Chat now with support
Chat with Support

Identity Manager 9.2.1 - Administration Guide for Connecting to LDAP

About this guide Managing LDAP environments Synchronizing LDAP directories
Setting up initial LDAP directory synchronization Adjusting the synchronization configuration for LDAP environments Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)
Managing LDAP user accounts and identities Managing memberships in LDAP groups Login credentials for LDAP user accounts Mapping LDAP objects in One Identity Manager Handling of LDAP objects in the Web Portal Basic data for managing an LDAP environment Troubleshooting Configuration parameters for managing an LDAP environment Default project template for LDAP LDAP connector V2 settings

LDAP group main data

Enter the following general main data.

Table 32: General main data
Property Description

Distinguished name

Distinguished name of the group. The distinguished name is determined by template from the name of the group and the container and cannot be edited.

Name

Name of the group.

Display name

Name for displaying the group in the user interface of One Identity Manager tools.

Domain

Domain in which to create the group.

Container

Container in which to create the group.

Administrator

The group administrator.

Service item

Service item data for requesting the group through the IT Shop.

Business unit

Business unit to which the group is assigned.

See also

Link to another LDAP object.

Structural object class

Structural object class representing the object type. By default, containers in One Identity Manager are added with GROUPOFNAMES.

Object class

List of classes defining the attributes for this object. By default, containers in One Identity Manager are added with GROUPOFNAMES. However, in the input field, you can add object classes and auxiliary classes that are used by other LDAP and X.500 directory services.

Risk index

Value for evaluating the risk of assigning the group to user accounts. Set a value in the range 0 to 1. This input field is only visible if the QER | CalculateRiskIndex configuration parameter is activated.

For more information about risk assessment, see the One Identity Manager Risk Assessment Administration Guide.

Category

Categories for group inheritance. Groups can be selectively inherited by user accounts. To do this, groups and user accounts are divided into categories. Select one or more categories from the menu.

Description

Text field for additional explanation.

Condition

LDAP filter for finding memberships in a dynamic group.

dynamic group

Specifies whether this is a dynamic group.

IT Shop

Specifies whether the group can be requested through the IT Shop. If this option is set, the group can be requested through the Web Portal and allocated by defined approval processes. The group can still be assigned directly to hierarchical roles.

Only for use in IT Shop

Specifies whether the group can only be requested through the IT Shop. If this option is set, the group can be requested through the Web Portal and allocated by defined approval processes. Direct assignment of the group to hierarchical roles or user accounts is not permitted.

Related topics

Assigning extended properties to LDAP groups

Extended properties are meta objects, such as operating codes, cost codes, or cost accounting areas that cannot be mapped directly in One Identity Manager.

For more information about setting up extended properties, see the One Identity Manager Identity Management Base Module Administration Guide.

To specify extended properties for a group

  1. In the Manager, select the LDAP > Groups category.

  2. Select the group in the result list.

  3. Select Assign extended properties.

  4. In the Add assignments pane, assign extended properties.

    TIP: In the Remove assignments pane, you can remove assigned extended properties.

    To remove an assignment

    • Select the extended property and double-click .

  5. Save the changes.

Adding LDAP groups to LDAP groups

Use this task to add a group to another group. This means that the groups can be hierarchically structured.

To assign groups directly to a group as members

  1. In the Manager, select the LDAP > Groups category.

  2. Select the group in the result list.

  3. Select the Assign groups category.

  4. Select the Has members tab.

  5. Assign child groups in Add assignments.

    TIP: In the Remove assignments pane, you can remove the assignment of groups.

    To remove an assignment

    • Select the group and double-click .

  6. Save the changes.

To add a group as a member of other groups

  1. In the Manager, select the LDAP > Groups category.

  2. Select the group in the result list.

  3. Select the Assign groups task.

  4. Select the Is member of tab.

  5. In the Add assignments pane, assign parent groups.

    TIP: In the Remove assignments pane, you can remove the assignment of groups.

    To remove an assignment

    • Select the group and double-click .

  6. Save the changes.

Deleting LDAP groups

The group is deleted permanently from the One Identity Manager database and from LDAP.

To delete a group

  1. In the Manager, select the LDAP > Groups category.

  2. Select the group in the result list.

  3. Click in the result list.

  4. Confirm the security prompt with Yes.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating