Identity Manager 8.0.1 - Administration Guide for Connecting to Active Directory

Managing Active Directory Environments Setting up Active Directory Synchronization Base Data for Managing Active Directory Active Directory Domains Active Directory User Accounts Active Directory Contacts Active Directory groups Active Directory Security IDs Active Directory Container Structures Active Directory computer Active Directory Printers Active Directory Locations Reports about Active Directory Objects Appendix: Configuration Parameters for Managing Active Directory Appendix: Default Project Template for Active Directory Appendix: Authentication Modules for Logging into the One Identity Manager

Preparing a Home and Profile Servers for adding User Directories

Preparing a Home and Profile Servers for adding User Directories

Table 24: Configuration Parameters for Setting Up User Directories
Configuration parameter Meaning

TargetSystem\ADS\AutoCreateServers

The configuration parameter specifies whether entries for missing home and profile servers are automatically created for user accounts.

TargetSystem\ADS\AutoCreateServers\
PreferredLanguage

This configuration parameter contains the referred language for automatically created servers.

QER\Person\User\ConnectHomeDir

This configuration parameter specifies whether the home directory should also be mounted when the user logs in.

QER\Person\User\PropertyMapping
\ProfileFromHome

This configuration parameter specifies whether the profile director in the user's home directory should also be managed.

Home and profile servers are expected when user account home and profile directories are added.

To declare home and profile servers

  • Set the configuration parameters "TargetSystem\ADS\AutoCreateServers" and "TargetSystem\ADS\AutoCreateServers\PreferredLanguage" in the Designer.

    If these configuration parameters are set, entries for missing home and profile servers are created automatically when the user accounts are synchronized.

- OR -

  1. Select the category Active Directory | Basic configuration data | Server.
  2. Select the Job server entry in the result list.
  3. Select Change master data in the task view.
  4. Edit the Job server's master data.
  5. Select the task Assign server functions and define the server functions "Home sever" and "Profile sever" respectively.
  6. Save the changes.

You may use other settings for create home and profile directories.

  • If you want to connect the user's home directory on login, set the configuration parameter "QER\Person\User\ConnectHomeDir" in the Designer.
  • To add a user profile to the user’s home directory, set the configuration parameter "QER\Person\User\PropertyMapping\ProfileFromHome" in the Designer.
  • You can use a batch file for creating the home directory, the result of which determines whether the home directory is enabled.
  • You can create a template structure on the profile server that is used in the process of creating the profile directory.
  • Home and profile directory permissions can be granted through the One Identity Manager Service.
Related Topics

Creating Home Directories using Batch Files

Creating Home Directories using Batch Files

To be satisfy special demands of individual network environments, you can implement a batch file, which is executed when you create a home directory with the One Identity Manager Service. Whether the home directory is ultimately enabled, depends on the result of executing the batch file.

To use this function, a Netlogon share must exist on all home servers. Subdirectories are added in the Netlogon share, which correspond to the NetBIOS names of the domain. If there is a batch file in this directory with the name HomePre.CMD, it is executed before the home directory is added. If the batch file ends in failure (that means Errorlevel <> 0), the home directory is not added.

Pass the following command line parameters to the batch file HomePre.CMD to be used during executed (in the given order; database column names are used):

SAMAccountName (from table ADSAccount)

Ident_Domain (from table ADSAccount)

Ident_Server (from table QBMServer)

SharedAs (from table ADSAccount)

HomeDirPath (from table ADSAccount)

HomeShare (from table ADSAccount)

You can run another batch file again after adding a home directory. This must be kept in the same place as before and have the name HomePost,CMD. You pass the parameters in the same way as HomePre.CMD. Merely, the exit code (Errorlevel) is not handled.

Example

A user account "test1" is added in the domain "Dom2". The home directory should be added to the share "Share7" with the name "TestHome6" on the server "Serv3" and shared as "TestShare5". The files HomePre.CMD and HomePost.CMD are found in the directory "\\ServHome\Netlogon\Dom2" on the executing home server "ServHome",

Batch call before creating the home directory:

\\ServHome\Netlogon\Dom2\HomePre.CMD Test1 Dom2 Serv3 TestShare5 TestHome6 Share7

If the batch run returns "0", the home directory is created. Otherwise, the process is aborted with a log message.

Batch call after creating the home directory:

\\ServHome\Netlogon\Dom2\HomePost.CMD Test1 Dom2 Serv3 TestShare5 TestHome6 Share7

Supporting Several Profile Directories

Supporting Several Profile Directories

Table 25: Configuration Parameters for Setting up User Profiles
Configuration parameter Meaning
TargetSystem\ADS\Accounts\ProfileFixedString This configuration parameter contain a fixed character string, which is appended to the user profile's default profile path.
TargetSystem\ADS\Accounts\TProfileFixedString This configuration parameter contain a fixed character string, which is appended to the user profile's default profile path on a terminal server.

The different Windows operating system versions use different repositories for roaming user profiles. For exact information about storing roaming profile, see the MicrosoftTechNet Library.

To map the roaming user profile in One Identity Manager.

  • Provide a template structure for the user profile on the profile server.

