Defining categories for the inheritance of Active Directory groups
Groups and be selectively inherited by user accounts and contacts in One Identity Manager. The groups and user accounts (contacts) are divided into categories in the process. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains tables that map the user accounts (contact) and the groups. Specify your categories for user account (contacts) in the table for user accounts (contacts). Enter your categories fro groups in the group table. Each table contains the Position 1 to Position 31 category positions.
To define a category
-
In the Manager, select the Active Directory > Domains category.
-
Select the domain in the result list.
-
Select the Change main data task.
-
Select the Categories tab.
-
Expand the root in the respective table.
-
To enable the category, double-click 
.
-
Enter a category name for user accounts, contacts, and groups in your login language.
- Save the changes.
Detailed information about this topic
Displaying information about the Active Directory forest
The information about the forest is required in One Identity Manager to map trusted domains and group memberships across domains.
The information about the Active Directory forest is loaded into One Identity Manager during synchronization.
To display information about a forest
-
In the Manager, select the Active Directory > Forest category.
-
Select a forest in the result list.
-
To display a domain's forest, select the Forest overview task.
-
To display a forest's main data, select the Change main data task.
Related topics
Entering and testing trusted Active Directory domains
For an explanation of the concept of trusts in Active Directory, refer to your Windows Server documentation. Users can access resources in other domains depending on the domain trusts.
-
Explicit trusts are loaded into Active Directory by synchronizing with One Identity Manager. Domains which are trusted by the currently synchronized domains are found.
-
To declare implicit two-way trusts between domains within an Active Directory forest in One Identity Manager, ensure that the parent domain is entered in all child domains.
To enter the parent domain
-
In the Manager, select the Active Directory > Domains category.
-
Select the domain in the result list.
-
Select the Change main data task.
-
Enter the parent domain.
-
Save the changes.
Implicit trusts are created automatically.
To test trusted domains
-
In the Manager, select the Active Directory > Domains category.
-
Select the domain in the result list.
-
Select Specify trust relationships.
This shows domains that trust the selected domain.
Active Directory account policies for Active Directory domains
Set up global account policies for a domain. This information is declared in the domain as default settings. For domains from the functional levels Windows Server 2008 R2 and above, it is possible to define multiple account policies. This allows individual users and groups to be subjected to stricter account policies as intended for global groups. Refer to your Active Directory documentation for more information about the concept of fine-grained password policies under Windows Server.
You can also define password policies in One Identity Manager that you can apply to the user account passwords.
NOTE: password policies, global account policy settings for the Active Directory domain, and Active Directory account policies are all taken into account when verifying user passwords.
Detailed information about this topic
Related topics
