerrorlog procedure
The permissions are required to find out information about the database server's system status.
-
- OneIM_<DatabaseName> database user
-
Member of the OneIMRole_<DatabaseName> database role
-
The database user is assigned to the <DatabaseName>_Admin SQL server login.
-
One Identity Manager database:
-
Admin database user
-
Member in db_owner database role
The database role is required to update a database with the Configuration Wizard.
-
The database user is assigned to the <DatabaseName>_Admin SQL server login.
-
Permissions for configuration users
During the installation of
SQL Server:
-
OneIMConfigRole_<DatabaseName> server role
-
view server state and alter any connection permissions
The permissions are required to check connections and close these if necessary.
-
-
<DatabaseName>_Config SQL login
-
Member of the OneIMConfigRole_<DatabaseName> server role
-
One Identity Manager database:
-
OneIMConfigRoleDB database role
-
Create Procedure, Delete, Select, Create table, Update, Checkpoint, Create View, Insert, Run, and Create function permissions for the database
-
-
Config database user
-
Member of the OneIMConfigRoleDB database role
-
The database user is connected with the <DatabaseName>_Config SQL Server login.
-
Permissions for end users
The following principals are created with the permissions for end users during the installation of the
SQL Server:
-
<DatabaseName>_User SQL login
One Identity Manager database:
-
OneIMUserRoleDB database role
-
Insert, Update, Select, and Delete permissions for selected tables in the database
-
View Definition permissions for the database
-
Run and References permissions for individual functions, procedures, and types
-
-
User database user
-
Member of the OneIMUserRoleDB database role
-
The database user is connected with the <DatabaseName>_User SQL Server login.
-