Chat now with support
Chat with Support

Identity Manager 8.0.5 - CSV Connector User Guide

Setting up Synchronization with the CSV Connector

The CSV connector can transfer data between CSV files and the One Identity Manager database. The CSV connector has read/write-access. You can use CSV files to synchronize target systems with the One Identity Manager database without a direct connection existing between the target system and the One Identity Manager database. For example, the CSV connector can be used to import employee data into the One Identity Manager database.

The data to synchronize must be in a fixed data structure. The data can be distributed between several CSV files. The synchronization server must be able to access the CSV files and the CSV system file directly.

 Note:The CSV connector does not provide a project template for setting up synchronization. You must create synchronization configuration components (mappings, workflows, start up configurations,...) manually after the synchronization project has been saved.

To set up synchronization with a CSV file

  1. Install and configure a synchronization server and declare the server as Job server in One Identity Manager.
  2. Provide One Identity Manager users with the required permissions for setting up synchronization and post-processing of synchronization objects.
  3. Create a synchronization project with the Synchronization Editor.
Detailed information about this topic

Users and Permissions for Synchronizing

In the synchronization process, there are three use cases for mapping synchronization objects in the One Identity Manager data model with the CSV connector.

  1. Mapping custom target systems
  2. Mapping default tables (for example Person, Department)
  3. Mapping custom tables

In the case of non role-based log in on One Identity Manager tools, it is sufficient to add one system user in the permissions group "DPR_EditRights_Methods". For more detailed information about system users and permissions groups, see the One Identity Manager Configuration Guide.

Table 1: Users and Permissions Groups for Non Role-Based Login
User Task

One Identity Manager administrators
  • Create customized permissions groups for application roles for role-based login to administration tools in the Designer, as required.
  • Create system users and permissions groups for non-role based login to administration tools, as required.
  • Enable or disable additional configuration parameters in the Designer, as required.
  • Create custom processes in the Designer, as required.
  • Create and configures schedules, as required.
  • Create and configure password policies, as required.

System users in the permissions group "DPR_EditRights_Methods"
  • Configure and start synchronization in the Synchronization Editor.
  • Edit the synchronization's target system types as well as outstanding objects in the Manager.

There are different steps required for role-based login, in order to equip One Identity Manager users with the required permissions for setting up synchronization and post-processing of synchronization objects.

Table 2: User and permissions groups for role-based login: Mapped as custom target system
User Task

One Identity Manager administrators
  • Create customized permissions groups for application roles for role-based login to administration tools in the Designer, as required.
  • Create system users and permissions groups for non-role based login to administration tools, as required.
  • Enable or disable additional configuration parameters in the Designer, as required.
  • Create custom processes in the Designer, as required.
  • Create and configures schedules, as required.
  • Create and configure password policies, as required.

Target system administrators

Target system administrators must be assigned to the application role Target system | Administrators.

Users with this application role:

  • Administrate application roles for individual target systems types.
  • Specify the target system manager.
  • Set up other application roles for target system managers if required.
  • Specify which application roles are conflicting for target system managers
  • Authorize other employee to be target system administrators.
  • Do not assume any administrative tasks within the target system.

Target system managers

Target system managers must be assigned to the application role Target systems | Custom target systems or a sub application role.

Users with this application role:

  • Assume administrative tasks for the target system.
  • Create, change or delete target system objects, like user accounts or groups.
  • Edit password policies for the target system.
  • Prepare groups for adding to the IT Shop.
  • Configure synchronization in the Synchronization Editor and defines the mapping for comparing target systems and One Identity Manager.
  • Edit the synchronization's target system types and outstanding objects.
  • Authorize other employees within their area of responsibility as target system managers and create child application roles if required.
Table 3: User and permissions groups for role-based login: Mapped as default tables
User Task

One Identity Manager administrators
  • Create customized permissions groups for application roles for role-based login to administration tools in the Designer, as required.
  • Create system users and permissions groups for non-role based login to administration tools, as required.
  • Enable or disable additional configuration parameters in the Designer, as required.
  • Create custom processes in the Designer, as required.
  • Create and configures schedules, as required.
  • Create and configure password policies, as required.

Custom application role

Users with this application role:

  • Configure and start synchronization in the Synchronization Editor.
  • Edit the synchronization's target system types as well as outstanding objects in the Manager.

This application role gets its write access through a custom permissions group and the permissions group "vi_4_SYNCPROJECT_ADMIN".

Table 4: Users and permissions groups for role-based login: Mapped in custom tables
User Task

One Identity Manager administrators
  • Create customized permissions groups for application roles for role-based login to administration tools in the Designer, as required.
  • Create system users and permissions groups for non-role based login to administration tools, as required.
  • Enable or disable additional configuration parameters in the Designer, as required.
  • Create custom processes in the Designer, as required.
  • Create and configures schedules, as required.
  • Create and configure password policies, as required.

Application roles for custom tasks

Administrators must be assigned to the application role Custom | Administrators.

Users with this application role:

  • Administrate custom application roles.
  • Set up other application roles for managers, if required.

Manager for custom tasks

Managers must be assigned to the application role Custom | Managers or a subordinate role.

Users with this application role:

  • Add custom task in the One Identity Manager.
  • Configure and start synchronization in the Synchronization Editor.
  • Edit the synchronization's target system types as well as outstanding objects in the Manager.

This application role gets its write access through a custom permissions group and the permissions group "vi_4_SYNCPROJECT_ADMIN".

To configure synchronization projects and target system synchronization (in the use cases 2 and 3)

  1. Set up a custom permissions group with all permissions for configuring synchronization and editing synchronization objects.
  2. Assign a custom application role to this permission group.
Detailed information about this topic

Setting Up a Custom Application Role for Synchronization

For role-based login, create a custom application role to guarantee One Identity Manager users the necessary permissions for configuring synchronization and handling outstanding objects. This application role obtains the required permissions by using a custom permissions group.

To set up an application role (use case 2)

  1. Select the default application role to use to edit the objects you want to synchronization in the Manager.
    • Establish the application role's default permissions group.

    If you want to import employee data, for example, select the application role Identity Management | Employees | Administrators. The default permissions group is "vi_4_PERSONADMIN".

  2. Create a new permissions group in the Designer.
    • Set the option Only use for role based authentication.
  3. Make the new permissions group dependent on the permission group "vi_4_SYNCPROJECT_ADMIN".

    The permissions "vi_4_SYNCPROJECT_ADMIN" must be assigned as parent permissions group. This means that the new permissions group inherits the properties.

  4. Make the new permissions group dependent on the default permission group of the selected default application role.

    The default permissions group must be assigned as a subgroup. This means that the new permissions group inherits the properties.

  5. Save the changes.
  6. Create a new application role in the Manager.
    1. Assign the selected application role to be the parent application role.
    2. Assign the newly created permissions group to it.
  7. Assign employees to this application role.
  8. Save the changes.

To set up an application role for synchronization (use case 3)

  1. Create a new permissions group for custom tables, which are populated though synchronization, in the Designer.
    • Set the option Only use for role based authentication.
  2. Guarantee this permissions group all the required permissions to the custom tables.
  3. Create another permissions group for synchronization.
    • Set the option Only use for role based authentication.
  4. Make the permissions group for synchronization dependent on the permissions group for custom tables.

    The permissions group for custom tables must be assigned as parent permissions group. This means the permissions groups for synchronization inherits its properties.

  5. Make the permissions group for synchronization dependent on the permissions group "vi_4_SYNCPROJECT_ADMIN".

    The permissions "vi_4_SYNCPROJECT_ADMIN" must be assigned as parent permissions group. This means the permissions groups for synchronization inherits its properties.

  6. Save the changes.
  7. Create a new application role in the Manager.
    1. Assign the application role Custom | Managers as parent application role.
    2. Assign the permissions group for synchronization.
  8. Assign employees to this application role.
  9. Save the changes.

For more detailed information about setting up application roles, see the One Identity Manager Application Roles Administration Guide. For more detailed information about permissions groups, see the One Identity Manager Configuration Guide.

Setting Up the Synchronization Server

A server with the following software must be available for setting up synchronization:

  • One Identity Manager Service
    • Install One Identity Manager components with the installation wizard.
      1. Select the option Select installation modules with existing database.
      2. Select the machine role Server | Job server.

    For more detailed information about system requirements for installing the One Identity Manager Service, see the One Identity Manager Installation Guide.

The synchronization server must be declared as a Job server in One Identity Manager.

Use the Server Installer to install the One Identity Manager Service. This program executes the following steps.

  • Setting up a Job server.
  • Specifying machine roles and server function for the Job server.
  • Remote installation of One Identity Manager Service components corresponding to the machine roles.
  • Configures the One Identity Manager Service.
  • Starts the One Identity Manager Service.

NOTE: The program executes remote installation of the One Identity Manager Service. Local installation of the service is not possible with this program. Remote installation is only supported within a domain or a trusted domain.

To install and configure the One Identity Manager Service remotely on a server

  1. Start the program Server Installer on your administrative workstation.
  2. Enter valid data for connecting to One Identity Manager on the Database connection page and click Next.
  3. Specify on which server you want to install the One Identity Manager Service on the Server properties page.
    1. Select a job server in the Server menu.

      - OR -

      Click Add to add a new job server.

    2. Enter the following data for the Job server.
      Table 5: Job Servers Properties
      Property Description
      Server Name of the Job servers.
      Queue

      Name of queue to handle the process steps. Each One Identity Manager Service within the network must have a unique queue identifier. The process steps are requested by the job queue using exactly this queue name. The queue identifier is entered in the One Identity Manager Service configuration file.

      Full server name

      Full name of the server in DNS syntax.

      Example:

      <name of server>.<fully qualified domain name>

      		 NOTE: Use the Advanced option to edit other Job server properties. You can use the Designer to change properties at a later date.
  4. Specify which job server roles to include in One Identity Manager on the Machine role page. Installation packages to be installed on the Job server are found depending on the selected machine role.

    Select at least the following roles:

    • Job Server
  5. Specify the server's functions in One Identity Manager on the Server functions page. One Identity Manager processes are handled depending on the server function.

    The server's functions depend on which machine roles you have selected. You can limit the server's functionality further here.

    Select at least one of the following server functions:

    • CSV connector
  6. Check the One Identity Manager Service configuration on the Service settings page.

    		NOTE: The initial service configuration is already predefined. If further changes need to be made to the configuration, you can do this later with the Designer. For more detailed information about configuring the service, see One Identity Manager Configuration Guide.
  7. To configure remote installations, click Next.
  8. Confirm the security prompt with Yes.
  9. Select the directory with the install files on the Select installation source page.
  10. Select the file with the private key on the page Select private key file.

    		NOTE: This page is only displayed when the database is encrypted.
  11. Enter the service's installation data on the Service access page.
    Table 6: Installation Data
    Data Description
    Computer Server on which to install and start the service from.

    To select a server

    • Enter the server name.

      - OR -

    • Select a entry from the list.
    Service account One Identity Manager Service user account data.

    To enter a user account for the One Identity Manager Service

    • Set the option Local system account.

      This starts the One Identity Manager Service under the account "NT AUTHORITY\SYSTEM".

      - OR -

    • Enter user account, password and password confirmation.

      The One Identity Manager Service farm's server farm account must be used as user account for SharePoint.

    Installation account Data for the administrative user account to install the service.

    To enter an administrative user account for installation

    • Enable Advanced.
    • Enable the option Current user.

      This uses the user account of the current user.

      - OR -

    • Enter user account, password and password confirmation.
  12. Click Next to start installing the service.

    Installation of the service occurs automatically and may take some time.

  13. Click Finish on the last page of the Server Installer.

    		NOTE: The is entered with the name "One Identity Manager Service" in the server's service administration.
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating