立即与支持人员聊天
与支持团队交流

Identity Manager 8.2 - Administration Guide for Connecting to Active Directory

Managing Active Directory environments Synchronizing an Active Directory environment
Setting up initial synchronization with an Active Directory domain Adjusting the synchronization configuration for Active Directory environments Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization
Managing Active Directory user accounts and employees
Account definitions for Active Directory user accounts and Active Directory contacts Assigning employees automatically to Active Directory user accounts Supported user account types Updating employees when Active Directory user account are modified Automatic creation of departments and locations based on user account information Specifying deferred deletion for Active Directory user accounts and Active Directory contacts
Managing memberships in Active Directory groups Login information for Active Directory user accounts Mapping of Active Directory objects in One Identity Manager
Active Directory domains Active Directory container structures Active Directory user accounts Active Directory contacts Active Directory groups Active Directory computers Active Directory security IDs Active Directory printers Active Directory sites Reports about Active Directory objects
Handling of Active Directory objects in the Web Portal Basic data for managing an Active Directory environment Configuration parameters for managing an Active Directory environment Default project template for Active Directory Processing methods of Active Directory system objects Active Directory connector settings

General main data for Active Directory domains

Enter the following data on the General tab.

Table 23: Domain main data

Property

Description

Domain

NetBIOS domain name. This corresponds to the pre-Windows 2000 domain names. The domain name cannot be changed later.

Parent domain

Parent domain for mapping a hierarchical domain structure. The full name and the defined name are automatically updated through templates.

Domain subtype

Active Directory functional level. There are several features available in Active Directory at functional level. Refer to the documentation for the appropriate Windows to find out which functional levels are supported by the domain controller's Windows Server operating system to be implemented. Following functional levels are supported in One Identity Manager:

  • Windows Server 2003 native

  • Windows Server 2003 mixed

  • Windows Server 2008

  • Windows Server 2008 R2

  • Windows Server 2012

  • Windows Server 2012 R2

  • Windows Server 2016

Display name

The display name is used to display the domain in the user interface. This is preset with the domain NetBIOS name; however, the display name can be changed.

Account definition (initial)

Initial account definition for creating user accounts. This account definition is used if automatic assignment of employees to user accounts is used for this domain and if user accounts are to be created that are already managed (Linked configured). The account definition's default manage level is applied.

User accounts are only linked to the employee (Linked) if no account definition is given. This is the case on initial synchronization, for example.

Contact definition (initial)

Initial account definition for creating contacts. These account definitions are used if automatic assignment of employees to contacts is used for this domain, resulting in administered user accounts (Linked configured state). The account definition's default manage level is applied.

Contacts are only linked to the employee (Linked state) if no account definition is given. This is the case on initial synchronization, for example.

Target system managers

Application role in which target system managers are specified for the domain. Target system managers only edit the objects from domains that are assigned to them. Therefore, each domain can have a different target system manager assigned to it.

Select the One Identity Manager application role whose members are responsible for administration of this domain. Use the button to add a new application role.

Synchronized by

Type of synchronization through which the data is synchronized between the domain and One Identity Manager. You can no longer change the synchronization type once objects for these domains are present in One Identity Manager.

If you create a domain with the Synchronization Editor, One Identity Manager is used.

Table 24: Permitted values
Value Synchronization by Provisioned by

One Identity Manager

Active Directory connector

Active Directory connector

No synchronization

none

none

NOTE: If you select No synchronization, you can define custom processes to exchange data between One Identity Manager and the target system.

Description

Text field for additional explanation.

Related topics

Global account policies for Active Directory domains

When you set up a user account, globally defined account policies and data are applicable for issuing passwords. You can enter these setting against the domain. Account policies apply when user accounts are newly added.

On the Account policies tab, enter the following main data.

Table 25: Account policies for domains
Property Description

Minimum password length

Minimum length of the password. Use this option to specify that a password has to be complex.

NOTE: If, during synchronization, a more restrictive value for an Active Directory domain's global account policy is found than the one on the One Identity Manager password policy, this value is the one that will be applied to the domain's One Identity Manager password policy.

If this One Identity Manager password policy is used for other domains the value also applies to these domains.

Minimum password lifetime

Minimum age of the password. Enter the length of time a password has to be used before the user is allowed to change it.

Max. password age

Maximum age of the password. Enter the length of time a password can be used before it expires.

Max. errors

Maximum number of errors. Set the number of invalid passwords. If the user has reached this number the user account is blocked.

Password history

  • Enter the number of passwords to be saved. For example, if you enter the value 5, the last 5 passwords for the user are saved.

    NOTE: If, during synchronization, a more restrictive value for an Active Directory domain's global account policy is found than the one on the One Identity Manager password policy, this value is the one that will be applied to the domain's One Identity Manager password policy.

    If this One Identity Manager password policy is used for other domains the value also applies to these domains.

    • Block duration [min]

    Block duration in minutes. Enter the time period the account should be locked for before it is automatically reset.

    Reset account [min]

    Duration in minutes of account reset. Enter the time period that can elapse between two invalid attempts to enter a password before a user account is locked.

    For domains from the functional level Windows Server 2008 R2 and above, it is possible to define multiple policies. You can also define password policies in One Identity Manager that you can apply to the user account passwords.

    NOTE: One Identity Manager password policies, global account policy settings for the Active Directory domain, and Active Directory account policies are all taken into account when verifying user passwords.

    Related topics

    Active Directory specific main data for Active Directory domains

    Enter the following main data on the Active Directory tab.

    Table 26: Active Directory data
    Property Description

    Domain name (pre Win2000)

    Pre-Windows 2000 computer name.

    Full domain name

    Name of the domain confirming to DNS syntax.

    <name of this domain>.<name of parent domain>.<name of root domain>.

    Account manager

    Manager responsible for the domain.

    To specify an account manager

    1. Click next to the field.
    2. In the Table menu, select the table that maps the account manager.
    3. In the Account manager menu, select the manager.
    4. Click OK.

    Distinguished name

    Distinguished name of the domain. The distinguished name is determined using a template from the full domain name and cannot be edited.

    Forest

    The name of the forest to which the domain belongs. This name should be given if group memberships are mapped cross-domain.

    Enable recycling bin

    (As of functional level Windows Server 2008 R2) Specifies whether the recycling bin is enabled. The property is imported by the synchronization and should not be edited in One Identity Manager.

    Retention period

    (As of function level Windows Server 2008 R2) Retention period of objects in the recycling bin. The property is imported by the synchronization and should not be edited in One Identity Manager.

    Complex passwords

    Specifies whether complex passwords are implemented in the domain. Complex passwords must fulfill certain minimum prerequisites. For more information, see the documentation for implementing Windows Server.

    For domains from the functional levels Windows Server 2008 R2 and above, it is possible to define this setting using account policies.

    Default home drive

    Default home drive to be connected when a user logs in.

    Structural object class

    Structural object class representing the object type. By default, the domains in One Identity Manager are created using the object class DOMAINDNS.

    Object class

    List of classes defining the attributes for this object. The object classes listed are read in from the database during synchronization with the Active Directory environment. You can also enter object classes in to the input field.

    Related topics

    Defining categories for the inheritance of Active Directory groups

    Groups and be selectively inherited by user accounts and contacts in One Identity Manager. The groups and user accounts (contacts) are divided into categories in the process. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains tables that map the user accounts (contact) and the groups. Specify your categories for user account (contacts) in the table for user accounts (contacts). Enter your categories fro groups in the group table. Each table contains the Position 1 to Position 31 category positions.

    To define a category

    1. In the Manager, select the Active Directory > Domains category.

    2. Select the domain in the result list.

    3. Select the Change main data task.

    4. Select the Categories tab.

    5. Expand the root in the respective table.

    6. To enable the category, double-click .

    7. Enter a category name for user accounts, contacts, and groups in your login language.

    8. Save the changes.
    Detailed information about this topic
    相关文档

    The document was helpful.

    选择评级

    I easily found the information I needed.

    选择评级