Chat now with support
Chat with Support

Identity Manager 8.2.1 - Administration Guide for Connecting to LDAP

About this guide Managing LDAP environments Synchronizing LDAP directories
Setting up initial LDAP directory synchronization Adjusting the synchronization configuration for LDAP environments Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization
Managing LDAP user accounts and employees Managing memberships in LDAP groups Login information for LDAP user accounts Mapping LDAP objects in One Identity Manager Handling of LDAP objects in the Web Portal Basic data for managing an LDAP environment Troubleshooting Configuration parameters for managing an LDAP environment Default project template for LDAP Generic LDAP connector settings LDAP connector V2 settings

LDAP groups

LDAP user accounts, computers, and groups can be grouped into groups that can be used to regulate access to resources. In One Identity Manager, you can set up new groups or to edit already existing groups.

To add users to groups, you assign the groups directly to users. You can assign groups to departments, cost centers, locations, business roles, system roles, or the IT Shop.

Related topics

Creating LDAP groups

To create a group

  1. In the Manager, select the LDAP > Groups category.

  2. Click in the result list.

  3. On the main data form, edit the main data of the group.

  4. Save the changes.
Related topics

Editing main data of LDAP groups

To edit group main data

  1. In the Manager, select the LDAP > Groups category.

  2. Select the group in the result list.

  3. Select the Change main data task.

  4. On the main data form, edit the main data of the group.

  5. Save the changes.
Related topics

LDAP group main data

Enter the following main data:

Table 33: General main data
Property Description

Distinguished name

Distinguished name of the group. The distinguished name is determined by template from the name of the group and the container and cannot be edited.

Name

Name of the group.

Display name

The display name is used to display the group in the One Identity Manager tools user interface.

Domain

Domain in which to create the group.

Container

Container in which to create the group.

Administrator

The group administrator.

Service item

Service item data for requesting the group through the IT Shop.

Business unit

Business unit to which the group is assigned.

See also

Link to another LDAP object.

Structural object class

Structural object class representing the object type. By default, containers in One Identity Manager are added with GROUPOFNAMES.

Object class

List of classes defining the attributes for this object. By default, containers in One Identity Manager are added with GROUPOFNAMES. However, in the input field, you can add object classes and auxiliary classes that are used by other LDAP and X.500 directory services.

Risk index

Value for evaluating the risk of assigning the group to user accounts. Set a value in the range 0 to 1. This input field is only visible if the QER | CalculateRiskIndex configuration parameter is activated.

For more information about risk assessment, see the One Identity Manager Risk Assessment Administration Guide.

Category

Categories for group inheritance. Groups can be selectively inherited by user accounts. To do this, groups and user accounts are divided into categories. Select one or more categories from the menu.

Description

Text field for additional explanation.

Condition

LDAP filter for finding memberships in a dynamic group.

dynamic group

Specifies whether this is a dynamic group.

IT Shop

Specifies whether the group can be requested through the IT Shop. If this option is set, the group can be requested by the employees through the Web Portal and distributed with a defined approval process. The group can still be assigned directly to hierarchical roles.

Only for use in IT Shop

Specifies whether the group can only be requested through the IT Shop. If this option is set, the group can be requested by the employees through the Web Portal and distributed with a defined approval process. Direct assignment of the group to hierarchical roles or user accounts is not permitted.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating