Automatically determining the owners
Initially, approvers of access request policies automatically become owners of PAM assets, PAM asset accounts, PAM directory accounts, PAM asset groups and PAM account groups. This assignment only takes place if an access request policy can be determined for a PAM object.
-
For each access request policy, a new application role is created for the owner under the Privileged Account Governance | Asset and account owners application role.
-
The role approvers of an access request policy are added to the application role.
-
The application is assigned to the PAM asserts, PAM asset accounts, PAM directory accounts, PAM asset groups, and PAM account groups within the policy's scope.
-
If there are several access policies defined for a PAM object, the valid application roles are determined through the access request policy's entitlements. The PAM object owners are determined by the following order:
-
Application roles of access request policies with low priority entitlements
-
Application roles of access request policies with the lowest priority
NOTE:
-
An application role for owners is only assigned automatically to a PAM object if an application role is not already assigned to the PAM object. Any existing assignment is not changed.
-
Owner are only determined initially. Changes to the role approver of an access request policy are not automatically added to the associated application role. Change the employee assigned to the application manually, if required.
-
Owners cannot be determined for access request policies that are automatically approved in One Identity Safeguard. In this case, assign employees manually to the application role.
Related topics
Manually specifying employees as PAM object owners
In addition to automatically determining the owners, you can specify the owners manually.
To manually specify employees as owners
-
Log in to Manager as target system manager.
-
In the Privileged Account Management > Basic configuration data > Asset and account owners category, select the application role.
-
Select the Assign employees task.
-
In the Add assignments pane, add employees.
TIP: In the Remove assignments pane, you can remove assigned employees.
To remove an assignment
- Save the changes.
Related topics
Manually specifying application roles for PAM object owners
Application roles are created when owner are determined automatically. You can specify further application roles manually.
To specify an application role for a PAM object owner
-
In the Manager, select one of the following filters in the Privileged Account Management > Appliances > <appliance> > Privileged objects category.
-
To specify an application role for an asset, select Assets.
-
To specify an application role for an asset group. select Asset group.
-
To specify an application role for an asset account, select Asset account.
-
To specify an application role for a directory account, select Directory account.
-
To specify an application role for an account group, select Account group.
-
In the result list, select the PAM object.
-
Select the Change main data task.
-
On the General tab, select the application role in the Owner (Application Role) selection list.
- OR -
Next to the Owner (Application Role) list, click on to create a new application role.
-
Enter the application role name and assign the parent application role Privileged Account Governance | Asset and account owners.
-
Click OK to add the new application role.
-
Assign employees, who are owners, to the application role.
Related topics
Configuring PAM access request policies
Access requests for assets, asset accounts, directory accounts, asset groups, and account groups can only be requested if the One Identity Manager enabled option is activated in the access request policy.
To configure the access request policy
-
In the Manager, select the Privileged Account Management > Appliances > <Appliance> > Entitlements > <Entitlement> category.
-
Select the access request policy in the result list.
-
Select the Change main data task.
-
On the General tab, check the One Identity Manager enabled option.
-
If this option is set, access requests can be requested for assets, asset accounts, directory accounts, asset groups, and account groups that are within the access request policy's scope.
-
If this option is not set, is not possible to request access requests for assets, asset accounts, directory accounts, asset groups, and account groups that are within the access request policy's scope.
Related topics