Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for Connecting to SharePoint

Managing SharePoint Environments Setting Up SharePoint Farm Synchronization Basic Data for Managing SharePoint SharePoint Farms SharePoint Web Applications SharePointSite Collections and Sites SharePoint User Accounts SharePoint Roles and Groups
SharePoint Groups SharePoint Roles and Permission Levels
Permissions for SharePoint Web Applications Reports about SharePoint Site Collections Appendix: Configuration Parameters for Managing SharePoint Appendix: Default Project Template for SharePoint

Supported User Account Types

Supported User Account Types

Different types of user accounts, such as default user accounts, administrative user accounts or service accounts, can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

  • Identity (column IdentityType)

    The identity describes the type of user account.

    Table 23: Identities of User Accounts
    Identity Description Value of the column "IdentityType"
    Primary identity Employee's default user account. Primary
    Organizational identity Secondary user account used for various roles within the organization, f. ex. In sub-agreements with other functional areas. Organizational
    Personalized admin identity User account with administration rights used by one person. Admin
    Sponsored identity User account used for example for training purposes. Sponsored
    Shared identity User account with administration rights used by several people. Shared
    Service identity Service account. Service
  • Privileged user account (column IsPrivilegedAccount)

    Use this option to flag user accounts with special, privileged permissions. This includes administrative user accounts or service accounts, for example. This option is not used to flag default user accounts.

Default User Accounts

Normally, each employee obtains a default user account, which has the permissions they require for their regular work. The user accounts are linked to the employee. By default, the link between employee and SharePoint user account is set up through the authentication objects to which the user account is assigned. Alternatively, employees can also be directly linked to the user accounts. Such user accounts can be managed through account definitions. The effect of the link and the scope of the employee’s inherited properties on the user accounts can be configured through an account definition and its manage levels.

To create default user accounts through account definitions

  1. Create an account definition and assign the manage level "Unmanaged" or "Full managed" to it.
  2. Specify the effect of temporarily or permanently disabling, deleting or the security risk of an employee on its user accounts and group memberships for each manage level.
  3. Create a formatting rule for IT operating data.

    An account definition specifies which rules are used to generate the IT operating data for example, whether the container for a user account is made up of the employee's department, cost center, location or business role and which default values will be used if no IT operating data can be found through the employee's primary roles.

    Which IT operating data is required, depends on the target system. The following setting are recommended for default user accounts:

    • Use the default value "1" in the formatting rule for the column IsGroupAccount and set the option Always use default value.
    • Use the default value "primary" in the formatting rule for the column IdentityType and set the option Always use default value.
  4. Enter the effective IT operating data for the target system. Select the concrete target system under Effects on.

    Specify in the departments, cost centers, locations or business roles, which IT operating data should apply when you set up a user account.

  5. Assign the account definition to employees.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

Administrative User Accounts

An administrative user account must be used for certain administrative tasks. Administrative user accounts are normally predefined in the target system and have fixed identifiers and login names, for example, "Administrator".

Administrative user accounts are loaded through synchronization into the One Identity Manager. To assign a manager to administrative user accounts, assign an employee to the user account in One Identity Manager.

NOTE: You can automatically label administrative user accounts as privileged user accounts. To do this, set the schedule "Mark selected user accounts as privileged" in the Designer.

Privileged User Accounts

Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are marked with the property Privileged user account (IsPrivilegedAccount).

NOTE: The criteria used to label user accounts automatically as privileged, are defined as extensions to the view definition (ViewAddOn) on the table TSBVAccountIsPrivDetectRule (table type "Union"). The evaluation is done in the script TSB_SetIsPrivilegedAccount.

To create privileged users through account definitions

  1. Create an account definition. Create a new manage level for privileged user accounts and assign this manage level to the account definition.
  2. If you want to prevent properties for privileged user accounts being overwritten, set the property IT operating data overwrites for the manage level, to the value "Only initially". In this case, the properties are populated just once when the user accounts is created.
  3. Specify the effect of temporarily or permanently disabling, deleting or the security risk of an employee on its user accounts and group memberships for each manage level.
  4. Create a formatting rule for IT operating data.

    An account definition specifies which rules are used to generate the IT operating data for example, whether the container for a user account is made up of the employee's department, cost center, location or business role and which default values will be used if no IT operating data can be found through the employee's primary roles.

    Which IT operating data is required, depends on the target system. The following settings are recommended for privileged user accounts:

    • Use the default value "1" in the formatting rule for the column IsPrivilegedAccount and set the option Always use default value.
    • You can also specify a formatting rule for the column IdentityType. The column owns different permitted values, which represent user accounts.
    • To prevent privileged user accounts inheriting default user groups, define a template for the column IsGroupAccount with the default value "0" and set the option Always use default value.
  5. Enter the effective IT operating data for the target system.

    Specify in the departments, cost centers, locations or business roles, which IT operating data should apply when you set up a user account.

  6. Assign the account definition directly to employees who work with privileged user accounts.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

NOTE: Specify a formatting rule for a naming schema if it is required by the company for privileged user account login names.

Entering Master Data for SharePoint User Accounts

Entering Master Data for SharePoint User Accounts

Each SharePoint user account represents an object from an authentication system. This object can be a group or a user. The group authentication and user authenticated user accounts are select separately in the navigation system.

To edit the properties of a group authenticated user account

  1. Select the category | User accounts (group authentication)SharePoint.
  2. Select the user account in the result list and run the task Change master data.

    - OR -

    Click in the result list toolbar.

  3. Edit the user account's resource data.
  4. Save the changes.

To edit the properties of a user authenticated user account.

  1. Select the category | User accounts (user authentication)SharePoint.
  2. Select the user account in the result list and run the task Change master data.

    - OR -

    Click in the result list toolbar.

  3. Edit the user account's resource data.
  4. Save the changes.

To manually assign or create a user authenticated user account for an employee

  1. Select the Employees | Employees.
  2. Select the employee in the result list and run Assign user accounts in SharePointthe task view.
  3. Assign a user account.
  4. Save the changes.
Detailed information about this topic

Group Authenticated User Account Properties

Group Authenticated User Account Properties

Table 24: Configuration Parameters for Setting up User Accounts
Configuration parameter Active Meaning
QER\CalculateRiskIndex Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.

If the parameter is set, values can be entered and calculated for the risk index.

Enter the following master data for a group authenticated user account.

Table 25: Group Authenticated User Account Properties
Property Description
Site collection Site collection the user account is used in.
Group authenticated Specifies whether the user account's authentication object is a group.
Authentication objectClosed Authentication object referencing the user account. Each SharePoint user account represents an object from an authentication system trusted by the SharePoint installation. If this authentication system is managed as a target system in One Identity Manager, the SharePoint object used for authentication can be saved as the authentication object in the user policy.

The authentication object is assigned during automatic synchronization. You can assign an authentication object when setting up a new user account in the Manager. The authentication object cannot be changed after saving.

The following authentication objects can be assigned to a group authenticated user account:

  • Active Directory groups with the group type "Security group" from the domain with the farm or a trusted domain
  • LDAP groups from the domain with the farm
Authentication modeClosed Authentication mode used for logging in on the SharePoint server with this user account.

The login name of new user accounts depends on the authentication mode. The authentication mode is set by a template. The value depends on the option Claims-based authentication of the associated web application. If you have defined custom authentication modes, select your authentication mode in the menu.

NOTE: Modify the template for this column (SPSUser.UID_SPSAuthSystem) to assign a custom authentication mode to user accounts.
Display name Any display name for the user account. By default, the display name is taken from the authentication object display name. Enter the display name by hand if no authentication object is assigned.
Login name User account login name. It is found using a template. Enter the login name by hand if no authentication object is assigned.

NOTE: Modify the template for this column (SPSUser.LoginName) to assign a custom authentication mode to user accounts.
Email address User account email address. It is formatted using templates from the authentication object's email address.

Risk index (calculated)

Maximum risk index values for all assigned SharePoint roles and groups. This property is only visible if the configuration parameter "QER\CalculateRiskIndex" is set. For more detailed information, see the .One Identity Manager Risk Assessment Administration Guide

Category Categories for the inheritance of groups by the user account. Select one or more categories from the menu. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories.
Advice Spare text box for additional explanation.

Identity

User account's identity type

Table 26: Permitted values for the identity.
Value Description
Primary identity Employee's default user account.
Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.
Personalized admin identity User account with administrative permissions, used by one employee.
Sponsored identity User account that is used for training purposes, for example.
Shared identity User account with administrative permissions, used by several employees.
Service identity Service account.
Privileged user account Specifies whether this is a privileged user account.
Administrator Specifies whether the user account is a site collection administrator.
Auditor Specifies whether the user account is a site collection auditor.
Detailed information about this topic

User Authenticated User Account Master Data

User Authenticated User Account Master Data

Table 27: Configuration Parameters for Setting up User Accounts
Configuration parameter Active Meaning
QER\CalculateRiskIndex Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.

If the parameter is set, values can be entered and calculated for the risk index.

Enter the following master data for a user authenticated user account.

Table 28: User Authenticated User Account Master Data
Property Description
Employee Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu. If an authentication object is assigned, the connected employee is found through the authentication object by using a template. If there is no authentication object assigned, the employee can be assigned automatically or manually.
Manage level User account's manage level. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.

Account definition

Account definition through which the user account was created.

Use the account definition to automatically fill user account master data and to specify a manage level for the user account. The One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account.

NOTE: The account definition cannot be changed once the user account has been saved.

To create the user account manually through an account definition, enter an employee in the Employee box. You can select all the account definitions assigned to this employee and through which no user account has been created for this employee.

NOTE: If employees obtain their SharePoint user accounts through account definitions, the employees must own user accounts in the Active Directory domain or LDAP domain. This domain is stored in the SharePoint farm in which the SharePoint user accounts are to be created.
Site collection Site collection the user account is used in.
Group authenticated Specifies whether the user account's authentication object is a group. This option is disabled for user authenticated user accounts.
Authentication objectClosed Authentication object referencing the user account. Each SharePoint user account represents an object from an authentication system trusted by the SharePoint installation. If this authentication system is managed as a target system in One Identity Manager, the SharePoint object used for authentication can be saved as the authentication object in the user policy.

The authentication object is assigned during automatic synchronization. You can assign an authentication object when setting up a new user account in the Manager. The authentication object cannot be changed after saving.

The following authentication objects can be assigned to an authenticated user account:

  • Active Directory user accounts from the domain with the farm or a trusted domain
  • LDAP user accounts from the domain with the farm

User accounts relating to Active Directory default SIDs cannot reference authentication objects in One Identity Manager.

NOTE: The SharePoint user account is also created if the user account that is used as authentication object is disabled or locked.
Authentication modeClosed Authentication mode used for logging in on the SharePoint server with this user account.

The login name of new user accounts depends on the authentication mode. The authentication mode is set by a template. The value depends on the option Claims-based authentication of the associated web application. If you have defined custom authentication modes, select your authentication mode in the menu.

NOTE: Modify the template for this column (SPSUser.UID_SPSAuthSystem) to assign a custom authentication mode to user accounts.
Display name Any display name for the user account. By default, the display name is taken from the authentication object display name. Enter the display name by hand if no authentication object is assigned.
Login name User account login name. It is found using a template. Enter the login name by hand if no authentication object is assigned.

NOTE: Modify the template for this column (SPSUser.LoginName) to assign a custom authentication mode to user accounts.
Email address User account email address. It is formatted using templates from the authentication object's email address.

Risk index (calculated)

Maximum risk index values for all assigned SharePoint roles and groups. This property is only visible if the configuration parameter "QER\CalculateRiskIndex" is set. For more detailed information, see the .One Identity Manager Risk Assessment Administration Guide

Category Categories for the inheritance of groups by the user account. Select one or more categories from the menu. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories.
Advice Spare text box for additional explanation.

Identity

User account's identity type

Table 29: Permitted values for the identity.
Value Description
Primary identity Employee's default user account.
Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.
Personalized admin identity User account with administrative permissions, used by one employee.
Sponsored identity User account that is used for training purposes, for example.
Shared identity User account with administrative permissions, used by several employees.
Service identity Service account.
Privileged user account Specifies whether this is a privileged user account.

Groups can be inherited

Specifies whether the user account SharePoint roles and groups can inherit through the employee. If this option is set, the user account inherits SharePoint roles and groups through hierarchical roles or IT Shop requests.

  • If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups.
  • If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.
Administrator Specifies whether the user account is a site collection administrator.
Auditor Specifies whether the user account is a site collection auditor.
Detailed information about this topic
Related Documents