Chatta subito con l'assistenza
Chat con il supporto

Identity Manager 9.1 - Administration Guide for Connecting to Cloud Applications

Mapping cloud applications in One Identity Manager Synchronizing cloud applications through the Universal Cloud Interface Provisioning object changes Managing provisioning processes in the Web Portal Mapping cloud objects in One Identity Manager
Cloud applications Container structures in cloud applications User accounts in cloud applications Groups and system entitlements in cloud applications Permissions controls in a cloud application
Base data for managing cloud applications Default project template for cloud applications Cloud system object processing methods Configuration parameters for managing cloud applications

Mapping cloud applications in One Identity Manager

One Identity Manager supports the implementation of Identity and Access Governance demands in IT environments, which are often a mix of traditional, on-premise applications and modern cloud applications. Users and entitlements from cloud applications can be mapped in One Identity Manager.

Data protection policies, such as the General Data Protection Regulation, require agreement as to which employee data can be stored in cloud applications. If the system environment is configured appropriately, One Identity Manager guarantees that cloud applications and their administrators have no access to any employee main data or Identity and Access Governance processes respectively. For this reason, cloud applications are managed in two separate modules, which can be installed in separate databases if necessary.

The Universal Cloud Interface Module provides the interface through which users and permissions can be transferred from cloud applications to a One Identity Manager database. Synchronization with the cloud applications is configured and run at this stage. Each cloud application is mapped as its own base object in One Identity Manager. The user data is saved as user accounts, groups, system entitlements, and permissions controls and can be organized into containers. They cannot be edited in One Identity Manager. There is no connection to identities (employees).

The connection to the identities is established in the Cloud Systems Management Module; user accounts, groups, system entitlements, and permissions controls can be created and edited. Data is exchanged between the Universal Cloud Interface and Cloud System Management modules by synchronization. Provisioning processes ensure that object changes are transferred from the Cloud Systems Management Module to the Universal Cloud Interface Module.

Automated interfaces for provisioning changes from the Universal Cloud Interface Module to the cloud application can (on technical grounds) or should (due to too few changes) not be applied to certain cloud applications. In this case, changes can be manually provisioned.

Since only data that must be available in the cloud application is saved in the Universal Cloud Interface Module, the module can be installed in a separate database. This database may be outside the company's infrastructure.

The One Identity Starling Connect cloud solution provides a simple and comprehensive solution for integrating cloud applications and for meeting the requirements of hybrid solution scenarios.

Architecture overview

One Identity Manager knows two methods for exchanging data with a cloud application.

  • Automatic synchronization and provisioning

    Synchronizing a cloud application with the One Identity Manager database and provisioning changes to One Identity Manager database objects in the cloud application is handled by the One Identity Manager's SCIM connector. This standard procedure ensures that target system and database data is regularly compared and therefore remains consistent.

  • Manual provisioning

    For certain cloud applications, automated interfaces for provisioning changes should not be implemented. Changes can be manually provisioned for cloud application like this. When data is transferred data from a cloud application to the One Identity Manager database, the synchronization can be configured with the SCIM connector. If One Identity Manager cannot obtain read access to the cloud application, you can set up data exchange through the CSV connector, for example.

    With the method, you carry the risk of inconsistent data and loss of data if the manual processes are maintained. This method is therefore not recommended.

Figure 1: Architecture for synchronization

To access cloud applications, the SCIM connector is installed on a synchronization server. The SCIM connector can communicate with cloud applications that understand the System for Cross-Domain Identity Management (SCIM) specification. The synchronization server ensures data is compared between the One Identity Manager database and the cloud application.

Figure 2: Synchronization topology

Detailed information about this topic

One Identity Manager users for managing cloud applications

The following users are used for setting up and administration of cloud applications.

Table 1: Users
Users Tasks

Cloud administrators

Cloud administrators must be assigned to the Universal Cloud Interface | Administrators application role or a child application role.

Users with this application role:

  • Manage application roles for the Universal Cloud Interface.

  • Set up other application roles as required.

  • Configure synchronization in the Synchronization Editor and define the mapping for comparing cloud applications and One Identity Manager.

  • Edit cloud application in the Manager.

  • Edit pending, manual provisioning processes in the Web Portal and obtain statistics.

  • Obtain information about the cloud objects in the Web Portal and the Manager.

Cloud operators

The cloud operators must be assigned to the Universal Cloud Interface | Operators application role or a child application role.

Users with this application role:

  • Edit pending, manual provisioning processes in the Web Portal and obtain statistics.

Cloud auditors

The cloud auditors must be assigned to the Universal Cloud Interface | Auditors application role or a child application role.

Users with this application role:

  • Can view manual provisioning processes in the Web Portal and obtain statistics.

One Identity Manager administrators

One Identity Manager administrator and administrative system users Administrative system users are not added to application roles.

One Identity Manager administrators:

  • Create customized permissions groups for application roles for role-based login to administration tools in the Designer as required.

  • Create system users and permissions groups for non role-based login to administration tools in the Designer as required.

  • Enable or disable additional configuration parameters in the Designer as required.

  • Create custom processes in the Designer as required.

  • Create and configure schedules as required.

Synchronizing cloud applications through the Universal Cloud Interface

One Identity Manager supports synchronization with cloud applications that understand the System for Cross-domain Identity Management (SCIM) in the version 2.0 specification. The requirements of RFC 7643 (System for Cross-domain Identity Management: Core Schema) and RFC 7644 (System for Cross-domain Identity Management: Protocol) must be guaranteed.

This sections explains how to:

  • Set up synchronization to import initial data from cloud applications into the One Identity Manager database.
  • Adapt a synchronization configuration to synchronize, for example, different cloud applications with the same synchronization project.
  • Start and deactivate the synchronization.
  • Evaluate the synchronization results.

TIP: Before you set up synchronization with a cloud application, familiarize yourself with the Synchronization Editor. For more information about this tool, see the One Identity Manager Target System Synchronization Reference Guide.

Detailed information about this topic
Strumenti self-service
Knowledge Base
Notifiche e avvisi
Supporto prodotti
Download di software
Documentazione tecnica
Forum utente
Esercitazioni video
Feed RSS
Contatti
Richiedi assistenza sulle licenze
Supporto tecnico
Visualizza tutto
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione