Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for Connecting to LDAP

Managing LDAP Environments Setting up LDAP Directory Synchronization Basic Configuration Data LDAP Domains LDAP User Accounts LDAP Groups LDAP Container Structures LDAP Computers Reports about LDAP Objects Appendix: Configuration Parameters for Managing LDAP Appendix: Default Project Template for LDAP Appendix: Authentication Modules for Logging into the One Identity Manager

Entering Master Data for LDAP User Accounts

Entering Master Data for LDAP User Accounts

A user account can be linked to an employee in the One Identity Manager. You can also manage user accounts separately from employees.

 NOTE: It is recommended to use account definitions to set up user accounts for company employees. In this case, some of the master data described in the following is mapped through templates from employee master data.

 NOTE: If employees obtain their user accounts through account definitions, they have to have a central user account and obtain their company IT data through assignment to a primary department, primary location or a primary cost center.

To edit master data for a user account

  1. Select the category LDAP | User accounts.
  2. Select the user account in the result list and run the task Change master data.

    - OR-

    Click in the result list toolbar.

  3. Edit the user account's resource data.
  4. Save the changes.

To manually assign or create a user account for an employee

  1. Select the Employees | Employees.
  2. Select the employee in the result list and run Assign LDAP user accounts from the task view.
  3. Assign a user account.
  4. Save the changes.
Detailed information about this topic
Related Topics

General Master Data for a LDAP User Account

General Master Data for a LDAP User Account

Enter the following data on the General tab:

Table 31: Additional Master Data for a User Account
Property Description

Employee

 Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu. If you use automatic employee assignment, an associated employee is created and entered into the user account when the user account is saved.

Account definition

Account definition through which the user account was created.

Use the account definition to automatically fill user account master data and to specify a manage level for the user account. The One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account.

 NOTE: The account definition cannot be changed once the user account has been saved.

To create the user account manually through an account definition, enter an employee in the Employee box. You can select all the account definitions assigned to this employee and through which no user account has been created for this employee.

Manage level

 User account's manage level. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.

Domain

Domain in which the user account is created.

Structural object class Structural object class representing the object type. By default, user accounts in One Identity Manager are added with the object class "INETORGPERSON".

Container

Container in which to create the user account. If you have assigned an account definition, the container is determined from the company IT data for the assigned employee depending on the manage level of the user account. When the container is selected, the defined name for the user is created using a formatting rule.

Object class

 List of classes defining the attributes for this object. By default, user accounts in One Identity Manager are added with the object class "INETORGPERSON". However, you can add object classes and auxiliary classes in the input field that are used by other LDAP and X.500 directory services.

Name

User account identifier. The identifier is made up of the user‘s first and last names.

Display name User account display name. The display name is made up of the first and last names.

Distinguished name

User account's distinguished name. The distinguished name is formatted from the user account's identifier and the container and cannot be changed.

Object SID (AD) The object's security ID (SID) in Active Directory.

First name

 The user’s first name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Last name

 The user’s last name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Initials

 The user’s initials. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Job description

 Job description. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Login name

Login name. If you assigned an account definition, the login name is made up of the employee’s central user account depending on the manage level.

Password

Password for the user account. Depending on the configuration parameter "Person\UseCentralPassword" the employee’s central password can be mapped to the user account‘s password. If you use an initial password for the user accounts, it is automatically entered when a user account is created.

NOTE: One Identity Manager password policies are taken into account when a user password is being verified. Ensure that the password policy does not violate the target system's requirements.

Password confirmation

Reconfirm password.

Risk index (calculated)

Maximum risk index values for all assigned groups. This property is only visible if the configuration parameter "QER\CalculateRiskIndex" is set. For more detailed information, see the .One Identity Manager Risk Assessment Administration Guide

Account expiry date

Account expiry date. Specifying an expiry data for the account has the effect that the logon for this user account is blocked as soon as the given date is exceeded. If you assigned an account definition, the employee’s last day of work it is automatically taken as the expiry date depending on the manage level. Any existing account expiry date is overwritten in this case.

Category

Categories for the inheritance of groups by the user account. Select one or more categories from the menu. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories.

Description

Spare text box for additional explanation.

Identity

User account's identity type

Table 32: Permitted values for the identity.
Value Description
Primary identity Employee's default user account.
Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.
Personalized admin identity User account with administrative permissions, used by one employee.
Sponsored identity User account that is used for training purposes, for example.
Shared identity User account with administrative permissions, used by several employees.
Service identity Service account.

Privileged user account

Specifies whether this is a privileged user account.

Groups can be inherited

Specifies whether the user account groups can inherit through the employee. If this option is set, the user account inherits groups through hierarchical roles or IT Shop requests.

  • If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups.
  • If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.

User account is disabled

Specifies whether the user account is disable. If a user account is not required for a period of time, you can temporarily disable the user account by using the option <User account is deactivated>.

Related Topics

Contact Data for an LDAP User Account

Contact Data for an LDAP User Account

Enter the data used by this user account for contacting the employee by telephone on the Contact data tab.

Table 33: Contact Data
Property Description
Picture

Picture to display in a telephone book, for example.

  • Load the picture using .
  • You can delete the picture using .

Email address

Email address. If you assigned an account definition, the email address is made up of the employee’s default email address depending on the manage level of the user account.

Phone

Telephone number. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Mobile phone

Mobile number. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Pager

Pager number.

Fax

Fax number. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Phone private

Private telephone number.

Phone, private (2)

Extra telephone number.

Internationale ISDN no.

Internationale ISDN number.

Additional email addresses

Additional email addresses.

X.121 address

Addressing as X.121 address.

X.400 address Address in X.400 format.

Address Information for an LDAP User Account

Address Information for an LDAP User Account

Enter the following address data for contacting the employee on the Address data tab.

Table 34: Address data
Property Description

Room

Room. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Registered address Postal address.
Address Postal address.
Address (private) Postal address (private).

Mailbox

Mailbox. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Street

Street or road. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Zip code

Zip code. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

State

State. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Related Documents