Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for Connecting to Custom Target Systems

Managing Custom Target Systems Setting up Script Controlled Data Provisioning in a Custom Target System Base Data for Custom Target Systems Setting up a Custom Target System Container Structures in a Custom Target System User Accounts in a Custom Target System Groups in a Custom Target System Entering Permissions Controls Reports about Custom Target Systems Appendix: Configuration Parameters for Managing Custom Target Systems

Entering User Account Master Data

Entering Master Data for User Accounts

A user account can be linked to an employee in the One Identity Manager. You can also manage user accounts separately from employees.

 NOTE: It is recommended to use account definitions to set up user accounts for company employees. In this case, some of the master data described in the following is mapped through templates from employee master data.

To edit master data for a user account

  1. Select the category Custom target systems | <target system> | User accounts.
  2. Select the user account in the result list and run the task Change master data.

    - OR-

    Click in the result list toolbar.

  3. Edit the user account's resource data.
  4. Save the changes.

To manually assign or create a user account for an employee

  1. Select the Employees | Employees.
  2. Select the employee in the result list and run Assign user accounts from the task view.
  3. Assign a user account.
  4. Save the changes.
Related Topics

User Account Master Data

User Account Master Data

Enter the following data for a user account:

Table 25: User Account Properties
Property Description

Employee

Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu.

Account definition

Account definition through which the user account was created.

Use the account definition to automatically fill user account master data and to specify a manage level for the user account. The One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account.

 NOTE: The account definition cannot be changed once the user account has been saved.

To create the user account manually through an account definition, enter an employee in the Employee box. You can select all the account definitions assigned to this employee and through which no user account has been created for this employee.

Manage level

User account's manage level. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.

Target System Target system in which the user account is created.

First name

The user’s first name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Last name

The user’s last name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Container Container in which to create the user account. If you have assigned an account definition, the container is determined from the company IT data for the assigned employee depending on the manage level of the user account. When the container is selected, the defined name for the user is created using a formatting rule.

Login name

 Name the user uses to log onto the target system.

If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Name

User account identifier. The identifier is made up of the user‘s first and last names.

Canonical name

User account's distinguished name. The canonical name is generated automatically and should not be changed.

Distinguished name

User account's distinguished name. The distinguished name is determined using a template and must not be changed.

Risk index (calculated)

Maximum risk index values for all assigned groups. This property is only visible if the configuration parameter "QER\CalculateRiskIndex" is set. For more detailed information, see the .One Identity Manager Risk Assessment Administration Guide

Category

 Categories for the inheritance of groups by the user account. Select one or more categories from the menu. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories.

Account expiry date

 The date up to which the user can log into a target system with this user account.

If a leaving date is specified for an employee, it will be used as the account expiry date depending on the manage level. Any existing account expiry date is overwritten in this case.

 NOTE: If the employee's leaving date is deleted at a later point in time, the user account expiry date remains intact!

Last login

Date of last target system login.

Password last changed

Data of last password change.

Password

Password for the user account. Depending on the configuration parameter "Person\UseCentralPassword" the employee’s central password can be mapped to the user account‘s password. If you use an initial password for the user accounts, it is automatically entered when a user account is created.

NOTE: One Identity Manager password policies are taken into account when a user password is being verified. Ensure that the password policy does not violate the target system's requirements.

Password confirmation

Reconfirm password.

Description

Spare text box for additional explanation.

Identity

User account's identity type

Table 26: Permitted values for the identity.
Value Description
Primary identity Employee's default user account.
Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.
Personalized admin identity User account with administrative permissions, used by one employee.
Sponsored identity User account that is used for training purposes, for example.
Shared identity User account with administrative permissions, used by several employees.
Service identity Service account.

Privileged user account

Specifies whether this is a privileged user account.

Groups can be inherited

Specifies whether the user account groups can inherit through the employee. If this option is set, the user account inherits groups through hierarchical roles or IT Shop requests.

  • If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups.
  • If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.

User account is disabled

Specifies that the user account is locked. If a user account is not required for a period of time, you can temporarily disable the user account by using the option <User account is deactivated>.

Related Topics

Additional Tasks for Managing User Accounts

After you have entered the master data, you can apply different tasks to it. The task view contains different forms with which you can run the following tasks.

Overview of User Accounts

Use this task to obtain an overview of the most important information about a user account.

To obtain an overview of a user account

  1. Select the category Custom target systems | <target system> | User accounts.
  2. Select the user account in the result list.
  3. Select User account overview in the task view.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating