As an administrator, you can configure the identity applications to send an email that notifies users that they have a pending task to approve or reject a permission request.
NOTE:Before enabling email-based approvals, ensure that you have configured the provisioning request definitions (PRDs) to support notifications and (optional) digital signatures. Also, configure the outgoing mail server. For more information, see the OpenText™ Identity Manager CE 24.4 (v4.10) - Administrator’s Guide to Designing the Identity Applications.
Server Type
Specifies the type of server that you want to use for the incoming email notifications.
If you select IMAP, you must also specify a value for Folder.
Host
Specifies the name or IP address of the incoming mail server.
NOTE:Authentication does not apply to the outgoing mail server. OpenText Identity Manager does not support two-way authentication.
Specifies the email address that receives the reply messages from users responsible for reviewing permissions requests.
If the notification includes action links for approving or denying a request, OpenText Identity Manager automatically populates the To: field. Otherwise, users must specify valid email address in this field.
Authentication Required
Specifies whether the incoming mail server requires authentication.
Authentication Type
Applies only if you have enabled the Authentication Required option.
Select whether you want to connect to your email server using basic authentication or modern authentication.
If you select Basic Authentication, then you must specify values for the following parameters:
Specifies the account required for server authentication.
The account for the incoming mail server should be unique and thus not duplicate an account that might receive the email notifications.
Specifies the password for the account.
If you select Modern Authentication, then you must specify values for the following parameters:
NOTE:This release only supports modern authentication using the Office 365 OAuth authentication service provided by Azure Active Directory (Azure AD) for Microsoft Outlook. You must register your application with Azure AD to get the values for most these parameters. For more information on how to register your application, see Register an application with the Microsoft identity platform.
Specifies the account required for server authentication.
The account for the incoming mail server should be unique and thus not duplicate an account that might receive the email notifications.
Specifies the Global Unique Identifier (GUID) for your registered account on Azure Active Directory. Also referred to as the Tenant (Directory) ID.
Use the Azure portal to obtain the value.
Specifies the unique ID assigned by Azure Active Directory to your OpenText Identity Manager. Also referred to as the Application (client) ID.
Use the Azure portal to obtain the value.
Specifies a secret string that OpenText Identity Manager uses to prove its identity when requesting an access token. This encrypted value is unique for your application.
Use the Azure portal to obtain the value.
Specifies the resource for which the token is granted during token redemption. It defines what OpenText Identity Manager can access on behalf of the user. It should be https://outlook.office365.com/.default for SMTP.
The access token issued to the application is limited to the scope granted.
Specifies the request URI of your email server, to which OpenText Identity Manager sends authentication requests containing the client secret, scope, grant type, and auth mechanism in the payload.
For example, https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token
Used by OpenText Identity Manager to obtain an access token to access their own resources, not on behalf of a user. The Grant Type parameter is set to client_credentials by default and cannot be modified.
Specifies the format used by OpenText Identity Manager to encode and transmit the access token to the authentication server. The access token authenticates a user's Outlook account. By default, Auth Mechanism is set to XOAUTH2 and cannot be modified.
Folder
Required for an IMAP server
Specifies the folder in the email system where you want to store the email notifications.
The default folder is INBOX. For POP3 servers, you cannot change the folder name.
Enable SSL
Specifies whether you want to use Secure Sockets Layer (SSL) protocol for authentication.
Use default port
Specifies whether the email process uses the default port for the mail server. Otherwise, specify the port number you want to use to connect to the incoming mail server.
Polling Interval
Specifies how often you want to poll the incoming mail server for task notifications.
Token Expiration
Specifies the amount of time that each email-based approval will remain in effect.
After the token expires, the email recipient cannot use that notification to approve or deny the task.
Cleanup Interval
Specifies the interval after which the server can clear expired tokens from the database.
Email Content Options
Specifies the type of information that you want to include in the notification:
The notification does not include the action links that users can select to approve or deny the request.
To act on the request, users can reply to the email, then add the appropriate keyword, such as Approve, to the Subject. Alternatively, they can log in to the identity applications to complete the task.
The notification includes the action links that users can select to approve or deny the request. The email does not require a digital ID for authenticating the message content.
The notification includes the action links that users can select to approve or deny the request. It also requires a digital ID for authenticating the message content.
Approve and Reject
Specifies the terminology for the links in the email that users select to approve or deny the request.
You can also modify these terms for all supported languages.
Success and Failure
Specifies the email templates that you want to use for indicating the results of users’ actions.
Success notifications occur after the user successfully approves or denies a task. The software sends a Failure notification when an error occurs in the approval process.
Enable Socks Proxy
Specifies whether you want to use a proxy server to process the approval emails. If not enabled, the server connects directly to the specified Inbox.
If you enable this setting, you must also specify values for the following parameters:
Specifies the name or IP address of the proxy mail server.
Specifies the port that you want to use for incoming mail to the proxy server.
Specifies whether the proxy server requires authentication for incoming mail.
If you enable this setting, you must also specify a valid userID and password for the proxy server.
Notification Template Host
Specifies the name or IP address of Tomcat that hosts the identity applications. For example, myapplication serverServer.
This value replaces the $HOST$ token in e-mail templates. The installation program uses this information to create a URL to provisioning request tasks and approval notifications.
Notification Template Port
Specifies the port number of Tomcat that hosts the identity applications.
This value replaces the $PORT$ token in e-mail templates that are used in provisioning requesttasks and approval notifications.
Notification Template Secure Port
Specifies the secure port number of Tomcat that hosts the identity applications.
This value replaces the $SECURE_PORT$ token in e-mail templates used in provisioning request tasks and approval notifications.
Notification Template Protocol
Specifies a non-secure protocol included in the URL when sending user email. For example, http.
This value replaces the $PROTOCOL$ token in e-mail templates used in provisioning request tasks and approval notifications.
Notification Template Secure Protocol
Specifies the secure protocol included in the URL when sending user email. For example, https.
This value replaces the $SECURE_PROTOCOL$ token in e-mail templates used in provisioning request tasks and approval notifications.
Notification SMTP Email From
Specifies the email account that the identity applications use to send email notifications.
SMTP Server Name
Specifies the IP address or DNS name of the SMTP email host that the identity applications use for provisioning emails. Do not use localhost.
Server requires authentication
Specifies whether you want the server to require authentication.
Authentication Type
Applies only if you have enabled the Server requires authentication option.
Select whether you want to connect to your email server using basic authentication or modern authentication.
If you select Basic Authentication, then you must specify values for the following parameters:
Specifies the name of a login account for the email server.
Specifies the password of login account for the mail server.
If you select Modern Authentication, then you must specify values for the following parameters:
NOTE:This release only supports modern authentication using the Office 365 OAuth authentication service provided by Azure Active Directory (Azure AD) for Microsoft Outlook. You must register your application with Azure AD to get the values for most these parameters. For more information on how to register your application, see Register an application with the Microsoft identity platform.
Specifies the account required for server authentication.
The account for the incoming mail server should be unique and thus not duplicate an account that might receive the email notifications.
Specifies the Global Unique Identifier (GUID) for your registered account on Azure Active Directory. Also referred to as the Tenant (Directory) ID.
Use the Azure portal to obtain the value.
Specifies the unique ID assigned by Azure Active Directory to your OpenText Identity Manager. Also referred to as the Application (client) ID.
Use the Azure portal to obtain the value.
Specifies a secret string that OpenText Identity Manager uses to prove its identity when requesting an access token. This encrypted value is unique for your application.
Use the Azure portal to obtain the value.
Specifies the resource for which the token is granted during token redemption. It defines what OpenText Identity Manager can access on behalf of the user. It should be https://outlook.office365.com/.default for SMTP.
The access token issued to the application is limited to the scope granted.
Specifies the request URI of your email server, to which OpenText Identity Manager sends authentication requests containing the client secret, scope, grant type, and auth mechanism in the payload.
For example, https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token
Used by OpenText Identity Manager to obtain an access token to access their own resources, not on behalf of a user. The Grant Type parameter is set to client_credentials by default and cannot be modified.
Specifies the format used by OpenText Identity Manager to encode and transmit the access token to the authentication server. The access token authenticates a user's Outlook account. By default, Auth Mechanism is set to XOAUTH2 and cannot be modified.
Use SMTP TLS
Specifies whether you want to secure the contents of email messages during transmission between the mail servers.
Email Notification Image Location
Specifies the path to the image that you want to include in email notifications.
When the Identity Applications server and the email server are both set to use secure connection, make sure that the following conditions are met:
The certificate used to establish a secure connection between the Identity Applications server and the email server is a trusted CA certificate
Use https in the image path. For example, https://localhost:8543/IDMProv/images
If Identity Applications is operating on a server that uses http for plain text communication, replace https with http in the image path. An example of the image path: http://localhost:8080/IDMProv/images
Sign email
Specifies whether you want to add a digital signature to outgoing messages.
If you enable this option, you must also specify settings for the keystore and signature key.
Applies only when you enable Sign email.
Specifies the full path to the keystore (cacerts) file that you want to use for digitally signing an email. You can manually enter the path or browse to the cacerts file.
For example, /opt/netiq/idm/apps/jre/lib/security/cacerts.
Applies only when you enable Sign email.
Specifies the password for the keystore file. For example, changeit.
Applies only when you enable Sign email.
Specifies the alias of the signing key in the keystore. For example, idmapptest.
Applies only when you enable Sign email.
Specifies the password that protects the file containing the signature key. For example, changeit.