Chat now with support
Chat with Support

Identity Manager 9.2 - Configuration Guide

About this guide One Identity Manager software architecture Customizing the One Identity Manager default configuration Customizing the One Identity Manager base configuration One Identity Manager schema basics Editing the user interface
Object definitions for the user interface User interface navigation Forms for the user interface Statistics in One Identity Manager Extending the Launchpad Task definitions for the user interface Applications for configuring the user interface Icons and images for configuring the user interface Using predefined database queries
Localization in One Identity Manager Process orchestration in One Identity Manager
Mapping processes in One Identity Manager Setting up Job servers
The One Identity Manager Service functionality Tracking changes with process monitoring Conditional compilation using preprocessor conditions Scripts in One Identity Manager
Visual Basic .NET scripts usage Notes on message output Notes on using date values Tips for using Windows PowerShell scripts Using dollar ($) notation Using base objects Calling functions Pre-scripts for use in processes and process steps Using session services Using #LD notation Script library Support for processing scripts in the Script Editor Creating and editing scripts in the Script Editor Copying scripts in the Script Editor Testing scripts in the Script Editor Testing script compilation in the Script Editor Overriding scripts Permissions for running scripts Editing and testing script code with the System Debugger Extended debugging in the Object Browser
One Identity Manager query language Reports in One Identity Manager Adding custom tables or columns to the One Identity Manager schema Web service integration One Identity Manager as SCIM 2.0 service provider Processing DBQueue tasks One Identity Manager Service configuration files

Configuring columns for full-text search

Full-text searching uses an external search index, which returns an object key as result. The object key is used to run a search query in the database. This database search query takes the permissions of the logged in user into account during the search. A maximum of 1000 objects can be returned by through the search index.

The full text search can be used in the Manager and in the Web Portal. For more information, see the One Identity Manager Web Designer Web Portal User Guide and the One Identity Manager User Guide for One Identity Manager Tools User Interface.

Prerequisites for using full text search is an application server installed with the search service.

  • If you run the Web Portal directly over an application server installed with the search service, you can use the full text search immediately.

  • If you are working with the Web Portal and an application server without a search service installed or with a direct database connection, you will need to enter an application server with a search service in the Web Portal configuration file. Full text search is available in the Web Portal once this has been done.

  • To use full text search in the Manager, you must run the Manager over an application server with an installed search service.

For more information about installing an application server and configuring the Web Portal for full-text search, see the One Identity Manager Installation Guide.

The following applies for the configuration of the full text search:

  • The columns XDateInserted, XDateUpdated, and XObjectKey must be available if you want to index a table or database view for full text search.

  • Columns for full text searching must be weighted. Increasing weighting results in a higher position in the full text search result. The default installation provides columns for the full-text search with a weighting of 1.

    Example:

    The column Person.CentralAccount is weighted with the value 1. The column ADSAccount.SAMAccountName is weighted with the value 0.5. This results in the identity being listed before the user account in the full text search.

    NOTE: Weighting does not have any effect on how the results are sorted in the user interface. For example, if you limit the search in the Web Portal to the 100 best matches, weighting determines which 100 objects are returned. But these 100 objects are then sorted again by the user interface.

  • Only columns with the .Net data types String, Text, or Int can be included in the full-text search.

    Exception: Columns that contain a list of permitted values, can always be included to the full text search.

  • Columns of tables with the Work tables or Historical transaction data usage type cannot be included in the full-text search.

  • Columns of assignment tables (M:N tables, M:all tables) cannot be included to the full-text search.

The search service indexes the following:

  • Column content

  • Foreign key column display value

  • Display values for lists of permitted values

  • Translation for every active language

  • Object display value, if the table's primary key column is configured for full text search

    The object's display value comes from the display pattern defined for the table. The display value's weighting comes from the table's primary key column weighting

    Example:

    The Person.UID_Person column is configured for full-text search. The display pattern of the Person table is defined as %InternalName% (%CentralAccount%).

    So the display value of Alex Miller (AlexM) is indexed for the identity Alex Miller.

The searched index is updated when changes are made to a table with indexed columns, to referenced tables or translations.

Certain important columns are already indexed for full text search in the default installation. You configure more columns for full text searching if you require.

To configure a column for full text search

  1. In the Designer, select the One Identity Manager Schema category.

  2. Select the table and start the Schema Editor with the Show table definition task.

  3. Select the column and then the Column properties view.

  4. Select the Column tab and edit the Index weighting property.

    • If the value is less than or equal to 0, no indexing takes place.

    • If the value is greater than 0, the data value is indexed.

  5. Select the Database > Commit to database and click Save.

Related topics

Scripts for conditionally displaying and editing columns

In principle, a user's permissions for displaying and editing columns are controlled by permissions in permissions groups.

However, you can also use scripts to conditionally display or edit scripts. For example, in this way you can control whether or not a column, on a main data form in the Manager, is displayed or can be edited only if another column has a specific value.

Example:

A system role is disabled until the release data is reached. During this time period, the user must be prevented from changing the disabled option in the Manager.

To do this, a script is created specifying the edit permissions for the ESet.IsInActive column.

If $ReleaseDate:Date$>Connection.LocalNow Then

Value = False

Else

Value = True

End If

NOTE:

  • The script does not change the user’s permissions but simply the behavior if the object is loaded in one of the One Identity Manager tools. If you want to limit visibility and editability of a column, change the column permissions of the permissions groups. For more information, see the One Identity Manager Authorization and Authentication Guide.

  • The scripts only affect interactively loaded objects.

  • For example, in lists in the Manager or in the Web Portal, objects are not loaded interactively so the scripts do not work.

  • In the Web Portal, a lot of objects are not loaded interactively due to performance reasons. If you want to use this behavior in the Web Portal, you must customize the components in the Web Designer. In this case, there can be adverse effects on performance when objects are loaded. For more information about editing Web Designer components, see the One Identity Manager Web Designer Reference Guide.

To specify a script for conditionally displaying and editing a column

  1. In the Designer, select the One Identity Manager Schema category.

  2. Select the table and start the Schema Editor with the Show table definition task.

  3. Select the column and then the Column properties view.

  4. Select the Permissions scripts and enter the following scripts in VB.Net syntax.

    • Visibility script: Script for conditionally displaying the column. If the return value is false, the column is not displayed in any One Identity Manager tools.

    • Editability script: Script for conditionally editing the column. If the return value is false, the column cannot be edited in any One Identity Manager tools.

  5. Select the Database > Commit to database and click Save.

Related topics

Editing column definitions

To edit column properties

  1. In the Designer, select the One Identity Manager schema category.

  2. Select the table and start the Schema Editor with the Show table definition task.

  3. Select the column in the Schema Editor and edit the column properties.

  4. Select the Database > Commit to database and click Save.

Related topics

Column definition properties

Table 27: Column properties
Property Description

Table

Name of the table to which the column belongs.

Column

Name of the column in the data model.

Display name

Language-dependent column name for displaying in the administration tools user interface. Translate the given text using the button.

Comment

Additional information about the column. The comment is displayed under the help function for a column in the individual administration tools. Translate the given text using the button.

Disabled by preprocessor

If a column is disabled by a preprocessor condition, the option is set by the Database Compiler. For more information, see Conditional compilation using preprocessor conditions.

Preprocessor condition

You can add preprocessor conditions to columns. The column is therefore only available when the preprocessor condition is fulfilled. For more information, see Conditional compilation using preprocessor conditions.

NOTE: In the Designer, you can find an overview of existing preprocessor dependencies in the One Identity Manager Schema > Preprocessor dependencies category.

Sort order

The sort order specifies the position for displaying the column on the generic form and the custom tabs of the default form. Columns with a value less than 1 are not displayed on the forms. For more information, see Displaying custom columns and tables on main data forms.

Group

Group is used to display the column on general main data forms. A new tab is created for each group on the generic form. For more information, see Displaying custom columns and tables on main data forms.

Base column

If a database view has the View table type, the reference to the column in the base table is entered here. For more information, see Database views of the View type.

Example:

The Department database view is part of the Basetree base table. The columns of the Basetree table are entered as base columns.

Column

Base column

Department.DepartmentName

BaseTree.Ident_Org

Department.Description

BaseTree.Description

Adjustment of permitted values list is not allowed

Specifies whether permitted values can be customized for this column. For more information, see Permitted column values.

Defined list of values

Marks whether the value in this column must correspond to the values in the List of permitted values, or are empty. For more information, see Permitted column values.

List of permitted values

If a column is enabled for editing the permitted values (that is, the Customizing permitted values list is not allowed option is not set and the Defined list of values option is set), you can add to or extend a value list. For more information, see Permitted column values.

Customizing bitmask is not allowed

Specifies whether the bitmask can be customized for this column. For more information, see Defining bitmasks.

Defined bitmask

Meaning of each bit position if the column contains a bitmask. The first bit in the definition start with the index 0. For more information, see Defining bitmasks.

Sort criteria of bitmask

Sort criteria for displaying the values. You have the following options:

  • Bit position: Sort by position.

  • Display: Sort by display value.

For more information, see Defining bitmasks.

Multilingual

Specifies whether this column can be given in multiple languages.

Permitted values are:

  • Translation target: The column content is displayed in translation.

  • Translation source: The column supplies the translation.

  • #LD content: The column has contents in #LD notation. The contents are extracted for translation.

  • Without text memory fallback: The text store is not used as fallback for the column.

The combination of values determines the resulting translation.

For more information, see Flagging columns for translation.

Syntax

Syntax type of data in this column. The syntax type is used to give One Identity Manager tools the appropriate syntax highlighting or input assistance.

Permitted syntax types are:

  • HTML: Input in HTML format.

  • Picture: Images.

  • SQL.Query: Full database queries.

  • SQL.Special: Special syntax for database queries.

  • SQL.WhereClause: WHERE clause for database queries.

  • Text.Dollar: Input in $ notation.

  • UNC: UNC path.

  • URL: URL.

  • VB.Class: Full VB.Net class definitions.

  • VB.Instruction: VB.Net statements in the form Value =.

  • VB.Method: Single methods or functions in VB.Net.

  • XML: Input in XML format.

  • ConnectionString: Input as a connection string.

  • JSON: Input in JSON format.

  • Color: Input of color codes.

Number of decimal places

Number of decimal places used to display values.For more information, see Defining decimal places for displaying values.

Date add-on

Additional information about displaying date and time in One Identity Manager tools.

Index weighting

Column weighting in indexing. Used for indexing the full-text search. Increasing weighting results in a higher position in the search results.

If the value is less than or equal to 0, no indexing takes place. If the value is greater than 0, the data value is indexed. Columns to be indexed are assigned a weighting of 1 in the default installation.

For more information, see Configuring columns for full-text search.

Data type in database

Shows the .Net data type for the column. This is used internally and cannot be edited. The Net data types are mapped internally to SQL data types. If no value is given, the data type is taken from the database schema.

Permitted syntax types are:

.Net data type Mapped SQL data type

Binary

varbinary, timestamp

Bool

bit

Date

datetime

Double

float

Int

int

Long

bigint

String

nvarchar/varchar/nchar

Text

nvarchar/varchar

Maximum size in DB

Maximum column length in the database schema.

Minimum size in DB

Minimum column length in the database schema.

Primary key

The primary key is given when the database is created.

UID column

Specifies whether this is UID column. This option is only permissible for columns with the String .Net data type and a length of 38 characters.

Default value

Specifies whether a default value is defined by a template for this column.

BLOB value

This option is used to label text columns whose data contents is so large that they cannot be kept internally in one line in the SQL sever and are therefore saved as a reference. This allows speedier access to the data.

Log changes

Specifies whether changes to this column are logged. For more information, see Logging data changes.

Log changes when deleting

Specifies whether the column is to be logged when an object is deleted. For more information, see Logging data changes.

Export for SPML schema

Specifies whether the table is to be exported for the SPML schema.

Not for export (XML export)

This column is not exported in data transports. The property is taken into account when data is transported between databases.

Not for import (XML import)

This column is not imported in data transports. The property is taken into account when data is transported between databases.

MVP column

This column is a multi-valued-property (MVP) containing individual value entries that are separated by char(7) or chr(7).

Multi-value specification

You can specify additional requirements on the values of an MVP column. You have the following options:

  • Unique: Set this option if the value must be unique.

  • Case sensitive: Set this option if the case sensitivity should be taken into account when the value is tested.

  • Accent insensitive: Set this option if accent characters should not be taken into account when the value is tested.

For more information, see Specifying requirements for MVP columns.

Multiline

Specifies whether the parameter contents can have multiple lines. Columns that are labeled with this option are displayed on a generic form with multiline input fields.

Permissions not issued automatically

For custom columns in a predefined table, permissions are not automatically assigned to predefined permissions groups, even though the Common | AutoExtendPermissions configuration parameter is set.

Column contains description

One column with a description can be labeled with this option per table. The description is only displayed on user interface assignment controls.

Contains name properties for password check

Specifies whether the column contains name properties. Depending on the password policy configuration, columns with name properties may be included in the password check. For more information about password policies, see the One Identity Manager Operational Guide.

Column contains hierarchy information

One column which maps hierarchy information in readable form can be labeled with this option per table. The column is used to map the hierarchy to the user interface assignment controls.

Part of primary key

This column is part of the primary key.

Part of alternative primary key

Alternative primary keys are already specified in the default version, but the definition can be customized. Alternative primary keys are used for data transport amongst other things.

Part of the key of a many-to-all table

Identifier of the foreign key of a many-to-all table The foreign key and the dynamic foreign key of a many-to-all table are identified with this option.

Show in wizards

Specifies whether the column is offered in the Rule Editor for compliance rules to create queries and in the Web Portal to display tabular overviews.

Recursive key

Specifies whether this column references a parent object. This input is needed for displaying hierarchical tables.

Example:

In the ADSContainer table, the UID_ParentADSContainer column contains the reference to the parent Active Directory container. The UID_ParentADSContainer column is labeled with this option in order to display this hierarchical link on forms.

Encrypted

Specifies whether the value in this column is encrypted. When the database is encrypted the value in this column is encrypted.

NOTE: If you set this option on database columns, you must encrypt the database again. For more information about database encryption, see the One Identity Manager Installation Guide.

Dynamic foreign key

Dynamic foreign keys refer to the object key in other tables. The object key comprises the table name and the values of the primary key of the actual object. Permitted tables can be limited. All tables are permitted, if there are no restrictions. For more information, see Dynamic foreign key.

No log

Specifies whether the column content is recorded in logs. For example, in the One Identity Manager Service log.

Proxy view column

If the column is used in a database view of the Proxy type, the corresponding column is entered in the view. For example, the column ADSDomain.DisplayName is mapped in the UNSRoot view to column RootObjectDisplay. For more information, see Database views of the proxy type.

Table Lookup Support

Each value in these columns is prepared for fast table lookup support. The search is also supported by single values in MVP columns. The internal mapping of prepared data in done in the QBMSplittedLookup table.

Permitted values are:

  • Central user account (CentralAccount)

  • Email address (EMail)

You can extend the list of permitted values and customize the results.

  • In the Designer, flag columns containing a user account name with the Central user account value in the Table lookup support property.

  • In the Designer, flag columns containing an email address with the Email address value in the Table lookup support property.

The functionality can be used for finding a unique central user account, for example, or a unique default email address for an identity. In the default installation, columns that are taken into account when the central user account or an email address are mapped are labeled with this property. The results are shown in the QERCentralAccount and QERMailAddress database views.

Remarks (custom)

 Text field for additional explanation.

Custom template/formatting not permitted

Specifies whether column's the default configuration can be changed by the user, such as, templates, formatting, minimum length, maximum length, column format.

Max. length

Maximum length of the column. If the value is equal to 0, the length from the database schema is used.

Minimum Length

Minimum length of the column. For columns that are displayed as required input fields in the administration tools user interface, set the minimum length to 1 or higher.

Column format

Specify the format permitted for value in this column. For more information, see Using predefined formatting types.

You can control the permitted format for the column with formatting types and formatting scripts.

Overwrites

Specifies whether the template can overwrite or not. If this option is set, the value template is always applied. If the option is not set, the value template is only applied when the column is empty. For more information, see Editing value templates.

Template

  • Template script. Write the script in VB.Net syntax. This allows all VB.Net script functions to be used. For more information, see Editing value templates.

    • Threshold (stop)

    Limit for the number of objects changed directly by a template. Once this limit has been reached, processing is stopped with an error message. For more information, see Restricting performance of value templates.

    NOTE: If a stop threshold value is specified, it must be larger than the threshold for asynchronous processing.

    Threshold (asynchronous)

    Limit for the number of objects changed directly by a template. Once this limit has been reached, processing takes place synchronously with the One Identity Manager Service. For more information, see Restricting performance of value templates.

    No automatic truncation by template

    Specifies whether the value is automatically truncated to the maximum column length if the maximum length is exceeded when applying a template. If this option is enabled, the value is not automatically truncated to the maximum column length. For more information, see Editing value templates.

    Formatting script

    Formatting script for the column. The formatting script for checking values is written in VB.Net syntax, which allows usage of all VB.Net script functions.

    Visibility script

    Script for conditional displaying of columns in One Identity Manager tools. For more information, see Scripts for conditionally displaying and editing columns.

    Editability script

    Script for conditional editing of columns in One Identity Manager tools. For more information, see Scripts for conditionally displaying and editing columns.

    Foreign key

    The column references an object in another table.

    Average column length

    Information is determined once a day through the maintenance tasks. The data material can help to plan capacities and maintenance work on the database.

    Template changed

    (Only for internal use) This indicates that the template was changed.

    No DB Transport

    Columns labeled with this option cannot be excluded from a custom configuration package. These columns are excluded from data transport.

    Mapping direction

    Specifies the mapping direction that will be applied to this column when synchronizing between two One Identity Manager databases. For more information about this, see the One Identity Manager User Guide for the One Identity Manager Connector.

    Synchronization information

    Additional information required for synchronization that is evaluated by the One Identity Manager connector.

    • Not relevant for synchronization: The column is not displayed in the Synchronization Editor.

    • Has unique value: The column contains a unique value.

    • Has conditional default value: The column contains a value that is formatted automatically under certain conditions, for example by a customizer.

    • Has a default value: The column contains a value that is formatted automatically, for example by a formation rule.

    • Conditional mandatory column: The column is a mandatory column under certain conditions, for example if the value is checked by triggers.

    • Mandatory column: The column is a mandatory column.

    • Multi-value sort order is significant: When identifying rogue modifications, the order of the values of multi-value schema properties is taken into account.

    For more information about this, see the One Identity Manager Target System Synchronization Reference Guide.

    Related topics
    Related Documents

    The document was helpful.

    Select Rating

    I easily found the information I needed.

    Select Rating