Page Comparison

Insert excerpt

	IL:External Directory Prerequisites V21
	IL:External Directory Prerequisites V21
nopanel	true

Step 1 – Create an IBM Security Verify Access account store

On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.
On the Account Stores page, select the Actions tab and then click Create Account Store.
Under System Types, search for IBM Security.
Click the IBM Security Verify Access record to select the type and then click Submit.

This opens the IBM Security Verify Access Settings form, which is where you enter information that allows EmpowerID to connect to the system.
Image RemovedImage Added
On the IBM Security Verify Access Settings form, fill in the following information according to your authentication scenario:

Easy html macro

theme

{"label":"solarized_dark","value":"solarized_dark"}

contentByMode

{"html":"<doctype html></doctype>\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\n<div class =\"bd-example\">\n<div class=\"accordion\" id=\"accordionExample\">\n <div class=\"accordion-item\">\n <h2 class=\"accordion-header\" id=\"headingOne\">\n <button class=\"accordion-button\" type=\"button\" data-bs-toggle=\"collapse\" data-bs-target=\"#collapseOne\" aria-expanded=\"true\" aria-controls=\"collapseOne\">\n Using EmpowerID for Authentication\n </button>\n </h2>\n <div id=\"collapseOne\" class=\"accordion-collapse collapse show\" aria-labelledby=\"headingOne\" data-bs-parent=\"#accordionExample\">\n <div class=\"accordion-body\">\n <p>Use this option when hosting the microservice outside of Azure.</p>\n <ul>\n <li><b>Name</b> - Enter a name for your account store</li>\n <li><b>Base DN</b> - Enter the root OU of the LDAP system, such as, \n <code><mark>dc=example,dc=com</mark></code></li>\n <li><b>SCIM Base URL</b> - Enter the URL for the SCIM app service. The base URL should include the \n version and look similar to the following: <br /><code><mark>http://192.168.87.106:8080/empoweridisam/scim/v2/</mark></code></li>\n <li><b>Use EmpowerID Authentication</b> - Select this option when using EmpowerID for authentication</li>\n <li><b>OAuth Application GUID</b> - Enter the GUID of the OAuth application you created for IBM Security Verify Access in EmpowerID.</li>\n <li><b>URL For Access Token</b> - Enter the URL to your EmpowerID environment, such as <code><mark>https://sso.empoweriam.com</mark></code>, where <code><mark>sso.empoweriam.com</mark></code>\n is the FQDN of your EmpowerID front-end server.</li>\n <li><b>Is Remote (Requires Cloud Gateway)</b> - This setting appears for account stores with local directories, such as Active Directory, LDAP, SAP, etc. When enabled, this tells EmpowerID to use the Cloud Gateway Connection for that account store. The Cloud Gateway Connection must be installed on an on-premise machine. For installation information, \n please see <a href=\"https://dotnetworkflow.jira.com/wiki/spaces/EAGV21/pages/2276065995/Install+the+Cloud+Gateway+Client\">Installing the EmpowerID Cloud Gateway Client</a>.</li>\n <li><b>Check For Deleted Objects</b> - Select this option to sync deleted objects. If this is not set to true,\n the connector will not disable deleted objects.</li>\n <li><b>Check For Deleted Objects Interval Minutes</b> - Specify the interval in minutes that EmpowerID should check for deleted objects.</li>\n </ul>\n </div>\n </div>\n </div>\n <div class=\"accordion-item\">\n <h2 class=\"accordion-header\" id=\"headingTwo\">\n <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\" data-bs-target=\"#collapseTwo\" aria-expanded=\"false\" aria-controls=\"collapseTwo\">\n Using Azure AD for Authentication\n </button>\n </h2>\n <div id=\"collapseTwo\" class=\"accordion-collapse collapse\" aria-labelledby=\"headingTwo\" data-bs-parent=\"#accordionExample\">\n <div class=\"accordion-body\">\n <p>Use this option when hosting the microservice in Azure.</p>\n <ul>\n <li><b>Name</b> - Enter a name for your account store</li>\n <li><b>Base DN</b> - Enter the root OU of the LDAP system, such as, <code><mark>dc=example,dc=com</mark></code></li>\n <li><b>SCIM Base URL</b> - Enter the URL for the SCIM app service. The base URL should include the \n version and look similar to the following: <br /><code><mark>http://192.168.87.106:8080/empoweridisam/scim/v2/</mark></code></li>\n <li><b>Application ID</b> - Enter the Client ID of the service principal application you registered in Azure for EmpowerID.</li>\n <li><b>Tenant ID</b> - Enter the Tenant ID for your Azure tenant hosting the app service.</li>\n <li><b>Is Remote (Requires Cloud Gateway)</b> - This setting appears for account stores with local directories, such as Active Directory, LDAP, SAP, etc. When enabled, this tells EmpowerID to use the Cloud Gateway Connection for that account store. The Cloud Gateway Connection must be installed on an on-premise machine. For installation information, \n please see <a href=\"https://dotnetworkflow.jira.com/wiki/spaces/EAGV21/pages/2276065995/Install+the+Cloud+Gateway+Client\">Installing the EmpowerID Cloud Gateway Client</a>.</li>\n <li><b>Azure App Certificate Thumbprint</b> - Enter the thumbprint of the certificate you uploaded to Azure for the service principal application</li>\n <li><b>Check For Deleted Objects</b> - Select this option to sync deleted objects. If this is not set to true,\n the connector will not disable deleted objects.</li>\n <li><b>Check For Deleted Objects Interval Minutes</b> - Specify the interval in minutes that EmpowerID should check for deleted objects.</li>\n </ul>\n </div>\n </div>\n </div>\n </div>\n <br />\n <ol start=\"5\">\n <li>When ready, click <b>Submit</b>.</li>\n </ol>\n</div>","javascript":"","css":""}

