Identity Manager 8.1 - One Identity Manager Connector User Guide

Setting Up Synchronization with the One Identity Manager Connector

Use the One Identity Manager connector to synchronize One Identity Manager databases with the same product version. In this way, you can transfer user data from a production database to a test database, for example. You can separate systems with large data volumes into smaller databases, which only contain one part of the entire data volume, for example, a location property's set. You then maintain the master data and system entitlements for these databases. You can optimize use of One Identity Manager functionality by synchronizing with a central database, containing all the data, on a regular basis. Here you can execute main tasks, such as Identity Audit.

Note: The One Identity Manager connector does not provide a project template for setting up synchronization. You must create synchronization configuration components (mappings, workflows, start up configurations ...) manually after the synchronization project has been saved.

To set up synchronization with a One Identity Manager database

  1. Install and configure a synchronization server and declare the server as Job server in One Identity Manager.
  2. Provide One Identity Manager users with the required permissions for setting up synchronization and post-processing of synchronization objects.

  3. Create a synchronization project with the Synchronization Editor.
Detailed information about this topic

Users and Permissions for Synchronizing

In the synchronization with the database connectors, there are three use cases for mapping synchronization objects in the One Identity Manager data model.

  1. Mapping custom target systems

  2. Mapping default tables (for example Person, Department)

  3. Mapping custom tables

In the case of non-role-based login to One Identity Manager tools, it is sufficient to add one system user in the DPR_EditRights_Methods permissions group. For detailed information about system users and permissions groups, see the One Identity Manager Authorization and Authentication Guide.

Table 1: Users and Permissions Groups for Non Role-Based Login
Users Task

One Identity Manager administrators

  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required.

  • Create system users and permissions groups for non-role-based login to administration tools in Designer as required.

  • Enable or disable additional configuration parameters in Designer as required.

  • Create custom processes in Designer as required.

  • Create and configures schedules as required.

  • Create and configure password policies as required.

System users in the DPR_EditRights_Methods permissions group

  • Configure and start synchronization in the Synchronization Editor.

  • Edit the synchronization's target system types as well as outstanding objects in the Manager.

There are different steps required for role-based login, in order to equip One Identity Manager users with the required permissions for setting up synchronization and post-processing of synchronization objects.

Table 2: User and permissions groups for role-based login: Mapped as custom target system
Users Task

One Identity Manager administrators

  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required.

  • Create system users and permissions groups for non-role-based login to administration tools in Designer as required.

  • Enable or disable additional configuration parameters in Designer as required.

  • Create custom processes in Designer as required.

  • Create and configures schedules as required.

  • Create and configure password policies as required.

Target system administrators

Target system administrators must be assigned to the Target systems | Administrators application role.

Users with this application role:

  • Administrate application roles for individual target systems types.

  • Specify the target system manager.

  • Set up other application roles for target system managers if required.

  • Specify which application roles are conflicting for target system managers

  • Authorize other employee to be target system administrators.

  • Do not assume any administrative tasks within the target system.

Target system managers

Target system managers must be assigned to the application role Target systems | Custom target systems or a sub application role.

Users with this application role:

  • Assume administrative tasks for the target system.

  • Create, change or delete target system objects, like user accounts or groups.

  • Edit password policies for the target system.

  • Prepare groups for adding to the IT Shop.

  • Can create employees with an identity that differs from the Primary identity.

  • Configure synchronization in the Synchronization Editor and defines the mapping for comparing target systems and One Identity Manager.

  • Edit the synchronization's target system types and outstanding objects.

  • Authorize other employees within their area of responsibility as target system managers and create child application roles if required.

Table 3: User and permissions groups for role-based login: Mapped as default tables
Users Task

One Identity Manager administrators

  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required.

  • Create system users and permissions groups for non-role-based login to administration tools in Designer as required.

  • Enable or disable additional configuration parameters in Designer as required.

  • Create custom processes in Designer as required.

  • Create and configures schedules as required.

  • Create and configure password policies as required.

Custom application role

Users with this application role:

  • Configure and start synchronization in the Synchronization Editor.

  • Edit the synchronization's target system types as well as outstanding objects in the Manager.

This application role gets its write access through a custom permissions group and the permissions group vi_4_SYNCPROJECT_ADMIN.

Table 4: Users and permissions groups for role-based login: Mapped in custom tables
Users Task

One Identity Manager administrators

  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required.

  • Create system users and permissions groups for non-role-based login to administration tools in Designer as required.

  • Enable or disable additional configuration parameters in Designer as required.

  • Create custom processes in Designer as required.

  • Create and configures schedules as required.

  • Create and configure password policies as required.

Application roles for custom tasks

Administrators must be assigned to Custom | Administrators.

Users with this application role:

  • Administrate custom application roles.

  • Set up other application roles for managers if required.

Manager for custom tasks

Managers must be assigned to Custom | Managers or a subordinate role.

Users with this application role:

  • Add custom task in One Identity Manager.

  • Configure and start synchronization in the Synchronization Editor.

  • Edit the synchronization's target system types as well as outstanding objects in the Manager.

You can use these application roles, for example, to guarantee One Identity Manager users write permissions on custom tables or columns. All application roles that you define here must obtain their write permissions through custom permissions groups.

This application role gets its write access through a custom permissions group and the permissions group vi_4_SYNCPROJECT_ADMIN.

To configure synchronization projects and target system synchronization (in the use cases 2 and 3)

  1. Set up a custom permissions group with all permissions for configuring synchronization and editing synchronization objects.

  2. Assign a custom application role to this permission group.

Detailed information about this topic

Setting Up a Custom Application Role for Synchronization

For role-based login, create a custom application role to guarantee One Identity Manager users the necessary permissions for configuring synchronization and handling outstanding objects. This application role obtains the required permissions by using a custom permissions group.

To set up an application role for synchronization (use case 2):

  1. Select the default application role to use to edit the objects you want to synchronization in the Manager.

    • Establish the application role's default permissions group.

    If you want to import employee data, for example, select Identity Management | Employees | Administrators. The default permissions group of this application role is vi_4_PERSONADMIN.

  2. Create a new permissions group in the Designer.

    • Set Only use for role based authentication.

  3. Make the new permissions group dependent on the vi_4_SYNCPROJECT_ADMIN permission group.

    The vi_4_SYNCPROJECT_ADMIN permissions groups must be assigned as the parent permissions group. This means that the new permissions group inherits the properties.

  4. Make the new permissions group dependent on the default permission group of the selected default application role.

    The default permissions group must be assigned as a subgroup. This means that the new permissions group inherits the properties.

  5. Save the changes.
  6. Create a new application role in the Manager.

    1. Assign the selected application role to be the parent application role.

    2. Assign the new permissions group.

  7. Assign employees to this application role.

  8. Save the changes.

To set up an application role for synchronization (use case 3):

  1. Create a new permissions group for custom tables, which are populated though synchronization, in the Designer.

    • Set Only use for role based authentication.

  2. Guarantee this permissions group all the required permissions to the custom tables.

  3. Create another permissions group for synchronization.

    • Set Only use for role based authentication.

  4. Make the permissions group for synchronization dependent on the permissions group for custom tables.

    The permissions group for custom tables must be assigned as parent permissions group. This means the permissions groups for synchronization inherits its properties.

  5. Make the permissions group for synchronization dependent on the vi_4_SYNCPROJECT_ADMIN permission group.

    The vi_4_SYNCPROJECT_ADMIN permissions groups must be assigned as the parent permissions group. This means the permissions groups for synchronization inherits its properties.

  6. Save the changes.
  7. Create a new application role in the Manager.

    1. Assign the application role Custom | Managers as the parent application role.
    2. Assign the permissions group for the synchronization.
  8. Assign employees to this application role.

  9. Save the changes.

For detailed information about setting up application roles and permissions groups, see the One Identity Manager Authorization and Authentication Guide.

Setting Up the Synchronization Server

A server with the following software must be available for setting up synchronization:

  • One Identity Manager Service

    • Install One Identity Manager components with the installation wizard.
      1. Select Select installation modules with existing database.

      2. Select the Server | Job server machine role.

    For more detailed information about system requirements for installing the One Identity Manager Service, see the One Identity Manager Installation Guide.

The synchronization server must be declared as a Job server in One Identity Manager.

Use the Server Installer to install the One Identity Manager Service. The program executes the following steps:

  • Setting up a Job server.

  • Specifying machine roles and server function for the Job server.

  • Remote installation of One Identity Manager Service components corresponding to the machine roles.

  • Configuration of One Identity Manager Service.

  • Starts the One Identity Manager Service.

NOTE: The program executes remote installation of the One Identity Manager Service. Local installation of the service is not possible with this program. Remote installation is only supported within a domain or a trusted domain.

For remote installation of One Identity Manager Service, you require an administrative workstation on which the One Identity Manager components are installed. For detailed information about installing a workstation, see the One Identity Manager Installation Guide.

To install and configure One Identity Manager Service remotely on a server

  1. Start the program Server Installer on your administrative workstation.

  2. Enter the valid connection credentials for the One Identity Manager database on the Database connection page.

  3. Specify the server on which you want to install One Identity Manager Service on the Server properties page.

    1. Select a Job server from the Server menu.

      - OR -

      To create a new Job server, click Add.

    2. Enter the following data for the Job server.

      Table 5: Job Server Properties

      Property

      Description

      Server

      Job server name.

      Queue

      Name of the queue to handle the process steps. Each One Identity Manager Service within the network must have a unique queue identifier. The process steps are requested by the job queue using exactly this queue name. The queue identifier is entered in the One Identity Manager Service configuration file.

      Full server name

      Full server name in accordance with DNS syntax.

      Example:

      <Name of servers>.<Fully qualified domain name>

      NOTE: You can use the Extended option to make changes to other properties for the Job server. You can also edit the properties later with Designer.
  4. Select Job server on the Machine roles page.

  5. Select One Identity Manager connector on the Server functions page.

  6. Check the One Identity Manager Service configuration on the Service settings page.

    NOTE: The initial service configuration is predefined already. If further changes need to be made to the configuration, you can do this later with the Designer. For detailed information about configuring the service, see the One Identity Manager Configuration Guide.
  7. To configure remote installations, click Next.

  8. Confirm the security prompt with Yes.

  9. Select the directory with the install files on Select installation source.

  10. Select the file with the private key on the page Select private key file.

    NOTE: This page is only displayed when the database is encrypted.
  11. Enter the service's installation data on the Service access page.

    Table 6: Installation Data

    Data

    Description

    Computer

    Server on which to install and start the service from.

    To select a server

    • Enter a name for the server.

      - OR -

    • Select a entry from the list.

    Service account

    User account data for the One Identity Manager Service.

    To enter a user account for the One Identity Manager Service

    • Set the option Local system account.

      This starts the One Identity Manager Service under the NT AUTHORITY\SYSTEM account.

      - OR -

    • Enter user account, password and password confirmation.

    Installation account

    Data for the administrative user account to install the service.

    To enter an administrative user account for installation

    • Enable Advanced.

    • Enable Current user.

      This uses the user account of the current user.

      - OR -

    • Enter user account, password and password confirmation.

  12. Click Next to start installing the service.

    Installation of the service occurs automatically and may take some time.

  13. Click Finish on the last page of Server Installer.

    NOTE: The service is entered with the name One Identity Manager Service in the server service management.
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents