Chat now with support
Chat with Support

Password Manager 5.10.1 - Administration Guide

About Password Manager Getting Started Password Manager Architecture
Password Manager Components and Third-Party Solutions Typical Deployment Scenarios Password Manager in Perimeter Network Management Policy Overview Password Policy Overview Secure Password Extension Overview reCAPTCHA Overview User Enrollment Process Overview Questions and Answers Policy Overview Password Change and Reset Process Overview Data Replication Phone-Based Authentication Service Overview
Management Policies
Checklist: Configuring Password Manager Understanding Management Policies Configuring Access to the Administration Site Configuring Access to the Self-Service Site Configuring Access to the Helpdesk Site Configuring Questions and Answers Policy Workflow overview Custom workflows Custom Activities Self-Service Workflows Helpdesk Workflows Notification Activities User Enforcement Rules
General Settings
General Settings Overview Search and Logon Options Import/Export Configuration Settings Outgoing Mail Servers Diagnostic Logging Scheduled Tasks Web Interface Customization Instance Reinitialization Realm Instances Domain Connections Extensibility Features RADIUS Two-Factor Authentication Password Manager components and third-party applications Unregistering users from Password Manager Working with Redistributable Secret Management account Email Templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies One Identity Starling Reporting Password Manager Integration Appendixes Glossary

Configuring Permissions for Domain Management Account

When you add a domain connection, you can create a new one or use existing connections, if any. When creating the domain connection, you must specify a domain management account — an account under which Password Manager will access the domain.

For the domain connection that you want to use in the user and Helpdesk scopes, make sure the domain management account has the following minimum set of permissions:

  • Membership in the Domain Users group
  • The Read permission for all attributes of user objects
  • The Write permission for the following attributes of user objects: pwdLastSet, comment, userAccountControl, and lockoutTime

    NOTE: If the Storage attribute for Security questions under the Reinitialization page is a custom value (such as userParameters), then the Write permissions must be provided for that attribute instead of Comment attribute.

  • The right to reset user passwords
  • The permission to create user accounts and containers in the Users container
  • The Read permission for attributes of the organizationalUnit object and domain objects
  • The Write permission for the gpLink attribute of the organizationalUnit objects and domain objects
  • The Read permission for the attributes of the container and serviceConnectionPoint objects in Group Policy containers
  • The permission to create container objects in the System container
  • The permission to create the serviceConnectionPoint objects in the System container
  • The permission to delete the serviceConnectionPoint objects in the System container
  • The Write permission for the keywords attribute of the serviceConnectionPoint objects in the System container

If you want to use the same domain connection in password policies, as well, make sure the account has the following permissions:

  • The Read permission for attributes of the groupPolicyContainer objects.
  • The Write permission to create and delete the groupPolicyContainer objects in the System Policies container.
  • The Read permission for the nTSecurityDecriptor attribute of the groupPolicyContainer objects.
  • The permission to create and delete container and the serviceConnectionPoint objects in Group Policy containers.
  • The Read permission for the attributes of the container and serviceConnectionPoint objects in Group Policy containers.
  • The Write permission for the serviceBindingInformation and displayName attributes of the serviceConnectionPoint objects in Group Policy containers.
  • The Write permission for the following attributes of the msDS-PasswordSettings object:
    • msDS-LockoutDuration
    • msDS-LockoutThreshold
    • msDS-MaximumPasswordAge
    • msDS-MinimumPasswordAge
    • msDS-MinimumPasswordLength
    • msDS-PasswordComplexityEnabled
    • msDS-PasswordHistoryLength
    • msDS-PasswordReversibleEncryption
    • msDS-PasswordSettingsPrecedence
    • msDS-PSOApplied
    • msDS-PSOAppliesTo
    • name

 

Corporate Authentication

In the Register workflow, if the Admin selects Corporate authentication check box, user will only be able to review the corporate account details while registration. If Allow user to edit corporate details check box is selected, user will be able to update the respective corporate details such as Corporate email and Corporate phone number, provided that the details are not previously populated by administrator in the AD.

If Corporate authentication registration mode is selected in the Register activity, make sure that Domain management account has the following set of permissions.

  1. The read permission for Corporate email attribute and Corporate phone attribute where, Mobile is the default attribute for the Corporate phone.
  2. If Allow user to edit corporate details checkbox is selected under Corporate authentication check box, both Read and Write permission must be available for Corporate email attribute and Corporate phone attribute, where Mobile is the default attribute for the Corporate phone.

NOTE: If the Corporate phone attribute under Reinitialization page is a custom value(say, pager) then, the Read/ Write Permissions need to be provided for that attribute instead of the mobile attribute.

Adding Domain Connection

After adding a domain connection to the user scope, you need to specify groups from the domain that will be able to access the Self-Service site. By default, the group Domain Users is included in the scope when you add the domain connection to the user scope. You can also restrict some domain groups from accessing the Self-Service site.

 NOTE: When you add a domain to the user scope, the group Domain Users from this domain is automatically included in the user scope.

To add a domain connection

  1. Open the Administration site by entering the Administration site URL in the address bar of your browser. By default, the URL is http(s)://<ComputerName>/PMAdmin, where <ComputerName> is the name of the computer on which Password Manager is installed.
  2. On the Administration site, select the Management Policy you want to configure and click the User Scope link.
  3. On the User Scope page, click Add domain connection.
  4. If domain connections already exist, select a domain connection from the list. If you want to create a new connection, click Add domain connection.
  5. If you selected to create the new domain connection, in the Add New Domain Connection dialog, configure access to the domain by doing the following:
    • In the Domain name text box, type the name of the domain that you want to register with Password Manager.
    • In the Domain alias text box, type the alias for the domain that will be used to address the domain on the Self-Service site.
    • To have Password Manager access the managed domain using the Password Manager Service account, select Password Manager Service account. Otherwise, select Domain management account, and then enter user name and password for the domain management account. Note that if Password Manager Service account is used to access the domain, it should have the same permissions as the domain management account.

For information on how to prepare a domain management account, see Configuring Permissions for Domain Management Account.

  1. Click Save.

To specify groups or OUs that are allowed to access the Self-Service site

  1. On the Administration site, select the Management Policy you want to configure and click the User Scope link.
  2. On the User Scope page, select the domain connection for which you want to specify groups or OUs and click Edit.
  3. Do the following:
    • To specify the groups, click Add under Groups allowed access to the Self-Service site.
    • To specify the OUs, click Add under Organizational units allowed access to the Self-Service site.
  4. Click Save.

NOTE: If you have the Domain Management account configured with a user other than the Active Directory Administrator, provide the Security permissions to all the groups, OUs that are added as Included groups, and Included OUs in the userscope. To provide Security permissions to a user/ group/ OU, go to the domain object properties -> security tab -> Add the configured Domain Management account to the Group or usernames in the Active Directory.

If the users/ groups/ OUs included in the userscope, are the member of DomainAdmins/ Administrators group in the Active Directory, then the Write Permissions are already inherited.

To specify groups or OUs that are denied access to the Self-Service site

  1. On the Administration site, select the Management Policy you want to configure and click the User Scope link.
  2. On the User Scope page, select the domain connection for which you want to specify groups or OUs and click Edit.
  3. Do the following:
    • To specify the groups, click Add under Groups denied access to the Self-Service site.
    • To specify the OUs, click Add under Organizational units denied access to the Self-Service site.
  4. Click Save.

Enable LDAP over SSL

Enabling LDAP over SSL

Password Manager supports both LDAP and LDAPS for communicating with the Active Directory Server. This section explains how to enable LDAP over SSL.

 NOTE: Configuration is required for all installations of Password Manager servers.

On a computer where Password Manager is installed, create the following value in the HKLM/SOFTWARE/One Identity/Password Manager registry key using the Registry Editor:

Value type: REG_SZ

Value name: PasswordEncodeMethod

Value data: ADS_PASSWORD_ENCODE_REQUIRE_SSL

 

Value type: REG_DWORD

Value name: PasswordSetPortNumber

Value data: 636

 NOTE: The default port for REG_DWORD is 636.

Specifying Advanced Options for Domain Connection

Specifying advanced settings for domain connection

After you have created a domain connection, you can specify advanced settings for the connection: domain controllers and Active Directory sites of the managed domain.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating