PowerProtect Data Manager Appliance 5.15.0.0 Security Configuration Guide for DM5500

Identity providers

An identity provider is an abstract source of user and group data that Data Manager Appliance can map to corresponding roles. The abstraction simplifies user and role management.

In addition to the list of supported external identity providers, Data Manager Appliance contains locally defined identity providers for application and operating system users.

Data Manager Appliance supports multiple active identity providers. Each identity provider has a unique associated domain that identifies all users from that identity provider.

You can map users to Data Manager Appliance roles directly or through user groups that come from an identity provider. After you configure an identity provider and map a user or group to a role, you can log in to Data Manager Appliance as that user, or as a user from that group.

Some guidelines on managing users in Active Directory Groups:

1. Managing a group of users with same role.
2. Password expiration is managed centrally in AD
3. If customer has multiple instances of Data Manager Appliance, the user accounts are managed centrally in AD.

System users are limited to SSH access. The operating system with "Support" users are not allowed to SSH to other operating systems that run with proxy, search or reporting service and others. For example, operating system users are not mapped to application roles and are limited to SSH access. The local identity provider does not support adding or deleting operating system users, only changing the passwords for existing accounts.