立即与支持人员聊天
与支持团队交流

Identity Manager 8.2.1 - Web Application Configuration Guide

Configuring requesting by reference users

Web Portal users can request products that have a specific identity. This is called requesting by reference user.

Required configuration key:

  • Products can be requested through reference user (VI_ITShop_ProductSelectionByReferenceUser ): Enables or disables the "By reference user" function in the Web Portal.

To configure requesting by reference user

  1. Log in to the Administration Portal (see Logging in to the Administration Portal).

  2. In the navigation, click Configuration.

  3. On the Configuration page, in the Show configuration for the following API project menu, select the API project for which you want to set up requesting by reference users.

  4. Expand the Products can be requested through reference user configuration key.

  5. Perform one of the following actions:

    • To enable the "By reference user" function, select the Products can be requested through reference user check box.

    • To disable the "By reference user" function, clear the Products can be requested through reference user check box.

  6. Click Apply.

  7. Perform one of the following actions:

    • If you want to apply the changes locally only, click Apply locally.

    • If you want to apply the changes globally, click Apply globally.

  8. Click Apply.

Configuring self-registration of new users

In the Password Reset Portal, users who are not yet registered have the option to register themselves to use the Web Portal and to create new accounts. Users who self-register, receive a verification email with a link to a verification page. On this page, users can complete registration themselves and then set their initial login password.

NOTE: To user this functionality, new users must supply an email address, otherwise the verification email cannot be sent.

NOTE: For more information about self-registration of new users in the Web Portal and associated attestation process, see the One Identity Manager Attestation Administration Guide.

To configure self-registration

  1. Start the Designer program.

  2. Connect to the relevant database.

  3. Configure the following configuration parameters:

    NOTE: For more information about editing configuration parameters in the Designer, see the One Identity Manager Configuration Guide.

    • QER | WebPortal | PasswordResetURL: Specify the Password Reset Portal's web address. This URL is used, for example, in the email notification to new users.

    • QER | Attestation | MailTemplateIdents | NewExternalUserVerification:

      By default, the verification message and link is sent with the Attestation - new external user verification link mail template.

      To use another template for this notification, change the value in the configuration parameter.

      TIP: In the Designer, you can configure the current mail template in the Mail templates > Person category. For more information about mail templates, see the One Identity Manager Operational Guide.

    • QER | Attestation | ApproveNewExternalUsers: Specify whether self-registered users must be attested before they are activated. A manager then decides whether to approve the new user's registration.

    • QER | Attestation | NewExternalUserTimeoutInHours: For new self-registered users, specify the duration of the verification link in hours.

    • QER | Attestation | NewExternalUserFinalTimeoutInHours: Specify the duration in hours, within which self-registration must be successfully completed.

  4. Assign at least one identity to the Identity & Access Governance | Attestation | Attestor for external users application role.

  5. Connect to the relevant API Server.

  6. In the API Server's installation directory, open the web.config file.

  7. (Optional) If the file is encrypted, decrypt the file.

  8. In the <connectionStrings> section, add the following entry:

    <add name="QER\Person\PasswordResetAuthenticator\ApplicationToken" connectionString="<application token>" />

    <Application token> is the application token that was set when the API Server was installed.

  9. In the <connectionStrings> section, add the following entry:

    <add name="sub:register" connectionString="Module=DialogUser;User=<USER>;(Password)Password=<PASSWORD/>

    • <USER> is the user's login name for creating new user accounts.

    • <PASSWORD> stands for the user's password.

  10. Save your changes to the file.

  11. (Optional) Encrypt the file.

Multi-factor authentication

Multi-factor authentication guarantees better security for logging into web applications. One Identity Manager tools use Starling Two-Factor Authentication for multi-factor authentication.

The following prerequisites must be fulfilled to use Starling Two-Factor Authentication:

  • Users must have a registered Starling 2FA token.
  • Use of an employee-related authentication module, for example "Person (role-based)"

Starling Two-Factor Authentication takes place after initial database login and is independent of it. At web application level, every access attempt is prevented until Starling Two-Factor Authentication has been completed.

Configuring multi-factor authentication

You can configure multi-factor authentication for web applications.

Required configuration key:

  • Multi-factor authentication(MfaAuthenticationProvider): Defines which multi-factor authentication is used.

To set up multi-factor authentication

  1. Log in to the Administration Portal (see Logging in to the Administration Portal).

  2. In the navigation, click Configuration.

  3. On the Configuration page, in the Show configuration for the following API project menu list, select the API project for which you want to set up multi-factor authentication.

  4. Expand the Multi-factor Authentication configuration key.

  5. In the menu, select the authentication module you want to use.

  6. Click Apply.

  7. Perform one of the following actions:

    • If you want to apply the changes locally only, click Apply locally.

    • If you want to apply the changes globally, click Apply globally.

  8. Click Apply.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级