Additional company-specific information. Use the Designer to customize display names, formats, and templates for the input fields.
Setting up an IT Shop solution
One Identity Manager users in the IT Shop
Implementing the IT Shop
Using the IT Shop with the Application Governance Module
Requestable products
Preparing products for requesting
Approval processes for IT Shop requests
Entering service items
Assigning and removing products
General main data for service items
Pricing for service items
Extended main data for service items
Default service items
Specifying dependencies between products
Editing product dependencies for requests
Defining hierarchy for service items
Assigning hierarchical roles to service items
Assigning functional areas to service items
Assigning extended properties to service items
Displaying websites for service items
Changing products for service items
Adding tags and assigning them to service items
Assigning object-dependent references to service items
Displaying the service item overview
Reports about service items
Entering service categories
Main data for service categories
Default service categories
Assigning service items to service categories
Assigning object-dependent references to a service category
Displaying the service category overview
Entering product-specific request properties
Request property and request parameter settings
Copy request properties
Displaying the request properties overview
Products for requests with time restrictions
Product request on customer or product relocation
Non-requestable products
Entering terms of use
Entering tags
Assigning products to shelves
Removing products from shelves
Moving products to another shelf
Replacing products
Preparing the IT Shop for multi-factor authentication
Assignment requests
Standard products for assignment requests
Requesting memberships in business roles
Requesting memberships in application roles
Customizing assignment requests
Canceling requests
Removing customers from a shop
Setting up assignment resources
Delegations
Creating IT Shop requests from existing user accounts, assignments, and role memberships
Creating requests for identities
Creating user account requests
Creating workdesk requests
Creating assignment requests
Adding system entitlements automatically to the IT Shop
Deleting unused application roles for product owners
Approval policies for requests
Request sequence
General main data of approval policies
Default approval policies
Additional tasks for approval policies
Approval workflows for requests
Working with the workflow editor
Setting up approval workflows
Determining effective approval policies
Selecting responsible approvers
Editing approval levels
Editing approval steps
Properties of an approval step
Connecting approval levels
Additional tasks for approval workflows
Deleting approval workflows
Default approval workflows
Default approval procedures
Request risk analysis
Testing requests for rule compliance
Self-service
Using IT Shop structures to find approvers
Using request recipients to find approvers
Using specific roles to find approvers
Using requested products to find approvers
Using approval roles to find approvers
Using cost centers to find approvers
Using departments to find approvers
Using requested roles to find approvers
Waiting for further approval
Calculated approval
Approvals to be made externally
Finding requesters
Setting up approval procedures
Copying an approval procedure
Deleting approval procedures
Determining the responsible approvers
Compliance checking requests
Identifying rule violations
Finding exception approvers
Restricting exception approvers
Explicit exception approval
Rule checking for requests with self-service
Approving requests from an approver
Automatically approving requests
Approval by peer group analysis
Approval recommendations for requests
Criteria for approval recommendations for requests
Configuring approval recommendations for requests
Gathering further information about a request
Appointing other approvers
Escalating an approval step
Approvers cannot be established
Automatic approval on timeout
Halting a request on timeout
Approval by the chief approval team
Approving requests with terms of use
Using default approval processes
The request overview
Requesting products more than once
Requests with limited validity period
Relocating a customer or product to another shop
Changing approval workflows of pending requests
Requests for employees
Requesting change of manager for an employee
Canceling requests
Unsubscribe products
Notifications in the request process
Managing an IT Shop
Requesting approval
Reminding approvers
Scheduled request for approval
Sequence for limited requests
Approving or denying request approval
Notifying delegates
Canceling requests
Escalating requests
Delegating approvals
Rejecting approvals
Notifications with questions
Using additional approvers to approve requests
Unsubscribing approved requests
Renewing approved requests
Product change notifications
Default mail templates
Bulk delegation notifications
Approval by mail
Adaptive cards approval
Using adaptive cards for approvals
Adding and deleting recipients and channels
Creating, editing, and deleting adaptive cards for requests
Creating, editing, and deleting adaptive cards templates for requests
General main data for adaptive cards
Deploying and evaluating adaptive cards for requests
Disabling adaptive cards
Requests with limited validity period for changed role memberships
Requests from permanently deactivated identities
Deleting request procedures and deputizations
IT Shop base data
Troubleshooting errors in the IT Shop
Configuration parameters for the IT Shop
Request statuses
Examples of request results
Processing status
Standard reason for requests
Role classes for the IT Shop
Role types for the IT Shop
Business partners
Functional areas
Chief approval team
Product owners
Attestors
Setting up IT Shop structures
Adding IT Shop structures
General main data of IT Shop structures
Custom main data of IT Shop structures
Assigning approval policies
Assigning requestable products to shelves
The IT Shop structure overview
Setting up a customer node
Adding customer nodes
General main data of customer nodes
Custom main data of customer nodes
Assigning identities directly
Assigning identities through dynamic roles
The entitled customers overview
Deleting IT Shop structures
Restructuring the IT Shop
Moving shops to other shopping centers
Moving shelves to other shops
Moving products to another shelf
Templates for automatically filling the IT Shop
Using shelf templates in an IT Shop solution
Editing shelf templates
General main data of a shelf template
Custom main data of shelf templates
Assigning approval policies
Assigning requestable products to shelf templates
Shelf-filling wizard
Assigning shelf templates to shops and shopping center templates
Deleting shelf templates
Custom mail templates for notifications
Creating and modifying IT Shop mail templates
General properties of mail templates
Creating and editing mail definitions
Product bundles
Using base object properties
Use of hyperlinks to the Web Portal
Default functions for creating hyperlinks
Customize email signatures
Copying IT Shop mail templates
Displaying IT Shop mail template previews
Deleting IT Shop mail templates
Custom notification processes
Creating and modifying product bundles
General main data of a product bundle
Cart items
Deleting product bundles
Recommendations and tips for transporting IT Shop components with the Database Transporter
Custom main data of customer nodes
Assigning identities directly
Add an identity that is authorized to make requests for the shop to the customer node. You have two possible ways of doing this. Identities can be assigned to a customer node either directly or through a dynamic role.
IMPORTANT:If a shop contains a large number of customers, the calculations in the IT Shop can cause a heavy load on the DBQueue Processor and therefore on the database server, as well.
Never assign more than 30,000 identities to a customer node.
To assign identities directly to a custom node
-
In the Manager, select the IT Shop > IT Shop > <shop> > Customers category or the IT Shop > IT Shop > <shopping center> > <shop> > Customers category.
-
Select the Assign identities task.
In the Add assignments pane, assign the identities authorized to make requests.
TIP: In the Remove assignments pane, you can remove assigned identities.
To remove an assignment
-
Select the identity and double-click
.
-
- Save the changes.
If an identity is removed from a customer node, all pending requests for this identity are canceled.
Related topics
Assigning identities through dynamic roles
Add an identity that is authorized to make requests for the shop to the customer node. You have two possible ways of doing this. Identities can be assigned to a customer node either directly or through a dynamic role.
NOTE: Create dynamic role is only available for customer nodes that do not have Dynamic roles not allowed set.
IMPORTANT:If a shop contains a large number of customers, the calculations in the IT Shop can cause a heavy load on the DBQueue Processor and therefore on the database server, as well.
Formulate the condition for the dynamic role so that no more than 30,000 identities are found.
To create a dynamic role
-
In the Manager, select the IT Shop > IT Shop > <shop> > Customers category or the IT Shop > IT Shop > <shopping center> > <shop> > Customers category.
-
Select the Create dynamic role task.
-
Enter the required main data.
- Save the changes.
To edit a dynamic role
-
In the Manager, select the IT Shop > IT Shop > <shop> > Customers category or the IT Shop > IT Shop > <shopping center> > <shop> > Customers category.
-
Select the Entitled customers overview task.
-
Select the Dynamic roles form element and click on the dynamic role.
-
Select the Change main data task and edit the dynamic role's main data.
- Save the changes.
For more information about dynamic roles, see the One Identity Manager Identity Management Base Module Administration Guide. The following features apply to dynamic roles for customer nodes:
|
Property |
Description |
|---|---|
|
IT Shop node |
This data is initialized with selected customer nodes. If the identities meet the dynamic role conditions, they are added to this customer node. |
|
Object class |
Employee |
|
Dynamic role |
The dynamic role name is made up of the object class and the full name of the IT Shop node by default. |
|
Calculation schedule |
Schedule for calculating dynamic roles. Identities with request permissions for the shop are determined regularly at the times specified in the schedule. In the default installation of One Identity Manager, the Dynamic roles check schedule is already defined. All dynamic role memberships are checked using this schedule and recalculation operations are sent to the DBQueue Processor if necessary. Use the Designer to customize schedules or set up new ones to meet your requirements. For more information, see the One Identity Manager Operational Guide. |
To delete a dynamic role
-
In the Manager, select the IT Shop > IT Shop > <shop> > Customers category or the IT Shop > IT Shop > <shopping center> > <shop> > Customers category.
-
Select the Entitled customers overview task.
-
Select the Dynamic roles form element and click on the dynamic role.
-
In the Manager's toolbar, click
.
- Confirm the security prompt with Yes.
Related topics
The entitled customers overview
To obtain an overview of a customer node
-
In the Manager, select the IT Shop > IT Shop > <shop> > Customers category or the IT Shop > IT Shop > <shopping center> > <shop> > Customers category.
-
Select the Entitled customers overview task.