Groups and be selectively inherited by user accounts and contacts in One Identity Manager. The groups and user accounts (contacts) are divided into categories in the process. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains tables that map the user accounts (contact) and the groups. Specify your categories for user account (contacts) in the table for user accounts (contacts). Enter your categories for groups in the group table. Each table contains the Position 1 to Position 31 category positions.
Every user account (contact) can be assigned to one or more categories. Each group can also be assigned to one or more categories. If at least one user account (contact) category position matches an assigned structural profile, the structural profile is inherited by the user account (contact). If the group or user account (contact) is not in classified into categories, the group is also inherited by the user account (contact).
NOTE: Inheritance through categories is only taken into account when groups are assigned indirectly through hierarchical roles. Categories are not taken into account when assigning groups to user accounts and contacts.
|Category position||Categories for user accounts||Categories for groups|
|1||Default user||Default entitlements|
|2||System users||System user entitlements|
|3||System administrator||System administrator entitlements|
Figure 2: Example of inheriting through categories.
To use inheritance through categories
- Define categories in the domain.
- Assign categories to user accounts and contacts through their master data.
- Assign categories to groups through their master data.