EmpowerID creates the account store and the associated resource system. The next step is to verify the resource system parameters.

Step 2 – Verify Resource System Configuration Parameters

On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.
On the Find Account Store page, select the Account Stores tab and search for the IBM Security Verify Access account store you just created.
Click the Account Store link for the account store.
Image Added

This directs you to the Account Store and Resource System page for the account store. This page contains several tabs related to the account store that you can access to view and manage the account store and resource system.
Image Added
Select the Resource System tab and then expand the Configuration Parameters accordion on the page.
Image Added
Verify the following parameters are correct for your system:
Insert excerpt
IL:Resource System Config Parameters
IL:Resource System Config Parameters
name TAM
nopanel true
To edit the value of a parameter, click the Edit button for the parameter you want edit.
Image Added
Enter the new value in the Value field and click Save.
Repeat as needed.

The next step is to configure attribute flow.

Step 3 – Configure Attribute Flow

Insert excerpt

	IL:Configure Attribute Flow Rules-V21
	IL:Configure Attribute Flow Rules-V21
nopanel	true

Now that the attribute flow has been set, you can configure the mapping between the SCIM microservice attribute and the EmpowerID account/group/OU table attribute if needed. Please follow the steps below if this is the case. the next steps include configuring the account store and enabling EmpowerID to inventory it.

Step 4 – Schema Mapping (Optional)

On the navbar, expand Admin > Applications and Directories and select Manage Schema.
Select the Security Boundary Object Attributes tab and search for user as Object Type ID and IBMTAMScim as Security Boundary Type.
Image Added
Click the Edit button beside the Security Boundary Object Attribute you want to modify.
Image Added
Change the RBACObject Attribute you want to use in the mapping and save your change.
Image Added
Repeat for each mapping you want to change.

Step 4 – Configure account store settings

On the Account Store and Resource System page, select the Account Store tab and then click the pencil icon to put the account store in edit mode.
Image Added

This opens the edit page for the account store. This page allows you to specify the account proxy used to connect EmpowerID to your IBM Security Verify Access system as well as how you want EmpowerID to handle the user information it discovers during inventory. Settings that can be edited are described in the table below the image.
Image Added

Insert excerpt
IL:Account Store Settings (Non-AD) V21
IL:Account Store Settings (Non-AD) V21
nopanel true
Edit the account store as needed and then click Save to save your changes.

Div

style	float: left; position: fixed;

IN THIS ARTICLE

Table of Contents

maxLevel	4
minLevel	2
style	none

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

Versions Compared

Old Version 5

New Version Current

Key

Step 1 – Create an IBM Security Verify Access account store

Step 2 – Verify Resource System Configuration Parameters

Step 3 – Configure Attribute Flow

Step 4 – Schema Mapping (Optional)

Step 4 – Configure account store settings