Identity Manager 8.2.1 - Authorization and Authentication Guide

Credentials	Login name, identifier, distinguished name or user ID of an LDAP user account. LDAP user account's password.
Prerequisites	The employee exists in the One Identity Manager database. The employee is assigned at least one application role. The LDAP user account exists in the One Identity Manager database and the employee is entered in the user account's main data. The configuration data for dynamically determining the system user is defined in the application. Thus, an employee can, for example, be assigned a system user dynamically depending on their department membership.
Set as default	No
Single sign-on	No
Front-end login allowed	Yes
Web Portal login allowed	Yes
Remarks	If you log in using a login name, identifier, or user ID, the corresponding user account is determined in the One Identity Manager database through the domain. Domains permitted for login are entered in the TargetSystem \| LDP \| Authentication \| RootDN configuration parameter. If log in uses a distinguished name, the LDAP user account is determined that uses this distinguished name. One Identity Manager determines which employee is assigned to the LDAP user account. If an employee has more than one identity, the QER \| Person \| MasterIdentity \| UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication. If this configuration parameter is set, the employee’s main identity is used for authentication. If this configuration parameter is set, the employee’s subidentity is used for authentication. A dynamic system user is determined from the employee's application roles. The user interface and the permissions are loaded through this system user. Data modifications are attributed to the current user account.

In the Designer, modify the following configuration parameters to implement the authentication module.

Table 29: Configuration parameters for the authentication module
Configuration parameter	Meaning
TargetSystem \| LDAP \| Authentication	Allows configuration of the LDAP authentication module.
TargetSystem \| LDAP \| Authentication \| Authentication	Authentication mechanism. Permitted values are Secure, Encryption, SecureSocketsLayer, ReadonlyServer, Anonymous, FastBind, Signing, Sealing, Delegation, and ServerBind. The value can be combined with commas (,). For more information about authentication types, see the MSDN Library. The default is ServerBind.
TargetSystem \| LDAP \| Authentication \| Port	LDAP server's port. The default is port 389.
TargetSystem \| LDAP \| Authentication \| RootDN	Pipe (\|) delimited list of root domains to be used to find the user account for authentication. Syntax: DC=<MyDomain>\|DC=<MyOtherDomain> Example: DC=Root1,DC=com\|DC=Root2,DC=de
TargetSystem \| LDAP \| Authentication \| Server	Name of the LDAP server.

LDAP user account (dynamic)

NOTE: This authentication module is available if the LDAP Module is installed.

Credentials	Login name, identifier, distinguished name or user ID of an LDAP user account. LDAP user account's password.
Prerequisites	The employee exists in the One Identity Manager database. The LDAP user account exists in the One Identity Manager database and the employee is entered in the user account's main data. The configuration data for dynamically determining the system user is defined in the application. Thus, an employee can, for example, be assigned a system user dynamically depending on their department membership.
Set as default	No
Single sign-on	No
Front-end login allowed	Yes
Web Portal login allowed	Yes
Remarks	If you log in using a login name, identifier, or user ID, the corresponding user account is determined in the One Identity Manager database through the domain. Domains permitted for login are entered in the TargetSystem \| LDP \| Authentication \| RootDN configuration parameter. If log in uses a distinguished name, the LDAP user account is determined that uses this distinguished name. One Identity Manager determines which employee is assigned to the LDAP user account. If an employee has more than one identity, the QER \| Person \| MasterIdentity \| UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication. If this configuration parameter is set, the employee’s main identity is used for authentication. If this configuration parameter is set, the employee’s subidentity is used for authentication. The application configuration data is used to determine a system user, which is automatically assigned to the employee. The user interface and permissions are loaded through the system user that is dynamically assigned to the logged in employee. Data modifications are attributed to the current user account.

In the Designer, modify the following configuration parameters to implement the authentication module.

Table 30: Configuration parameters for the authentication module
Configuration parameter	Meaning
TargetSystem \| LDAP \| Authentication	Allows configuration of the LDAP authentication module.
TargetSystem \| LDAP \| Authentication \| Authentication	Authentication mechanism. Permitted values are Secure, Encryption, SecureSocketsLayer, ReadonlyServer, Anonymous, FastBind, Signing, Sealing, Delegation, and ServerBind. The value can be combined with commas (,). For more information about authentication types, see the MSDN Library. The default is ServerBind.
TargetSystem \| LDAP \| Authentication \| Port	LDAP server's port. The default is port 389.
TargetSystem \| LDAP \| Authentication \| RootDN	Pipe (\|) delimited list of root domains to be used to find the user account for authentication. Syntax: DC=<MyDomain>\|DC=<MyOtherDomain> Example: DC=Root1,DC=com\|DC=Root2,DC=de
TargetSystem \| LDAP \| Authentication \| Server	Name of the LDAP server.

HTTP header

NOTE: This authentication module is available if the Configuration Module is installed.

The authentication module supports authentication by web single sign-on solutions that work with a proxy-based architecture.

Credentials	Employee's central user account or personnel number.
Prerequisites	The system user with permissions exists in the One Identity Manager database. The employee exists in the One Identity Manager database. The central user account or personnel number is entered in the employee's main data. The system user is entered in the employee's main data.
Set as default	No
Single sign-on	Yes
Front-end login allowed	No
Web Portal login allowed	Yes
Remarks	You must pass the user (in the form: UserName =<user name of authenticated user>) in the HTTP header. The employee is found in the One Identity Manager database whose central user account or personnel number matches the user name passed down. If an employee has more than one identity, the QER \| Person \| MasterIdentity \| UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication. If this configuration parameter is set, the employee’s main identity is used for authentication. If this configuration parameter is set, the employee’s subidentity is used for authentication. The user interface and permissions are loaded through the system user that is directly assigned to the logged in employee. If a system user is not assigned to the employee, the system user from the SysConfig \| Logon \| DefaultUser configuration parameter is used. Changes to the data are assigned to the logged in employee.

HTTP header (role-based)

NOTE: This authentication module is available if the Identity Management Base Module is installed.

The authentication module supports authentication by web single sign-on solutions that work with a proxy-based architecture.

Credentials	Employee's central user account or personnel number.
Prerequisites	The employee exists in the One Identity Manager database. The central user account or personnel number is entered in the employee's main data. The employee is assigned at least one application role.
Set as default	Yes
Single sign-on	Yes
Front-end login allowed	No
Web Portal login allowed	Yes
Remarks	You must pass the user (in the form: UserName =<user name of authenticated user>) in the HTTP header. The employee is found in the One Identity Manager database whose central user account or personnel number matches the user name passed down. If an employee has more than one identity, the QER \| Person \| MasterIdentity \| UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication. If this configuration parameter is set, the employee’s main identity is used for authentication. If this configuration parameter is set, the employee’s subidentity is used for authentication. A dynamic system user is determined from the employee's application roles. The user interface and the permissions are loaded through this system user. Changes to the data are assigned to the logged in employee.

製品を選択してください:

サービス向上のために、「Purpose of your Chat（チャットの目的）」を記入してください。

お客様の不具合に推奨されるソリューション

Identity Manager 8.2.1 - Authorization and Authentication Guide

LDAP user account (role-based)

LDAP user account (dynamic)

Related topics

HTTP header

HTTP header (role-based)