One Identity Manager 8.0

One Identity Manager 8.0

Release Notes

January 2018

These release notes provide information about the One Identity Manager release. For changes to the Web Designer and the Web Portal since the last version, see the document "Web Designer and Web Portal Changes".

The documentation is available in both English and German. The following documents are only available in English:

• One Identity Manager Password Capture Agent Administration Guide
• One Identity Manager LDAP Connector for CA Top Secret Reference Guide
• One Identity Manager LDAP Connector for IBM RACF Reference Guide
• One Identity Manager LDAP Connector for IBM AS/400 Reference Guide
• One Identity Manager LDAP Connector for CA ACF2 Reference Guide
• One Identity Manager REST API Reference Guide
• One Identity Manager Web Runtime Documentation
• One Identity Manager Object Layer Documentation

Topics:

About One Identity Manager 8.0

One Identity Manager simplifies the process of managing user identities, access permissions and security policies. You allow the company control over identity management and access decisions whilst the IT team can focus on their core competence.

With this product, you can:

• Implement group management using self service and attestation for Active Directory with the One Identity Manager Active Directory Edition
• Realize Access Governance demands cross-platform within your entire concern with One Identity Manager

Every one of these scenario specific products is based on an automation-optimized architecture that addresses major identity and access management challenges at a fraction of the complexity, time, or expense of "traditional" solutions.

One Identity Manager 8.0 is a major release with enhanced features and functionality. See Features and Enhancements.

Features

New features in One Identity Manager 8.0:

Basic functionality

• SQL Server 2017 is supported.
• Oracle Database 12.2 is supported.
• Improved security measures for accessing the One Identity Manager.

  • Cyclical checking of authentication for existing connections.

    The system runs validity checks for open connections to prevent users from working with existing connections if they have been deactivated after they logged in. The check is carried out by the next permissions-based action on the connection after a configurable interval of 20 minutes. The interval is defined in the configuration parameter "Common\Authentication\CheckInterval".

  • Support for password policies in the One Identity Manager.

    You can implement password policies, for example, for system user passwords, the employees' central password as well as passwords for individual target systems. Password polices apply not only when the user enters a password but also when random passwords are generated.

    A default password policy is supplied that protects the password for system users and employee-based authentication modules. Other predefined password policies are also supplied.

  • Support for expired passwords.

    The user is advised that their password is about to expire and can change the password if necessary. In the case of employee-based authentication modules, the system sends reminder emails starting from 7 days before the password's expiry date. You can configure the time in days in the configuration parameter "Common\Authentication\DialogUserPasswordReminder". The emails are triggered by a schedule and use the mail template "Employee - system user password expires".

    To prevent password of certain system users from expiring, you can mark these system users so that their passwords never expire.

  • Issues a random, temporary passcode for a one-off login on the Password Reset Portal.

  • Support for password history.

  • Failed login attempts are logged.

  • Wrong answers to the password question for resetting the central password are logged.
  • Login with empty passwords is no longer supported.
  • Restricted password lists are supported.

• Support for load balancing of all SQL processes.

  A new server function "SQL processing server" is available. The server can execute SQL tasks. Several SQL processing servers can be set up to spread the load of SQL processes. The system distributes the generated SQL processes throughout all the Job servers with this server function.

• Improved identification of the server for automatic software updating.

  A new server function "Update server" is available. This server executes automatic software updating of all other servers. The server requires a direct connection to the database server that the One Identity Manager database is installed on.

  The server installed with the One Identity Manager database, is labeled with this functionality during initial installation of the schema.

• Preparing data for faster cross-table searching.

  The values for columns can be prepared for faster cross-table searching. Searching for single values in MVP columns is supported.

  The functionality can be used for finding a unique central user account, for example, or a unique default email address for an employee. Columns in the default installation, which are taken into account when mapping the central user account or an email address, are labeled accordingly.

