Chat now with support
Chat with Support

Identity Manager 8.1.4 - Administration Guide for Active Roles Integration

Active Roles specific extensions for Active Directory groups

To display Active Roles group data ascertained from Active Directory

  1. In the Manager, select the Active Directory | Groups category.
  2. Select the group in the result list.

  3. Select the Change master data task.

  4. Select the Active Roles tab.

The following properties are displayed:

Table 8: Active Roles specific properties of an Active Directory group
Property Description

Group is published to Self-Service Manager

If an Active Directory group is published, the Active Directory group can be requested in the Web Portal immediately after successful synchronization. The data is loaded from Active Roles on synchronization. This information is published when an Active Directory group is added through the Web Portal in order to start other workflows in Active Roles if necessary.

Approval by the group owner

Specifies whether the Active Directory group owner (account manager) must approve group membership. The information affects the approval workflow in the IT Shop.

Approval by a additional owner of the group

Specifies whether the additional Active Directory group owner must approve group membership. The information affects the approval workflow in the IT Shop.

Additional owners

List of additional owners Active Directory groups or Active Directory user accounts are permitted.

Deprovisioning status

Status of deprovisioning sequence through Active Roles when an object is deleted. The data is loaded from Active Roles on synchronization.

Status Description

No deprovisioning

The Active Directory object is enabled.

Deprovisioning successful

The Active Directory object was successfully deprovisioned

Deprovisioning failed

An error occurred deprovisioning the Active Directory object.

Deprovisioning date

Status of deprovisioning sequence through an Active Roles when a object is deleted. The information is loaded from the Active Roles during synchronization.

Related topics

Deprovisioning Active Directory user accounts and Active Directory groups

One Identity Manager supports deprovisioning through Active Roles. Based on deprovisioning policies configured in Active Roles, an Active Directory object is modified such that it is temporarily or permanently disabled and possibly is not deleted until a certain time period has expired. You can find detailed information about Active Roles deprovisioning in your One Identity Active Roles documentation.

NOTE: The deprovisioning policy configuration in Active Roles may conflict with the default One Identity Manager configuration. In this case, make any appropriate adjustments to templates or processes, for example.

The following procedures are implemented for deprovisioning Active Directory user accounts and Active Directory groups with One Identity Manager:

  • Deprovisioning not deletion
  • Quick deprovisioning
Detailed information about this topic

Deprovisioning not deletion

To implement this method

  • In the Active Directory domain, set the User accounts deleted by Active Roles workflows and Groups deleted by Active Roles workflows options.

If an Active Directory user account or an Active Directory group is deleted in One Identity Manager, a deprovisioning process is generated in the Active Roles instead of the default deletion process. This process queues the Active Directory object for deprovisioning in Active Roles, sets a deprovisioned status, and checks the deprovisioning sequence. Active Directory objects continue to be processed in One Identity Manager depending this.

  • If the Active Directory object was deleted immediately in Active Roles, the Active Directory object is also deleted in One Identity Manager.
  • If the Active Directory object in Active Roles was renamed or moved to another Active Directory container, this is done in One Identity Manager as well.

    The Active Directory object remains in the One Identity Manager database with the status "deleted".

To delete a user account

  1. Select the Active Directory | User accounts category.
  2. Select the user account in the result list.
  3. Delete the user account.
  4. Confirm the security prompt with Yes.

To delete an Active Directory group

  1. Select the Active Directory | Groups category.
  2. Select the group in the result list.
  3. Delete the group using .
  4. Confirm the security prompt with Yes.
Related topics

Quick deprovisioning

You can apply this method if the Active Directory domain is not marked for deprovisioning. The Deprovision task is provided on these objects for the deprovisioning of individual Active Directory user accounts or Active Directory groups.

A deprovisioning process is generated in Active Roles. This process queues the Active Directory object for deprovisioning in Active Roles, sets a deprovisioned status, and checks the deprovisioning sequence. Active Directory objects continue to be processed in One Identity Manager depending this.

  • If the Active Directory object was deleted immediately in Active Roles, the Active Directory object is also deleted in One Identity Manager.
  • If the Active Directory object in Active Roles was renamed or moved to another Active Directory container, this is done in One Identity Manager as well.

    The Active Directory object remains in the One Identity Manager database with the status "changed". All the Active Directory object properties are loaded in the One Identity Manager database by the next synchronization and set to "published".

To deprovision an Active Directory user account

  1. Select the Active Directory | User accounts category.
  2. Select the user account in the result list.
  3. Select the Deprovision task.
  4. Confirm the security prompt with Yes.
  5. Confirm with OK.

To deprovision an Active Directory group

  1. Select the Active Directory | Groups category.
  2. Select the group in the result list.
  3. Select the Deprovision task.
  4. Confirm the security prompt with Yes.
  5. Confirm with OK.
Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating