Assigning system roles directly to employees
NOTE: This function is only available if the System Roles Module is installed.
System roles can be assigned directly or indirectly to employees. Indirect assignment is carried out by allocating the employees and system roles in company structures, such as departments, cost centers, locations, or business roles. For more information about working with system roles, see the One Identity Manager System Roles Administration Guide.
To react quickly to special requests, you can assign system roles directly to an employee.
To assign system roles directly to an employee
-
In the Manager, select the Employees > Employees category.
-
Select the employee in the result list.
-
Select the Assign system roles task.
-
In the Add assignments pane, assign system roles.
TIP: In the Remove assignments pane, you can remove the system role assignment.
To remove an assignment
- Save the changes.
Assigning subscribable reports directly to employees
NOTE: This function is only available if the Report Subscription Module is installed.
You can assign subscribable reports directly or indirectly to employees. Indirect assignment is carried out by assigning the employee and subscribable report to company structures, like departments, cost centers, locations, or business roles. For more information about report subscriptions, see the One Identity Manager Report Subscriptions Administration Guide.
In order to react quickly to special requests, you can also assign subscribable reports directly to employees.
To assign user accounts to an employee
-
In the Manager, select the Employees > Employees category.
-
Select the employee in the result list.
-
Select the Assign subscribable reports task.
-
In the Add assignments pane, assign reports.
TIP: In the Remove assignments pane, you can remove report assignments.
To remove an assignment
-
Save the changes.
Displaying the origin of employees' roles and entitlements
The Show entitlements origin report allows you to determine which entitlements an employee owns and where they come from. You can establish whether the employee obtained an entitlements directly or indirectly. For example, in the case of an indirect assignment, you can determine whether the entitlement resulted from a department memberships or a request,
You can also use the report to discover which departments, cost centers, locations, and business roles are assigned to an employee and how the membership evolved.
To use the origin report
To display the origin of an employee's entitlements
-
In the Manager, select the Employees > Employees category.
-
Select an employee in the result list and run the Show entitlements origin report.
-
Under Assigned objects, you will see the employee's entitlements, departments, cost centers, locations, and business roles. Select an entry by double-clicking on it to view more details.
-
The Origin area displays the details for the selected entry in a hierarchical structure.
You can see whether the assignment was a direct assignment, dynamic assignment, or a request.
-
You can use the Details button to switch to the dynamic role or to the request.
-
Double-click on some of the entries in the detail view to go to the object.
-
Choose the Inspect button for further information about the assignment of authorizations.
Example: Report on an entitlement's origin
The Show entitlements origin report establishes that Jo User1 is assigned to the Active Directory "Finance" group.
The report answers several questions.
Question |
Why does Jo User1 have the Active Directory group? |
Answer |
Jo User1 owns an Active Directory user account and this user account is assigned to the "Finance" group.
|
Question |
Why is the user account assigned to the "Finance" group? |
Answer |
Jo User1 is assigned to the "Finance" department.
The "Finance" department inherits from the "Global Finance" department. The "Global Finance" department is directly assigned to the "Finance" group.
|
Question |
Why is Jo User1 in the "Finance" department? |
Answer |
There is a department membership request for Jo User1.
|
Analyzing role memberships and employee assignments
The Overview of all assignments report is displayed for some objects, such as authorizations, compliance rules, or roles. The report finds all the roles, for example, departments, cost centers, locations, business roles, and IT Shop structures in which there are employees who own the selected base object. In this case, direct as well as indirect base object assignments are included.
Examples:
-
If the report is created for a resource, all roles are determined in which there are employees with this resource.
-
If the report is created for a group or another system entitlement, all roles are determined in which there are employees with this group or system entitlement.
-
If the report is created for a compliance rule, all roles are determined in which there are employees who violate this compliance rule.
-
If the report is created for a department, all roles are determined in which employees of the selected department are also members.
-
If the report is created for a business role, all roles are determined in which employees of the selected business role are also members.
To display detailed information about assignments
-
To display the report, select the base object from the navigation or the result list and select the Overview of all assignments report.
-
Click the Used by button in the report toolbar to select the role class for which you want to determine whether roles exist that contain employees with the selected base object.
All the roles of the selected role class are shown. The color coding of elements identifies the role in which there are employees with the selected base object. The meaning of the report control elements is explained in a separate legend. To access the legend, click the icon in the report's toolbar.
-
Double-click a control to show all child roles belonging to the selected role.
-
By clicking the button in a role's control, you display all employees in the role with the base object.
-
Use the small arrow next to to start a wizard that allows you to bookmark this list of employees for tracking. This creates a new business role to which the employees are assigned.
Figure 13: Toolbar of the Overview of all assignments report.
Table 40: Meaning of icons in the report toolbar
|
Show the legend with the meaning of the report control elements |
|
Saves the current report view as a graphic. |
|
Selects the role class used to generate the report. |
|
Displays all roles or only the affected roles. |