• Fallback for translations can be disabled for columns that are labeled as translation targets. Another value "Without fallback translation source" has been added to do this.
• The priority of process steps can be determined dynamically at time the process is generated.
• Support for more than one script with the same name and identical number of parameters but different data types. The data type of the script parameter can be passed in the process parameter "ScriptName" in addition to the script name, in the process component "ScriptComponent".
• The Report Editor uses an updated version of the report engine, which provides new functions and controls for setting up reports.
• A role-based authentication module for LDAP is available.

• The configuration of initial data for LDAP authentication modules is done with the configuration parameters "TargetSystem\LDAP\Authentication", "TargetSystem\LDAP\Authentication\Authentication", "TargetSystem\LDAP\Authentication\Port", "TargetSystem\LDAP\Authentication\RootDN" and "TargetSystem\LDAP\Authentication\Server".

  The initial configuration data for existing installations remains valid and is used as a fallback.

Web Portal

• New Password Reset Portal.

  The Password Reset Portal allows users to reset passwords of the user accounts they manage, securely. Users can navigate from the Web Portal directly to the Password Reset Portal.

  To utilize the Password Reset Portal, it must be installed as a dedicated web application. The required security is guaranteed by Starling Two-Factor Authentication.

• New Operations Support Web Portal.

  The Operations Support Web Portal supports help desk users with their tasks in One Identity Manager. You can use the Operations Support Web Portal to create passcodes, display DBQueue and Job queue entries for specific objects, show process steps and restart them if necessary, monitor processing handling performance.

  To utilize the Operations Support Web Portal, it must be installed as a dedicated web application. A new application role Base roles | Operations support is provided for use with the Operations Support Web Portal. The required security is guaranteed by Starling Two-Factor Authentication.

• To improve user friendliness, the Web Portal's user interface and the navigation structure has been completely reworked and new functions have been added.

  • Support for the Starling 2FA App for multi-factor authentication.

    In addition to the login, a further access control (multi-factor authentication) can be configured.

  • Managers can generate a passcode for their staff.
  • Users can set their password question and answer.
  • New wizards for defining reports and report subscriptions.
  • Bookmarks for service categories can be added.

  • Changed data values are marked.

  • Processes triggered by users are displayed.

  • Users specify whether diagrams are permanently hidden.

  • Managers can view their staff's rule violations.
  • The chief approval team can immediately escalate a request.

  • Owners of departments, location and cost centers can also manage child objects.

  • Request templates can be created from a reference user and its assignments.
  • Request templates can be created for assignment requests.
  • Permissions, which contribute to a rule violation can be removed.
  • An additional test of possible exclusion definitions is made before sending a request.

  • A product can be unsubscribed for several people at the same time, also for multi-requestable/unsubscribable resources.

  • Renewals and cancellations do not have to be done strictly through the shopping cart.

  • Users can temporarily switch to another language.

Web Designer

• New version of the Secure Token Server. For more information, see the document "Web Designer and Web Portal Changes".

• Custom configuration settings for a given web project can be managed in a central overview.

Target system connection

• Support for G Suite as a target system. The key aspects are the mapping of user accounts and their entitlements. To do this, groups, organizations, permissions, admin roles, products and SKUs are mapped in One Identity Manager.
• Support for Oracle E-Business Suite as a target system. The key aspects are the mapping of user accounts, responsibilities and entitlements.

• Support for SharePoint Online as target system. The key aspects are the mapping of user accounts, groups, site collections, sites, roles and role assignments. The SharePoint Online connector and a default project template are installed.

• Mapping remote mailboxes for Exchange hybrid support. The mapping for remote mailboxes is part of the Microsoft Exchange project template. Remote mailboxes are synchronized using the Microsoft Exchange connector.

• The member filter's excluded lists for the target system Microsoft Exchange have been altered in connection with Exchange hybrid support.

  A patch for synchronization projects with the patch ID VPR#28904 is available.

• Support for Outlook Web App mailbox policies for the Microsoft Exchange target system.

• The way the Microsoft Exchange version is determined has been changed. The schema property ObjectVersion is used to determine the version.

  A patch for synchronization projects with the patch ID VPR#27447 is available.

• The Microsoft Exchange connector now supports connections through HTTPS.

  NOTE: Microsoft Exchange does not support this type of connection by default. You must configure support for HTTPS in your Microsoft Exchange.

• The schema property "Recovery" is provided to mark Microsoft Exchange mailbox databases as recovery databases.

• Introduction of a revision filter for Microsoft Exchange.

  Microsoft Exchange synchronization has been changed as follows to support customer environments with large numbers of objects:

  1. The schema type "Mailbox" has been divided into the sub types "Mailbox", "Calendar Processing" and "Mailboxstatistics".
  2. A revision criterion has been defined for the schema types "Mailbox", "MailUser", "MailContact", "MailPublicFolder", "DistributionGroup" and "DynamicDistributionGroup". This is based on the "whenChanged" property of the underlying Active Directory object.

  3. Automatic dependency resolution of the synchronization workflow's steps has been disabled, which has reduced the number of synchronization steps.

     Due to this, reference objects arise in the synchronization buffer during synchronization (DPRAttachedDataStore), possibly at short notice, which are resolved afterward by a maintenance step. This happens exclusively on the One Identity Manager side, therefore requiring no other access to the Microsoft Exchange infrastructure.

  IMPORTANT: The revision algorithm can only be enabled in synchronization projects created with version 8.0. If usage of revisions is activated in old 7.x synchronization projects, modifications made directly in Microsoft Exchange are not necessarily recognized.

  NOTE: Due to the complexity of the changes, existing synchronization projects are not automatically converted by using the patch. You can, however, continue to use existing synchronization projects (from 7.x installations), unchanged until the next major release because the schema is compatible. The properties of the old "mailbox" schema type that has been transferred to the new schema types named above, are marked as obsolete in the "mailbox" type. This does not, however, have any affect on the functionality. These properties will certainly be removed in the next major release. Even if your 7.x synchronization projects are compatible, it is recommended you recreate the synchronization project using the synchronization project template implemented in the version 8.0.

• Introduction of a revision filter for Exchange Online.

  Exchange Online synchronization has been changed as follows to support customer environments with large numbers of objects:

  1. The schema type "Mailbox" has been divided into the following types:

     • Mailbox (Basic information about mailboxes)
     • CalendarProcessingSettings_RoomEquipment (calender processing settings for room and equipment mailboxes)
     • CalendarProcessingSettings_UserShared (calender processing settings for user and room mailboxes)
     • MailboxStatistics_RoomEquipment (status information for room and equipment mailboxes)
     • MailboxStatistics_UserShared (status information for user and room mailboxes)
  2. A revision criterion has been defined for the schema types "Mailbox", "MailUser", "MailContact", "MailPublicFolder", "DistributionGroup", "UnifiedGroup" and "DynamicDistributionGroup". This is based on the "whenChanged" property of the underlying Azure Active Directory object.
  3. Automatic dependency resolution of the synchronization workflow's steps has been disabled, which has reduced the number of synchronization steps. Due to this, reference objects arise in the synchronization buffer during synchronization (DPRAttachedDataStore), possibly at short notice, which are resolved afterward by a maintenance step. This happens exclusively on the One Identity Manager side, therefore requiring no other access to the Exchange Online infrastructure.

  4. The synchronization steps for CalendarProcessingSettings_UserShared and MailboxStatistics_RoomEquipment are disabled by default. Calendar processing settings for user mailboxes (CalendarProcessingSettings_UserShared) are not usually relevant but can be queried by the appropriate commands. The same is valid for status information (for example, the number of emails, last login) from room and equipment mailboxes (MailboxStatistics_RoomEquipment). The steps in the workflow "Initial Synchronization" can be enabled at any time if required. However, this can cause a noticeable increase in the runtime.

  IMPORTANT: The revision algorithm can only be enabled in synchronization projects created with version 8.0. If usage of revisions is activated in old 7.x synchronization projects, modifications made directly in Exchange Online are not necessarily recognized.

  NOTE: Due to the complexity of the changes, existing synchronization projects are not automatically converted by using the patch. You can, however, continue to use existing synchronization projects (from 7.1.2 installations), unchanged until the next major release because the schema is compatible. The properties of the old "mailbox" schema type that has been transferred to the new schema types named above, are marked as obsolete in the "mailbox" type. This does not, however, have any affect on the functionality. These properties will certainly be removed in the next major release. Even if your 7.1.2 synchronization projects are compatible, it is recommended you recreate the synchronization project using the synchronization project template implemented in the version 8.0.

• The LDAP connector supports connections at rootDSE level.

• The LDAP connector provides information about object class hierarchy.

• The Windows PowerShell connector supports SecureString parameters.

  A ConversionMethod can now be entered in the SetParameter definition. The ConversionMethod="ToSecureString" is currently supported. This allows connections parameters to be passed securely.

• Extensions in the Synchronization Editor
  • New view for managing custom project templates in expert mode.

  • Synchronization workflows can be copied.

  • A schema editor for improved editing of virtual properties is integrated in the Schema Browser.

  • Start up configurations can be grouped. Behavior for simultaneous start up within a group can be defined.

    The delay between retries is specified in the configuration parameter "Common\Jobservice\RedoDelayMinutes".

  • Comprehensive logging and improved displaying of entries in the system journal.
  • New virtual property of type "Data mapping" for mapping predefined value lists.

  • New schema class type "Unique Objects" for creating unique objects to simplify the import of multiple object types from a single source such as a CSV file or a database table.

  • Patches can be automatically applied during One Identity Manager schema updates.

Identity and Access Governance

• Introduction and versioning of approval workflows for IT Shop requests and attestations.

  • The configuration parameters "QER\ITShop\OnWorkflowAssign" and "QER\ITShop\OnWorkflowUpdate" specify whether pending requests are reset when the approval workflow is changed.

  • The configuration parameters "QER\Attestation\OnWorkflowAssign" and "QER\Attestation\OnWorkflowUpdate" specify whether pending attestations are reset when the approval workflow is changed.

  NOTE: If you have set up you own approval procedures and have used properties from approval steps in your queries for finding approvers, modify these queries as follows: If you referenced the table PWODecisionStep over the column UID_PWODecisionStep until now, then change this reference to the column UID_QERWorkingStep in the table QERWorkingStep.

• The approval step of an attestation case can be used to specify whether the employee affected by the attestation case can also approve it. This overrides the setting in the configuration parameter "QER\Attestation\PersonToAttestNoDecide".
• Assignment resources can be created for One Identity Manager application roles. The assignment resource can be requested in the Web Portal like any other company resource. After the request has been successfully assigned, the employee, for whom it was requested, becomes a member of the associated application role through internal inheritance processes.

See also:

• Enhancements
• Fixes
• Schema changes
• Patches for synchronization projects

Enhancements

The following is a list of enhancements implemented in One Identity Manager 8.0.

See also:

• Schema changes
• Patches for synchronization projects

Deprecated features

The following features are no longer supported with this version of One Identity Manager:

• Provider mode, including the associated process component "ObjectTransferComponent".

  The One Identity Manager connector can be used for transporting data between One Identity Manager databases. For more detailed information about synchronizing using the One Identity Manager connector, see the One Identity Manager User Guide for the One Identity Manager Connector.

The following functions will be discontinued in later One Identity Manager versions and should no longer be utilized:

• Oracle Database as database system for the One Identity Manager database (no longer available after release of One Identity Manager version 8.1)