LDAP containers are represented by a hierarchical tree structure. Containers are often used to display organizational units such as branch offices or departments, to organize LDAP directory objects such as users, groups, and computers logically, and therefore to ease the burden of object administration. LDAP directory containers are loaded by synchronization with the One Identity Manager database.
About this guide
Managing LDAP environments
Architecture overview
One Identity Manager users for managing LDAP
Configuration parameters for managing a LDAP environment
Synchronizing LDAP directories
Setting up initial LDAP directory synchronization
Managing LDAP user accounts and employees
Users and permissions for synchronizing with LDAP
Special cases for synchronizing Active Directory Lightweight Directory Services
Special cases for synchronizing Oracle Directory Server Enterprise Edition
Setting up the LDAP synchronization server
Adjusting the synchronization configuration for LDAP environments
System requirements for the LDAP synchronization server
Installing One Identity Manager Service with an LDAP connector
Creating a synchronization project for initial synchronization of an LDAP domain
Information required to set up a synchronization project
Creating an initial synchronization project for an LDAP domain with the generic LDAP connector
Creating an initial synchronization project for an LDAP domain with the LDAP connector V2
Configuring the synchronization log
Configuring synchronization in LDAP domains
Configuring synchronization of several LDAP domains
Changing system connection settings of LDAP domains
Running synchronization
Editing connection parameters in the variable set
Editing target system connection properties
Advanced settings of a generic LDAP connector
Extended schema configuration with the LDAP connector V2
Updating schemas
Speeding up synchronization with revision filtering
Configuring the provisioning of memberships
Configuring single object synchronization
Accelerating provisioning and single object synchronization
Starting synchronization
Displaying synchronization results
Deactivating synchronization
Synchronizing single objects
Tasks following synchronization
Post-processing outstanding objects
Adding custom tables to the target system synchronization
Managing LDAP user accounts through account definitions
Troubleshooting
Ignoring data error in synchronization
Account definitions for LDAP user accounts
Managing memberships in LDAP groups
Creating account definitions
Editing account definitions
Main data for account definitions
Editing manage levels
Creating manage levels
Assigning manage levels to account definitions
Main data for manage levels
Creating mapping rules for IT operating data
Entering IT operating data
Modify IT operating data
Assigning account definitions to employees
Assigning employees automatically to LDAP user accounts
Assigning account definitions to departments, cost centers, and locations
Assigning account definitions to business roles
Assigning account definitions to all employees
Assigning account definitions directly to employees
Assigning account definitions to system roles
Adding account definitions in the IT Shop
Assigning account definitions to LDAP domains
Deleting account definitions
Editing search criteria for automatic employee assignment
Finding employees and directly assigning them to user accounts
Changing manage levels for LDAP user accounts
Assigning account definitions to linked LDAP user accounts
Manually linking employees to LDAP user accounts
Supported user account types
Default user accounts
Administrative user accounts
Specifying deferred deletion for LDAP user accounts
Providing administrative user accounts for one employee
Providing administrative user accounts for several employees
Privileged user accounts
Assigning LDAP groups to LDAP user accounts and LDAP computers in One Identity Manager
Login information for LDAP user accounts
Prerequisites for indirect assignment of LDAP groups
Assigning LDAP groups to departments, cost centers, and locations
Assigning LDAP groups to business roles
Adding LDAP groups to system roles
Adding LDAP groups to the IT Shop
Assigning LDAP user accounts directly to LDAP groups
Assigning LDAP groups directly to LDAP user accounts
Assigning LDAP computers directly to LDAP groups
Assigning LDAP groups directly to LDAP computers
Effectiveness of membership in LDAP user groups
LDAP group inheritance based on categories
Overview of all assignments
Password policies for LDAP user accounts
Mapping LDAP objects in One Identity Manager
Predefined password policies
Using password policies
Editing password policies
Creating password policies
General main data of password policies
Policy settings
Character classes for passwords
Custom scripts for password requirements
Editing the excluded list for passwords
Checking passwords
Testing the generation of passwords
Initial password for new LDAP user accounts
Email notifications about login data
LDAP domains
Handling of LDAP objects in the Web Portal
Basic data for managing a LDAP environment
Troubleshooting
Creating LDAP domains
Editing main data of LDAP domains
General main data for LDAP domains
LDAP specific main data for LDAP domains
Defining categories for inheritance by LDAP groups
Editing the synchronization project for an LDAP domain
Displaying the LDAP domain overview
LDAP container structures
Creating LDAP containers
Editing main data of LDAP containers
General main data for LDAP containers
Contact data for LDAP containers
Address information for LDAP containers
Assigning extended properties to LDAP containers
Displaying the LDAP container overview
LDAP user accounts
Creating LDAP user accounts
Editing main data of LDAP user accounts
General main data of LDAP user accounts
Contact information for LDAP user accounts
Address information for LDAP user accounts
Organizational data for LDAP user accounts
Miscellaneous data for LDAP user accounts
Assigning extended properties to LDAP user accounts
Disabling LDAP user accounts
Deleting and restoring LDAP user accounts
Displaying the LDAP user account overview
LDAP groups
Creating LDAP groups
Editing main data of LDAP groups
LDAP group main data
Assigning extended properties to LDAP groups
Adding LDAP groups to LDAP groups
Deleting LDAP groups
Displaying the LDAP group overview
LDAP computers
Creating LDAP computers
Editing main data of LDAP computers
Main data for LDAP computers
Displaying the LDAP computer overview
Reports about LDAP objects
Possible errors when synchronizing an OpenDJ environment
Errors connecting multiple LDAP systems with the same distinguished name
Configuration parameters for managing an LDAP environment
Default project template for LDAP
OpenDJ project template for the generic LDAP connector
Active Directory Lightweight Directory Services project template for the generic LDAP connector
OpenDJ project template for the LDAP connector V2
Active Directory Lightweight Directory Services project template for the LDAP connector V2
Oracle Directory Server Enterprise Edition template for the LDAP connector V2
Generic project template for the LDAP connector V2
Generic LDAP connector settings
LDAP connector V2 settings
LDAP container structures
Creating LDAP containers
To create a container
-
In the Manager, select the LDAP > Container category.
-
Click
in the result list.
-
Edit the container's main data.
- Save the changes.
Related topics
Editing main data of LDAP containers
To edit a container
-
In the Manager, select the LDAP > Container category.
-
Select the container in the result list and run the Change main data task.
Click -
Edit the container's main data.
- Save the changes.
Related topics
General main data for LDAP containers
Enter the following data on the General tab.
| Property | Description |
|---|---|
|
Display name |
Container’s display name. |
|
Domain |
Container domain |
|
Parent container |
Parent container for mapping a hierarchical container structure. The distinguished name is automatically updated using templates. |
|
Name |
Container name. |
|
Distinguished name |
Container's distinguished name. The distinguished name for the new container is made up from the container name, the object class, the parent container, and the domain and cannot be modified. |
|
Business unit |
Business unit to which the container is assigned. |
|
Link (named URI format) |
Specifies links in Uniform Resource Identifier (URI) Format; made up of a name and a URL. |
|
Search mask |
Search mask for another LDAP object. |
|
See also |
Link to another LDAP object. |
|
State |
State. |
|
Structural object class |
Structural object class representing the object type. By default, containers in One Identity Manager are added with the ORGANIZATIONALUNIT object class. |
|
Object class |
List of classes defining the attributes for this object. By default, containers in One Identity Manager are added with the ORGANIZATIONALUNIT object class. However, in the input field, you can add object classes and auxiliary classes that are used by other LDAP and X.500 directory services. |
|
Description |
Text field for additional explanation. |
|
Target system manager |
Application role in which target system managers are specified for the container. Target system managers only edit container objects that are assigned to them. Each container can have a different target system manager assigned to it. Select the One Identity Manager application role whose members are responsible for administration of this container. Use the |