Configuration parameter | Active Meaning |
---|---|
QER\Structures\RelatedStructures |
Preprocessor relevant configuration parameter for controlling the model parts that specify relations between roles. Changes to the parameter require recompiling the database. If the parameter is set, you can specify which roles are mutually exclusive. |
Use this task to specify between which roles relations exist. This mapping is only for informative use. Parent node definitions do not provide information about role relations of subordinate roles.
To define relations between departments
To define relations between cost centers
To define relations between locations
One Identity Manager makes various reports available containing information about the selected base object and its relations to other One Identity Manager database objects. The following reports are available for departments, cost centers and locations.
|
NOTE: Other sections may be available depending on the which modules are installed. |
Report | Description |
---|---|
Overview of all Assignments | This report finds all the roles in which employees from the selected department, cost center or location are also members. |
Data quality of department members (cost center members) | This report evaluates the data quality of employee data records. It takes all employees in the department or cost center into account. |
Show historical memberships |
This report lists all members of the selected department, cost center or location and the duration of their membership. |
Employees per department |
This report contains the number of employee per department. The primary and secondary assignments to organizations are taken into account. You can find this report in the category My One Identity Manager. |
Employees per cost center |
This report contains the number of employee per cost center. The primary and secondary assignments to organizations are taken into account. You can find this report in the category My One Identity Manager. |
Employees per location |
This report contains the number of employee per location. The primary and secondary assignments to organizations are taken into account. You can find this report in the category My One Identity Manager. |
Dynamic roles are used to specify role memberships dynamically. Employees, devices or workdesks are not permanently assigned to a role, just when they fulfill certain conditions. A check is performed regularly to assess which employees (devices or workdesks) fulfill these conditions. The means the role memberships change dynamically. For example, company resources can be assigned dynamically to all employees in a department in this way; if an employee leaves the department they immediately lose the resources assigned to them.
Role memberships through dynamic roles are implemented as indirect, secondary assignments. Therefore secondary assignment of employees, devices and workdesks to role classes must be permitted. If necessary, further configuration settings need to be made.
All external employees are added to a new dynamic role. These employees should be assigned to a company resource ABC. The dynamic role is initially defined with the following data:
Dynamic role | External employees |
Description | All external employees |
Object class | PERSON |
Condition | IsExternal = 1 |
Department | A_1 |
The department A_1 is now assigned the resource ABC. All employees that fulfill the condition at the time the dynamic role was defined, are assigned to department A_1 and therefore inherit the resource ABC. Employees who fulfill the condition at a later date, are assigned to department A_1 from that moment. Conversely, employees in department A_1 are removed the moment the are no longer known as external employees by One Identity Manager. The resource ABC is no longer available to those employees assuming they have not been assigned the resource through other channels.
You can create dynamic roles for departments, cost centers, locations, business roles, application roles and IT Shop nodes. This allows you to specify memberships in these roles.
To create a dynamic role
To edit a dynamic role
For more information about dynamic roles for application roles, see the One Identity Manager Application Roles Administration Guide.
© 2023 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy