Chat now with support
Chat with Support

Identity Manager 9.2 - Authorization and Authentication Guide

About this guide One Identity Manager application roles Granting One Identity Manager schema permissions through permissions groups Managing permissions to program functions One Identity Manager authentication modules OAuth 2.0/OpenID Connect authentication Multi-factor authentication in One Identity Manager Granular permissions for the SQL Server and database Installing One Identity Redistributable Secure Token Server Preventing blind SQL injection Program functions for starting the One Identity Manager tools Minimum access levels of One Identity Manager tools

Example of a system user assignment using a selection criterion

The scenario described in the previous example is extended such that only the cost center manager can see an identity’s leaving date. You need to add the input field LeavingDate to the contact data form to do this.

Permissions are used for controlling viewing and editing. Set up a new dlg_kst system user and include the system user in the vi_DE-CentralPwd, vi_DE-ITShopOrder and WebShop_Customer_Grp permissions groups. You should also give the system user read and write permissions to the Person.Exitdate column.

Extend the application configuration data in such a way that the cost center managers use the dlg_kst system user to log in. All other identities use the dlg_all system user to log in.

Change the configuration data as follows:

<DialogUserDetect>

<Usermappings>

<Usermapping

DialogUser = "dlg_kst"

Selection = "select 1 where %uid% in (select uid_personhead from profitcenter)"

/>

<Usermapping

DialogUser = "dlg_all"

/>

</Usermappings>

</DialogUserDetect>

Related topics

Example of a function group assignment

To assign function groups to permissions groups you have to define two database views. The first database view shows the assignment of identities to function groups. The database view contains two columns, UID_Person and FunctionGroup.

Example:

create view custom_Person2Fu as

select uid_personHead as UID_Person, 'Cost center manager' as FunctionGroup

from Profitcenter

where isnull(uid_personHead, '') > ' '

union all

select uid_personHead, 'Department manager' as FunctionGroup

from Department

where isnull(uid_personHead, '') > ' '

The second database view assigns function groups to permissions groups. This database view contains two columns, FunctionGroup and DialogGroup.

Example:

create view custom_Fu2D as

select 'Cost center manager' as FunctionGroup, '<UID_Custom_Dialoggroup_ChefP>' as DialogGroup

union all select 'Department manager', '<UID_Custom_Dialoggroup_ChefD>'as DialogGroup

Set up role-based permissions groups with the required permissions.

TIP: A role-based permissions group can inherit from a non role-based permissions group. This allows you to build up an inheritance hierarchy to making it easier to grant permissions.

Change the configuration data for assigning function groups to permissions groups as follows:

<DialogUserDetect>

<FunctionGroupMapping

PersonToFunction = "custom_Person2Fu"

FunctionToGroup = "custom_Fu2D"

/>

</DialogUserDetect>

Related topics

Checking authentication

When a user logs in, a validity check is run. Use the settings to configure additional options.

  • The system runs additional validity checks to prevent users from working with established connections, if they were deactivated after they logged in. The check takes place with next action on the connection after a fixed interval of 20 minutes.

    You can adjust the interval in the Common | Authentication | CheckInterval configuration parameter. In the Designer, edit the configuration parameter.

  • The number of session that a user can open within a short time is limited to 10 session a minute.

    If this number is exceeded, the user is sent an error message.

    You have logged in too often in the last minute. Please wait a moment before you log in again.

    This check is done for each front-end if the login is local. If the login is on the application server, it is checked for each application server.

    You can modify the number of sessions in the Common | Authentication | SessionsPerUserAndMinute configuration parameter. In the Designer, edit the configuration parameter.

  • Use the QBM | AppServer | SessionTimeout configuration parameter to add the timeout in hours, after which inactive application server sessions are closed. The default value is 24 hours. In the Designer, edit the configuration parameter.

OAuth 2.0/OpenID Connect authentication

The OAuth2.0/OpenID Connect and OAuth2.0/OpenID Connect (role-based) authentication modules support the authorization code flow for OAuth 2.0 and OpenID Connect. For more information about the authorization code flow, see, for example, the OAuth Specification or the OpenID Connect Specification.

To use OAuth2.0/OpenID Connect authentication

  • In the Designer, create the identity provider and the OAuth2.0/OpenID Connect applications for the identity provider. A wizard is available in the Designer to assist in this process.

  • Assign the OAuth2.0/OpenID Connect application to the web applications.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating