Chat now with support
Chat with Support

Identity Manager 8.1.5 - Administration Guide for Privileged Account Governance

Mapping a Privileged Account Management system in One Identity Manager Synchronizing a Privileged Account Management system
Setting up the initial synchronization of a One Identity Safeguard Customizing the synchronization configuration for One Identity Safeguard Executing synchronization Tasks after a synchronization Troubleshooting
Managing PAM user accounts and employees Managing the assignments of PAM user groups Provision of login information for PAM user accounts Mapping of PAM objects in One Identity Manager PAM access requests Handling of PAM objects in the Web Portal Basic data for managing a Privileged Account Management system Configuration parameters for the management of a Privileged Account Management system Default project template for One Identity Safeguard Editing One Identity Safeguard system objects Known issues about connecting One Identity Safeguard appliances About us

Provision of login information for PAM user accounts

When new user accounts are created in One Identity Manager, the passwords needed to log in to the target system are created immediately also. Various options are available for assigning the initial password. Predefined password policies are applied to the passwords, and you can adjust these policies to suit your individual requirements if necessary. You can set up email notifications to distribute the login information generated to users.

Detailed information about this topic

Password policies for PAM users

One Identity Manager provides you with support for creating complex password policies, for example, for system user passwords, the employees' central password as well as passwords for individual target systems. Password polices apply not only when the user enters a password but also when random passwords are generated.

Predefined password policies are supplied with the default installation that you can use or customize if required. You can also define your own password policies.

Detailed information about this topic

Predefined password policies

You can customize predefined password policies to meet your own requirements, if necessary.

Password for logging in to One Identity Manager

The One Identity Manager password policy is applied for logging in to One Identity Manager. This password policy defines the settings for the system user passwords (DialogUser.Password and Person.DialogUserPassword) as well as the passcode for a one time log in on the Web Portal (Person.Passcode).

NOTE: The One Identity Manager password policy is marked as the default policy. This password policy is applied if no other password policy can be found for employees, user accounts, or system users.

For detailed information about password policies for employees, see the One Identity Manager Identity Management Base Module Administration Guide.

Password policy for forming employees' central passwords

An employee's central password is formed from the target system specific user accounts by respective configuration. The Employee central password policy defines the settings for the (Person.CentralPassword) central password. Members of the Identity Management | Employees | Administrators application role can adjust this password policy.

IMPORTANT: Ensure that the Employee central password policy does not violate the target system-specific requirements for passwords.

For detailed information about password policies for employees, see the One Identity Manager Identity Management Base Module Administration Guide.

Password policies for user accounts

Predefined password policies are provided, which you can apply to the user account password columns of the user accounts.

IMPORTANT: If you do not use password policies that are specific to the target system, the One Identity Manager password policy default policy applies. In this case, ensure that the default policy does not violate the target systems requirements.

The Privileged Account Management password policy is predefined for PAM systems. You can apply this password policy to the passwords of user accounts (PAGUser.Password) of an appliance.

If the password requirements for the appliances are different, it is recommended that you set up your own password policies for each appliance.

Furthermore, you can apply password policies based on the account definition of the user accounts or based on the manage level of the user accounts.

Using password policies

The Privileged Account Management password policy is predefined for PAM systems. You can apply this password policy to the passwords of user accounts (PAGUser.Password) of an appliance.

If the password requirements for the appliances are different, it is recommended that you set up your own password policies for each appliance.

Furthermore, you can apply password policies based on the account definition of the user accounts or based on the manage level of the user accounts.

The password policy that is to be used for a user account is determined in the following sequence:

  1. Password policy of the account definition of the user account.

  2. Password policy of the manage level of the user account.

  3. Password policy for the appliance of the user.

  4. The One Identity Manager password policy (default policy).

IMPORTANT: If you do not use password policies that are specific to the target system, the One Identity Manager password policy default policy applies. In this case, ensure that the default policy does not violate the target systems requirements.

To reassign a password policy

  1. In the Manager, select the Privileged Account Management | Basic configuration data | Password policies category.

  2. Select the password policy in the result list.
  3. Select the Assign objects task.

  4. Click Add in the Assignments section and enter the following data.

    Table 20: Assigning a password policy

    Property

    Description

    Apply to

    Application scope of the password policy.

    To specify an application scope

    1. Click next to the field.
    2. Select one of the following references under Table:
      • The table that contains the base objects of synchronization.
      • To apply the password policy based on the account definition, select the TSBAccountDef table.
      • To apply the password policy based on the manage level, select the TSBBehavior table.
    3. Under Apply to, select the table that contains the base objects.
      • If you have selected the table containing the base objects of synchronization, next select the specific target system.
      • If you have selected the TSBAccountDef table, next select the specific account definition.
      • If you have selected the TSBBehavior table, next select the specific manage level.
    4. Click OK.

    Password column

    The password column's identifier.

    Password policy

    The identifier of the password policy to be used.

  5. Save the changes.

To change a password policy's assignment

  1. In the Manager, select the Privileged Account Management | Basic configuration data | Password policies category.

  2. Select the password policy in the result list.
  3. Select the Assign objects task.
  4. In the Assignments pane, select the assignment you want to change.
  5. From the Password Policies menu, select the new password policy you want to apply.
  6. Save the changes.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating