One Identity Manager uses different authentication modules for logging in to administration tools. Authentication modules identify the system users to be used and load the user interface and database resource editing permissions depending on their permission group memberships.
- The permissions assigned to the system user are found from the permissions groups for logging into One Identity Manager tools with an authentication module that expects a defined system user.
- Dynamic system users are used for logging into One Identity Manager tools with role-based authentication modules. First, the employee memberships in the One Identity Manager application roles are determined during login. Assignments of permissions group to One Identity Manager application roles are used to determine which permissions groups apply to the employee. A dynamic system user is determined from these permissions groups that will be used for the employee’s login.
Before you can use an authentication module for logging on, the following prerequisites must be fulfilled:
-
The authentication module must be enabled.
-
The authentication module must be assigned to the application.
-
The assignment of the authentication module to the application must be enabled.
This allows you to log in to the assigned application using this authentication module. Ensure that users found through the authentication module also have the required program function to use the program.
NOTE: After the initial schema installation, only the System user and Component authenticator authentication modules and the role-based authentication modules are enabled in One Identity Manager.
Use non role-based authentication modules to log in to the Designer. Role-based authentication modules for logging in to the Designer are not supported.
NOTE: Authentication modules are defined in the One Identity Manager modules and are not available until the modules are installed.
|
Credentials |
The system user's identifier and password. |
|
Prerequisites |
- The system user with permissions exists in the database.
|
|
Set as default |
Yes |
|
Single sign-on |
No |
|
Front-end login allowed |
Yes |
|
Web Portal login allowed |
No |
|
Remarks |
The user interface and the write permissions are loaded through the system user.
Data modifications are attributed to the system user. |
IMPORTANT: The viadmin system user is available by default. The system user has the predefined user interface and access permissions to database resources. The user interface and the permissions structure for the system user must not be used or changed in the production system because this system user is overwritten as a template user with each schema update.
TIP: Create your own system user with the appropriate permissions. This can be done on initial installation of the One Identity Manager database. This system user can compile an initial One Identity Manager database and can be used to log into the administration tools for the first time.
NOTE: This authentication module is available if the Identity Management Base Module is installed.
|
Credentials |
The authentication module uses the login data of the user currently logged in on the workstation. |
|
Prerequisites |
- The employee exists in the database.
- The employee is assigned at least one application role.
- The user account exists in the database and the employee is entered in the user account's master data.
|
|
Set as default |
No |
|
Single sign-on |
Yes |
|
Front-end login allowed |
Yes |
|
Web Portal login allowed |
Yes |
|
Remarks |
One Identity Manager searches for the user account according to the configuration and finds the employee assigned to the user account.
If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.
- If this configuration parameter is set, the employee’s main identity is used for authentication.
- If the parameter is not set, the employee’s subidentity is used for authentication.
A dynamic system user determined from the employee's application roles. The user interface and the write permissions are loaded through this system user.
Changes to the data are assigned to the logged in employee. |
Modify the following configuration parameters in the Designer to implement the authentication module.
Table 29: Configuration parameters for the authentication module
| QER | Person | GenericAuthenticator |
This configuration parameter specifies whether authentication through single sign-on is supported. |
| QER | Person | GenericAuthenticator | SearchTable |
This configuration parameter contains the table in the One Identity Manager schema in which user information is stored. The table must contain a foreign key with the name UID_Person, which points to the table Person.
Example: ADSAccount |
| QER | Person | GenericAuthenticator | SearchColumn |
This configuration parameter contains the column from the One Identity Manager table (SearchTable), which is used to search for user name of the current user.
Example: CN |
| QER | Person | GenericAuthenticator | EnabledBy |
This configuration parameter contains a pipe (|) delimited list of Boolean columns from the One Identity Manager table (SearchTable), which enables the user account for login. |
| QER | Person | GenericAuthenticator | DisabledBy |
This configuration parameter contains a pipe (|) delimited list of Boolean columns from the One Identity Manager table (SearchTable), which disables the user account for login.
Example: AccountDisabled |
NOTE: This authentication module is available if the Identity Management Base Module is installed.
|
Credentials |
Employee's central user account and password. |
|
Prerequisites |
- The system user with permissions exists in the database.
- The employee exists in the database.
- The central user account is entered in the employee's master data.
- The system user is entered in the employee's master data.
- The system user password is entered in the employee's master data.
|
|
Set as default |
Yes |
|
Single sign-on |
No |
|
Front-end login allowed |
Yes |
|
Web Portal login allowed |
Yes |
|
Remarks |
If an employee has more than one identity, the QER | Person | MasterIdentity | UseMasterForAuthentication configuration parameter controls which employee identity is used for authentication.
- If this configuration parameter is set, the employee’s main identity is used for authentication.
- If the parameter is not set, the employee’s subidentity is used for authentication.
The user interface and the write permissions are loaded through the system user that is directly assigned to the logged in employee.
Changes to the data are assigned to the logged in employee. |
