Chat now with support
Chat with Support

Identity Manager 8.2 - Administration Guide for Connecting to LDAP

About this guide Managing LDAP environments Synchronizing LDAP directories
Setting up initial LDAP directory synchronization Adjusting the synchronization configuration for LDAP environments Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization
Managing LDAP user accounts and employees Managing memberships in LDAP groups Login information for LDAP user accounts Mapping LDAP objects in One Identity Manager Handling of LDAP objects in the Web Portal Basic data for managing a LDAP environment Troubleshooting Configuration parameters for managing an LDAP environment Default project template for LDAP Generic LDAP connector settings LDAP connector V2 settings

Configuration parameters for managing an LDAP environment

The following configuration parameters are additionally available in One Identity Manager after the module has been installed.

Table 40: Configuration parameters for LDAP directory synchronization
Configuration parameters Description

TargetSystem | LDAP

Preprocessor relevant configuration parameter for controlling the database model components for the administration of the target system LDAP. If the parameter is set, the target system components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | LDAP | Accounts

Allows configuration of user account data.

TargetSystem | LDAP | Accounts
| InitialRandomPassword

Specifies whether a random password is generated when a new user account is added. The password must contain at least those character sets that are defined in the password policy.

TargetSystem | LDAP | Accounts |
InitialRandomPassword | SendTo

Employee to receive an email with the random generated password (manager cost center/department/location/business role, employee’s manager or XUserInserted). If no recipient can be found, the password is sent to the address stored in the TargetSystem | LDAP | DefaultAddress configuration parameter.

TargetSystem | LDAP | Accounts |
InitialRandomPassword | SendTo |
MailTemplateAccountName

Mail template name that is sent to supply users with the login credentials for the user account. The Employee - new user account created mail template is used.

TargetSystem | LDAP | Accounts |
InitialRandomPassword | SendTo |
MailTemplatePassword

Mail template name that is sent to supply users with the initial password. The Employee - initial password for new user account mail template is used.

TargetSystem | LDAP | Accounts |
MailTemplateDefaultValues

Mail template used to send notifications about whether default IT operating data mapping values are used for automatically creating a user account. The Employee - new user account with default properties created mail template is used.

TargetSystem | LDAP | Accounts |
PrivilegedAccount

Allows configuration of privileged LDAP user account settings.

TargetSystem | LDAP | Accounts |
PrivilegedAccount | UserID_Postfix

Postfix for formatting the login name of privileged user accounts.

TargetSystem | LDAP | Accounts |
PrivilegedAccount | UserID_Prefix

Prefix for formatting a login name of privileged user accounts.

TargetSystem | LDAP | Authentication

Allows configuration of the LDAP authentication module.

For more information about One Identity Manager authentication modules, see the One Identity Manager Authorization and Authentication Guide.

TargetSystem | LDAP | Authentication | Authentication

Authentication mechanism. Permitted values are Secure, Encryption, SecureSocketsLayer, ReadonlyServer, Anonymous, FastBind, Signing, Sealing, Delegation, and ServerBind. The value can be combined with commas (,). For more information about authentication types, see the MSDN Library.

The default is ServerBind.

TargetSystem | LDAP | Authentication | Port

LDAP server port. The default is port 389.

TargetSystem | LDAP | Authentication | RootDN

Pipe (|) delimited list of root domains to be used to find the user account for authentication.

Syntax:

DC=<MyDomain>|DC=<MyOtherDomain>

Example:

DC=Root1,DC=com|DC=Root2,DC=de

TargetSystem | LDAP | Authentication | Server

Name of the LDAP server.

TargetSystem | LDAP | DefaultAddress

Default email address of the recipient for notifications about actions in the target system.

TargetSystem | LDAP |
HardwareInGroupFromOrg

Specfies whether computers are added to groups based on group assignment to roles.

TargetSystem | LDAP |
MaxFullsyncDuration

Maximum runtime of a synchronization in minutes. No recalculation of group memberships by the DBQueue Processor can take place during this time. If the maximum runtime is exceeded, group membership are recalculated.

TargetSystem | LDAP |
PersonAutoDefault

Mode for automatic employee assignment for user accounts added to the database outside synchronization.

TargetSystem | LDAP |
PersonAutoDisabledAccounts

Specifies whether employees are automatically assigned to disabled user accounts. User accounts are not given an account definition.

TargetSystem | LDAP |
PersonAutoFullSync

Mode for automatic employee assignment for user accounts that are added to or updated in the database by synchronization.

Default project template for LDAP

A default project template ensures that all required information is added in One Identity Manager. This includes mappings, workflows, and the synchronization base object. If you do not use a default project template you must declare the synchronization base object in One Identity Manager yourself.

Use a default project template for initially setting up the synchronization project. For custom implementations, you can extend the synchronization project with the Synchronization Editor.

Detailed information about this topic

OpenDJ project template for the generic LDAP connector

This project template is based on OpenDJ. The project template uses mappings for the following schema types.

Table 41: Mapping schema types to tables in the One Identity Manager schema.
Schema type in LDAP Table in the One Identity Manager Schema

domain

LDPDomain

organization

LDAPContainer

organizationalUnit

LDAPContainer

locality

LDAPContainer

container

LDAPContainer

groupOfNames

LDAPGroup

groupOfUniqueNames

LDAPGroup

groupOfURLs

LDAPGroup

inetOrgPerson

LDAPAccount

Active Directory Lightweight Directory Services project template for the generic LDAP connector

This project template is based on Active Directory Lightweight Directory Services (AD LDS). The project template uses mappings for the following schema types.

Table 42: Mapping schema types to tables in the One Identity Manager schema.
Schema type in AD LDS Table in the One Identity Manager Schema

Container

LDAPContainer

country

LDAPContainer

domainDNS

LDAPContainer

foreignSecurityPrincipal

LDAPAccount

group

LDAPGroup

groupOfNames

LDAPGroup

inetOrgPerson

LDAPAccount

organization

LDAPContainer

organizationalUnit

LDAPContainer

user

LDAPAccount

userProxy

LDAPAccount

userProxyFull

LDAPAccount

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating