Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for Connecting to LDAP

Managing LDAP Environments Setting up LDAP Directory Synchronization Basic Configuration Data LDAP Domains LDAP User Accounts LDAP Groups LDAP Container Structures LDAP Computers Reports about LDAP Objects Appendix: Configuration Parameters for Managing LDAP Appendix: Default Project Template for LDAP Appendix: Authentication Modules for Logging into the One Identity Manager

LDAP Domains

LDAP Domains

NOTE: The Synchronization EditorClosed sets up the domains in the One Identity Manager database by using a default template.

To edit master data for an LDAP domain

  1. Select the category LDAP | Domains.
  2. Select the domain in the result list and run the task Change master data.
  3. Edit the domain's master data.
  4. Save the changes.
Detailed information about this topic

General Master Data for an LDAP Domain

General Master Data for a LDAP Domain

Enter the following data on the General tab:

Table 27: Domain Master Data

Property

Description

Domain

NetBIOS domain name.

Full domain name

Name of the domain confirming to DNS syntax.

Name of this domain.name of parent domain.name of default domain

Example

Docu.Testlab.dd

LDAP system type

Type of the LDAP system.

Display name

The display name is used to display the domain in the user interface. This is preset with the domain NetBIOS name; however, the display name can be changed.

Object class List of classes defining the attributes for this object. The default object class is "DOMAIN". However, you can add object classes and auxiliary classes in the input field that are used by other LDAP and X.500 directory services.

Distinguished name

Distinguished name of the domain. The distinguished name is determined using a template from the full domain name and cannot be edited.

Canonical name Canonical name of the domain.

Account definition (initial)

Initial account definition for creating user accounts. These account definitions are used if automatic assignment of employees to user account is used for this domain resulting in administered user accounts (state "Linked configured"). The account definition's default manage level is applied.

User accounts are only linked to the employee (state "Linked") if no account definition is given. This is the case on initial synchronization, for example.

Target system managers

Application role in which target system managers are specified for the domain. Target system managers only edit the objects from domains that are assigned to them. Therefore, each domain can have a different target system manager assigned to it.

Select the One Identity Manager application role whose members are responsible for administration of this domain. Use the button to add a new application role.

Synchronized by

NOTE: You can only specify the synchronization type when adding a new domain. No changes can be made after saving.

"One Identity Manager" is used when you create a domain with the Synchronization EditorClosed.

Type of synchronization through which the data is synchronized between the domain and One Identity Manager.

Table 28: Permitted Values
Value SynchronizationClosed by Provisioned by

One Identity Manager

LDAP connector

LDAP connector

No synchronization

none

none

NOTE: If you select "No synchronization" you can define custom processes to exchange data between One Identity Manager and the target system.

Description

Spare text box for additional explanation.

Structural object class Structural object class representing the object type.
Related Topics

LDAP Specific Master Data for a LDAP Domain

LDAP Specific Master Data for an LDAP Domain

Enter the following master data on the LDAP tab.

Table 29: LDAP Data
Property Description

Full domain name

Name of the domain confirming to DNS syntax.

Name of this domain.name of parent domain.name of default domain

Example

Docu.Testlab.dd

Distinguished name

Distinguished name of the domain. The distinguished name is determined using a template from the full domain name and cannot be edited.

Structural object class Structural object class representing the object type.
Object class List of classes defining the attributes for this object. The default object class is "DOMAIN". However, you can add object classes and auxiliary classes in the input field that are used by other LDAP and X.500 directory services.
Search mask Search mask for another LDAP object.

Specifying Categories for Inheriting LDAP Groups

Specifying Categories for Inheriting LDAP Groups

In One Identity Manager, groups can be selectively inherited by user accounts. For this, groups and user accounts are divided into categories. The categories can be freely selected and are specified by a template. Each category is given a specific position within the template. The template contains two tables; the user account table and the group table. Use the user account table to specify categories for target system dependent user accounts. Enter your categories for the target system dependent groups, administrative roles, subscriptions and disabled service plans in the . Each table contains the category items "Position1" to "Position31".

To define a category

  1. Select the category LDAP | Domains.
  2. Select the domain in the result list.
  3. Select Change master data in the task view.
  4. Switch to the MappingClosed rule category tab.
  5. Expand the respective base node of the user account or group table.
  6. Click to enable category.
  7. Enter a name for the user account and group categories in the current language.
  8. Save the changes.
Detailed information about this topic
Related Documents