When you assign new owners to devices or system entitlements in the Web Portal, the new owner should agree with this assignment. An attestation with the PO approval procedure is carried out for this purpose.
When you assign new owners to devices or system entitlements in the Web Portal, the new owner should agree with this assignment. An attestation with the PO approval procedure is carried out for this purpose.
If you want to allow user accounts to be attested by the employees assigned to them, use the EA approval procedure. This approval procedure can be used if the Target System Base Module is installed.
An employee can attest to the correctness of their own main data to confirm that it has been entered correctly, for example. Use the CS approval procedure to do this. Employees are the base object for attestation. The approval procedure is used by default to assign managers to employees who do not have a manager assigned to them (Attestation of initial manager assignment attestation policy).
If you want to make attestation dependent on specific conditions, use the CD approval procedure. This procedure does not determine an attestor. One Identity Manager makes the decision depending on the condition that is formulated in the approval step.
You can use the procedure for any attestation base objects. You create a condition in the approval step. If the condition returns a result, the approval step is approved through One Identity Manager. If the condition does not return a result, the approval step is denied by One Identity Manager. If there are no further approval steps, the approval procedure is either finally granted or denied.
To enter a condition for the CD approval procedure
Edit the approval step properties.
In the Condition input field, enter a valid WHERE clause for database queries. You can enter the SQL query directly or with a wizard.
External employees should be attestation by their managers. If no manager is assigned, the members of a designated application role must attest the employees.
You can find all external employees, who have managers assigned to them by using the CD approval procedure and the following condition.
EXISTS
(SELECT 1 FROM
(SELECT xobjectkey FROM Person WHERE (IsExternal = 1)
AND (EXISTS
(SELECT 1 FROM
(SELECT UID_Person FROM Person WHERE 1 = 1) as X
WHERE X.UID_Person = Person.UID_PersonHead) )) as X
WHERE X.xobjectkey = AttestationCase.ObjectKeyBase)
If the condition is fulfilled, the external employee's manager can attest the employee. To do this, add an approval step in the positive approval path with the CM approval procedure.
If the condition is not fulfilled, the employee is attested by the member of a designated application role. To do this, add an approval step in the negative approval path with the OR approval procedure and assign the application role.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center