One Identity Manager Enterprise Implementation Guide

Overview

One Identity Manager is an Identity Governance and Administration (IGA) platform designed to centralize identity lifecycle management, role-based access control, attestation, policy enforcement, and compliance reporting. Enterprises use it to connect HR, Active Directory, Entra ID, SAP, databases, and business applications so joiner-mover-leaver processes and access certifications can be automated at scale.

Its core purpose is to establish a governed identity model where people, accounts, entitlements, and business roles are linked through policy. In practice, this reduces manual provisioning effort, shortens onboarding time, improves audit readiness, and enforces segregation of duties across complex hybrid estates.

Architecture

A typical One Identity Manager deployment includes:

• SQL Server database hosting the One Identity schema and configuration data
• Job Service servers executing synchronization, provisioning, and process tasks
• Synchronization Editor for connector configuration and mapping rules
• Manager and Web Portal for administration, approvals, attestation, and reporting
• Application Server exposing business logic to web components and APIs

Deployment models

• On-premises for regulated environments with direct connectivity to internal systems
• Hybrid with internal Job Servers and externally accessible web tiers
• Distributed enterprise model with dedicated Job Servers per target system or region

Data flow

1. Authoritative identities are imported from HR or ERP.
2. Identity objects are correlated to accounts in AD, Entra ID, SAP, and other systems.
3. Business roles, IT Shop requests, and policies determine entitlements.
4. Job Service executes provisioning tasks through connectors.
5. Attestation and recertification workflows validate ongoing access.

Implementation Guide

1. Prepare the SQL Server database

Create a database and service account with least privilege.

sqlcmd -S sql01.corp.example.com -U sa -Q "CREATE DATABASE OneIM;"
sqlcmd -S sql01.corp.example.com -U sa -Q "CREATE LOGIN oneim_svc WITH PASSWORD='Str0ng!Passw0rd#2026';"
sqlcmd -S sql01.corp.example.com -U sa -d OneIM -Q "CREATE USER oneim_svc FOR LOGIN oneim_svc; ALTER ROLE db_owner ADD MEMBER oneim_svc;"

2. Install core services silently

On the application server, run the installer with response parameters.

msiexec /i OneIdentityManager.msi /qn ADDLOCAL=AppServer,JobService DBSERVER=sql01.corp.example.com DBNAME=OneIM DBSERVICEUSER=oneim_svc

3. Configure Job Service

Edit C:\Program Files\One Identity\One Identity Manager\JobService\Jobservice.cfg.

JobService:
  Queue: VI_ITSHOP
  LogLevel: Info
  Connection:
    Provider: SqlServer
    DataSource: sql01.corp.example.com
    InitialCatalog: OneIM
    IntegratedSecurity: false
    UserID: oneim_svc
    Password: "Str0ng!Passw0rd#2026"
  Encryption:
    Enabled: true
    CertificateThumbprint: "9A7C2E1D4B5F6A77889900112233445566778899"

Restart the service:

sc stop OneIMJobService
sc start OneIMJobService

4. Register synchronization project

Import connector configuration and test connectivity.

imxsync.exe /project:"C:\Configs\AD-Sync.imsx" /server:"sql01.corp.example.com" /database:"OneIM" /auth:sql /user:"oneim_svc"

5. Validate processing

Check queue health and synchronization status from Manager and confirm Job Queue Processor throughput.

Code Examples

Example 1: PowerShell-style batch launch for nightly sync

@echo off
set IMX_BIN=C:\Program Files\One Identity\One Identity Manager\SyncEditor
"%IMX_BIN%\imxsync.exe" /project:"C:\Configs\HR-Sync.imsx" /server:"sql01.corp.example.com" /database:"OneIM" /auth:sql /user:"oneim_svc" /password:"Str0ng!Passw0rd#2026"
if %ERRORLEVEL% NEQ 0 exit /b 1

Example 2: Application settings for web tier

appServer:
  url: "https://oneim-app.corp.example.com/AppServer"
  authentication: "Negotiate"
  sessionTimeoutMinutes: 30
  tls:
    minVersion: "1.2"
    hsts: true
logging:
  level: "Information"

Example 3: API validation script

import requests
url = "https://oneim-app.corp.example.com/AppServer/api/ping"
r = requests.get(url, verify=True, timeout=10)
print(r.status_code)
print(r.text)

Security Hardening

• Enforce TLS 1.2+ on web and application tiers; disable legacy ciphers in IIS and Windows Schannel.
• Store service credentials in a managed vault and rotate them regularly.
• Use dedicated Job Servers for high-risk connectors such as SAP or privileged directories.
• Restrict SQL access to application and admin subnets only.
• Enable database encryption at rest with TDE and protect backups separately.
• Apply role-based administration in One Identity Manager so approval, policy, and sync duties are separated.
• Sign and review custom scripts before deployment to production.

Comparison

Troubleshooting

Error 1: Database connectivity failure

Log sample:

[ERR] VI.DB.SqlServer.ConnectionManager - Login failed for user 'oneim_svc'.
[ERR] System.Data.SqlClient.SqlException (0x80131904): Cannot open database "OneIM" requested by the login.

Fix:

• Verify SQL login mapping to the OneIM database.
• Confirm firewall rules and SQL Server TCP connectivity on 1433.

Error 2: Job queue not processing

Log sample:

2026-04-11 02:14:33.221 +00:00 [Error] VI.JobService.JobComponents.QueueProcessor - Queue VI_ITSHOP is frozen.
2026-04-11 02:14:33.224 +00:00 [Warning] No process steps picked up in the last 300 seconds.

Fix:

• Confirm Job Service is bound to the correct queue.
• Check DB queue status and restart the Job Service after correcting Jobservice.cfg.

Error 3: Synchronization mapping failure

Log sample:

[SyncError] Object matching rule returned multiple results for target object CN=JSmith,OU=Users,DC=corp,DC=example,DC=com
[SyncError] VI.Projector - Cannot resolve unique person assignment.

Fix:

• Tighten matching rules using immutable IDs such as employee ID or objectGUID.
• Run preview mode before full sync.

Best Practices

Do

• Use HR as authoritative source for worker lifecycle data.
• Separate development, test, and production databases and Job Servers.
• Model business roles before direct entitlement assignment.
• Enable attestation for privileged groups and toxic combinations.

Don't

• Do not provision directly from unmanaged spreadsheets.
• Do not run all connectors on a single Job Server in large environments.
• Do not grant db_owner or local admin rights beyond installation requirements.
• Do not deploy custom process changes without rollback scripts and sync validation.