Chat now with support
Chat with Support

Identity Manager 9.2.1 - Administration Guide for Privileged Account Governance

About this guide Managing a Privileged Account Management system in One Identity Manager Synchronizing a Privileged Account Management system
Setting up the initial synchronization of a One Identity Safeguard Customizing the synchronization configuration for One Identity Safeguard Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization Pausing handling of target system specific processes (Offline mode)
Managing PAM user accounts and identities Managing assignments of PAM user groups Login credentials for PAM user accounts Mapping PAM objects in One Identity Manager
PAM appliances PAM user accounts PAM user groups PAM assets PAM asset groups PAM asset accounts PAM directory accounts PAM account groups PAM directories PAM partitions PAM entitlements PAM access request policies Reports about PAM objects
PAM access requests Handling of PAM objects in the Web Portal Basic data for managing a Privileged Account Management system Configuration parameters for managing a Privileged Account Management system Default project template for One Identity Safeguard Editing One Identity Safeguard system objects One Identity Safeguard connector settings Known issues about connecting One Identity Safeguard appliances

Preparing the administrative workstation for access to the One Identity Safeguard appliance

To configure synchronization with a Synchronization Editor appliance in One Identity Safeguard, One Identity Manager must load the data directly from the appliance. If the appliance is accessed directly from the work station on which the Synchronization Editor is installed, the following software must also be installed on this workstation:

  • PowerShell version 5 or later

  • PowerShell Module safeguard-ps

In the certificate store of the user logged on to the administrative workstation, the user account requires the certificate with the private key that is saved on the One Identity Safeguard appliance as a trusted certificate. The certificate must be the same certificate used by the synchronization user. For more information about certificates in One Identity Safeguard, see the One Identity Safeguard Administration Guide.

If direct access from the workstation to the appliance is not possible, you can set up a remote connection.

Related topics

Preparing a remote connection server for access to the One Identity Safeguard appliance

To configure synchronization with a target system, One Identity Manager must load the data from the target system. One Identity Manager communicates directly with the target system to do this. Sometimes direct access from the workstation, on which the Synchronization Editor is installed, is not possible. For example, because of the firewall configuration or the workstation does not fulfill the necessary hardware and software requirements. If direct access is not possible from the workstation, you can set up a remote connection.

Remote connection server configuration:

  • One Identity Manager Service is started

  • RemoteConnectPlugin is installed and an authentication method is set up

  • PowerShell version 5 or above is installed

  • PowerShell module safeguard-ps is installed

  • One Identity Safeguard connector is installed

The remote connection server must be declared as a Job server in One Identity Manager. The Job server name is required.

TIP: The remote connection server requires the same configuration as the synchronization server (with regard to the installed software and entitlements and user account certificate). Use the synchronization server as remote connection server as well by installing the RemoteConnectPlugin.

For more detailed information about setting up a remote connection, see the One Identity Manager Target System Synchronization Reference Guide.

Related topics

Creating a synchronization project for initial synchronization of a One Identity Safeguard appliance

Use the Synchronization Editor to configure synchronization between the One Identity Manager database and a One Identity Safeguard appliance. The following describes the steps for initial configuration of a synchronization project. For more information about setting up synchronization, see the One Identity Manager Target System Synchronization Reference Guide.

After the initial configuration, you can customize and configure workflows within the synchronization project. Use the workflow wizard in the Synchronization Editor for this. The Synchronization Editor also provides different configuration options for a synchronization project.

Related topics

Information required for setting up a synchronization project

Have the following information available for setting up a synchronization project.

Table 4: Information required for setting up a synchronization project

Data

Explanation

Appliance hostname or IP

Host name or IP address of the One Identity Safeguard appliance. If you use a cluster of multiple One Identity Safeguard appliances, enter the primary appliance here.

NOTE: This value must be adjusted if the primary appliance changes in the cluster. If the Always connect to the primary cluster node option is set in the system connection wizard, the primary appliance is calculated automatically.

Trusted certificate thumbprint

Thumbprint of the trusted certificate that is used by the synchronization user and the user account of the One Identity Manager Service.

For more information, see Users and permissions for synchronizing with a One Identity Safeguard appliance.

Synchronization server for the appliance

All One Identity Manager Service actions are run against the target system environment on the synchronization server. Data entries required for synchronization and administration with the One Identity Manager database are processed by the synchronization server.

The One Identity Manager Service with the One Identity Safeguard connector must be installed on the synchronization server.

The synchronization server must be declared as a Job server in One Identity Manager. Use the following properties when you set up the Job server.

  • Server function: One Identity Safeguard connector

  • Machine role: Server | Job Server | Privileged Account Management

For more information, see Setting up the One Identity Safeguard synchronization server.

One Identity Manager database connection data

  • Database server

  • Database name

  • SQL Server login and password

  • Specifies whether integrated Windows authentication is used

    Use of the integrated Windows authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.

Remote connection server

For more information, see Preparing a remote connection server for access to the One Identity Safeguard appliance.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating