Chat now with support
Chat with Support

Identity Manager 9.2.1 - Administration Guide for Connecting Unix-Based Target Systems

Managing Unix-based systems Synchronizing Unix-based target systems Managing Unix user accounts and identities Managing memberships in Unix groups Login credentials for Unix user accounts Mapping Unix objects in One Identity Manager Handling of Unix objects in the Web Portal Basic data for Unix-based target systems Configuration parameters for managing Unix-based target systems Default project template for Unix-based target systems Unix connector settings

Finding identities and directly assigning them to user accounts

Based on the search criteria, you can create a suggestion list for the assignment of identities to user accounts and make the assignment directly. User accounts are grouped in different views for this.

  • Suggested assignments: This view lists all user accounts to which One Identity Manager can assign an identity. All identities are shown that were found using the search criteria and can be assigned.

  • Assigned user accounts: This view lists all user accounts to which an identity is assigned.

  • No identity assignment: This view lists all user accounts to which no identity is assigned and for which no identity was found using the search criteria.

NOTE: To display disabled user accounts or deactivated identities in the view, enable the Even locked accounts are mapped option.

If you assign a deactivated identity to a user account, it might be locked or deleted depending on the configuration.

To apply search criteria to user accounts

  1. In the Manager, select the Unix > Hosts category.

  2. Select the host in the result list.

  3. Select the Define search criteria for identity assignment task.

  4. At the bottom of the form, click Reload.

    All possible assignments based on the search criteria are found in the target system for all user accounts. The three views are updated.

TIP: By double-clicking on an entry in the view, you can view the user account and identity main data.

The assignment of identities to user accounts creates connected user accounts (Linked state). To create managed user accounts (Linked configured state), you can assign an account definition at the same time.

To assign identities directly to user accounts

  • Click Suggested assignments.

    1. Click the Selection box of all user accounts to which you want to assign the suggested identities. Multi-select is possible.

    2. (Optional) Select an account definition in the Assign this account definition menu, and select a manage level in the Assign this account manage level menu.

    3. Click Assign selected.

    4. Confirm the security prompt with Yes.

      The identities determined using the search criteria are assigned to the selected user accounts. If an account definition was selected, this is assigned to all selected user accounts.

    - OR -

  • Click No identity assignment.

    1. Click Select identity for the user account to which you want to assign an identity. Select an identity from the menu.

    2. Click the Selection box of all user accounts to which you want to assign the selected identities. Multi-select is possible.

    3. (Optional) Select an account definition in the Assign this account definition menu, and select a manage level in the Assign this account manage level menu.

    4. Click Assign selected.

    5. Confirm the security prompt with Yes.

      The identities displayed in the Identity column are assigned to the selected user accounts. If an account definition was selected, this is assigned to all selected user accounts.

To remove assignments

  • Click Assigned user accounts.

    1. Click the Selection box of all the user accounts with the identity assignment you want to delete. Multi-select is possible.

    2. Click Remove selected.

    3. Confirm the security prompt with Yes.

      The assigned identities are removed from the selected user accounts.

Changing manage levels for Unix user accounts

The default manage level is applied if you create user accounts using automatic identity assignment. You can change a user account manage level later.

To change the manage level for a user account

  1. In the Manager, select the Unix > User accounts category.

  2. Select the user account in the result list.

  3. Select the Change main data task.

  4. Select the manage level in the Manage level list on the General tab.

  5. Save the changes.
Related topics

Supported user account types

Different types of user accounts, such as default user accounts, administrative user accounts, service accounts, or privileged user accounts, can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

  • Identity type

    The Identity type property (IdentityType column) is used to describe the type of user account.

    Table 10: Identity types of user accounts
    Identity type Description Value of the IdentityType column

    Primary identity

    Identity's default user account.

    Primary

    Organizational identity

    Secondary user account used for different roles in the company, for example for subcontracts with other functional areas.

    Organizational

    Personalized administrator identity

    User account with administrative permissions, used by an identity.

    Admin

    Sponsored identity

    User account used for a specific purpose. For example, for training purposes.

    Sponsored

    Shared identity

    User account with administrative permissions, used by multiple identities.

    Shared

    Service identity

    Service account.

    Service

  • Privileged user account

    Privileged user accounts are used to provide identities with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are labeled with the Privileged user account property (IsPrivilegedAccount column).

Detailed information about this topic

Default user accounts

Normally, each identity obtains a default user account, which has the permissions they require for their regular work. The user accounts are linked to the identity. The effect of the link and the scope of the identity’s inherited properties on the user accounts can be configured through an account definition and its manage levels.

To create default user accounts through account definitions

  1. Create an account definition and assign the Unmanaged and Full managed manage levels.

  2. Specify how an identity's temporary deactivation, permanent deactivation, deletion, and security risks affect its user accounts and group memberships at each manage level.

  3. Create a formatting rule for IT operating data.

    You use the mapping rule to define which rules are used to map IT operating data for user accounts and which default values are used if no IT operating data can be determined through an identity's primary roles.

    The type of IT operating data required depends on the target system. The following setting are recommended for default user accounts:

    • In the mapping rule for the IsGroupAccount column, use the default value 1 and enable the Always use default value option.

    • In the mapping rule for the IdentityType column, use the default value Primary and enable Always use default value.

  4. Enter the effective IT operating data for the target system. Select the concrete target system under Effects on.

    Specify in the departments, cost centers, locations, or business roles that IT operating data should apply when you set up a user account.

  5. Assign the account definition to identities.

    When the account definition is assigned to an identity, a new user account is created through the inheritance mechanism and subsequent processing.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating