Chat now with support
Chat with Support

Active Roles 8.1.1 - Administration Guide

Introduction Getting started Rule-based administrative views Role-based administration
Access Templates as administrative roles Access Template management tasks Examples of use Deployment considerations Windows claims-based access rules
Rule-based autoprovisioning and deprovisioning
Provisioning Policy Objects Deprovisioning Policy Objects How Policy Objects work Policy Object management tasks Policy configuration tasks
Property Generation and Validation User Logon Name Generation Group Membership AutoProvisioning Exchange Mailbox AutoProvisioning AutoProvisioning in SaaS products OneDrive Provisioning Home Folder AutoProvisioning Script Execution Microsoft 365 and Azure Tenant Selection E-mail Alias Generation User Account Deprovisioning Office 365 Licenses Retention Group Membership Removal Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Relocation User Account Permanent Deletion Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Notification Distribution Report Distribution
Deployment considerations Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Container Deletion Prevention policy Picture management rules Policy extensions
Using rule-based and role-based tools for granular administration Workflows
Key workflow features and definitions About workflow processes Workflow processing overview Workflow activities overview Configuring a workflow
Creating a workflow definition for a workflow Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configure an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Approval workflow Email-based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic groups Active Roles Reporting Management History Entitlement profile Recycle Bin AD LDS data management One Identity Starling Join and configuration through Active Roles Managing One Identity Starling Connect Configuring linked mailboxes with Exchange Resource Forest Management Configuring remote mailboxes for on-premises users Azure AD, Microsoft 365, and Exchange Online Management
Configuring Active Roles to manage Hybrid AD objects Managing Hybrid AD users
Creating a new Azure AD user with the Web Interface Viewing or updating the Azure AD user properties with the Web Interface Viewing or modifying the manager of a hybrid Azure user Disabling an Azure AD user Enabling an Azure AD user Deprovisioning of an Azure AD user Undo deprovisioning of an Azure AD user Adding an Azure AD user to a group Removing an Azure AD user from a group View the change history and user activity for an Azure AD user Deleting an Azure AD user with the Web Interface Creating a new hybrid Azure user with the Active Roles Web Interface Converting an on-premises user with an Exchange mailbox to a hybrid Azure user Licensing a hybrid Azure user for an Exchange Online mailbox Viewing or modifying the Exchange Online properties of a hybrid Azure user Creating a new Azure AD user with Management Shell Updating the Azure AD user properties with the Management Shell Viewing the Azure AD user properties with the Management Shell Delete an Azure AD user with the Management Shell Assigning Microsoft 365 licenses to new hybrid users Assigning Microsoft 365 licenses to existing hybrid users Modifying or removing Microsoft 365 licenses assigned to hybrid users Updating Microsoft 365 licenses display names
Unified provisioning policy for Azure M365 Tenant Selection, Microsoft 365 License Selection, Microsoft 365 Roles Selection, and OneDrive provisioning Microsoft 365 roles management for hybrid environment users Managing Microsoft 365 contacts Managing Hybrid AD groups Managing Microsoft 365 Groups Managing cloud-only distribution groups Managing cloud-only dynamic distribution groups Managing Azure security groups Managing cloud-only Azure users Managing cloud-only Azure guest users Managing cloud-only Azure contacts Changes to Active Roles policies for cloud-only Azure objects Managing room mailboxes Managing cloud-only shared mailboxes
Modern Authentication Managing the configuration of Active Roles
Connecting to the Administration Service Managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the Console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server replication Using regular expressions Administrative Template Communication ports Active Roles and supported Azure environments Integrating Active Roles with other products and services Active Roles Language Pack Active Roles Diagnostic Tools Active Roles Add-on Manager

Suggested values setting

The suggested values setting allows you to configure predefined values from which you can choose when using the claim type in a conditional expression. If you create a claim type without suggested values, you will have to type rather than select values in the condition builder. Another option is to create one or more suggested values for the claim type. These values will appear in a list provided by the condition builder.

You can add, edit or remove suggested values for a given claim type when creating or modifying the respective claim type object. When you add or edit a suggested value, you are prompted to complete the following fields:

  • Value: This value data will be used when evaluating conditional expressions that include the suggested value you are configuring.

  • Display name: This is the name of the suggested value that appears in the list when you configure a conditional expression.

Steps for managing Claim Types

Claim types must be created in Active Directory to enable domain controllers (DCs) to issue claims to users or computers. Claims issued by the DC are sourced from attributes of user or computer accounts stored in Active Directory. Claim types specify the attributes from which the claims are sourced, and contain metadata required for using claims.

New claim types are created in the Claim Types container under the Active Directory node located in the Active Roles Console tree. If you have domains from multiple forests registered with Active Roles, then the Console displays an individual Claim Types container for each forest that has DCs running Windows Server 2016 or a later version of the Windows Server operating system. To identify the forest of a given Claim Types container, the container name includes the name (or a part of the name) of the forest root domain.

To create a new claim type

  1. Right-click the Claim Types container, and select New > Claim Type.

  2. On the Source Attribute page, select the desired source attribute for claims of this type.

  3. Review the auto-generated display name and description, and change them if needed.

  4. Under Claims of this type can be issued for the following classes, select:

    • The User check box to enable issuance of this claim type to users.

    • The Computers check box to enable issuance of this claim type to computers.

  5. Select the Set ID to a semantically identical claim type in a trusted forest check box if the claim type must match an existing claim type in a different forest. Type the claim identifier. Clear this check box to generate the claim identifier automatically.

  6. Select the Protect from accidental deletion check box to ensure an administrator cannot accidentally delete the claim type. Clear the check box to remove accidental deletion protection.

  7. Click Next to proceed to the Suggested Values page.

  8. Click the option you want for suggested values. Create suggested values as needed.

  9. Click Finish.

To modify an existing claim type

  1. Right-click the claim type you want to modify and then click Properties.

  2. On the Source Attribute page, view or change the source attribute, the display name, description, user or computer claim issuance options, and the option to protect the claim type from accidental deletion.

  3. Click the Suggested Values tab to view or change suggested values.

  4. Click OK to save the modified claim type.

To delete a claim type

  1. Right-click the claim type and then click Delete.

  2. Confirm the claim type deletion.

If you encounter a message stating that you do not have permission to delete the claim type, then modify the claim type and clear the Protect from accidental deletion check box. If this check box is cleared, verify that you have sufficient rights to delete claim type objects.

Enabling and disabling Claim Types

Windows claim types have two states: disabled and enabled. Disabled claim types are valid claim types, but are unavailable for use in production. Claims of disabled claim types are not issued by domain controllers and disabled claim types are filtered from view in the access rule condition builder. A claim type becomes available for production use once you enable it. Active Roles creates enabled claim types, and allows you to disable and enable claim types as needed.

To disable an enabled claim type

  • Right-click the claim type object and click Disable.

To enable a disabled claim type

  • Right-click the claim type object and click Enable.

Populating claim source attributes

Creating a claim type object makes the Active Directory forest aware of the claim type. However, claim type objects do not provide information held in the actual claims. When issuing claims, domain controllers (DCs) retrieve that information from user and computer objects. Hence, in addition to claim type objects, user and computer objects must contain the information necessary for DCs to issue claims.

Attribute-based claim types define the attributes from which to source the claims. These are attributes of user and computer objects. Each claim type object specifies a certain attribute that the DC retrieves when creating and issuing claims of that type. During authentication of a user, the claim-aware DC reads all enabled claim types from the user’s Active Directory forest, and maps them to the attributes of the authenticating user or computer. Then, the DC retrieves information from the mapped attributes, and issues claims containing that information.

As DCs do not issue blank claims, you may encounter a situation where you have created a valid claim type but the DC does not issue the claim during authentication. This is because a claim type object merely maps claims to a certain attribute, directing the DC to issue claims based on the information present in that attribute. If the attribute of the authenticating user or computer does not contain information, the DC does not issue the claim.

Therefore, it is important that claim source attributes contain information. Additionally, as authorization decisions depend upon information found in claims, claim source attributes must contain valid information. Incorrect attribute information can lead to unexpected access to data using claims-based authorization.

To ensure that claim source attributes contain valid information, you could periodically inspect and, if needed, set or correct the properties of users and computers by using the Active Roles Console or Web Interface. However, it would be more practical to leverage property generation and validation policies provided by Active Roles. You can use policies to:

  • Auto-generate the appropriate values for user and computer properties upon creation of user and computer objects.

  • Prevent invalid values from being assigned to user and computer properties, by applying validation rules or creating immutable lists of suggested values.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating