Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Enterprise Single Sign-On 9.0.2 - One Identity Enterprise Access Management Console Administration Guide

Table of Contents

Preface Overview

Enterprise Access Management Concepts EAM Controllers

EAM Services Domain Controller Selection

A Multi-Domain Architecture Interface general design

Home Window Directory Panel Overview

Authenticating to EAM Console and Managing Protection Modes

Starting/Stopping EAM Console

Starting EAM Console

Starting EAM Console in hardware protection mode Starting EAM Console in software protection mode

Stopping EAM Console

Managing protection modes

Displaying the current protection mode Migrating from software protection mode to hardware protection mode Managing administrators whose administration keys are protected by password

Searching the Directory Tree

Searching for Directory Objects Deleting Search Requests

Managing administrators

Administration Modes - Presentation

The Classic Administration Mode The Advanced Administration Mode Administration Role Inheritance

Delegating Administration Roles Managing Administration Profiles

Creating/Editing an Administration Profile Deleting an Administration Profile

Transferring an Administration Role Deleting an Administration Role Displaying your Administration Role Modifying the Parent Administrator Adding/Removing Primary Administrators

Managing Security Profiles

Managing time slices

Creating/Modifying Time Slices Configuring Time Slices Displaying time slice usage logs Displaying time slice event logs Renaming representative objects Deleting time slices

Managing Password Format Control Policies

Creating/Modifying Password Format Control Policies Configuring Password Format Control Policy Displaying PFCP usage logs Displaying Password Format Control Policy Event Logs Renaming Password Format Control Policies Deleting Password Format Control Policies

Managing User Security Profiles

Creating/Modifying User Security Profiles Configuring User Security Profiles

Authentication Tab Security Tab SSO and Notes Tab Cloud Tab Unlocking Tab (Fast User Switching - FUS) Self Service Password Request Tab Biometrics Tab Session Delegation Tab Audit Tab OTP Tab Mobile Device Tab

Displaying User Security Profile Usage Logs Displaying User Security Profile Event Logs Renaming User Security Profiles Deleting User Security Profiles

Managing Access Point Security Profiles

Creating/Modifying Access Point Security Profiles Configuring Access Point Security Profiles

Security Services Tab Authentication Manager Tab Enterprise SSO Tab Multi-User Desktop Tab Biometrics Tab Self Service Password Request Tab Active RFID Tab Audit Tab Local Administrators Tab

Displaying Access Point Security Profile Usage Logs Displaying Access Point Security Profile Event Logs Renaming Access Point Security Profiles Deleting Access Point Security Profiles

Managing Application Security Profiles

Managing Password Generation Policies

Creating/Modifying Password Generation Policies Configuring the Password Generation Policy Displaying Password Generation Policy Usage Logs Displaying Password Generation Policy Event Logs Renaming Password Generation Policies Deleting Password Generation Policies

Creating/Modifying Application Security Profiles Configuring Application Security Profiles

General Tab Account tab Authentication method Tab Delegation Tab IP Address Constraints Tab

Displaying Application Security Profile Usage Logs Displaying Application Security Profile Event Logs Renaming Application Security Profiles Deleting Application Security Profiles

Defining Security Profiles Default Values Managing User and Access Point Security Profiles Priorities

Managing directory objects

Managing applications

Creating an application

Creating an application without using templates Creating an application using templates

Defining the general properties of an application Creating the account properties for an application

Defining account base parameters Defining account properties

Defining the Single Sign-On properties of an application (SSO) Defining external names Defining the Provisioning Connector Assigning users to an application Sharing the administration of an application Generating/Importing accounts for an application Assigning access points to an application Displaying accounts associated with the application Displaying application event logs Displaying/Modifying application information Renaming applications Deleting applications

Displaying general information about the user Defining user connection parameters

Suspending or limiting temporarily user access Displaying user authentication information and administering roaming sessions Predefining a new user's primary password Managing user Self Service Password Request Defining an audit identifier Creating a welcome message

Assigning a user security profile Declaring a user as administrator Assigning/forbidding access points to a user Managing user accounts Managing the User Self Enrollment

Assigning Administration Rights Configuring the Dedicated Organizational Units Configuring Self Enrollment

Sending SSO account passwords to users Sending primary password expiration notification emails to users Defining additional security parameters for groups of users Managing user smart cards Managing user Mobile Devices Displaying and deleting user biometrics data Assigning applications to a user Displaying delegated sessions Managing user RFID tokens Displaying user event logs Deleting SSO data of disabled user accounts Adding or removing a user from a group

Managing access points

Displaying general information about the access point Defining access point configuration parameters

Assigning an access point security profile Managing EAM controller services Assigning a generic account to an access point

Assigning/forbidding users to an access point Assigning/forbidding applications to an access point Adding or removing an access point from a group Analyzing Errors of a Remote Access Point

Managing the Cache Managing Traces Managing Security Services

Displaying access point event logs Updating manually an access point

Managing representative objects

Managing inbound representative objects

Creating/Modifying an inbound representative object Defining the set of users to represent Assigning a user security profile to the inbound representative object Selecting access points available to the representative

Managing outbound representative objects

Creating/Modifying an outbound representative object Defining the set of access points to represent Selecting applications available to the representative

Displaying representative event logs Renaming representative objects Deleting representative objects

Managing clusters of access points

Creating and configuring a cluster of access points Managing user permissions on clusters

Authorizing users to access the workstations of the cluster Displaying the cluster composed by authorized users

