Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Identity Manager 8.1.5 - Administration Guide for Privileged Account Governance

Table of Contents

Mapping a Privileged Account Management system in One Identity Manager

Architecture overview One Identity Manager users for managing Privileged Account Management Configuration parameters

Synchronizing a Privileged Account Management system

Setting up the initial synchronization of a One Identity Safeguard

Users and permissions for synchronizing with a One Identity Safeguard appliance Setting up the One Identity Safeguard synchronization server

System requirements for the One Identity Safeguard synchronization server Installing the safeguard-ps Windows PowerShell module Installing One Identity Manager Service with One Identity Safeguard connector

Preparing the administrative workstation for access to the One Identity Safeguard appliance Preparing a remote connection server for access to the One Identity Safeguard appliance Creating a synchronization project for initial synchronization of a One Identity Safeguard appliance

Information required for setting up a synchronization project Creating an initial synchronization project for One Identity Safeguard

Configuring the synchronization log

Customizing the synchronization configuration for One Identity Safeguard

Configuring synchronization to a One Identity Safeguard appliance Configuring synchronization of multiple One Identity Safeguard appliances Updating schemas Speeding up synchronization with revision filtering Configuring the provisioning of memberships Configuring single object synchronization Accelerating provisioning and single object synchronization Adjusting the Windows PowerShell definition of the One Identity Safeguard connector

Executing synchronization

Starting synchronization Displaying synchronization results Deactivating synchronization Synchronizing single objects

Tasks after a synchronization

Post-processing outstanding objects Adding custom tables to the target system synchronization Managing PAM user accounts through account definitions

Troubleshooting

Managing PAM user accounts and employees

Account definitions for PAM user accounts

Creating account definitions Editing account definitions Master data for account definitions Editing manage levels Creating manage levels Master data for manage levels creating mapping rules for IT operating data Entering IT operating data Modify IT operating data Assigning account definitions to employees

Assigning account definitions to departments, cost centers, and locations Assigning account definitions to business roles Assigning account definitions to all employees Assigning account definitions directly to employees Assigning account definitions to system roles Adding account definitions in the IT Shop

Assigning account definitions to PAM appliances Deleting account definitions

Automatic assignment of employees to PAM user accounts

Editing search criteria for automatic employee assignment

Finding employees and directly assigning them to user accounts

Changing manage levels for PAM user accounts Assigning account definitions to linked PAM user accounts

Manually linking employees to PAM user accounts Supported user account types

Default user accounts Administrative user accounts

Providing administrative user accounts for one employee Providing administrative user accounts for several employees

Privileged user accounts

Managing the assignments of PAM user groups

Assigning PAM user groups to PAM user accounts in One Identity Manager

Assigning PAM user groups to departments, cost centers, and locations Assigning PAM user groups to business roles Adding PAM user groups to system roles Adding PAM user groups to the IT Shop Adding local PAM user groups to the IT Shop automatically Assigning PAM user accounts directly to a PAM user group Assigning PAM user groups directly to a PAM user account

Effects of PAM user group memberships PAM user group inheritance based on categories Overview of all assignments

Provision of login information for PAM user accounts

Password policies for PAM users

Predefined password policies Using password policies Editing password policies Creating password policies General master data for password policies Policy settings Character classes for passwords Custom scripts for password requirements

Script for checking passwords Script for generating a password

Editing the excluded list for passwords Checking passwords Testing the generation of passwords

Initial password for new PAM user accounts Email notifications about login data

Mapping of PAM objects in One Identity Manager

Creating PAM appliances Editing the master data for PAM appliances General master data for PAM appliances Defining categories for the inheritance of PAM user groups Additional tasks for managing PAM appliances

The PAM appliance overview Editing the synchronization project for a PAM appliance

PAM user accounts

Creating local PAM user accounts Creating certificate-based PAM user accounts Creating PAM user accounts for directory users Editing master data for PAM user accounts General master data for PAM user accounts Contact information for PAM user accounts Secondary authentication for PAM user accounts Administrative entitlements for PAM user accounts Additional tasks for managing PAM user accounts

The PAM user account overview Assigning extended properties to PAM user accounts

Disabling PAM user accounts Deleting and restoring PAM user accounts

PAM user groups

Editing master data for PAM user groups General master data for PAM user accounts Additional tasks for managing PAM user groups

The PAM user group overview Assigning extended properties to PAM user groups

PAM assets PAM asset groups PAM asset accounts PAM directory accounts PAM account groups PAM directories PAM entitlements PAM access request policies Reports about PAM objects

PAM access requests

System requirements for requesting PAM access requests Requesting PAM access requests PAM object owners

Automatically determining the owners Manually specifying employees as PAM object owners Manually specifying application roles for PAM object owners

Configuring PAM access request policies

Handling of PAM objects in the Web Portal Basic data for managing a Privileged Account Management system

Job server for PAM-specific process handling

Editing PAM Job servers General master data for Job servers Specifying server functions

Target system managers for PAM systems

Configuration parameters for the management of a Privileged Account Management system Default project template for One Identity Safeguard Editing One Identity Safeguard system objects Known issues about connecting One Identity Safeguard appliances About us

Editing password policies

Provision of login information for PAM user accounts > Password policies for PAM users > Editing password policies

To edit a password policy

In the Manager, select the Privileged Account Management | Basic configuration data | Password policies category.
In the result list, select the password policy.
Select the Change master data task.
Edit the password policy's master data.
Save the changes.

Detailed information about this topic

Related topics

Creating password policies

Creating password policies

Provision of login information for PAM user accounts > Password policies for PAM users > Creating password policies

To create a password policy

In the Manager, select the Privileged Account Management | Basic configuration data | Password policies category.
Click in the result list.
On the master data form, enter the master data for the password policy.
Save the changes.

Detailed information about this topic

Related topics

Editing password policies

General master data for password policies

Provision of login information for PAM user accounts > Password policies for PAM users > General master data for password policies

Enter the following master data for a password policy.

Table 21: Master data for a password policy
Property	Meaning
Display name	Password policy name. Translate the given text using the button.
Description	Text field for additional explanation. Translate the given text using the button.
Error Message	Custom error message generated if the policy is not fulfilled. Translate the given text using the button.
Owner (Application Role)	Application roles whose members can configure the password policies.
Default policy	Mark as default policy for passwords. NOTE: The One Identity Manager password policy is marked as the default policy. This password policy is applied if no other password policy can be found for employees, user accounts, or system users.

Policy settings

Provision of login information for PAM user accounts > Password policies for PAM users > Policy settings

Define the following settings for a password policy on the Password tab.

Table 22: Policy settings
Property	Meaning
Initial password	Initial password for newly created user accounts. The initial password is used if a password is not entered when you create a user account or if a random password is not generated.
Password confirmation	Reconfirm password.
Minimum Length	Minimum length of the password. Specify the number of characters a password must have.
Max. length	Maximum length of the password. Specify the number of characters a password can have. The maximum permitted value is 256.
Max. errors	Maximum number of errors. Set the number of invalid passwords attempts. Only taken into account when logging in to One Identity Manager. This data is only taken into account if the One Identity Manager login was through a system user or employee based authentication module. If a user has reached the number of maximum failed logins, the employee or system user can no longer log in to One Identity Manager. You can use the Password Reset Portal to reset the passwords of employees and system users who have been blocked. For more detailed information, see the One Identity Manager Web Portal User Guide.
Validity period	Maximum age of the password. Enter the length of time a password can be used before it expires.
Password history	Enter the number of passwords to be saved. If, for example, a value of 5 is entered, the user's last five passwords are stored.
Minimum password strength	Specifies how secure the password must be. The higher the password strength, the more secure it is. The value 0 means that the password strength is not tested. The values 1, 2, 3 and 4 specify the required complexity of the password. The value 1 represents the lowest requirements in terms of password strength. The value 4 requires the highest level of complexity.
Name properties denied	Specifies whether name properties are permitted in the password. If this option is set, name properties are not permitted in passwords. The values of these columns are taken into account if the Contains name properties for password check option is set. In the Designer, adjust this option in the column definition. For more detailed information, see the One Identity Manager Configuration Guide.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center