立即与支持人员聊天
与支持团队交流

Identity Manager 8.2 - Authorization and Authentication Guide

About this guide One Identity Manager application roles Granting One Identity Manager schema permissions through permissions groups Managing permissions to program features One Identity Manager authentication modules OAuth 2.0 / OpenID Connect configuration Multi-factor authentication in One Identity Manager Authenticating other applications using OAuth 2.0/OpenID Connect Granular permissions for the SQL Server and database Installing One Identity Redistributable STS Program functions for starting the One Identity Manager tools Minimum access levels of One Identity Manager tools

Installing One Identity Redistributable STS

The Redistributable STS (RSTS) is a Secure Token Server component service designed to provide user authentication using standard federation protocols such as WS-Federation and OAuth 2.0. One Identity Manager uses the RSTS for authentication to web applications with Webauthn and OAuth 2.0.

For detailed information about the Webauthn configuration, see the One Identity Manager Web Application Configuration Guide.

To install the RSTS

  1. Launch autorun.exe from the root directory of the One Identity Manager installation medium.

  2. Switch to the Other products tab

  3. Select One Identity Redistributable STS and click Install.

  4. On the start page of the installation wizard, click Next.

  5. On the Select database page, select the One Identity Manager database connection. Select a user who has a minimum of administrative permissions for the database.

  6. On the Installation settings page, enter the required information.

  7. On the Installation page you can see the installation progress. When the installation has finished, click Next.

  8. Click Finish to close the installation wizard.

Related topics

Program functions for starting the One Identity Manager tools

The One Identity Manager tools can only be started if the user has the relevant program function permissions. The following program functions allow the One Identity Manager tools to be started.

To make the program function available to users

  • In the Designer under the Permissions > Program functions category, check which permissions group contains the required program function and assign the program functions to other permissions groups as necessary.

  • For non role-based login: Add the system user to the permissions group in the Designer under Permissions > System users.

  • For role-based logins: Ensure that the user is assigned to the application role that owns the program function through its permissions group.

Table 42: Program functions for starting the One Identity Manager tools

Program function

Description

ApplicationStart_Analyzer

Allows the program Analyzer (Analyzer.exe) to be started.

ApplicationStart_ApiDesigner

Allows the program API Designer (ApiDesigner.exe) to be started.

ApplicationStart_ConfigWizard

Allows the program Configuration Wizard (ConfigWizard.exe) to be started.

ApplicationStart_CryptoConfig

Allows the program Crypto Configuration (CryptoConfig.exe) to be started.

ApplicationStart_DataImporter

Allows the program Data Import (DataImporter.exe) to be started.

ApplicationStart_DBClone

Allows the program (DBClone.exe) to be started.

ApplicationStart_DBComparer

Allows the program (DBComparer.exe) to be started.

ApplicationStart_DBCompiler

Allows the program Database Compiler (DBCompiler.exe) to be started.

ApplicationStart_Designer

Allows the program Designer (Designer.exe) to be started.

ApplicationStart_JobQueueInfo

Allows the program Job Queue Info (JobQueueInfo.exe) to be started.

ApplicationStart_LaunchPad

Allows the program Launchpad (LaunchPad.exe) to be started.

ApplicationStart_LicenseMeter

Allows the program License Meter (LicenseMeter.exe) to be started.

ApplicationStart_Manager

Allows the program Manager (Manager.exe) to be started.

ApplicationStart_ObjectBrowser

Allows the program Object Browser (ObjectBrowser.exe) to be started.

ApplicationStart_OpSupport

Enables start-up of the Operations Support Web Portal.

ApplicationStart_ReportEdit

Allows the program Report Editor (ReportEdit2.exe) to be started.

ApplicationStart_SchemaExtension

Allows the program Schema Extension (SchemaExtension.exe) to be started.

ApplicationStart_ServerInstaller

Allows the program Server Installer (ServerInstaller.exe) to be started.

ApplicationStart_SoftwareLoader

Allows the program Software Loader (SoftwareLoader.exe) to be started.

ApplicationStart_SynchronizationEditor

Allows the program Synchronization Editor (SynchronizationEditor.exe) to be started.

ApplicationStart_SystemDebugger

Allows the program System Debugging (SystemDebugger.exe) to be started.

ApplicationStart_Transporter

Allows the program Database Transporter (Transporter.exe) to be started.

ApplicationStart_WebDesignerCompiler

Allows the program (VI.WebDesigner.CompilerCmd.exe) to be started.

ApplicationStart_WebConfig

Allows the program Web Designer Configuration Editor (WebConfigEditor.exe) to be started.

ApplicationStart_WebDesigner

Allows the program Web Designer (WebDesigner.exe) to be started.

ApplicationStart_WebDesignerInstall

Allows the program Web Installer (WebDesigner.Installer.exe) to be started.

Related topics

Minimum access levels of One Identity Manager tools

NOTE:

  • Connections that do not use the expected access level for SQL Server logins are not shown in the connection dialog.

  • If you select an existing database connection in the connections dialog, the access level of the login to be used is shown in a tooltip.

You require the following minimum access level for One Identity Manager tools.

Table 43: Access level for One Identity Manager tools
Tool Minimum access level

Analyzer

End user

Application server

End user or configuration user (depending on the application server's task)

AppServer.Installer.CMD.exe

Configuration user

API Designer

Configuration user

API Server

End user

Configuration Wizard

Administrative user

Crypto Configuration

Configuration user

Data Import

End user

Configuration user (saves import definition)

DataImporterCMD.exe

End user

Database Compiler

Configuration user

DBCompilerCMD.exe

Configuration user

Database Transporter

Configuration user

DBTransporterCMD.exe

Administrative user

DBClone

Administrative user

DBComparer

Configuration user

Designer

Configuration user

Some consistency checks require the administrative user access level.

Job Queue Info

Configuration user

Launchpad

End user

Some application that are started from the Launchpad, required different access levels

License Meter

End user

Manager

End user

Some functions require configuration user access levels, for example, opening synchronization projects for target systems. Some consistency checks require the configuration user or administrative user access level.

HistoryDB Manager

End user

Object Browser

End user

One Identity Manager Service

Configuration users for process collection with the MSSQLJobProvider

Report Editor

Configuration user

Schema Extension

Configuration user

SchemaExtensionCmd.exe

Configuration user

Server Installer

Configuration user

Software Loader

Configuration user

SoftwareLoaderCMD.exe

Configuration user

Synchronization Editor

Configuration user

System Debugger

Configuration user

Web Designer

Configuration user

Web Designer Configuration Editor

Configuration user

VI.WebDesigner.CompilerCmd.exe

Configuration user

WebDesigner.InstallerCMD.exe

Configuration user

Web Portal

End user

Password Reset Portal

End user

Operations Support Web Portal

End user

Quantum.MigratorCmd.exe

Administrative user

Related topics
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级