Chat now with support
Chat with Support

Identity Manager 8.1.5 - Administration Guide for Connecting to LDAP

Managing LDAP environments Synchronizing LDAP directories
Setting up initial LDAP directory synchronization Customizing the synchronization configuration Executing synchronization Tasks after a synchronization Troubleshooting
Basic configuration data LDAP domains LDAP user accounts LDAP groups LDAP container structures LDAP computers Reports about LDAP objects Configuration parameters for managing an LDAP environment Default project template for LDAP Generic LDAP connector settings

Entering master data for LDAP user accounts

A user account can be linked to an employee in One Identity Manager. You can also manage user accounts separately from employees.

NOTE: It is recommended to use account definitions to set up user accounts for company employees. In this case, some of the master data described in the following is mapped through templates from employee master data.

NOTE: If employees are to obtain their user accounts through account definitions, the employees must own a central user account and obtain their IT operating data through assignment to a primary department, a primary location, or a primary cost center.

To create a user account

  1. In the Manager, select the LDAP | User accounts category.

  2. Click in the result list.

  3. On the master data form, edit the master data for the user account.

  4. Save the changes.

To edit master data for a user account

  1. In the Manager, select the LDAP | User accounts category.

  2. Select the user account in the result list and run the Change master data task.

  3. Edit the user account's resource data.

  4. Save the changes.

To manually assign or create a user account for an employee

  1. In the Manager, select the Employees | Employees category.

  2. Select the employee in the result list and run the Assign LDAP user accounts task.

  3. Assign a user account.

  4. Save the changes.
Detailed information about this topic
Related topics

General master data of LDAP user accounts

Enter the following data on the General tab.

Table 26: General master data for a user account
Property Description

Employee

 Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu. If you are using automatic employee assignment, an associated employee is found and added to the user account when you save the user account.

You can create a new employee for a user account with an identity of type Organizational identity, Personalized administrator identity, Sponsored identity, Shared identity, or Service identity. To do this, click next to the input field and enter the required employee master data. Which login data is required depends on the selected identity type.

Account definition

Account definition through which the user account was created.

Use the account definition to automatically fill user account master data and to specify a manage level for the user account. One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account.

NOTE: The account definition cannot be changed once the user account has been saved.

Manage level

 Manage level of the user account. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.

Domain

Domain in which the user account is created.

Structural object class Structural object class representing the object type. By default, user accounts in One Identity Manager are added with the INETORGPERSON object class.

Container

Container in which to create the user account. If you have assigned an account definition, the container is determined from the company IT data for the assigned employee depending on the manage level of the user account. When the container is selected, the defined name for the user is created using a formatting rule.

Object class

 List of classes defining the attributes for this object. By default, user accounts in One Identity Manager are added with the INETORGPERSON object class. However, in the input field, you can add object classes and auxiliary classes that are used by other LDAP and X.500 directory services.

Name

User account identifier. The identifier is made up of the user’s first and last names.

Display name User account display name. The display name is made up of the first and last names.

Distinguished name

User account's distinguished name. The distinguished name is formatted from the user account's identifier and the container and cannot be changed.

Object SID (AD) The object's security ID (SID) in Active Directory.

First name

 The user’s first name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Last name

 The user’s last name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Initials

 The user’s initials. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Job description

 Job description. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Login name

Login name. If you assigned an account definition, the login name is made up of the employee’s central user account depending on the manage level.

Password

Password for the user account. The employee’s central password can be mapped to the user account password. For detailed information about an employee’s central password, see One Identity Manager Identity Management Base Module Administration Guide.

If you use an initial password for the user accounts, it is automatically entered when a user account is created.

The password is deleted from the database after publishing to the target system.

NOTE: One Identity Manager password policies are taken into account when a user password is being verified. Ensure that the password policy does not violate the target system's requirements.

Password confirmation

Reconfirm password.

Risk index (calculated)

Maximum risk index value of all assigned groups. The property is only visible if the QER | CalculateRiskIndex configuration parameter is set. For detailed information, see the One Identity Manager Risk Assessment Administration Guide.

Account expiry date

Account expiry date. Specifying an expiry data for the account has the effect that the logon for this user account is blocked as soon as the given date is exceeded. If you assigned an account definition, the employee’s last day of work it is automatically taken as the expiry date depending on the manage level. Any existing account expiry date is overwritten in this case.

Category

Categories for the inheritance of groups by the user account. Groups can be selectively inherited by user accounts. To do this, groups and user accounts or contacts are divided into categories. Select one or more categories from the menu.

Description

Text field for additional explanation.

Identity

User account's identity type Permitted values are:

  • Primary identity: Employee's default user account.

  • Organizational identity: Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.

  • Personalized administrator identity: User account with administrative permissions, used by one employee.

  • Sponsored identity: User account that is used for a specific purpose, such as training.

  • Shared identity: User account with administrative permissions, used by several employees. Assign all employees that use this user account.

  • Service identity: Service account.

Privileged user account

Specifies whether this is a privileged user account.

Groups can be inherited

Specifies whether the user account can inherit groups through the employee. If this option is set, the user account inherits groups through hierarchical roles or IT Shop requests.

  • If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups.
  • If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.

User account is disabled

Specifies whether the user account is disable. If a user account is not required for a period of time, you can temporarily disable the user account by using the <User account is deactivated> option.

Related topics

Contact data for an LDAP user account

On the Contact data tab, enter the data used by this user account for contacting the employee by telephone.

Table 27: Contact data
Property Description
Image

Picture to display in a telephone book, for example.

  • Load the image using the button.
  • You can delete the picture using .

Email address

Email address. If you assigned an account definition, the email address is made up of the employee’s default email address depending on the manage level of the user account.

Phone

Telephone number. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Mobile phone

Mobile number. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Pager

Pager number.

Fax

Fax number. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Phone private

Private telephone number.

Phone, private (2)

Extra telephone number.

International ISDN no.

International ISDN number.

Additional email addresses

Additional email addresses.

X.121 address

Addressing as X.121 address.

X.400 address Address in X.400 format.

Address information for LDAP user accounts

Enter the following address data for contacting the employee on the Address data tab.

Table 28: Address data
Property Description

Room

Room. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Registered address Postal address.
Address Postal address.
Address (private) Postal address (private).

Mailbox

Mailbox. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Street

Street or road. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Zip code

Zip code. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

State

State. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating