To configure the user scope, add one or more domain connections. Domain connections created for the user scope can also be used in the helpdesk scope and password policies. The same domain connection can be used in different Management Policies. Wherever you create a domain connection, you can use it elsewhere, that is, a domain connection configured for password policies can be used in the helpdesk scope.
To add a domain connection
Open the Administration Site by entering the Administration Site URL in the address bar of your browser. By default, the URL is http(s)://<computer-name>/PMAdmin, where <computer-name> is the name of the computer on which Password Manager is installed.
On the Administration Site, select the Management Policy you want to configure and click the User Scope link.
On the User Scope page, click Add domain connection.
If domain connections already exist, select a domain connection from the list. If you want to create a new connection, click Add domain connection.
If you selected to create the new domain connection, in the Add New Domain Connection dialog, configure access to the domain by doing the following:
In the Domain name text box, type the name of the domain that you want to register with Password Manager.
In the Domain alias text box, type the alias for the domain which will be used to address the domain on the Self-Service Site.
To have Password Manager access the managed domain using the Password Manager Service account, select Password Manager Service account. Otherwise, select Domain management account, then enter the user name and password of the domain management account.
NOTE: If the Password Manager Service account is used to access the domain, it must have the same permissions as the domain management account.
Click Save.
NOTE: When you add a domain to the user scope, the group “Domain Users” from this domain is automatically included in the user scope.
After adding a domain connection to the user scope, you need to specify groups from the domain that will be able to access the Self-Service site. By default, the group “Domain Users” is included in the scope when you add the domain connection to the user scope. You can also restrict some domain groups from accessing the Self-Service site.
NOTE: Only Global Security groups can be added. Distribution groups are not supported.
To specify groups or OUs that are allowed to access the Self-Service site
On the Administration Site, select the Management Policy you want to configure and click the User Scope link.
On the User Scope page, select the domain connection for which you want to specify groups or OUs and click Edit.
Do the following:
To specify the groups, click Add under Groups allowed access to the Self-Service site.
To specify the OUs, click Add under Organizational units allowed access to the Self-Service site.
Click Save.
To specify groups or OUs that are denied access to the Self-Service Site
On the Administration Site, select the Management Policy you want to configure and click the User Scope link.
On the User Scope page, select the domain connection for which you want to specify groups or OUs and click Edit.
Do the following:
To specify the groups, click Add under Groups denied access to the Self-Service site.
To specify the OUs, click Add under Organizational units denied access to the Self-Service site.
Click Save.
After you have created a domain connection, you can specify advanced settings for the connection: domain controllers and Active Directory sites of the managed domain.
To specify domain controllers
On the Administration Site, select the Management Policy you want to configure and click the User Scope link.
On the User Scope page, select the domain connection for which you want to specify domain controllers and click Edit.
On the User Scope Settings for #Domain# page, click Edit.
On the Advanced settings tab of the Edit Domain Connection dialog, click Add under the domain controllers table and select required domain controllers, and click Add.
Click Save and select how you want to apply the updated settings. You can either apply the new settings for this user scope only, or everywhere where this domain connection is used.
By specifying Active Directory sites in the domain connection settings you select the site in which you want Password Manager to replicate changes as soon as they occur in other sites. This reduces downtime that users may experience when your environment has several Active Directory sites and changes do not get immediately replicated between the sites.
To specify Active Directory sites
On the Administration Site, select the Management Policy you want to configure and click the User Scope link.
On the User Scope page, select the domain connection for which you want to specify Active Directory sites and click Edit.
On the User Scope Settings for #Domain# page, click Edit.
On the Advanced Options tab of the Edit Domain Connection dialog, click Add under the Active Directory sites table, select required sites, and click Add. You can use the autofill option to automatically populate the table with all available sites from the current domain.
Click Save and select how you want to apply the updated settings. You can either apply the new settings for this user scope only, or everywhere where this domain connection is used.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center