    Example of a Template Structure for User Profiles on a Profile Server

    PROFILE

    UserProfile

    All required folders/files

    UserProfile.V2

    All required folders/files

    UserProfile.V3

    All required folders/files

    UserProfile.V4

    All required folders/files

  • Set the configuration parameter "TargetSystem\ADS\Accounts\ProfileFixedString" in the Designer and specify the part of the user profile directory path which is appended to the default profile path. The default value is UserProfile.

As a result, the directory paths for the user profiles are mapped as follows in the default installation.

  • If the profile directory is created in the home directory:

    \\Servername\HOMES\Username$\PROFILES\UserProfile

  • If the profile directory is not created in the home directory:

    \\Servername\PROFILES\Username\UserProfile

The following directories exist after handling the processes.

  • If the profile directory is created in the home directory:

    \\Servername\HOMES\Username$\PROFILES\UserProfile

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v2

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v3

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v4

  • If the profile directory is not created in the home directory:

    \\Servername\PROFILES\Username\UserProfile

    \\Servername\PROFILES\Username\UserProfile.v2

    \\Servername\PROFILES\Username\UserProfile.v3

    \\Servername\PROFILES\Username\UserProfile.v4

The directory paths for the repository on the terminal server are mapped in the same way. Modify the configuration parameter "TargetSystem\ADS\Accounts\TProfileFixedString" in this case. Specify in this configuration parameter the part of the user profile directory path which is appended to the default profile path on a terminal server. The default value is UserProfile.

Home and Profile Directory Access Permissions

Home and Profile Directory Access Permissions

Table 26: Configuration Parameters for Setting Up User Directories
Configuration parameter Meaning
QER\Person\User\AccessRights This configuration parameter allows configuration of access permissions to user directories.

NOTE: In certain circumstances it is necessary for granting permissions to files and directories, to store user account names such as "Administrators", "Everyone" or "Domain Users" as language dependent. The default language for the user accounts names is English.

To grant access permissions to a home directory

  • Set the configuration parameter "QER\Person\User\AccessRights\HomeDir" and the subparameters in the Designer and enter access permission in the configuration parameter.

    Granting access permissions to the home directory is done by through the One Identity Manager Service.

Table 27: Configuration Parameters for Home Directory Access Permissions
Configuration parameter Active Meaning

QER\Person\User\AccessRights\HomeDir

The home directory that is connected when the user logs in. In order to set user rights the configuration parameter and sub parameters need to be set.

QER\Person\User\AccessRights\HomeDir\EveryOne

Permissions for everyone on a user's home directory. Default: -r-w-x

QER\Person\User\AccessRights\HomeDir\User

This configuration parameter defines the home directory user rights. Default: +r+w-x

To grant access permission for the profile directory

  • Set the configuration parameter "QER\Person\User\AccessRights\ProfileDir" and the subparameters in the Designer and enter access permissions in the configuration parameter.

    Granting access permissions to the profile directory is done by through the One Identity Manager Service.

Table 28: Configuration Parameters for Profile Directory Access Permissions
Configuration parameter Active Meaning

QER\Person\User\AccessRights\ProfileDir

Configures the access rights for a user’s profile. In order to set user rights the configuration parameter and sub parameters need to be set.

QER\Person\User\AccessRights\ProfileDir\EveryOne

'EveryOne' rights for a user's profile directory. Default: -r-w-x

QER\Person\User\AccessRights\ProfileDir\User

Profile directory user rights. Default: +r+w-x

To grant access permissions to the home directory on a terminal server

  • Set the configuration parameter "QER\Person\User\AccessRights\TerminalHomeDir" and it subparameters in the Designer and enter the access permissions in the configuration parameters.

    Granting access permissions to the home directory is done by through the One Identity Manager Service.

Table 29: Configuration Parameters for Access Permissions to the Home Directory on a Terminal Server
Configuration parameter Active Meaning

QER\Person\User\AccessRights\TerminalHomeDir

Configures the access rights for an Active Directory user account’s terminal home directory. In order to set user rights the configuration parameter and sub parameters need to be set.

QER\Person\User\AccessRights\TerminalHomeDir\EveryOne

This configuration parameter defines the 'EveryOne' rights for the a user's terminal server home directory. Default: -r-w-x

QER\Person\User\AccessRights\TerminalHomeDir\User

This configuration parameter defines the terminal server home directory user rights. Default: +r+w-x

To grant access permissions to the profile directory on a terminal server

  • Set the configuration parameter "QER\Person\User\AccessRights\TerminalProfileDir" and the subparameters in the Designer and enter access permission in the configuration parameter.

    Granting access permissions to the profile directory is done by through the One Identity Manager Service.

Table 30: Configuration Parameters for Access Permissions to the Profile Directory on a Terminal Server
Configuration parameter Active Meaning

QER\Person\User\AccessRights\TerminalProfileDir

Configures the access rights for an Active Directory user account’s terminal profile directory. In order to set user rights the configuration parameter and sub parameters need to be set.

QER\Person\User\AccessRights\TerminalProfileDir\EveryOne

This configuration parameter defines the 'EveryOne' rights for a user's terminal server profile directory. Default: -r-w-x

QER\Person\User\AccessRights\TerminalProfileDir\User

Terminal server profile directory user rights. Default: +r+w-x

Related Topics
Related Documents