Displaying cluster event logs Renaming clusters Deleting cluster

Selecting a domain controller

Importing/Exporting security profiles and directory objects

Exporting objects from EAM Console Importing objects in EAM Console

Managing smart cards

Configuring smart card parameters of use

Managing smart card configuration profiles

Creating/Modifying configuration profiles Renaming a configuration profile Deleting a configuration profile

Modifying authentication parameters of an assigned smart card Managing batches of smart cards

Creating/modifying a batch of cards Forcing the use of smart cards defined in the batches of cards Displaying information on batches of cards

Managing smart card certificates

Administering smart card certificates

Importing a certification authority Deleting a certification authority

Enabling the automatic renewal of smart card certificates

Assigning smart cards (except loan cards)

Assigning smart cards Assigning a smart card managed by an external CMS Smart card self enrollment Formatting an assigned smart card

Managing loan cards

Assigning a loan card to a user Returning a loan card

Unlocking smart cards

Setting administrator's contact information Unlocking to Forcing PIN Unlocking by secret code Unlocking by SSPR Unlocking by extending the validity duration Formatting a blacklisted card

Managing lost or theft smart cards

Disabling/enabling temporarily smart cards Blacklisting smart cards Assigning a loan card

Formatting smart cards Displaying information

Displaying smart card properties Display the list of supported smart cards

Exporting Generated Reports

Managing SA server devices

Configuring EAM for the management of SA Server devices

Configuring the connection to the SA server Configuring the management of SA Server devices

Managing SA server devices

Assigning an SA server device to a user Formatting an SA Server device Blacklisting an SA Server device Managing the link between the user and the SA Server device

Managing RFID tokens

Assigning an RFID token Locking and unlocking an RFID token

Locking and unlocking an RFID token from the Directory panel Locking and unlocking an RFID token from the RFID panel

Resetting the PIN of an RFID badge Blacklisting and deleting an RFID token

Blacklisting and deleting an RFID token from the Directory panel Blacklisting and deleting an RFID token from the RFID panel

Modifying the detection areas and the grace period Exporting a list of RFID tokens

Managing biometrics

Defining the biometric enrollment policy

Defining the user biometric profile Adjusting the biometric enrollment tool behavior

Defining the workstation biometric parameters Managing the user enrollment Displaying and exporting the biometric enrollment report

Managing Mobile Devices Enabling the public key authentication method

Configuring user and access point security profiles to support the PKA authentication method Activating the PKA authentication method and defining the set of authorized certification authorities

Activating the PKA authentication method Configuring the set of authorized certification authorities

Importing certification authorities from PEM or DER encoded files Importing certification authorities from the Windows system storage Deleting a certification authority

Configuring the automatic update of the revocation information

Importing a CRL point of distribution Importing an OCSP responder Deleting a CRL point of distribution or an OCSP responder

Managing Emergency Accesses

Managing the emergency plan Managing the emergency access

Managing audit events

Displaying audit events Defining an audit population Managing and assigning audit filters

Creating an audit filter Saving an audit filter Loading an audit filter Applying an audit filter

Applying an audit filter to audit records Applying an audit filter to specific objects

Interpreting audit events

The audit main window The "Event details" window Detailed information on the audit administration events

Exporting audit events Archiving audit records Retrieving user identifier from audit identifier Retrieving audit events

Managing reports

Generating PDF reports

Configuring the Reporting Module Managing Report Models Managing Permissions Creating Custom Groups

On-demand Generation Creating a Periodic Generation

Generating On-screen reports

Generating analysis and statistics reports Generating application account reports Generating user account reports Generating administrators report Exporting the generated report

Customizing configuration files

Importing a list of supported authentication tokens Adding user attribute information

Creating scripts

Using the script editor Script commands

CREATE_ROLE CREATE_ACCESS CREATE_ACCOUNT CREATE_COMPUTER_ACCOUNT

Importing script files

Basic syntax of regular expressions Listing audit events and error codes

Listing audit events Listing error codes

Correspondence between profiles and administration rights Report Models and Parameters List

Report List Parameter Description

Custom Group Files Format

Adjusting the biometric enrollment tool behavior

Managing biometrics > Defining the biometric enrollment policy > Adjusting the biometric enrollment tool behavior

You can define the behavior of the biometric enrollment tool on each workstation by setting registry keys. The key values are described in Authentication Manager for Windows User's Guide.

Defining the workstation biometric parameters

Managing biometrics > Defining the workstation biometric parameters

You define the biometric parameters of the workstations in the access point security profile, as explained in Section Biometrics Tab.

Managing the user enrollment

Managing biometrics > Managing the user enrollment

You can manage the user biometric data enrollment from the user object in the directory tree structure, as explained in Section Displaying and deleting user biometrics data.

Displaying and exporting the biometric enrollment report

Managing biometrics > Displaying and exporting the biometric enrollment report

Subject

The Biometrics panel allows you to display and export the list of users who have enrolled biometric data, as explained in the following procedure.

Before starting

To perform the task described in this section, you must work in advanced administration mode, and your role must contain the following administration right: "Bio: Is enable to allow biometrics pattern enrollment".

NOTE: For more information on administration roles, see Section Managing administrators.

Procedure

In the Biometrics panel, click the View button.
- The panel displays the list of users who have enrolled their biometric data, the enrollment date and the name of the user who approved the enrollment.
To export the list in a CSV file, click the Export button and complete the displayed window.
- The displayed list is saved in a CSV file.

Related Documents

© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy