SharePoint group inheritance based on categories
In One Identity Manager, groups can be selectively inherited by user accounts. For this purpose, the groups and the user accounts are divided into categories. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The template contains two tables; the user account table and the group table. Use the user account table to specify categories for target system dependent user accounts. In the group table enter your categories for the target system-dependent groups. Each table contains the Position 1 to Position 31 category positions.
Every user account can be assigned to one or more categories. Each group can also be assigned to one or more categories. The group is inherited by the user account when at least one user account category items matches an assigned group. The group is also inherited by the user account if the group or the user account is not put into categories.
NOTE: Inheritance through categories is only taken into account when groups are assigned indirectly through hierarchical roles. Categories are not taken into account when groups are directly assigned to user accounts.
Table 36: Category examples
| 1 |
Default user |
Default permissions |
| 2 |
System users |
System user permissions |
| 3 |
System administrator |
System administrator permissions |
Figure 3: Example of inheriting through categories.
To use inheritance through categories
- Define the categories in the site collection.
- Assign categories to user accounts through their master data.
- Assign categories to groups through their master data.
Related topics
Assigning extended properties to SharePoint groups
Extended properties are meta objects, such as operating codes, cost codes, or cost accounting areas that cannot be mapped directly in One Identity Manager.
To specify extended properties for a group
-
In the Manager, select the SharePoint | Groups category.
-
Select the group in the result list.
-
Select the Assign extended properties task.
-
In the Add assignments pane, assign extended properties.
TIP: In the Remove assignments pane, you can remove assigned extended properties.
To remove an assignment
- Select the extended property and double-click
.
- Save the changes.
For more detailed information about setting up extended properties, see the One Identity Manager Identity Management Base Module Administration Guide.
Deleting SharePoint groups
To delete a group
- Select the SharePoint | Groups category.
- Select the group in the result list.
- Click
to delete the group.
- Confirm the security prompt with Yes.
The group is deleted completely from the One Identity Manager database and from SharePoint.
Default solutions for requesting SharePoint groups
In One Identity Manager, default products and default approval workflows are provided for requesting SharePoint groups and membership in these groups through the IT Shop. Permissions in this target system are therefore issued by defined approval processes.
For detailed information, see the One Identity Manager Web Portal User Guide.
Detailed information about this topic
