IAM Shop. |
Authentication and Password Settings |
Use for Authentication | Specifies whether user credentials in the external system can be used to authenticate to EmpowerID. |
Allow Search for User Name in Authentication | This setting works in conjunction with pass-through authentication to allow users to log in without specifying a domain name. When this is enabled, EmpowerID first checks to see if the username entered exists within its Identity Warehouse and if so attempts to authenticate as that user. If a matching logon name exists but the login fails, EmpowerID then searches through all Accounts Stores where simple username search is enabled to find the correct username and password combination. |
Allow Password Sync | Enables or disables the synchronization of password changes to user accounts in the domain based on password changes for the owning person object or another account owned by the person. This setting does not prevent password changes by users running the reset user account password workflows. |
Queue Password Changes | Specifies whether EmpowerID sends password changes to the Account Password Reset Inbox for batch processing. |
Password Manager Policy for Accounts without Person | Specifies the Password Manager Policy to be used for user accounts not joined to an EmpowerID Person. |
Provisioning Settings |
Allow Person Provisioning (Joiner Source) | Specifies whether EmpowerID Persons can be provisioned from user accounts in the account store. |
Allow Attribute Flow | Specifies whether attribute changes should flow between EmpowerID and the account store. |
Allow Provisioning (By RET) | Allows or disallows the Resource Entitlement (RET) Inbox process to auto-provision accounts for this domain for users who receive RET policy-assigned user accounts, but have not yet had them provisioned. |
Allow Deprovisioning (By RET) | Allows or disallows the Resource Entitlement Inbox process to auto de-provision accounts for this domain for users who still have RET policy-assigned user accounts, but no longer receive a policy that grants them a user account in the domain. De-provisioning only occurs if the de-provision action on the Resource Entitlement policy is set to De-Provision. |
Max Accounts per Person | This specifies the maximum number of user accounts from this domain that an EmpowerID Person can have linked to them. This prevents the possibility of a runaway error caused by a wrongly configured Join rule. It is recommended that this value be set to 1 unless users will have more than 1 account and you wish them to be joined to the same person. |
Business Role Settings |
Allow Business Role and Location Re-Evaluation | Specifies whether Business Role and Location re-evaluation should occur for the account store |
Business Role and Location Re-Evaluation Order | Specifies the order of the account store for re-evaluating Business Roles and locations |
Inventory Auto Provision OUs as IT System Locations | Specifies whether EmpowerID should automatically provision external OUs as IT System locations |
Inventory Auto Provision External Roles as Business Roles | Specifies whether EmpowerID should provision Business roles for external account store roles |
Default Person Business Role | Specifies the default EmpowerID Business Role to be assigned to each EmpowerID Person provisioned from the user accounts in the account store. |
Default Person Location (leave blank to use account container) | Specifies the default EmpowerID Location to be assigned to each EmpowerID Person provisioned from the user accounts in the account store. |
Group Settings |
Allow Account Creation on Membership Request | Specifies whether EmpowerID creates user accounts in the account store when an EmpowerID Person without one requests membership within a group belonging to the account store. |
Recertify External Group |