Chat now with support
Chat with Support

Identity Manager 9.2 - Administration Guide for Active Roles Integration

One Identity Active Roles integration Synchronizing Active Directory using One Identity Active Roles Interaction with Active Roles workflows Interaction with Active Roles policies Managing Active Directory objects Configuration parameters for managing an Active Directory environment Default project template for One Identity Active Roles Active Roles connector settings

Configuration parameters for managing an Active Directory environment

The following configuration parameters are available in One Identity Manager after the Active Directory Module and the Active Roles Module have been installed.

Table 10: Configuration parameters
Configuration parameters Description

QER | ITShop | AutoPublish | ADSGroup

Preprocessor relevant configuration parameter for automatically adding Active Directory groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are no longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

QER | ITShop | AutoPublish | ADSGroup | AutoFillDisplayName

The configuration parameter specifies whether the template should be applied to the ADSGroup.DisplayName column.

QER | ITShop | AutoPublish | ADSGroup | ExcludeList

List of all Active Directory groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

TargetSystem | ADS

Preprocessor relevant configuration parameter for controlling database model components for Active Directory target system administration. If the parameter is set, the target system components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are no longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | ADS | Accounts

Allows configuration of user account data.

TargetSystem | ADS | Accounts | InitialRandomPassword

Specifies whether a random password is generated when a new user account is added. The password must contain at least those character sets that are defined in the password policy.

TargetSystem | ADS | Accounts | InitialRandomPassword | SendTo

Identity to receive an email with the random generated password (manager cost center/department/location/business role, identity’s manager or XUserInserted). If no recipient can be found, the password is sent to the address stored in the configuration parameter TargetSystem | ADS | DefaultAddress.

TargetSystem | ADS | Accounts | InitialRandomPassword | SendTo | MailTemplateAccountName

Mail template name that is sent to supply users with the login credentials for the user account. The Identity - new user account created mail template is used.

TargetSystem | ADS | Accounts | InitialRandomPassword | SendTo | MailTemplatePassword

Mail template name that is sent to supply users with the initial password. The Identity - initial password for new user account mail template is used.

TargetSystem | ADS | Accounts | MailTemplateDefaultValues

Mail template used to send notifications about whether default IT operating data mapping values are used for automatically creating a user account. The Identity - new user account with default properties created mail template is used.

TargetSystem | ADS | Accounts | NotRequirePassword

Specifies whether a password is required when creating new Active Directory user accounts in One Identity Manager. If the configuration parameter is not set, entry of a password that meets the defined password guidelines is requested when a new Active Directory user account is created. If the configuration parameter is set, it is not necessary to specify a password when creating new Active Directory user accounts.

TargetSystem | ADS | Accounts | PrivilegedAccount

Allows configuration of privileged Active Directory user account settings.

TargetSystem | ADS | Accounts |
PrivilegedAccount | SAMAccountName_Postfix

Postfix for formatting the login name of privileged user accounts.

TargetSystem | ADS | Accounts | PrivilegedAccount |
SAMAccountName_Prefix

Prefix for formatting a login name of privileged user accounts.

TargetSystem | ADS | Accounts | ProfileFixedString

Fixed string appended to the default profile path of a user profile.

TargetSystem | ADS | Accounts | TransferJPegPhoto

Specifies whether changes to the identity's picture are published in existing user accounts. The picture is not part of default synchronization. It is only published when an identity's main data is changed.

TargetSystem | ADS | Accounts | TransferSIDHistory

Specifies whether the SID history is loaded from the target system.

TargetSystem | ADS | Accounts | TSProfileFixedString

Fixed string appended to the default profile path of a user profile on a terminal server.

TargetSystem | ADS | Accounts | UnlockByCentralPassword

Specifies whether the identity's Active Directory user account is unlocked when the central password is synchronized.

TargetSystem | ADS | Accounts | UserMustChangePassword

Specifies whether the Change password at next login option is enabled when a new user account is created.

TargetSystem | ADS | ARS

Preprocessor relevant configuration parameter to control the database model components for supporting Active Roles. If the parameter is set, Self-Service Management components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are no longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | ADS | ARS_SSM

Preprocessor relevant configuration parameter for controlling the database model components for One Identity Active Roles Self-Service Manager in the One Identity Manager IT Shop. If the parameter is set, Self-Service Management components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are no longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | ADS | AuthenticationDomains

Pipe (|) delimited list of domains to be used by the manual Active Directory authentication module to authenticate users. The list is processed in the given order. This list should only contain domains to be synchronized.

Example:

MyDomain|MyOtherDomain

For more information about One Identity Manager authentication modules, see the One Identity Manager Authorization and Authentication Guide.

TargetSystem | ADS | AutoCreateDepartment

Specifies whether departments are automatically created when user accounts are modified or synchronized.

TargetSystem | ADS | AutoCreateLocality

Specifies whether locations are automatically created when user accounts are modified or synchronized.

TargetSystem | ADS | AutoCreateHardwaretype

Specifies whether corresponding device types are created automatically in the database for imported printer objects.

TargetSystem | ADS | AutoCreateServers

Specifies whether entries for missing home servers and profile servers are created automatically when user accounts are synchronized.

TargetSystem | ADS | AutoCreateServers | PreferredLanguage

Language of automatically created servers.

TargetSystem | ADS | DefaultAddress

Default email address of the recipient for notifications about actions in the target system.

TargetSystem | ADS | HardwareInGroupFromOrg

Specifies whether computers are added to groups based on group assignment to roles.

TargetSystem | ADS | MaxFullsyncDuration

Maximum runtime of a synchronization in minutes. No recalculation of group memberships by the DBQueue Processor can take place during this time. If the maximum runtime is exceeded, group membership are recalculated.

TargetSystem | ADS | MembershipAssignCheck

Specifies whether membership validity is verified on saving when group memberships are assigned in the One Identity Manager database.

Disable this configuration parameter if several trusted domains with access across memberships are managed in the database.

TargetSystem | ADS | MemberShipRestriction

General configuration parameter for restricting membership in Active Directory.

TargetSystem | ADS | MemberShipRestriction | Container

Number of Active Directory objects allowed per container before warning email is sent.

TargetSystem | ADS | MemberShipRestriction | Group

Number of Active Directory objects allowed per group before warning email is sent.

TargetSystem | ADS | MemberShipRestriction | MailNotification

Default mail address for sending warning emails.

TargetSystem | ADS | PersonAutoDefault

Mode for automatic identity assignment for user accounts added to the database outside synchronization.

TargetSystem | ADS | PersonAutoDisabledAccounts

Specifies whether identities are automatically assigned to disabled user accounts. User accounts are not given an account definition.

TargetSystem | ADS | PersonAutoFullSync

Mode for automatic identity assignment for user accounts that are added to or updated in the database by synchronization.

TargetSystem | ADS | PersonExcludeList

Listing of all user account without automatic identity assignment. Names are listed in a pipe (|) delimited list that is handled as a regular search pattern.

Example:

ADMINISTRATOR|GUEST|KRBTGT|TSINTERNETUSER|IUSR_.*|IWAM_.*|SUPPORT_.*|.* | $

TargetSystem | ADS | PersonUpdate

Specifies whether identities are updated if their user accounts are changed. This configuration parameter is set to allow ongoing update of identities from associated user accounts.

TargetSystem | ADS | ReplicateImmediately

Speeds up synchronization of modifications between two domain controllers When set, the accumulated modifications in Active Directory are immediately replicated between domain controllers.

Default project template for One Identity Active Roles

A default project template ensures that all required information is added in One Identity Manager. This includes mappings, workflows, and the synchronization base object. If you do not use a default project template you must declare the synchronization base object in One Identity Manager yourself.

Use a default project template for initially setting up the synchronization project. For custom implementations, you can extend the synchronization project with the Synchronization Editor.

The project template uses mappings for the following schema types.

Table 11: Schema type mapping

Schema type in Active Roles

Table in the One Identity Manager Schema

builtInDomain

ADSContainer

computer

ADSMachine

contact

ADSContact

container

ADSContainer

domainDNS

ADSDomain

group

ADSGroup

inetOrgPerson

ADSAccount

msDS-PasswordSettings

ADSPolicy

msExchSystemObjectsContainer

ADSContainer

organization

ADSContainer

organizationalUnit

ADSContainer

printQueue

ADSPrinter

rpcContainer

ADSContainer

user

ADSAccount

Active Roles connector settings

The following settings are configured for the system connection with the Active Roles connector.

Table 12: Active Roles connector settings

Setting

Meaning

Domain

Full domain name.

Variable: CP_Rootdn

User account

User for logging in to Active Roles

Variable: CP_User

Password

The user account’s password.

Variable: CP_Password

DNS name or IP address of the Active Roles server.

DNS name or IP address of the Active Roles server that connects against the synchronization server.

Example:

<Name of servers>.<Fully qualified domain name>

Variable: CP_Server

Reason for workflows

Reason that is entered when the workflows are running.

Variable: DefaultWorkflowReason

Run Active Roles workflows

Specifies whether to run Active Roles workflows.

If the value is False , no Active Roles workflows are run. The user account requires permissions as in Permissions required for synchronizing with One Identity Active Roles.

If the value is true, the connector will attempt to run the Active Roles workflows associated with the operation. This works only if the connection account is not a member of the Active Roles administrators group.

Default: False

Variable: RunArsWorkflowsByDefault

ForestName

Name of the domain forest.

Variable: ForestName

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating