Standard products for assignment requests
You require special resources, so-called assignment resources, for assignment requests. Assignment resources are linked to service items and can thus be made available as products in the IT Shop.
One Identity Manager provides standard products for assignment requests. These are used to:
-
Request membership in business roles or organizations for which the logged-in One Identity Manager user is responsible.
-
Request system entitlement assignments or other company resources to system roles, business roles, or organizations for which the logged in One Identity Manager user is responsible.
Table 18: Standard products for assignment requests
|
Members in roles |
Members in roles |
Identity & Access Lifecycle | Identity Lifecycle |
Memberships in business roles, application roles, and organizations |
|
Role entitlement assignments |
Role entitlement assignments |
Assignment of company resources to business roles and organizations |
|
System role assignments |
System role assignments |
Assignment of company resources to system roles |
In the default installation, all active One Identity Manager database identities are customers of the Identity & Access Lifecycle shop. This allows all active identities to request memberships and assignments. The assignment requests are automatically approved by self-service.
You can add standard products for assignment requests to your own IT Shop.
Assignments can only be requested from and for customers of this shop. This means, the manager of the hierarchical roles as well as the identities that are also members of these roles, must be customers in the shop.
TIP: Assignment requests can also be made for custom assignment tables (many-to-many tables), if they have an XOrigin column. The properties for this column must correspond to the column definition for XOrigin columns in the One Identity Manager data model.
Example for an assignment request
Jo User1 is the project X project leader. A business role (Project X) is added in the Manager to ensure that all the project staff obtain the necessary entitlements. Jo User1 is assigned as manager of this business role. All project staff have a user account in the Active Directory domain P.
Jo User1 can request memberships in the Project X business role in the Web Portal because they are a manager. Jo User1 requests memberships for themselves and all project staff.
Furthermore, Jo User1 wants all project staff to obtain their entitlements in Active Directory through the Project X AD permissions Active Directory group. To this, they request Project X AD permissions in the Web Portal for the Project X business role.
The user accounts of all project staff become members in the Project X AD permissions Active Directory group through internal inheritance processes.
For more information, see the One Identity Manager Web Designer Web Portal User Guide.
Related topics
Requesting memberships in business roles
NOTE: This function is only available if the Business Roles Module is installed.
You have the option to limit assignment requests to single business roles. To do this, an assignment resource is created for a fixed requestable business role. The business role is automatically part of the request in an assignment resource request. If the request has been approved, the requester becomes a member of the application role.
Each requestable business role of this kind can have its own approval process defined. The service items connected with the assignment resources are assigned separate approval policies in order to do this.
To limit assignment requests to single business roles
-
In the Manager, select the Business roles > <role class> category.
-
Select the business role in the result list.
-
Select the Create assignment resource task.
This starts a wizard that takes you through the steps for adding an assignment resource.
-
Enter a description and allocate a resource type.
This creates a new assignment resource with the following custom properties:
-
Enter the service item properties to allocate to the assignment resource.
A new service item is created and linked to the assignment resource.
-
Assign the assignment resource to an IT Shop shelf as a product.
-
Assign an approval policy to the shelf or the assignment resource’s service item.
Assignment resource and service item main data can be processed later on if required.
The assignment resource can be requested in the Web Portal like any other company resource. After the request has been successfully assigned, the identity for whom it was requested becomes a member of the associated business role through internal inheritance processes. For more information about requesting assignment resources, see the One Identity Manager Web Designer Web Portal User Guide.
The assignment resource cannot be used to request the assignment of company resources to this business role. Instead, use the Role entitlement assignment default assignment resource.
Related topics
Requesting memberships in application roles
You have the option to limit assignment requests to single business roles. To do this, an assignment resource is created for a fixed requestable application role. The application role then automatically becomes part of the assignment resource request. If the request is approved, the requester becomes a member of the application role.
Each requestable application role of this kind can have its own approval process defined. The service items connected with the assignment resources are assigned separate approval policies in order to do this.
To limit assignment requests to single application roles
-
In the Manager, select an application role in the One Identity Manager Administration category.
-
Select the Create assignment resource task.
This starts a wizard that takes you through the steps for adding an assignment resource.
-
Enter a description and allocate a resource type.
This creates a new assignment resource with the following custom properties:
-
Enter the service item properties to allocate to the assignment resource.
A new service item is created and linked to the assignment resource.
-
Assign the assignment resource to an IT Shop shelf as a product.
-
Assign an approval policy to the shelf or the assignment resource’s service item.
Assignment resource and service item main data can be processed later on if required.
The assignment resource can be requested in the Web Portal like any other company resource. After the request has been successfully assigned, the identity for whom it was requested becomes a member of the associated application role through internal inheritance processes. For more information about requesting assignment resources, see the One Identity Manager Web Designer Web Portal User Guide.
Related topics
Customizing assignment requests
Assignment requests with standard products are automatically approved through self-service. If assignment requests are going to be approved by an approval supervisor, assign a suitable approval policy to the default assignment resource. This means that assignment requests also go through the defined approval process.
To approve assignment requests through an approver
Sometimes assignment requests should be subject to various approval processes depending on the object requested. For example, a department manager should approve department assignment, but department membership should be approved by the identity’s manager. You can define assignment resources to do this. You can assign these assignment resources to any shelf in your IT Shop.
NOTE: To use these assignment resources, you must make more modifications to the Web Designer configuration.
To configure custom assignment requests
-
Create a new assignment resource.
-
In the Manager, select the Entitlements > Assignment resources for IT Shop category.
-
Click 
in the result list.
-
Select the Change main data task.
-
Enter the assignment resource name.
-
Assign a new service item.
- Save the changes.
-
Assign the assignment resource to an IT Shop shelf as a product.
-
Select the Add to IT Shop task.
-
In the Add assignments pane, assign a shelf.
- Save the changes.
-
Assign an approval policy to the shelf or the assignment resource’s service item.
-
In the Web Designer, configure usage of the assignment resource.
For more information, see the One Identity Manager Web Designer Reference Guide.
Detailed information about this topic
Related topics
