| Property | Description |
|---|---|
|
System users |
Name of the system user for logging in to the administration tools. |
|
Password and password confirmation |
Password with which the system logs into the administration tools. |
|
Password last changed |
Date of last password change. |
|
Password never expires |
Specifies whether the password never expires. Enable the option for service accounts, for example, to prevent the password from expiring. This option overwrites the maximum age of the password. |
|
Remarks |
Text field for additional explanation. |
|
Read-only |
Set the option if a system user is a member in several permissions groups, but has read-only permissions for the objects. This overrides all edit permissions that the system user is granted through memberships in permission groups. |
|
Logins |
Logins with which the system user can log in to the One Identity Manager tools. Enter the login in the form: Domain\User. This information is required if the Account based system user authentication module is used to log into the One Identity Manager tools. |
|
Administrative user |
Specifies whether this is an administrative system user. Administrative system users are automatically added to all non role-based permissions groups. NOTE: You can create an administrative system user in the Designer with the User & Permissions Group Editor using the Create administrator menu. |
|
Service account |
Specifies whether this is a system user that is used by a service account. This system user is not assigned to a permissions group but has all the permissions, tasks, and program functionality. |
|
External password management |
Specifies whether the system user password is determined by an external password management system. You cannot change the password in One Identity Manager. The determination of the system user password must be customized. |
About this guide
One Identity Manager application roles
Application roles overview
Granting One Identity Manager schema permissions through permissions groups
Application roles for basic functions
Application role for the Operations Support Web Portal
Application role for Compliance & Security Officers
Application role for auditors
Application roles for identity audit
Application roles for company policies
Application roles for attestation
Application roles for subscribable reports
Application roles for management levels
Application roles for business roles
Application roles for organizations
Application for employee administrators
Application roles for the IT Shop
Application roles for target systems
Application roles for Universal Cloud Interface
Application role for Privileged Account Governance
Application roles for Application Governance
Application roles for custom tasks
Implementing the application roles
Creating and editing application roles
Main data of application roles
Assigning employees to application roles
Custom extension of application role permissions
Creating and editing dynamic roles for application roles
Specifying mutually exclusive application roles
Assigning subscribable reports to application roles
Assigning extended properties to application roles
Generating assignment resources for application roles
Reports about application roles
Predefined permissions groups and system users
Rules for determining the valid permissions for tables and columns
Editing permissions groups
Managing permissions to program features
Dependencies between permissions groups
Permissions group dependencies
Copying permissions groups
Creating permissions groups
Permissions group properties
Editing system users
Creating system users
System users’ passwords
System user properties
Adding system users to permission groups
Which employees use the system user?
Dynamic system user
Permissions for tables and columns
Displaying permissions of a permissions group
Displaying permissions for tables
Editing table permissions
Editing column permissions
Copying table permissions and column permissions
Simulating permissions for system users
Displaying permissions for objects
Displaying permissions for the current user
Assigning role-based permissions groups to an applications
Displaying the current user's program functions
Assigning program functions to permissions groups
Permissions for running scripts
Permissions for running methods
Permissions for triggering processes
Modifying permissions for running actions in the Launchpad
One Identity Manager authentication modules
System users
Generic single sign-on (role-based)
Employee
Employee (role-based)
Employee (dynamic)
User account
User account (role-based)
Account based system user
Active Directory user account
Active Directory user account (role-based)
Active Directory user account (manual input)
Active Directory user account (manual input/role-based)
Active Directory user account (dynamic)
LDAP user account (role-based)
LDAP user account (dynamic)
HTTP header
HTTP header (role-based)
OAuth 2.0/OpenID Connect
OAuth 2.0/OpenID Connect (role-based)
Synchronization authentication module
Web agent authentication module
Component authentication module
Crawler
Password reset
Password reset (role-based)
