Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Enterprise Single Sign-On 9.0.2 - One Identity Enterprise Access Management Console Administration Guide

Table of Contents

Preface Overview

Enterprise Access Management Concepts EAM Controllers

EAM Services Domain Controller Selection

A Multi-Domain Architecture Interface general design

Home Window Directory Panel Overview

Authenticating to EAM Console and Managing Protection Modes

Starting/Stopping EAM Console

Starting EAM Console

Starting EAM Console in hardware protection mode Starting EAM Console in software protection mode

Stopping EAM Console

Managing protection modes

Displaying the current protection mode Migrating from software protection mode to hardware protection mode Managing administrators whose administration keys are protected by password

Searching the Directory Tree

Searching for Directory Objects Deleting Search Requests

Managing administrators

Administration Modes - Presentation

The Classic Administration Mode The Advanced Administration Mode Administration Role Inheritance

Delegating Administration Roles Managing Administration Profiles

Creating/Editing an Administration Profile Deleting an Administration Profile

Transferring an Administration Role Deleting an Administration Role Displaying your Administration Role Modifying the Parent Administrator Adding/Removing Primary Administrators

Managing Security Profiles

Managing time slices

Creating/Modifying Time Slices Configuring Time Slices Displaying time slice usage logs Displaying time slice event logs Renaming representative objects Deleting time slices

Managing Password Format Control Policies

Creating/Modifying Password Format Control Policies Configuring Password Format Control Policy Displaying PFCP usage logs Displaying Password Format Control Policy Event Logs Renaming Password Format Control Policies Deleting Password Format Control Policies

Managing User Security Profiles

Creating/Modifying User Security Profiles Configuring User Security Profiles

Authentication Tab Security Tab SSO and Notes Tab Cloud Tab Unlocking Tab (Fast User Switching - FUS) Self Service Password Request Tab Biometrics Tab Session Delegation Tab Audit Tab OTP Tab Mobile Device Tab

Displaying User Security Profile Usage Logs Displaying User Security Profile Event Logs Renaming User Security Profiles Deleting User Security Profiles

Managing Access Point Security Profiles

Creating/Modifying Access Point Security Profiles Configuring Access Point Security Profiles

Security Services Tab Authentication Manager Tab Enterprise SSO Tab Multi-User Desktop Tab Biometrics Tab Self Service Password Request Tab Active RFID Tab Audit Tab Local Administrators Tab

Displaying Access Point Security Profile Usage Logs Displaying Access Point Security Profile Event Logs Renaming Access Point Security Profiles Deleting Access Point Security Profiles

Managing Application Security Profiles

Managing Password Generation Policies

Creating/Modifying Password Generation Policies Configuring the Password Generation Policy Displaying Password Generation Policy Usage Logs Displaying Password Generation Policy Event Logs Renaming Password Generation Policies Deleting Password Generation Policies

Creating/Modifying Application Security Profiles Configuring Application Security Profiles

General Tab Account tab Authentication method Tab Delegation Tab IP Address Constraints Tab

Displaying Application Security Profile Usage Logs Displaying Application Security Profile Event Logs Renaming Application Security Profiles Deleting Application Security Profiles

Defining Security Profiles Default Values Managing User and Access Point Security Profiles Priorities

Managing directory objects

Managing applications

Creating an application

Creating an application without using templates Creating an application using templates

Defining the general properties of an application Creating the account properties for an application

Defining account base parameters Defining account properties

Defining the Single Sign-On properties of an application (SSO) Defining external names Defining the Provisioning Connector Assigning users to an application Sharing the administration of an application Generating/Importing accounts for an application Assigning access points to an application Displaying accounts associated with the application Displaying application event logs Displaying/Modifying application information Renaming applications Deleting applications

Displaying general information about the user Defining user connection parameters

Suspending or limiting temporarily user access Displaying user authentication information and administering roaming sessions Predefining a new user's primary password Managing user Self Service Password Request Defining an audit identifier Creating a welcome message

Assigning a user security profile Declaring a user as administrator Assigning/forbidding access points to a user Managing user accounts Managing the User Self Enrollment

Assigning Administration Rights Configuring the Dedicated Organizational Units Configuring Self Enrollment

Sending SSO account passwords to users Sending primary password expiration notification emails to users Defining additional security parameters for groups of users Managing user smart cards Managing user Mobile Devices Displaying and deleting user biometrics data Assigning applications to a user Displaying delegated sessions Managing user RFID tokens Displaying user event logs Deleting SSO data of disabled user accounts Adding or removing a user from a group

Managing access points

Displaying general information about the access point Defining access point configuration parameters

Assigning an access point security profile Managing EAM controller services Assigning a generic account to an access point

Assigning/forbidding users to an access point Assigning/forbidding applications to an access point Adding or removing an access point from a group Analyzing Errors of a Remote Access Point

Managing the Cache Managing Traces Managing Security Services

Displaying access point event logs Updating manually an access point

Managing representative objects

Managing inbound representative objects

Creating/Modifying an inbound representative object Defining the set of users to represent Assigning a user security profile to the inbound representative object Selecting access points available to the representative

Managing outbound representative objects

Creating/Modifying an outbound representative object Defining the set of access points to represent Selecting applications available to the representative

Displaying representative event logs Renaming representative objects Deleting representative objects

Managing clusters of access points

Creating and configuring a cluster of access points Managing user permissions on clusters

Authorizing users to access the workstations of the cluster Displaying the cluster composed by authorized users

Displaying cluster event logs Renaming clusters Deleting cluster

Selecting a domain controller

Importing/Exporting security profiles and directory objects

Exporting objects from EAM Console Importing objects in EAM Console

Managing smart cards

Configuring smart card parameters of use

Managing smart card configuration profiles

Creating/Modifying configuration profiles Renaming a configuration profile Deleting a configuration profile

Modifying authentication parameters of an assigned smart card Managing batches of smart cards

Creating/modifying a batch of cards Forcing the use of smart cards defined in the batches of cards Displaying information on batches of cards

Managing smart card certificates

Administering smart card certificates

Importing a certification authority Deleting a certification authority

Enabling the automatic renewal of smart card certificates

Assigning smart cards (except loan cards)

Assigning smart cards Assigning a smart card managed by an external CMS Smart card self enrollment Formatting an assigned smart card

Managing loan cards

Assigning a loan card to a user Returning a loan card

Unlocking smart cards

Setting administrator's contact information Unlocking to Forcing PIN Unlocking by secret code Unlocking by SSPR Unlocking by extending the validity duration Formatting a blacklisted card

Managing lost or theft smart cards

Disabling/enabling temporarily smart cards Blacklisting smart cards Assigning a loan card

Formatting smart cards Displaying information

Displaying smart card properties Display the list of supported smart cards

Exporting Generated Reports

Managing SA server devices

Configuring EAM for the management of SA Server devices

Configuring the connection to the SA server Configuring the management of SA Server devices

Managing SA server devices

Assigning an SA server device to a user Formatting an SA Server device Blacklisting an SA Server device Managing the link between the user and the SA Server device

Managing RFID tokens

Assigning an RFID token Locking and unlocking an RFID token

Locking and unlocking an RFID token from the Directory panel Locking and unlocking an RFID token from the RFID panel

Resetting the PIN of an RFID badge Blacklisting and deleting an RFID token

Blacklisting and deleting an RFID token from the Directory panel Blacklisting and deleting an RFID token from the RFID panel

Modifying the detection areas and the grace period Exporting a list of RFID tokens

Managing biometrics

Defining the biometric enrollment policy

Defining the user biometric profile Adjusting the biometric enrollment tool behavior

Defining the workstation biometric parameters Managing the user enrollment Displaying and exporting the biometric enrollment report

Managing Mobile Devices Enabling the public key authentication method

Configuring user and access point security profiles to support the PKA authentication method Activating the PKA authentication method and defining the set of authorized certification authorities

Activating the PKA authentication method Configuring the set of authorized certification authorities

Importing certification authorities from PEM or DER encoded files Importing certification authorities from the Windows system storage Deleting a certification authority

Configuring the automatic update of the revocation information

Importing a CRL point of distribution Importing an OCSP responder Deleting a CRL point of distribution or an OCSP responder

Managing Emergency Accesses

Managing the emergency plan Managing the emergency access

Managing audit events

Displaying audit events Defining an audit population Managing and assigning audit filters

Creating an audit filter Saving an audit filter Loading an audit filter Applying an audit filter

Applying an audit filter to audit records Applying an audit filter to specific objects

Interpreting audit events

The audit main window The "Event details" window Detailed information on the audit administration events

Exporting audit events Archiving audit records Retrieving user identifier from audit identifier Retrieving audit events

Managing reports

Generating PDF reports

Configuring the Reporting Module Managing Report Models Managing Permissions Creating Custom Groups

On-demand Generation Creating a Periodic Generation

Generating On-screen reports

Generating analysis and statistics reports Generating application account reports Generating user account reports Generating administrators report Exporting the generated report

Customizing configuration files

Importing a list of supported authentication tokens Adding user attribute information

Creating scripts

Using the script editor Script commands

CREATE_ROLE CREATE_ACCESS CREATE_ACCOUNT CREATE_COMPUTER_ACCOUNT

Importing script files

Basic syntax of regular expressions Listing audit events and error codes

Listing audit events Listing error codes

Correspondence between profiles and administration rights Report Models and Parameters List

Report List Parameter Description

Custom Group Files Format

Locking and unlocking an RFID token

Managing RFID tokens > Locking and unlocking an RFID token

Locking and unlocking an RFID token

There are two ways to lock and unlock an RFID token, as detailed in the following subsections.

In this section:

Locking and unlocking an RFID token from the Directory panel

Managing RFID tokens > Locking and unlocking an RFID token > Locking and unlocking an RFID token from the Directory panel

Subject

This section describes how to lock and unlock an RFID token from the Directory panel.

Before starting

To perform the task described in this section, you must have at least the following administration role:
- In classic administration mode: "Smart card administrator".
- In advanced administration mode, your role must contain the following administration rights: "Token: Modification" and "Directory: Browsing".
If you have authenticated with a smart card, you must be a "Smart card manager" (this right is granted at card assignation time, in the Administration tab) to be able to perform the task described in this section.

Procedure

Browse the directory tree structure to select the wanted user and click the RFID tab.
- The list of RFID tokens assigned to this user appears.
Select the RFID token to lock and click the Lock button.
- The state of the token changes to Locked.
To unlock it, select it and click the Unlock button.
- The state of the token changes to Active.

Locking and unlocking an RFID token from the RFID panel

Managing RFID tokens > Locking and unlocking an RFID token > Locking and unlocking an RFID token from the RFID panel

Subject

This section describes how to lock and unlock an RFID token from the RFID panel.

Before starting

To perform the task described in this section, you must have at least the following administration role:
- In classic administration mode: "Smart card administrator".
- In advanced administration mode, your role must contain the following administration right: "Token: Modification".
If you have authenticated with a smart card, you must be a "Smart card manager" (this right is granted at card assignation time, in the Administration tab) to be able to perform the task described in this section.

Procedure

Modify the RFID filter (optional) and click the Apply button.
- A list of RFID tokens appears.
Select in the list the token to lock and click the Lock button.
- The state of the token changes to Locked.
To unlock it, select it and click the Unlock button.
- The state of the token changes to Active.

Resetting the PIN of an RFID badge

Managing RFID tokens > Resetting the PIN of an RFID badge

Subject

This section describes how to reset the PIN of an RFID badge.

Before starting

To perform the task described in this section, you must have at least the following administration role:

In classic administration mode: "Smart card administrator".
In advanced administration mode, your role must contain the following administration rights: "Token: Modification" and "Directory: Browsing".

Procedure

Browse the directory tree structure to select the wanted user and click the RFID tab.
- The list of RFID tokens assigned to this user appears.

Select the RFID badge which PIN must be reset and click the Reset PIN button.
- The Reset RFID PIN window appears.
Enter the new PIN.
(Optional): select the Change PIN at next connection check box to force the user to change his PIN at the next authentication.
Click OK.

Related Documents

© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy