Chat now with support
Chat with Support

Identity Manager 9.0 LTS - Compliance Rules Administration Guide

Compliance rules and identity audit
One Identity Manager users for identity audit Basic data for setting up rules Setting up a rule base rule check Mail templates for notifying about identity auditing
Mitigating controls for compliance rules Configuration parameters for Identity Audit

Rule checking rule modifications

A processing task for rule checking is generated the moment an active rule is modified or deleted. All employees are checked to see if they fulfill the affected rule.

When specific changes are made to entitlements, you can immediately queue or schedule the calculation tasks to check the rules. Specify the desired behavior in the QER | ComplianceCheck | CalculateImmediately configuration parameter. If the parameter is set, the processing task for recalculating rule violation for an employee are immediately queued. If the parameter is not set, the calculation task is started the next time the schedule is planned to run.

To trigger rule checks immediate after relevant changes have been made

  • In the Designer, set the QER | ComplianceCheck | CalculateImmediately configuration parameter.

    The processing task for recalculating rule violations for an employee is immediately started when relevant changes occur.

NOTE: This configuration parameter only applies if data changes are relevant. These include:

  • Changes to employee main data

  • Changes to employee assignments (for example, the PersonHasQERResource table)

  • Changes to employees' role memberships

  • Changes to membership in system entitlements (for example, the ADSAccountInADSGroup table)

  • Changes to SAP function matches (the SAPUserInSAPFunction table)

Ad-hoc rule checking

There are several tasks available for a rule that immediately perform a rule check.

Table 26: Additional tasks for rules
Task Description

Recalculate rule

All employees are checked to see if they comply to the current rule.

Recalculate for current user

All employees are checked to see if they comply to all rules.

Recalculate all

All employees are checked to see if they comply to all rules.

Speeding up rule checking

Scheduled rule checking can take a long time under certain circumstances. This may be the case, for example, if many rules exist in which the employee group affected is not limited ("This rule is broken by all workers"). One Identity Manager supplies two consistency checks for optimizing performance of the calculation of affected employee groups. This reduces the amount of data in the auxiliary tables.

To optimize rule checking, start these consistency checks and repair the rules which are found.

To run a consistency check

  1. In the Manager, select the Database > Check data consistency menu item.

  2. Click in the Consistency Editor's toolbar.

  3. Click in the "Test options" dialog toolbar.

  4. Set the Content > Compliance > ComplianceRule change IsPersonStoreInverted to 1 and Content > Compliance > ComplianceRule change IsPersonStoreInverted to 0 checks.

  5. Click OK.

  6. Run the consistency check for the Database object.

  7. Verify the analysis results.

    TIP: For details about an error message

    1. Select the error message.

    2. Click in the toolbar.

  8. To optimize the rule condition for an affected rule

    1. Select the error message.

    2. Click on Repair both for the original rule and the working copy.

For more information about consistency checking, see the One Identity Manager Operational Guide.

Related topics

Rule check analysis

Each rule references its own object for rule violations (NonCompliance table). Employees who violate rules are assigned to this objects (PersonInNonCompliance table). There are two forms available for rule checking that are supposed to answer the following questions:

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating