User Account Mapping

Account mapping allows authentication of a USoft account using the credentials of another account. For example, validation of a USoft application user named User1 using the password of an operating system user named User2. This has the advantage of reducing the number of passwords a user has to know. Typically, a set of USoft application accounts that serve different application roles might be authenticated by the password of one single account, optionally the password of the user's operating system account.

In the USoft Authorizer, account validation is specified for each funneling user. Setting the Validation Agent to "Account Mapping" allows the use of account names in USoft that differ from the account against which the validation takes place.

For example, two different USoft users, User1 and User2, could be validated against the credentials of operating system user OS1. For that scenario, User1, User2 and OS1 are added in the authorizers application users. The validation agent of user OS1 is set to "Operating System". The validation agents for User1 and User2 are set to "Mapped Account", with the mapped user field set to OS1. In this scenario, OS1 may but does not have to be a USoft application user. User1 and User2 are application users but can have different user groups.

In the example, User 1 and User2 may have different rights by assigning them to different user groups, but they share the same credentials of the mapped user OS1. In this way, the User1 and User2 accounts can be given to a person as USoft accounts for different roles.

A Mapped Account can be mapped onto another Mapped Account. The purpose of this is to allow accounts to stay mapped regardless of how the Validation Agent of the underlying account may change in time.

NOTE: If an account that is used in a mapping has its name changed or is deleted, subsequent logon attempts for the mapped accounts will fail. For example, if User2 is a mapped account on User1 and User1 is validated with validation agent "USoft", User2 can log on using the password set for User1. Changing User1 to use User3 will allow User3 to log on with the password originally set for User1 but User2 will no longer be able to log on.