Supporting File Groups

One Identity Manager supports file groups to group tables together to help with administration, data assigning and data distribution. One Identity Manager differentiates between logical storage and physical storage.

In the default installation, logical disk stores are predefined for the table in each module of the One Identity Manager and the system tables. You cannot change the assignments. You can create your own logical disk storage for grouping custom tables.

To define logical storage for custom tables

1. Select the category One Identity Manager Schema | Logical disk stores in the Designer.
2. Select Object | New in the menu.
3. Enter a name and description for the logical storage.
4. Assign custom tables to the logical disk store.

5. Select the menu item View | Select table relations... and enable the table DialogTable. This shows the tab Tables for assigning tables.

You can link logical storage with physical storage - the file groups - in the One Identity Manager schema. If file groups are created on different data medium, you can use parallel accessing to enhance the performance of tables with high change rates. An example of this is tables for processing DBQueue Processor tasks or table for process handling.

One Identity Manager supports distribution of table to file groups using a set of database procedures, which you an run in the database using a suitable query tool.

To distribute tables to file groups under SQL Server

1. Create your file groups. For detailed information about this, see the documents for your currently installed version of SQL Server.
2. Synchronize the file groups in the One Identity Manager database. Run the following query in the database using a suitable query tool.

   exec QBM_PDiskStorePhysicalSync

3. Assign physical storage to logical storage in the Designer.
   1. Select the category One Identity Manager Schema | Logical disk stores in the Designer.
   2. Select the logical disk store and select the file groups under Physical disk store.

   3. Save the changes to the database using Database | Commit to database....

4. Disable processing of DBQueue Processor tasks and process handling. Run the following query in the database using a suitable query tool.

   exec QBM_PWatchDogPrepare 1

   exec QBM_PDBQueuePrepare 1

5. Move the tables into the configured file groups. Run the following query in the database using a suitable query tool.

   exec QBM_PTableMove

6. Reactivate the DBQueue Processor. Run the following query in the database using a suitable query tool.

   exec QBM_PDBQueuePrepare 0,1

   exec QBM_PWatchDogPrepare

To distribute tables to tablespaces under Oracle Database

1. Create your tablespaces and make them available for use by One Identity Manager database users. For detailed information about this, see the documents for your currently installed version of Oracle Database.
2. Synchronize the tablespaces in the One Identity Manager database. Run the following query in the database using a suitable query tool.

   begin QBM_GCommon2.PDiskStorePhysicalSync(); end;

3. Assign physical storage to logical storage in the Designer.
   1. Select the category One Identity Manager Schema | Logical disk stores in the Designer.
   2. Select the logical disk store and select the tablespace under Physical disk store.

   3. Save the changes to the database using Database | Commit to database....

4. Disable processing of DBQueue Processor tasks and process handling. Run the following query in the database using a suitable query tool.

   begin QBM_GWatchDog.PPrepare(1); end;

   begin QBM_GDBQueue.PDBQueuePrepare(1); end;

5. Move the tables (including LOBs ad indexes) to the configured tablespaces. Run the following query in the database using a suitable query tool.

   begin QBM_GCommon2.PTableMove(); end;

6. Reactivate the DBQueue Processor. Run the following query in the database using a suitable query tool.

   begin QBM_GDBQueue.PDBQueuePrepare(0); end;

   begin QBM_GWatchDog.PPrepare(0); end;

Granting One Identity Manager Schema Permissions

Granting One Identity Manager Schema Permissions

Permissions for accessing tables and columns of the One Identity Manager schema are themselves mapped in the schema through permissions groups. Permissions groups can be assigned to system users and application roles.

The user's effective permissions depend on the authentication module used for logging into One Identity Manager tools.

• The permissions assigned to the system user are found from the permissions groups for logging into One Identity Manager tools with an authentication module that expects a defined system user.
• Dynamic system users are used for logging into One Identity Manager tools with role-based authentication modules. First, the employee memberships in the One Identity Manager application roles are determined during login. Assignments of permissions group to One Identity Manager application roles are used to determine which permissions groups apply to the employee. A dynamic system user is determined from these permissions groups that will be used for the employee’s login.

The system user's effective permissions that are found are not saved in the One Identity Manager schema, but are determined when logging into One Identity Manager tools and then they are loaded.

Permissions groups are also used to control access to parts of the user interface, such as, menu items, forms, tasks and program functions. When a user logs into the One Identity Manager tools, menus, forms and methods are loaded depending on the system user's permissions groups, displaying a user interface customized for this system user.

The One Identity Manager provides permissions groups and system users with a predefined user interface and edit permissions to the One Identity Manager schema's tables and columns. These predefined configurations are maintained by the schema installation and cannot be edited apart from a few properties. Use predefined permissions groups and system users as templates for your own permissions groups and system users.

Detailed information about this topic

• Predefined Permissions Groups and System Users
• Editing Permissions Groups and System Users
• Editing Permissions for One Identity Manager Schema Tables and Columns
• Rules for Finding Valid Permissions for Tables and Columns
• Availability of Certain Functionality
• Displaying Permissions for an Object
• Displaying the Current User's Permissions

Related Topics

• Working with the User Interface
• One Identity Manager Authentication Module

• For more detailed information about implementing and editing application roles, see the One Identity Manager Application Roles Administration Guide.

Predefined Permissions Groups and System Users

One Identity Manager supplies system users and permissions groups with predefined user interfaces (menu items, forms, tasks, program functions) and special access permissions for One Identity Manager schema tables and columns. These predefined configurations are maintained by the schema installation and cannot be edited apart from a few properties. Use predefined permissions groups and system users as templates for your own permissions groups and system users.

Related Topics

• Editing Permissions Groups and System Users

Editing Permissions Groups and System Users

In the One Identity Manager default installation certain permissions groups and system users already exist with predefined access permissions. Predefined configurations are maintained by the schema installation and cannot be edited apart from a few properties. Set up your own permissions groups and system users such that the access permissions relate to the different administrative tasks required. You can enable permissions to be passed on from one permissions group to other permissions groups by structuring permissions groups hierarchically.

Permissions groups are managed in the Designer in the category Permissions | Permissions groups. Here you will find an overview of edit permissions and user interface components that are assigned to individual permissions groups. In addition, the system users are displayed, which the permissions groups are assigned.

System users are displayed in the category Permissions | System users in the Designer. You will see an overview of the permissions groups that are assigned to each individual system user.

Related Topics

• Predefined Permissions Groups and System Users
• Permissions Group Dependencies
• Copying Permissions Groups
• Manually Creating Permissions Groups
• Editing System Users
• Adding a System User to Permissions Groups
• Dynamic system user
• Which Employees Use System Users?