Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Identity Manager 8.2.1 - Attestation Administration Guide

Table of Contents

Attestation and recertification

One Identity Manager users for attestation Attestation base data

Attestation types

Default attestation types Additional tasks for attestation types

Overview of the attestation type Assigning attestation procedures

Attestation procedure

General main data of an attestation procedure Defining reports for attestation Default attestation procedures Additional tasks for attestation procedures

Overview of the attestation procedure Assigning approval policies Creating a copy

Attestation schedules

Default schedules Additional tasks for schedules

Schedule overview Assigning attestation policies Starting schedules immediately

Compliance frameworks

Additional tasks for compliance frameworks

Compliance framework overview Assigning attestation policies

Chief approval team Attestation policy owners Standard reasons for attestation

Predefined standard reasons for attestations

Attestation policies

General main data of attestation policies Specifying risk indexes for attestation guidelines Default attestation policies Additional tasks for attestation policies

The attestation policy overview Assigning approvers to attestation policies Assigning compliance frameworks to attestation policies Mitigating controls

Assigning mitigating controls Creating mitigating controls

Running attestation for single objects Showing or hiding conditions Copy attestation policies Showing selected objects Deleting attestation policies

Disabling attestation policies Reports about attestations

Sample attestation

Creating, editing, deleting samples General main data of samples Managing sample data Generating sample data automatically Using samples with attestation policies Displaying the sample overview Default sample for attesting memberships in system entitlements

Custom mail templates for notifications

Creating and editing attestation mail templates General properties of a mail template Creating and editing a mail definition

Using base object properties Use of hyperlinks in the Web Portal

Default functions for creating hyperlinks

Customizing email signatures

Copying mail templates for attestation Displaying attestation mail templates previews Deleting mail templates for attestation Custom notification processes

Suspending attestation

Approval processes for attestation cases

Approval policies for attestations

General main data of approval policies Default approval policies Additional tasks for approval policies

Editing approval workflows Validity checking

Approval workflow for attestations

Working with the workflow editor Setting up approval workflows

Editing approval levels Editing approval steps Properties of an approval step Connecting approval levels

Additional tasks for approval workflows

The approval workflow overview Copying approval workflows

Deleting approval workflows Default approval workflows

Selecting attestors

Default approval procedures

Using attestation policies to find attestors Using roles of employees to be attested to find attestors Using attestation objects to find attestors Determining attestors using the attestation objects' service item Using attestation object managers to find attestors Using persons responsible for attestation objects to find attestors Using a specified role to find attestors Using product owners to find attestors Using owners of a privileged object to find attestors Using additional Active Directory group owners to find attestors Using owners of the attestation objects to find attestors Using employees assigned to user accounts to find attestors Determining attested employee as attestor Calculated approval Approvals to be made externally Waiting for further approval

Setting up approval procedures

General main data of an approval procedure Queries for finding attestors

Additional tasks for approval procedures

Overview of the approval procedure Specifying permitted approval procedures for tables Copying an approval procedure

Deleting approval procedures Determining the responsible attestors

Setting up multi-factor authentication for attestation Prevent attestation by employee awaiting attestation Attestation by peer group analysis

Configuring peer group analysis for attestations

Managing attestation cases

Getting more information Appointing other attestors Escalating an attestation case Attestors cannot be established Automatic approval on timeout Halting an attestation case on timeout Attesting by chief approval team

Attestation sequence

Starting attestation Additional tasks for attestation cases

Attestation case overview Approval sequence Attestation history Reports about attestation cases

Modifying approval workflows for pending attestation cases Closing attestation cases for deactivated employees Deleting attestation cases Notifications in the attestation process

Requesting attestation Reminding attestors Scheduling attestation requests Reminding attestors about attestation objects Granting or denying attestation cases Notifying delegates Canceling attestation cases Escalation of attestation cases Delegating attestations Rejecting approvals Notifications with questions Notifications from additional attestors Link for verifying new external users Default mail templates

Attestation by mail

Processing attestation mails

Adaptive cards attestation

Using adaptive cards for attestations Adding and deleting recipients and channels Creating, editing, and deleting adaptive cards for attestations Creating, editing, and deleting adaptive cards templates for attestations Deploying and evaluating adaptive cards for attestations

Default attestation and withdrawal of entitlements

Attesting system entitlements System role attestation Application role attestation Business role attestation

User attestation and recertification

One Identity Manager users for attesting and recertifying users Configuring user attestation and recertification Attesting new users

Self-registration of new users in the Web Portal Adding new employees using a manager or employee administrator Importing new employee main data Scheduled attestation Limiting attestation objects for certification

Recertifying existing users

Preparing for recertification The recertification sequence Limiting attestation objects for recertification

Mitigating controls

General main data of mitigating controls Additional tasks for mitigating controls

Mitigating controls overview Assigning attestation policies

Calculating mitigation

Setting up attestation in a separate database

Requirements for the central database Setting up work databases Setting up synchronization between central and work databases Setting up and running attestations in the work database

Configuration parameters for attestation

Generating sample data automatically

One Identity Manager distinguishes between manual sampling and automatic sampling. Automatic sampling can trigger the generation of sample data as follows:

Event-based: All modified objects of an object class (table from which the sample data is selected) are calculated.

Example: All user accounts whose risk index has increased since the previous attestation.

For the default Monthly organizational changes of employees sample, the sample data are generated event-based.

Prerequisite

In the sample, the Manually selected option is disabled.

To generate sample data for an event-based sample

In the Designer, create a process that is generated when changes are made to the table given in the sample. Use the Execute SQL process task from the SQLComponent process component.
- Determine the value of the SQLStmt parameter with the following query:
  
  Dim f As ISqlFormatter = Connection.SqlFormatter Value = f.StoredProcedure(New SQLFunction("QER", "''", "PPickedItemInsert"), _ f.FormatValue("<UID_QERPickCategory>", ValType.String, True), _ f.FormatValue($XObjectKey$, ValType.String, True) _ )
- UID_QERPickCategory: Unique identifier of the sample whose sample data is to be generated.

For more information about defining processes, see the One Identity Manager Configuration Guide.

If the Remove items after attestation run option is set in the sample, the sample data will be deleted as soon as an attestation run is completed. This way ensures that the sample always contains only those objects that have been changed since the previous attestation.

Related topics

Using samples with attestation policies

To use sampling for attestation, assign a sample to the appropriate attestation policies. A sample can only be assigned to exactly one attestation policy.

To assign a sample to an attestation policy

In the Manager, select the Attestation > Attestation policies category.
Select an attestation policy in the result list and run the Change main data task.
In the Sample menu, select a sample.
- To create a new sample, click . Enter the name of the sample and assign the table from which to take the data for the sample.
Save the changes.

Related topics

Displaying the sample overview

You can see the most important information about a sample on the overview form. You can see the attestation policy that is used with sample.

To obtain an overview of a sample

In the Manager, select the Attestation > Samples category.
Select the sample in the results list.
Select the Sample oerview task .

Related topics

Default sample for attesting memberships in system entitlements

A default sample is provided for attesting memberships in system entitlements after organizational changes. This sample data is determined automatically. This identifies all individuals whose manager or primary department, cost center, or business role assignment has changed since the previous attestation. All memberships are attested whose user accounts are associated with these individuals.

To use attestation of memberships in system authorizations after organizational changes

In the Designer, set the QER | Selections | PersonOrganizationalChanges configuration parameter.
In the Manager, assign an enabled schedule to the System entitlement memberships after organizational changes attestation policy.

Once an attestation run is complete, the sample data is deleted. As soon as an individual's organizational data changes, they are included in the sample. This ensures that the sample always includes only those individuals whose organizational data has changed since the previous attestation.

TIP: Sample data is calculated by the QER_Person_Add_to_PickCategory_Organizational_Changes process. You can customize the generating condition of this process.

Related topics

General main data of attestation policies

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center