Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Identity Manager 9.2 - Attestation Administration Guide

Table of Contents

Attestation and recertification

One Identity Manager users for attestation Attestation base data Attestation types

Default attestation types Additional tasks for attestation types

Overview of the attestation type Assigning attestation procedures

Attestation procedure

General main data of an attestation procedure Templates for attestation procedures Providing information about attestation objects

Defining reports for attestation Defining snapshot content

Default attestation procedures Additional tasks for attestation procedures

Overview of the attestation procedure Assigning approval policies Creating a copy

Attestation schedules

Default schedules Assigning attestation policies Assigning policy collections Schedule overview Starting schedules immediately

Compliance frameworks

Additional tasks for compliance frameworks

Compliance framework overview Assigning attestation policies

Chief approval team Attestation policy owners Standard reasons for attestation

Predefined standard reasons for attestations

Attestation policies

General main data of attestation policies Specifying risk indexes for attestation guidelines Default attestation policies Additional tasks for attestation policies

The attestation policy overview Assigning approvers to attestation policies Assigning compliance frameworks to attestation policies Mitigating controls

Assigning mitigating controls Creating mitigating controls

Running attestation for single objects Showing or hiding conditions Copy attestation policies Showing selected objects Deleting attestation policies

Disabling attestation policies

Sample attestation

Creating, editing, deleting samples General main data of samples Managing sample data Generating sample data automatically Using samples with attestation policies Displaying the sample overview Default sample for attesting memberships in system entitlements Default sample for attesting identities

Grouping attestation policies

Creating and editing policy collections General main data of policy collections Assigning policy collections to attestation policies Disabling policy collections Deleting policy collections Default policy collections

Custom mail templates for notifications

Creating and editing attestation mail templates General properties of a mail template Creating and editing a mail definition

Using base object properties Use of hyperlinks in the Web Portal

Default functions for creating hyperlinks

Customizing email signatures

Copying mail templates for attestation Displaying attestation mail templates previews Deleting mail templates for attestation Custom notification processes

Suspending attestation Automatic attestation of policy violations

Approval processes for attestation cases

Approval policies for attestations

General main data of approval policies Default approval policies Additional tasks for approval policies

Editing approval workflows Validity checking

Approval workflow for attestations

Working with the workflow editor Setting up approval workflows

Editing approval levels Editing approval steps Properties of an approval step Connecting approval levels

Additional tasks for approval workflows

The approval workflow overview Copying approval workflows

Deleting approval workflows Default approval workflows

Selecting attestors

Default approval procedures

Using attestation policies to find attestors Using roles of identities to be attested to find attestors Using attestation objects to find attestors Determining attestors using the attestation objects' service item Using attestation object managers to find attestors Using persons responsible for attestation objects to find attestors Using a specified role to find attestors Using product owners to find attestors Using owners of a privileged object to find attestors Using additional Active Directory group owners to find attestors Using owners of the attestation objects to find attestors Using identities assigned to user accounts to find attestors Determining attested identity as attestor Determining attestation policy owners Calculated approval Approvals to be made externally Waiting for further approval

Setting up approval procedures

General main data of an approval procedure Queries for finding attestors

Additional tasks for approval procedures

Overview of the approval procedure Specifying permitted approval procedures for tables Copying an approval procedure

Deleting approval procedures Determining the responsible attestors

Setting up multi-factor authentication for attestation Prevent attestation by identity awaiting attestation Automatic acceptance of attestation approvals Phases of attestation

Setting up the staging phase Criteria for the Staging phase Setting up the challenge phase Setting up withdrawal of entitlements

Attestation by peer group analysis

Configuring peer group analysis for attestations

Approval recommendations for attestations

Criteria for approval recommendations for attestation Configuring approval recommendations for attestation

Managing attestation cases

Getting more information Appointing other attestors Escalating an attestation case Attestors cannot be established Automatic approval on timeout Halting an attestation case on timeout Attesting by chief approval team

Attestation sequence

Starting attestation Attestation case overview Approval sequence Attestation history Modifying approval workflows for pending attestation cases Closing attestation cases for deactivated identities Deleting attestation cases Notifications in the attestation case

Requesting attestation Reminding attestors Scheduling attestation requests Reminding attestors about attestation objects Approving or denying attestation cases Notifying delegates Canceling attestation cases Escalation of attestation cases Delegating attestations Rejecting approvals Notifications with questions Notifications from additional attestors Link for verifying new external users Default mail templates

Attestation by mail

Processing attestation mails

Adaptive cards attestation

Using adaptive cards for attestations Adding and deleting recipients and channels Creating, editing, and deleting adaptive cards for attestations Creating, editing, and deleting adaptive cards templates for attestations General main data for adaptive cards Deploying and evaluating adaptive cards for attestations Disabling adaptive cards

Approving attestation cases in the Manager Displaying attestation cases of an attestor Displaying information about attestation objects Assigning extended properties to attestation cases Displaying incomplete attestation runs Canceling incomplete attestation runs Displaying canceled attestation runs Reports about attestations

Default attestations

Configuring withdrawal of entitlements

Attesting system entitlements System role attestation Application role attestation Business role attestation

Configuring sample attestation of identities and their entitlements User attestation and recertification

One Identity Manager users for attesting and recertifying users Configuring user attestation and recertification Attesting new users

Self-registration of new users in the Web Portal Adding new identities using a manager or administrator for identities Importing new identity main data Scheduled attestation Limiting attestation objects for certification

Recertifying existing users

Preparing for recertification The recertification sequence Limiting attestation objects for recertification

Certifying new roles and organizations

One Identity Manager users for certifying roles and organizations Configuring certification of new departments Configuring certification of new cost centers Configuring certification of new locations Configuring certification of new business roles Configuring certification of new application roles

Mitigating controls

General main data of mitigating controls Additional tasks for mitigating controls

Mitigating controls overview Assigning attestation policies

Calculating mitigation

Setting up attestation in a separate database

Requirements for the central database Setting up work databases Setting up synchronization between central and work databases Setting up and running attestations in the work database

Configuration parameters for attestation

Overview of the attestation procedure

You can display the most important information about an attestation procedure on the overview form.

To obtain an overview of an attestation procedure

In the Manager, select the Attestation > Basic configuration data > Attestation procedures category.
Select the attestation procedure in the result list.
Select the Attestation procedure overview task.

Assigning approval policies

Use this task to assign the selected attestation procedure to the approval policies that should be used in this attestation procedure. All approval policies permitted for the attestation base object are listed.

To assign approval policies to attestation procedures

In the Manager, select the Attestation > Basic configuration data > Attestation procedures category.
Select the attestation procedure in the result list.
Select Assign approval policies task.

In the Add assignments pane, assign the approval policies.
TIP: In the Remove assignments pane, you can remove approval policy assignments.

To remove an assignment
- Select the approval policy and double-click .
Save the changes.

Which approval policies are permitted depends on the approval procedures in use. Approval procedures dictate to which tables an approval procedure can be assigned.

Related topics

Specifying permitted approval procedures for tables

Creating a copy

You can make copies of attestation procedures and those copies allow you to modify default attestation procedures.

To copy an attestation procedure

In the Manager, select the Attestation > Basic configuration data > Attestation procedures category.
Select the attestation procedure in the result list.
Select Create copy task.
Confirm the security prompt with Yes.
Decide whether the condition types should be copied for the attestation wizard in the Web Portal as well.

Condition types are required if attestation policies are created and edited with the attestation wizard in the Web Portal. For more information about this, see the One Identity Manager Web Designer Web Portal User Guide.
Edit the attestation procedure copy and save the changes.

The attestation procedure copy is displayed on the main data form with the name <Name of original attestation procedure>(copy). You can rename and edit this attestation policy.

Attestation schedules

Use schedules to automate attestation. These specify when and how often attestation cases are created. One Identity Manager supplies several default schedules for attestation.

To edit schedules

In the Manager, select the Attestation > Basic configuration data > Schedules category.

The result list shows all schedules configured for attestation policies (AttestationPolicy task).
Select a schedule in the result list and run the Change main data task.

- OR -

Click in the result list.
Edit the schedule’s main data.
Save the changes.

Enter the following properties for a schedule.

Table 5: Schedule properties
Property	Meaning
Name	Schedule ID. Translate the given text using the button.
Description	Detailed description of the schedule. Translate the given text using the button.
Table	Table whose data can be used by the schedule. Schedules for the attestation must refer to the AttestationPolicy table.
Enabled	Specifies whether the schedule is enabled. NOTE: Only active schedules are run. Active schedules are only run if the QBM \| Schedules configuration parameter is set.
Time zones	Unique identifier for the time zone that is used for running the schedule. Choose between Universal Time Code or one of the time zones in the menu. NOTE: When you add a new schedule, the time zone is preset to that of the client from which you started the Manager.
Start (date)	The day on which the schedule should be run for the first time. If this day conflicts with the defined interval type, the first run is on the next available day based on the start date.
Validity period	Period within which the schedule is run. If the schedule will be run for an unlimited period, select the Unlimited duration option. To set a validity period, select the Limited duration option and enter the day the schedule will be run for the last time in End (date).
Occurs	Interval in which the task is run. Other settings may be required depending on the settings. Every minute: The schedule is run once a minute. The starting point is calculated from the rate of occurrence and the interval type. Hourly: The schedule is run at defined intervals of a multiple of hours such as every two hours. Under Repeat every, specify after how many hours the schedule is run again. The starting point is calculated from the rate of occurrence and the interval type. Daily: The schedule is run at specified times in a defined interval of days such as every second day at 6am and 6pm. Under Start time, specify the times to run the schedule. Under Repeat every, specify after how many days the schedule is run again. Weekly: The schedule is run at a defined interval of weeks, on a specific day, at a specified time such as every second week on Monday at 6am and 6pm. Under Start time, specify the times to run the schedule. Under Repeat every, specify after how many weeks the schedule is run again. Specify the set day of the week for running the schedule. Weekly: The schedule is run at a defined interval of months, on a specific day, at a specified time such as every second month on the 1st and the 15th at 6am and 6pm. Under Start time, specify the times to run the schedule. Under Repeat every, specify after how many months the schedule is run again. Specify the days of the month (1st - 31st of the month). NOTE: If the Monthly interval type with the sub interval 29, 30 or 31 does not exist in this month, the last day of the month is used. Example: A schedule that is run on the 31st day of each month is run on April 30th. In February, the schedule is run on the 28th (or 29th in leap year). Yearly: The schedule is run at a defined interval of years, on a specific day, at a specified time such as every year on the 1st, the 100th, and the 200th day at 6am and 6pm. Under Start time, specify the times to run the schedule. Under Repeat every, specify after how many years the schedule is run again. Specify the days of the year (1st - 366th day of the year). NOTE: If you select the 366th day of the year, the schedule is only run in leap years. Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday: The schedule is run on a defined day of the week, in specified months, at specified times such as every second Saturday in January and June at 10am. Under Start time, specify the times to run the schedule. Under Repeat every, specify after how many days of the month the schedule is run again. The values 1 to 4, -1 (last day of the week), and -2 (last day but one of the week) are permitted. Specify in which month to run the schedule. The values 1 to 12 are permitted. If the value is empty, the schedule is run each month.
Start time	Fixed start time Enter the time in local format for the chosen time zone. If there is a list of start times, the schedule is started at each of the given times.
Repeat every	Rate of occurrence for running the schedule within the selected time interval.
Last planned run/Next planned run	Activation time calculated by the DBQueue Processor. Activation times are recalculated whilst the schedule is running. The time of the next run is calculated from the interval type, rate of occurrence, and the start time. NOTE: One Identity Manager provides the start information in the time zone of the client where the program was started. Changes due to daylight saving are taken into account.

Related topics

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center