Decentralized identity
Decentralized Identity (role-based)
Editing authentication modules
OAuth 2.0 / OpenID Connect configuration
Enabling authentication modules
Assigning authentication modules to applications
Disabling or enabling authentication modules for applications
Authentication module properties
Initial data for authentication modules
Configuration data for system user dynamic authentication
Checking authentication
Expiry of the OAuth 2.0/OpenID Connect authentication
Creating the OAuth 2.0/OpenID Connect configuration
Assigning OAuth 2.0/OpenID Connect configuration to web applications
Displaying the configuration of the identity provider and the OAuth 2.0/OpenID Connect applications
Specifying enabled and disabled columns for logging in
Logging information about OAuth 2.0/OpenID Connect authentication
Multi-factor authentication in One Identity Manager
Editing table properties
Preparing the Starling 2FA token request
Requesting a security code
Multi-factor authentication with One Identity Defender
Authenticating other applications using OAuth 2.0/OpenID Connect
Granular permissions for the SQL Server and database
Displaying database server logins
Displaying users' access levels
Displaying server roles and database roles permissions
Installing One Identity Redistributable STS
Program functions for starting the One Identity Manager tools
Minimum access levels of One Identity Manager tools
System user properties
Adding system users to permission groups
Add the system users to permissions groups, thereby granting permissions for the tables and columns of the One Identity Manager schema and make the user interface available.
NOTE:
-
You cannot add system users to role-based permissions groups. Dynamic system users are calculated for role-based login.
-
Administrative system users are automatically added to all non role-based permissions groups.
-
The QBM_BaseRights permissions group defines the base rights that are required for a system user to log in to the One Identity Manager tools. This permissions group is always assigned implicitly.
-
The viadmin system user has all of the specified permissions and the complete user interface. The system user implicitly receives the authorizations and user interface parts of the custom permissions groups.
A system user's memberships in permissions groups are displayed in the Designer in the User & Permissions Group Editor. Use the Options > Display permissions group inheritance menu to specify whether to display the direct and inherited memberships of permissions groups for a system user.
Figure 2: Memberships of a system user in permissions groups
| Icon | Meaning |
|---|---|
|
|
The selected system user is not assigned to this permissions group. |
|
|
The selected system user is assigned to this permissions group. |
|
|
The selected system user is indirectly assigned to this permissions group. |
|
|
The selected system user is directly and indirectly assigned to this permissions group. |
To assign a system user to a permissions group
-
In the Designer, select the Permissions > System user category.
-
Select a system user and start the User & Permissions Group Editor with the Edit system user task.
-
In the hierarchical view, select the permission group. By clicking on the icon, you add or delete the selected system user to or from a permissions group.
-
Select the Database > Save to database and click Save.
TIP: To assign a system user to several permissions groups, use the User > Permissions groups menu.
Related topics
Which employees use the system user?
Employees obtain a system user direct through their main data or dynamically through their One Identity Manager applications roles.
To display which employees are assigned to a system user
-
In the Designer, select the Permissions > System user category.
-
Select a system user and start the User & Permissions Group Editor with the Edit system user task.
-
Select the View > One Identity Manager employees menu item.
NOTE: You cannot change the assignments in this view.
Dynamic system user
Dynamic system users are used for logging into One Identity Manager tools with role-based authentication modules. First, the employee memberships in the One Identity Manager application roles are determined during login. Assignments of permissions groups to One Identity Manager application roles are used to determine which permissions groups apply to the employee. A dynamic system user is determined from these permissions groups that will be used for the employee’s login.
NOTE: You cannot edit dynamic system users. If no role-based logins of employees who use dynamic system users are performed for some time, you should delete the dynamic system users for performance reasons. A new dynamic system user is created during the next role-based employee login.
To delete system users
-
In the Designer, enable the Common | DynamicUserLifetime configuration parameter and enter the maximum retention period in days for dynamic system users.
If the configuration parameter is set, dynamic system users, whose retention period has expired, are deleted from the database as part of the daily maintenance tasks.