Permissions for triggering processes
The basic permissions for triggering processes are granted to the logged in user by the Allow to trigger any events from the frontend program feature (Common_TriggerEvents).
In One Identity Manager, triggering of events on stored processes is linked to the permissions concept. Users can only trigger events on objects like this if they own edit permissions for them. This can lead to table users who only have viewing permissions not being able to trigger additional events for processes.
In this case, it is possible to connect the object events (QBMEvent table) with a program function (QBMFeature table). An event (JobEventGen table), which is defined for a process, is linked with an object event (JobEventGen.UID_QBMEvent column). The object events are linked to a program function (QBMEventHasFeature table). Users with this program function can trigger the object event and therefore the process too independent of their permissions.
To control triggering a process through a program function
-
Create a new program function.
-
In the Designer, select the Permissions > Program functions category.
-
Select the Object > New menu item.
- Enter the following information:
-
Program function: Name of the program function.
-
Description: Short description of the program function.
-
Function group: Property for grouping program functions.
-
Connect the program function with object events that the user will trigger.
-
In the Designer, select the Permissions > Program functions category.
-
Select the View > Select table relations menu item and enable the QBMEventHasFeature table.
-
In the List Editor, select the newly created program function.
-
In the Object events edit view, assign the object events.
-
Assign the required program functions to the custom permissions group whose systems users will trigger these events.
-
In the Designer, select the Permissions > Program functions category.
-
Select the View > Select table relations menu item and enable the DialogGroupHasFeature table.
-
In List Editor, use Ctrl+Selection to select your newly created program function and the function Allow to trigger any events from the frontend (Common_TriggerEvents).
-
Assign the permissions group in the Permissions groups edit view.
-
Select the Database > Save to database and click Save.
Related topics
Modifying permissions for running actions in the Launchpad
One Identity Manager supplies a number of Launchpad actions that you can use to start applications by using the Launchpad. You can also start your own applications over the Launchpad.
If some actions in the Launchpad should not be made available to all users, you can manage the permissions by assigning Launchpad actions to program functions (QBMLaunchActionHasFeature table). Only tasks containing actions that the user's program function permissions permit him to run are shown in the Launchpad.
To assign a program function to Launchpad actions
-
In the Designer, select the Permissions > Program functions category.
-
Select the View > Select table relations menu item and enable the QBMLaunchActionHasFeature table.
-
In the List Editor, select the program function.
-
In the Launchpad action edit view, assign the actions.
-
Select the Database > Save to database and click Save.
One Identity Manager authentication modules
One Identity Manager uses different authentication modules for logging in to administration tools. Authentication modules identify the system users to be used and load the user interface and database resource editing permissions depending on their permission group memberships.
-
The permissions assigned to the system user are found from the permissions groups for logging into One Identity Manager tools with an authentication module that expects a defined system user.
-
Dynamic system users are used for logging into One Identity Manager tools with role-based authentication modules. First, the employee memberships in the One Identity Manager application roles are determined during login. Assignments of permissions groups to One Identity Manager application roles are used to determine which permissions groups apply to the employee. A dynamic system user is determined from these permissions groups that will be used for the employee’s login.
Before you can use an authentication module for logging on, the following prerequisites must be fulfilled:
-
The authentication module must be enabled.
-
The authentication module must be assigned to the application.
-
The assignment of the authentication module to the application must be enabled.
This allows you to log in to the assigned application using this authentication module. Ensure that users found through the authentication module also have the required program function to use the program.
NOTE: After the initial schema installation, only the System user and Component authenticator authentication modules and the role-based authentication modules are enabled in One Identity Manager.
Use non role-based authentication modules to log in to the Designer. Role-based authentication modules for logging in to the Designer are not supported.
NOTE: Authentication modules are defined in the One Identity Manager modules and are not available until the modules are installed.
Related topics
System users
NOTE: This authentication module is available if the Configuration Module is installed.
|
Credentials |
The system user's identifier and password. |
|
Prerequisites |
- The system user with permissions exists in the database.
|
|
Set as default |
Yes |
|
Single sign-on |
No |
|
Front-end login allowed |
Yes |
|
Web Portal login allowed |
No |
|
Remarks |
The user interface and the permissions are loaded through the system user.
Data modifications are attributed to the system user. |
IMPORTANT: The viadmin system user is available by default. The system user has the predefined user interface and access permissions to database resources. You must not use or change the user interface and the permissions structure of the system user in live systems because this system user is overwritten with each schema update as it is from a system user template.
TIP: Create your own system user with the appropriate permissions. This can be done on initial installation of the One Identity Manager database. This system user can compile an initial One Identity Manager database and can be used to log into the administration tools for the first time.
