Company resource inheritance for single roles can be temporarily prevented. You can use this behavior, for example, to assign all required company resources to a role. Inheritance of company resources does not take place, however, unless inheritance is permitted for the role, for example, by running a defined approval process.
To prevent inheritance for business roles
-
In the Manager, in the Organizations category, select a business role.
-
Select the Change main data task.
-
Set one or more of the following options:
-
To prevent identities from inheriting, set the Identities do not inherit option.
-
To prevent devices from inheriting, set the Devices do not inherit option.
-
To prevent workdesks from inheriting, set the Workdesks do not inherit option.
- Save the changes.
Related topics
Inheritance of company resources can be prevented for single identities, devices, or workdesks. For example, you can use this behavior after importing to correct the imported data first and then apply inheritance afterward.
To prevent an identity from inheriting
-
In the Manager, select the identity in the Identities category.
-
Select the Change main data task.
-
Set the No inheritance option.
The identity does not inherit company resources through roles.
NOTE: This option does not have any effect on direct assignments. Company resource direct assignments remain assigned.
- Save the changes.
To prevent an device from inheriting
-
In the Manager, select the device in the Devices & Workdesks > Devices category.
-
Select the Change main data task.
-
Set the No inheritance option.
The device does not inherit company resources through roles.
NOTE: This option does not have any effect on direct assignments. Company resource direct assignments remain assigned.
- Save the changes.
To prevent a workdesk from inheriting
-
In the Manager, select the workdesk in the Devices & Workdesks > Workdesks category.
-
Select the Change main data task.
-
Set the No inheritance option.
The workdesk does not inherit company resources through roles.
NOTE: This option does not have any effect on direct assignments. Company resource direct assignments remain assigned.
- Save the changes.
Related topics
By assigning identities, devices, or workdesks to roles and through the associated inheritance of company resources, an identity, device, or workdesk may obtain company resources that should not be assigned in this combination. To prevent this, you define inheritance exclusion. o do this, you specify which role of a pair of roles can inherit the company resources if an identity (device or workdesk) is a member in both. Inheritance through excluded roles cannot occur.
NOTE: It is possible to assign identities, devices, or workdesks to an excluded role directly or by assignment request. This can be done at any time. One Identity Manager determines whether the assignment takes effect when it calculates role the memberships.
Example: Inheritance exclusion
Jo User1 has a user account in this target system. They belongs to the "Marketing" business role. The "Controlling" and "Finance" business roles are assigned to them secondarily. The user account would normally, without inheritance exclusion, obtain all permissions of groups A, B, and C.
By using suitable controls, you want to prevent an identity from being able to trigger a request and to pay invoices. Inheritance exclusion is defined for the "Finance" business role to do this. An identity that checks invoices may not be able to make invoice payments as well. Inheritance exclusion is defined for "Controlling" business role to do this.
Table 6: Definition of inheritance exclusion
|
Marketing |
|
Group A |
|
Finance |
Marketing |
Group B |
|
Controlling |
Finance |
Group C |
Table 7: Resulting assignments for user accounts
|
Pat Identity1 |
Marketing |
Marketing |
Group A |
|
Jan User3 |
Marketing, finance |
Finance |
Group B |
|
Jo User1 |
Marketing, finance, controlling |
Controlling |
Group C |
|
Chris User2 |
Marketing, Controlling |
Marketing, Controlling |
Group A, Group C |
Only the group C assignment is in effect for Jo User1 due to inheritance exclusion. If Jo User1 leaves the "controlling" business role at a later date, their membership in the business role takes effect again and group B is reassigned to the user account.
NOTE: Only directly defined inheritance exclusions between the roles are taken into account.
For Chris User2, group assignments A and C remain because there was no direct inheritance exclusion defined between the "Marketing" and "Controlling" business role. That means that the identity is authorized to trigger request and to check invoices. If this should not be allowed either, define further inheritance exclusion for the "Controlling" business role.
Table 8: Resulting assignments for the user account
|
Chris User2
|
Marketing |
|
Group A |
Controlling
|
Group C
|
|
Controlling |
Finance
Marketing |
Group C |
You can define conflicting roles to prevent identities, devices, or workdesks from being assigned to several roles at the same time and from obtaining mutually exclusive company resources through these roles. At the same time, specify which business roles are mutually exclusive. This means you may not assign these roles to one and the same identity (device, workdesk).
NOTE: Only roles, which are defined directly as conflicting roles cannot be assigned to the same identity (device, workdesk). Definitions made on parent or child roles do not affect the assignment.
Example:
The business role B has been entered as conflicting role in business role Alex User1 and Jo Identity are members of business role A. Toni User2 is member of business role B. Jo Identity cannot be assigned to business role B. Apart from that, One Identity Manager also prevents Alex User1 from being assigned to business role B and Toni User2 to business role A.
Figure 12: Members in conflicting roles
To configure inheritance exclusion
Related topics
In certain circumstances you might want an identity to be assigned to only one business role such as, within a project structure.
To map this behavior, you can use the No multiple assignment of identities option. You can enable the option for role classes and role types.
-
If a role class has this option enabled, an identity can be assigned to only one business role of this role class. Assignment of the identity to other business roles belonging to this role class is not allowed.
-
If a role type has this option enabled, an identity can only be assigned one business role of this role type. Assignment of the identity to other business roles belonging to this role type is not allowed.
NOTE:
-
Only for direct assignments of identities to business roles are verified.
-
Use the Multiple role assignments despite IsPersonAssignOnce on OrgRoot and Multiple role assignments despite IsPersonAssignOnce on OrgType consistency checks to identify invalid assignments to business roles. These assignments can originate from dynamic roles or through purchase orders, for example. For more information about consistency checking, see the One Identity Manager Operational Guide.
-
If an identity has already been assigned to multiple business roles of a role class or role type, then the option cannot be set again for this role class or role type.
Related topics
