Chatta subito con l'assistenza
Chat con il supporto

Identity Manager 9.3 - Administration Guide for Connecting to Active Directory

Managing Active Directory environments Synchronizing an Active Directory environment
Setting up initial synchronization with an Active Directory domain Adjusting the synchronization configuration for Active Directory environments Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)
Managing Active Directory user accounts and identities
Account definitions for Active Directory user accounts and Active Directory contacts Assigning identities automatically to Active Directory user accounts Supported user account types Updating identities when Active Directory user account are modified Automatic creation of departments and locations based on user account information Specifying deferred deletion for Active Directory user accounts and Active Directory contacts
Managing memberships in Active Directory groups Login credentials for Active Directory user accounts Mapping Active Directory objects in One Identity Manager
Active Directory domains Active Directory container structures Active Directory user accounts Active Directory contacts Active Directory groups Active Directory computers Active Directory security IDs Active Directory printers Active Directory sites Reports about Active Directory objects
Handling of Active Directory objects in the Web Portal Basic data for managing an Active Directory environment Configuration parameters for managing an Active Directory environment Default project template for Active Directory Processing methods of Active Directory system objects Active Directory connector settings

Preparing a home server and profile server for creating user directories

Home and profile servers are expected when user account home and profile directories are added.

To declare home and profile servers

  • In the Designer, set the TargetSystem | ADS | AutoCreateServers and TargetSystem | ADS | AutoCreateServers | PreferredLanguage configuration parameters.

    If these configuration parameters are set, entries for missing home servers and profile servers are created automatically when user accounts are synchronized.

- OR -

  1. In the Manager, select the Active Directory > Basic configuration data > Server category.

  2. Select the Job server entry in the result list.

  3. Select the Change main data task.

  4. Edit the Job server's main data.

  5. Select the Assign server functions task and specify the Home server and Profile server server functions.

  6. Save the changes.

You may use other settings for create home and profile directories.

  • If you want a user’s home directory to be linked at the time of login, in the Designer, set the QER | Person | User | ConnectHomeDir configuration parameter.

  • To create the user profile in the user’s home directory, in the Designer, set the QER | Person | User | PropertyMapping | ProfileFromHome configuration parameter.

  • You can use a batch file for creating the home directory, the result of which determines whether the home directory is enabled.

  • You can create a template structure on the profile server that is used in the process of creating the profile directory.

  • Home and profile directory permissions can be granted through the One Identity Manager Service.

Related topics

Creating home directories using batch files

To satisfy specific demands of individual network environments, you can use a batch file, which is run when you create a home directory with One Identity Manager Service. Whether the home directory is ultimately enabled depends on the result of running the batch file.

To use this function, a Netlogon share must exist on all home servers. Subdirectories are added in the Netlogon share, which correspond to the NetBIOS names of the domain. If there is a batch file in this directory with the name HomePre.CMD, it is run before the home directory is added. If the batch file ends in failure (that means Errorlevel <> 0), the home directory is not added.

Pass the following command line parameters to the batch file HomePre.CMD to be used during the run (in the given order; database column names are used):

SAMAccountName (from table ADSAccount)

Ident_Domain (from table ADSAccount)

Ident_Server (from table QBMServer)

SharedAs (from table ADSAccount)

HomeDirPath (from table ADSAccount)

HomeShare (from table ADSAccount)

You can run another batch file again after adding a home directory. This must be kept in the same place as before and have the name HomePost,CMD. You pass the parameters in the same way as HomePre.CMD. Merely, the exit code (Errorlevel) is not handled.

Example: Batch calls to create a home

A user account Test1 is created in the domain Dom2. Its home directory should be created on the server Serv3 in the shared drive Share7 with the name TestHome6 and be released as TestShare5. On the running home server ServHome the files HomePre.CMD and HomePost.CMD are found in the \\ServHome\Netlogon\Dom2 directory.

Batch call before creating the home directory:

\\ServHome\Netlogon\Dom2\HomePre.CMD Test1 Dom2 Serv3 TestShare5 TestHome6 Share7

If the batch run returns an exit code 0, the home directory is created. Otherwise, the process is stopped with a log message.

Batch call after creating the home directory:

\\ServHome\Netlogon\Dom2\HomePost.CMD Test1 Dom2 Serv3 TestShare5 TestHome6 Share7

Supporting multiple profile directories

The different Windows operating system versions use different repositories for roaming user profiles. For more information about storing roaming user profiles, see the MicrosoftTechNet Library.

To map the roaming user profile in One Identity Manager.

  • Provide a template structure for the user profile on the profile server.

    Example of a template structure for user profiles on a profile server

    PROFILE

    UserProfile

    All required folders/files

    UserProfile.V2

    All required folders/files

    UserProfile.V3

    All required folders/files

    UserProfile.V4

    All required folders/files

  • In the Designer, set the TargetSystem | ADS | Accounts | ProfileFixedString configuration parameter and define the part of the user profile directory that you want to attach to the default profile path. The default value is UserProfile.

As a result, the directory paths for the user profiles are mapped as follows in the default installation.

  • If the profile directory is created in the home directory:

    \\Servername\HOMES\Username$\PROFILES\UserProfile

  • If the profile directory is not created in the home directory:

    \\Servername\PROFILES\Username\UserProfile

The following directories exist after handling the processes.

  • If the profile directory is created in the home directory:

    \\Servername\HOMES\Username$\PROFILES\UserProfile

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v2

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v3

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v4

  • If the profile directory is not created in the home directory:

    \\Servername\PROFILES\Username\UserProfile

    \\Servername\PROFILES\Username\UserProfile.v2

    \\Servername\PROFILES\Username\UserProfile.v3

    \\Servername\PROFILES\Username\UserProfile.v4

The directory paths for the repository on the terminal server are mapped in the same way.

  • In this case, in the Designer, change the TargetSystem | ADS | Accounts | TProfileFixedString configuration parameter accordingly.

  • Specify in this configuration parameter the part of the user profile directory path which is appended to the default profile path on a terminal server. The default value is UserProfile.

Home and profile directory access permissions

Table 66: Configuration parameters for setting up user directories
Configuration parameter Meaning

QER | Person | User | AccessRights

Configuration of permissions for accessing user directories.

NOTE: To assign permissions to directories and files, it is sometimes necessary to define user account names such as Administrators or Domain Users in specific languages. The default language for the user accounts names is English.

NOTE: Ensure that the subdirectories under the root directories, such as the home directory, do not inherit permissions for the Everyone user group. Otherwise, there is a possibility that the user group obtains unwanted permissions on all home directories.

To grant access permissions for the home directory

  • In the Designer, set the QER | Person | User | AccessRights | HomeDir and its configuration subparameters, then enter the access permissions in the configuration parameters.

    Granting access permissions to the home directory is done by the One Identity Manager Service.

    Table 67: Configuration parameters for home directory access permissions
    Configuration parameter Effect when set

    QER | Person | User | AccessRights | HomeDir

    Configuration of access permissions for the user’s home directory. To set the permissions, the configuration parameter and subparameters need to be set.

    QER | Person | User | AccessRights | HomeDir | User

    Defines the user’s home directory permissions.

    Default: +r+w-x

To grant access permission for the profile directory

  • In the Designer, set the QER | Person | User | AccessRights | ProfileDir configuration parameter and its configuration subparameters, and enter the access permissions in the configuration parameters.

    Granting access permissions to the profile directory is done by the One Identity Manager Service.

    Table 68: Configuration parameters for profile directory access permissions
    Configuration parameter Effect when set

    QER | Person | User | AccessRights | ProfileDir

    Configuration of access permissions for the user’s profile directory. To set the permissions, the configuration parameter and subparameters need to be set.

    QER | Person | User | AccessRights | ProfileDir | User

    Defines the user’s profile directory permissions.

    Default: +r+w-x

To grant access permissions for the home directory on a terminal server

  • In the Designer, set the QER | Person | User | AccessRights | TerminalHomeDir and its configuration subparameters, and enter the access permissions in the configuration parameters.

    Granting access permissions to the home directory is done by the One Identity Manager Service.

    Table 69: Configuration parameters for access permissions to the home directory on a terminal server
    Configuration parameter Effect when set

    QER | Person | User | AccessRights | TerminalHomeDir

    Configuration of access permissions for an Active Directory user account’s terminal server home directory. To set the permissions, the configuration parameter and subparameters need to be set.

    QER | Person | User | AccessRights | TerminalHomeDir | User

    Defines the user’s terminal server home directory permissions.

    Default: +r+w-x

To grant access permissions for the profile directory on a terminal server

  • In the Designer, set the QER | Person | User | AccessRights | TerminalProfileDir and its configuration subparameters, and enter the access permissions in the configuration parameters.

    Granting access permissions to the profile directory is done by the One Identity Manager Service.

    Table 70: Configuration parameters for access permissions to the profile directory on a terminal server
    Configuration parameter Effect when set

    QER | Person | User | AccessRights | TerminalProfileDir

    Configuration of access permissions for an Active Directory user account’s terminal server profile directory. To set permissions, the configuration parameter and subparameters need to be set.

    QER | Person | User | AccessRights | TerminalProfileDir | User

    Terminal server profile directory permissions.

    Default: +r+w-x

Related topics
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione