| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
Step 1 – Create an account store in EmpowerID
From the navbar of the EmpowerID Web interface, expand Admin > Applications and Directories and select Account Stores and Systems.
Select the Actions tab and then click Create Account Store.
Insert excerpt IL:Common Images IL:Common Images name CreateAccountStoreAction nopanel true
This opens the System Types look up.Insert excerpt IL:Common Images IL:Common Images name SystemTypesLookup nopanel true Search for SCIM Connector.
Click the SCIM Connector record to select it, and then click Submit.
This opens the SCIM connector form.
Enter the following information in the SCIM connector form:
Name – Name of the connector
Base URL – URL for the site hosting the SCIM microservice. For example, enter the URL for the app service if the microservice is hosted in an Azure app service.
Client Secret – If using OAuth authentication, enter the Client Secret for the app.
Client ID – If using OAuth authentication, enter the Client ID for the app.
Certificate – If using certificate-based authentication, enter the thumbprint of the certificate.
When ready, click Submit.
Step 2 – Verify resource system parameters
Navigate to the Find Account Store page (Admin > Applications and Directories > Account Stores and Systems) and search for the SCIM account store you just created.
Click the Account Store link to navigate to the details page for the account store.
Click the Resource System tab and then expand the Configuration Parameters accordion.
The accordion contains the following parameters, some of which may not pertain to your specific implementation.
Insert excerpt IL:SCIM Connector Resource System Config Parameters IL:SCIM Connector Resource System Config Parameters nopanel true Edit the parameters as needed. To do so, click the Edit button for the parameter to be updated, as shown below.
Enter the appropriate value for the parameter in the Value field and click Save.
Repeat for each parameter that needs to be updated.
Step 2 – Configure attribute flow
| Tip |
|---|
EmpowerID supports the configuration of attribute synchronization rules for flowing attribute changes between directories and the EmpowerID Identity Warehouse. Attribute Flow rules are visually configured and are always relative to the relationship between an attribute in a directory and the corresponding attribute in the EmpowerID Identity Warehouse. Attribute Flow rules define the specific fields and attributes that are synchronized between the EmpowerID Identity Warehouse person objects and the external user accounts to which they are linked. Additionally, Attribute Flow rules can be weighted by account store. For example, if you have connected EmpowerID to an HR system as well as Active Directory, and you want any changes made to an attribute in the HR system to take priority over changes made in Active Directory or EmpowerID (while allowing changes to be made in any system), you would give a higher score for each CRUD operation originating from the HR account store and correspondingly lower scores for the Active Directory account store. The following flow rules are available:
The following CRUD operations are available:
|
– When this option is selected, changes made within EmpowerID update the native system and vice-versa. For most attributes, this is the default setting.On the Account Store Details page for the SCIM app account store, select the Attribute Flow Rules tab.
To change the flow for an attribute, click the Attribute Flow drop-down located between the Person Attribute column and the External Directory Attribute column, and select the desired flow direction from the context menu.
To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.
| Info |
|---|
EmpowerID only considers scores for attribute CRUD operations when multiple account stores with the same user records are connected to EmpowerID, such as would be the case if an HR System and this account store were being inventoried by EmpowerID. |
Now that the attribute flow has been set, the next steps include configuring the account store and enabling EmpowerID to inventory it.
Step 3 – Configure account store settings
On the Account Store and Resource System page, click the Account Store tab and then click the pencil icon to put the account store in edit mode.
This opens the edit page for the account store. This page allows you to specify how you want EmpowerID to handle the user information it discovers during inventory. Settings that can be edited are described in the below table.Insert excerpt IL:Account Store Settings 22 IL:Account Store Settings 22 nopanel true Edit the account store as needed and then click Save to save your changes.
Next, enable the Account Inbox permanent workflow to allow the Account Inbox to provision or join the user accounts in ServiceNow to EmpowerID Persons as demonstrated below.
| Tip |
|---|
EmpowerID recommends using the Account Inbox for provisioning and joining. |
Step 4 – Enable the Account Inbox Permanent Workflow
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
Step 5 – Monitor Inventory
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
| Div | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
IN THIS ARTICLE
|
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|