Chat now with support
Chat with Support

Identity Manager 9.1 - Administration Guide for Integration with OneLogin Cloud Directory

Integration with OneLogin Cloud Directory Synchronizing a OneLogin domain
Setting up initial synchronization with a OneLogin domain Customizing the synchronization configuration Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)
Managing OneLogin user accounts and employees Managing memberships in OneLogin roles Login information for OneLogin user accounts Mapping OneLogin objects in One Identity Manager Handling of OneLogin objects in the Web Portal Base data for OneLogin domains Configuration parameters for managing OneLogin domains Default template for OneLogin domains Editing OneLogin system objects OneLogin connector settings

Finding employees and directly assigning them to user accounts

Based on the search criteria, you can create a suggestion list for the assignment of employees to user accounts and make the assignment directly. User accounts are grouped in different views for this.

Table 10: Manual assignment view

View

Description

Suggested assignments

This view lists all user accounts to which One Identity Manager can assign an employee. All employees are shown who were found using the search criteria and can be assigned.

Assigned user accounts

This view lists all user accounts to which an employee is assigned.

Without employee assignment

This view lists all user accounts to which no employee is assigned and for which no employee was found using the search criteria.

To apply search criteria to user accounts

  1. In the Manager, select the OneLogin > Domains category.

  2. Select the domain in the result list.

  3. Select the Define search criteria for employee assignment task.

  4. At the bottom of the form, click Reload.

    All possible assignments based on the search criteria are found in the target system for all user accounts. The three views are updated.

TIP: By double-clicking on an entry in the view, you can view the user account and employee main data.

The assignment of employees to user accounts creates connected user accounts (Linked state). To create managed user accounts (Linked configured state), you can assign an account definition at the same time.

To assign employees directly over a suggestion list

  • Click Suggested assignments.

    1. Click the Selection box of all user accounts to which you want to assign the suggested employees. Multi-select is possible.

    2. (Optional) Select an account definition in the Assign this account definition menu, and select a manage level in the Assign this account manage level menu.

    3. Click Assign selected.

    4. Confirm the security prompt with Yes.

      The employees determined using the search criteria are assigned to the selected user accounts. If an account definition was selected, this is assigned to all selected user accounts.

    - OR -

  • Click No employee assignment.

    1. Click Select employee for the user account to which you want to assign an employee. Select an employee from the menu.

    2. Click the Selection box of all user accounts to which you want to assign the selected employees. Multi-select is possible.

    3. (Optional) Select an account definition in the Assign this account definition menu, and select a manage level in the Assign this account manage level menu.

    4. Click Assign selected.

    5. Confirm the security prompt with Yes.

      The employees displayed in the Employee column are assigned to the selected user accounts. If an account definition was selected, this is assigned to all selected user accounts.

To remove assignments

  • Click Assigned user accounts.

    1. Click the Selection box of all the user accounts you want to delete the employee assignment from. Multi-select is possible.

    2. Click Remove selected.

    3. Confirm the security prompt with Yes.

      The assigned employees are removed from the selected user accounts.

Changing manage levels for OneLogin user accounts

The default manage level is applied if you create user accounts using automatic employee assignment. You can change a user account manage level later.

To change the manage level for a user account

  1. Select the user account in the result list.

  2. Select the Change main data task.

  3. Select the manage level in the Manage level list on the General tab.

  4. Save the changes.
Related topics

Supported user account types

Different types of user accounts, such as default user accounts, administrative user accounts, service accounts, or privileged user accounts, can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

  • Identity

    The Identity property (IdentityType column) is used to describe the type of user account.

    Table 11: Identities of user accounts
    Identity Description Value of the IdentityType column

    Primary identity

    Employee's default user account.

    Primary

    Organizational identity

    Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.

    Organizational

    Personalized admin identity

    User account with administrative permissions, used by one employee.

    Admin

    Sponsored identity

    User account used for a specific purpose. For example, for training purposes.

    Sponsored

    Shared identity

    User account with administrative permissions, used by several employees.

    Shared

    Service identity

    Service account.

    Service

    NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.

    The primary identity, the organizational identity, and the personalized admin identity are used for different user accounts, which can be used by the same actual employee to perform their different tasks within the company.

    To provide user accounts with a personalized admin identity or an organizational identity for an employee, you create subidentities for the employee. These subidentities are then linked to user accounts, enabling you to assign the required permissions to the different user accounts.

    User accounts with a sponsored identity, shared identity, or service identity are linked to pseudo employees that do not refer to a real employee. These pseudo employees are needed so that permissions can be inherited by the user accounts. When evaluating reports, attestations, or compliance checks, check whether pseudo employees need to be considered separately.

    For more information about mapping employee identities, see the One Identity Manager Identity Management Base Module Administration Guide.

  • Privileged user account

    Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are labeled with the Privileged user account property (IsPrivilegedAccount column).

Detailed information about this topic

Default user accounts

Normally, each employee obtains a default user account, which has the permissions they require for their regular work. The user accounts are linked to the employee. The effect of the link and the scope of the employee’s inherited properties on the user accounts can be configured through an account definition and its manage levels.

To create default user accounts through account definitions

  1. Create an account definition and assign the Unmanaged and Full managed manage levels.

  2. Specify the effect of temporarily or permanently disabling, deleting, or the security risk of an employee on its user accounts and group memberships for each manage level.

  3. Create a formatting rule for IT operating data.

    You use the mapping rule to define which rules are used to map IT operating data for user accounts and which default values are used if no IT operating data can be determined through a person's primary roles.

    The type of IT operating data required depends on the target system. The following setting are recommended for default user accounts:

    • In the mapping rule for the IsGroupAccount_Role column, use the default value 1 and enable the Always use default value option.

    • In the mapping rule for the IdentityType column, use the default value Primary and enable Always use default value.

  4. Enter the effective IT operating data for the target system. Select the concrete target system under Effects on.

    Specify in the departments, cost centers, locations, or business roles that IT operating data should apply when you set up a user account.

  5. Assign the account definition to employees.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating