Chat now with support
Chat with Support

Identity Manager 8.1.4 - Authorization and Authentication Guide

About this guide One Identity Manager application roles Granting One Identity Manager schema permissions through permissions groups Managing permissions to program features One Identity Manager authentication modules OAuth 2.0 / OpenID Connect configuration Multi-factor authentication in One Identity Manager Granulated permissions for the SQL Server and database

Active Directory user account (manual input/role-based)

NOTE: This authentication module is available if the module Active Directory Module is installed.

Credentials

Login name and password for registering with Active Directory. You do not have to enter the domain.

Prerequisites
  • The employee exists in the One Identity Manager database.
  • The employee is assigned at least one application role.
  • The Active Directory user account exists in the One Identity Manager database and the employee is entered in the user account's master data.
  • Domains permitted for login are entered in the TargetSystem | ADS | AuthenticationDomains configuration parameter.

Set as default

Yes

Single sign-on

No

Front-end login allowed

Yes

Web Portal login allowed

Yes

Remarks

The user‘s identity is determined from a predefined list of permitted Active Directory domains. The corresponding user account and employee are determined in the One Identity Manager database, which the user account is assigned to.

If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.

  • If this configuration parameter is set, the employee’s main identity is used for authentication.
  • If the parameter is not set, the employee’s subidentity is used for authentication.

A dynamic system user determined from the employee's application roles. The user interface and the write permissions are loaded through this system user.

Data modifications are attributed to the current user account.

Active Directory user account (dynamic)

NOTE: This authentication module is available if the module Active Directory Module is installed.

Credentials

The authentication module uses the Active Directory login data of the user currently logged in on the workstation.

Prerequisites
  • The employee exists in the One Identity Manager database.
  • The Active Directory user account exists in the One Identity Manager database and the employee is entered in the user account's master data.
  • The configuration data for dynamically determining the system user is defined in the application. Thus, an employee can, for example, be assigned a system user dynamically depending on their department membership.

Set as default

No

Single sign-on

Yes

Front-end login allowed

Yes

Web Portal login allowed

Yes

Remarks

The appropriate user account is found in the One Identity Manager database through the user's SID and the domain given at login. One Identity Manager determines which employee is assigned to the user account.

If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.

  • If this configuration parameter is set, the employee’s main identity is used for authentication.
  • If the parameter is not set, the employee’s subidentity is used for authentication.

The application configuration data is used to determine a system user, which is automatically assigned to the employee. The user interface and write permissions are loaded through the system user that is dynamically assigned to the logged in employee.

Data modifications are attributed to the current user account.

NOTE: If the Connect automatically option is set, authentication is no longer necessary for subsequent logins.
Related topics

LDAP user account (role-based)

NOTE: This authentication module is available if the LDAP Module is installed.

Credentials

Login name, identifier, distinguished name or user ID of an LDAP user account.

LDAP user account's password.

Prerequisites
  • The employee exists in the One Identity Manager database.
  • The employee is assigned at least one application role.
  • The LDAP user account exists in the One Identity Manager database and the employee is entered in the user account's master data.
  • The configuration data for dynamically determining the system user is defined in the application. Thus, an employee can, for example, be assigned a system user dynamically depending on their department membership.

Set as default

No

Single sign-on

No

Front-end login allowed

Yes

Web Portal login allowed

Yes

Remarks

If you log in using a login name, identifier, or user ID, the corresponding user account is determined in the One Identity Manager database through the domain. Domains permitted for login are entered in the TargetSystem | LDP | Authentication | RootDN configuration parameter. If log in uses a distinguished name, the LDAP user account is determined that uses this distinguished name. One Identity Manager determines which employee is assigned to the LDAP user account.

If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.

  • If this configuration parameter is set, the employee’s main identity is used for authentication.
  • If the parameter is not set, the employee’s subidentity is used for authentication.

A dynamic system user determined from the employee's application roles. The user interface and the write permissions are loaded through this system user.

Data modifications are attributed to the current user account.

In the Designer, modify the following configuration parameters to implement the authentication module.

Table 30: Configuration parameters for the authentication module
Configuration parameter Meaning

TargetSystem | LDAP | Authentication

The configuration parameter allows configuration of the LDAP authentication module.

TargetSystem | LDAP | Authentication | Authentication

The configuration parameter specified the authentication mechanism. Permitted values are Secure, Encryption, SecureSocketsLayer, ReadonlyServer, Anonymous, FastBind, Signing, Sealing, Delegation, and ServerBind. The value can be combined with commas (,). For more information about authentication types, see the MSDN Library.

The default is ServerBind.

TargetSystem | LDAP | Authentication | Port

LDAP server's port. The default is port 389.

TargetSystem | LDAP | Authentication | RootDN

The configuration parameter contains a pipe (|) delimited list of root domains to use for finding the user account for authentication.

Syntax:

DC=<MyDomain>|DC=<MyOtherDomain>

Example:

DC=Root1,DC=com|DC=Root2,DC=de

TargetSystem | LDAP | Authentication | Server

The configuration parameter contains the name of the LDAP server.

LDAP user account (dynamic)

NOTE: This authentication module is available if the LDAP Module is installed.

Credentials

Login name, identifier, distinguished name or user ID of an LDAP user account.

LDAP user account's password.

Prerequisites
  • The employee exists in the One Identity Manager database.
  • The LDAP user account exists in the One Identity Manager database and the employee is entered in the user account's master data.
  • The configuration data for dynamically determining the system user is defined in the application. Thus, an employee can, for example, be assigned a system user dynamically depending on their department membership.

Set as default

No

Single sign-on

No

Front-end login allowed

Yes

Web Portal login allowed

Yes

Remarks

If you log in using a login name, identifier, or user ID, the corresponding user account is determined in the One Identity Manager database through the domain. Domains permitted for login are entered in the TargetSystem | LDP | Authentication | RootDN configuration parameter. If log in uses a distinguished name, the LDAP user account is determined that uses this distinguished name. One Identity Manager determines which employee is assigned to the LDAP user account.

If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.

  • If this configuration parameter is set, the employee’s main identity is used for authentication.
  • If the parameter is not set, the employee’s subidentity is used for authentication.

The application configuration data is used to determine a system user, which is automatically assigned to the employee. The user interface and write permissions are loaded through the system user that is dynamically assigned to the logged in employee.

Data modifications are attributed to the current user account.

In the Designer, modify the following configuration parameters to implement the authentication module.

Table 31: Configuration parameters for the authentication module
Configuration parameter Meaning

TargetSystem | LDAP | Authentication

The configuration parameter allows configuration of the LDAP authentication module.

TargetSystem | LDAP | Authentication | Authentication

The configuration parameter specified the authentication mechanism. Permitted values are Secure, Encryption, SecureSocketsLayer, ReadonlyServer, Anonymous, FastBind, Signing, Sealing, Delegation, and ServerBind. The value can be combined with commas (,). For more information about authentication types, see the MSDN Library.

The default is ServerBind.

TargetSystem | LDAP | Authentication | Port

LDAP server's port. The default is port 389.

TargetSystem | LDAP | Authentication | RootDN

The configuration parameter contains a pipe (|) delimited list of root domains to use for finding the user account for authentication.

Syntax:

DC=<MyDomain>|DC=<MyOtherDomain>

Example:

DC=Root1,DC=com|DC=Root2,DC=de

TargetSystem | LDAP | Authentication | Server

The configuration parameter contains the name of the LDAP server.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating