One Identity Manager provide various default attestation procedures for different data situations and default attestation procedures.

Data situations for default attestations:

• System entitlements owned by an employee

• System entitlements assigned to system entitlements

• System entitlements assigned to hierarchical roles

• System roles assigned to an employee

• Company resources assigned to system roles

• System roles assigned to hierarchical roles

• Business and application role memberships

• Employee main data of a new One Identity Manager user

• Employee main data of an existing One Identity Manager user

The attestation polices required for attesting employee main data are also supplied by default. You can also use the default supplied attestation policies without modifying them. The prerequisites and the attestation sequence for employee data are described in User attestation and recertification.

You can set up attestation policies easily in the Web Portal using default attestation procedures for other data situations. You can also use the default attestation policies supplied without customizing them. Furthermore, you can configure how to deal with denied attestations that are based on these default attestation procedures. If your specific data situation allows, denied entitlements can be removed by One Identity Manager following the attestation.

To remove denied permissions automatically

1. In the Designer, set the QER | Attestation | AutoRemovalScope configuration parameter and the configuration subparameters.

2. If the entitlements were obtained through IT Shop, specify whether these requests should be unsubscribed or canceled. To do this, set the QER | Attestation | AutoRemovalScope | PWOMethodName configuration parameter and select a value.

   • Abort: Requests are canceled. In this case, they do not go through a cancellation workflow. The requested entitlements are withdrawn without additional checks.

   • Unsubscribe: Requests are unsubscribed. They go through the cancellation workflow defined in the approval policies. Withdrawal of the entitlement can thus be subjected to an additional check.

     If the cancellation is denied, the entitlement is not withdrawn even though the attestation has been denied.

   If the configuration parameter is not set, the requests are canceled.

Automatic removal of entitlements is triggered by an additional approval step with the EX approval procedure in the default approval workflows.

Attestation sequence with subsequence withdrawal of denied entitlements:

1. Attestation is carried out using a default attestation procedure.

2. The attestor denies attestation. The approval step is not granted approval and approval is passed on the next approval level with the EX approval procedure.

3. The approval step triggers the AUTOREMOVE event. This runs the VI_Attestation_AttestationCase_AutoRemoveMembership process.

4. The process runs the VI_AttestationCase_RemoveMembership script. This removes the affected entitlement depending on which configuration parameters are set.

5. The script sets the approval step status to Denied. This means the entire attestation case is finally denied.

6. Tasks to recalculate inheritance are entered in the DBQueue.

Detailed information about this topic

• Attesting system entitlements
• System role attestation
• Application role attestation
• Business role attestation