Chat now with support
Chat with Support

Identity Manager 8.1.4 - Authorization and Authentication Guide

About this guide One Identity Manager application roles Granting One Identity Manager schema permissions through permissions groups Managing permissions to program features One Identity Manager authentication modules OAuth 2.0 / OpenID Connect configuration Multi-factor authentication in One Identity Manager Granulated permissions for the SQL Server and database

One Identity Manager authentication modules

One Identity Manager uses different authentication modules for logging in to administration tools. Authentication modules identify the system users to be used and load the user interface and database resource editing permissions depending on their permission group memberships.

  • The permissions assigned to the system user are found from the permissions groups for logging into One Identity Manager tools with an authentication module that expects a defined system user.
  • Dynamic system users are used for logging into One Identity Manager tools with role-based authentication modules. First, the employee memberships in the One Identity Manager application roles are determined during login. Assignments of permissions group to One Identity Manager application roles are used to determine which permissions groups apply to the employee. A dynamic system user is determined from these permissions groups that will be used for the employee’s login.

Before you can use an authentication module for logging on, the following prerequisites must be fulfilled:

  1. The authentication module must be enabled.

  2. The authentication module must be assigned to the application.

  3. The assignment of the authentication module to the application must be enabled.

This allows you to log in to the assigned application using this authentication module. Ensure that users found through the authentication module also have the required program function to use the program.

NOTE: After the initial schema installation, only the System user and Component authenticator authentication modules and the role-based authentication modules are enabled in One Identity Manager.

Use non role-based authentication modules to log in to the Designer. Role-based authentication modules for logging in to the Designer are not supported.

NOTE: Authentication modules are defined in the One Identity Manager modules and are not available until the modules are installed.

System users

Credentials

The system user's identifier and password.

Prerequisites

  • The system user with permissions exists in the One Identity Manager database.

Set as default

Yes

Single sign-on

No

Front-end login allowed

Yes

Web Portal login allowed

No

Remarks

The user interface and the write permissions are loaded through the system user.

Data modifications are attributed to the system user.

IMPORTANT: The viadmin system user is available by default. The system user has the predefined user interface and access permissions to database resources. The user interface and the permissions structure for the system user must not be used or changed in the production system because this system user is overwritten as a template user with each schema update.

TIP: Create your own system user with the appropriate permissions. This can be done on initial installation of the One Identity Manager database. This system user can compile an initial One Identity Manager database and can be used to log into the administration tools for the first time.

Generic single sign-on (role-based)

NOTE: This authentication module is available if the Identity Management Base Module is installed.

Credentials

The authentication module uses the login data of the user currently logged in on the workstation.

Prerequisites

  • The employee exists in the One Identity Manager database.
  • The employee is assigned at least one application role.
  • The user account exists in the One Identity Manager database and the employee is entered in the user account's master data.

Set as default

No

Single sign-on

Yes

Front-end login allowed

Yes

Web Portal login allowed

Yes

Remarks

One Identity Manager searches for the user account according to the configuration and finds the employee assigned to the user account.

If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.

  • If this configuration parameter is set, the employee’s main identity is used for authentication.
  • If the parameter is not set, the employee’s subidentity is used for authentication.

A dynamic system user determined from the employee's application roles. The user interface and the write permissions are loaded through this system user.

Changes to the data are assigned to the logged in employee.

Modify the following configuration parameters in the Designer to implement the authentication module.

Table 29: Configuration parameters for the authentication module
Configuration parameter Meaning
QER | Person | GenericAuthenticator This configuration parameter specifies whether authentication through single sign-on is supported.
QER | Person | GenericAuthenticator | SearchTable

This configuration parameter contains the table in the One Identity Manager schema in which user information is stored. The table must contain a foreign key with the name UID_Person, which points to the table Person.

Example: ADSAccount

QER | Person | GenericAuthenticator | SearchColumn

This configuration parameter contains the column from the One Identity Manager table (SearchTable), which is used to search for user name of the current user.

Example: CN

QER | Person | GenericAuthenticator | EnabledBy

This configuration parameter contains a pipe (|) delimited list of Boolean columns from the One Identity Manager table (SearchTable), which enables the user account for login.

QER | Person | GenericAuthenticator | DisabledBy

This configuration parameter contains a pipe (|) delimited list of Boolean columns from the One Identity Manager table (SearchTable), which disables the user account for login.

Example: AccountDisabled

Employee

NOTE: This authentication module is available if the Identity Management Base Module is installed.

Credentials

Employee's central user account and password.

Prerequisites

  • The system user with permissions exists in the One Identity Manager database.
  • The employee exists in the One Identity Manager database.
  • The central user account is entered in the employee's master data.
  • The system user is entered in the employee's master data.
  • The system user password is entered in the employee's master data.

Set as default

Yes

Single sign-on

No

Front-end login allowed

Yes

Web Portal login allowed

Yes

Remarks

If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.

  • If this configuration parameter is set, the employee’s main identity is used for authentication.
  • If the parameter is not set, the employee’s subidentity is used for authentication.

The user interface and the write permissions are loaded through the system user that is directly assigned to the logged in employee.

Changes to the data are assigned to the logged in employee.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating