Identity Manager 8.0 - Business Roles Administration Guide

Analysis Evaluation

You should always compare the business roles with the custom structures in the case of role mining, because the mathematical methods of cluster analysis only forecast a trend. Apart from renaming nodes, you can also edit employee assignments and business role permissions directly. You can create new business roles with the Analyzer and assign them directly to employees. This makes adding and moving employees into a certain business role very simple.

View the results of the analysis in a window with various panes in the Analyzer.

Figure 15: Presentation of Analysis Results

On the left, the clusters found by the analysis are displayed hierarchically on a tab. The nodes mapped here are named though the first employee found, when analysis data is selected with wizards. The naming of predefined analysis methods follows specified rules in the program settings. You can change names using F2 or Rename in the context menu.

The number of occurrences is displayed graphically in the columns <Employees> and <Permissions>. The display is normed in both columns, which means, the group with the highest number of employees or permissions assigned to it corresponds to 100% and is represented with maximized bars.

When a structure node is selected the employees (above) and permissions (below) contained in it are listed in view (2). You can use the color similarity bar to help identify where permissions overlap with each other and how far the user’s actual permissions situation fits to the permissions assignment of the selected role. Matching group memberships are green, but non-matching, additional group memberships are red. Directly below this, you see each of the employee’s permissions for the analyzed target systems separately. A permissions weighting is displayed depending on the program settings.

You can analyze permissions memberships of individual employees by multi-selecting in the list of employees and running a direct comparison.

To compare employee memberships

• Select employees in view (2) using CTRL + SELECT or SHIFT + SELECT.
• Click Compare in the context menu to start comparing.

Transferring Changes

You can use the Analyzer to create new business roles and assign employees directly to them or move employees and permissions into specific business roles.

To transfer changes to the One Identity Manager database

1. Mark the business roles you want to transfer, in the hierarchy.

   Use the context menu items Insert and Add recursively to do this. You can delete business roles from the data transfer using the context menu item Remove.

2. Select Database | Save to database... from menu to start the data transfer wizard and click Next to continue.
3. Select the role class under which the business role will be created in the One Identity Manager database.

   Use Add a new role to create a new role class.

4. Select the save options.

   Table 26: Save Options for Data

   Save Option	Meaning
   Delete existing objects in role class	Deletes current objects in the selected role class from the One Identity Manager database.
   Business roles do not inherit	Disables inheritance of assignments by business roles. NOTE: After you have checked the assignments, remove the option Employee do not inherit from the business roles. Use the program "Manager" to do this.
   Delete direct assignments	Removes direct permissions assignments to the employees’ user accounts. WARNING: Only set this option if you have ensured that the permissions are inherited by the employees through business roles. Otherwise this option results in a loss of permissions.
   Attest new roles	New business roles must go through an attestation case. NOTE: This function is only available if the Attestation Module is installed.

5. Click Finished to save the data.