System roles make it easier to assign company resources that are frequently required or rather that are always assigned together. For example, new employees in the finance department should be provided, by default, with certain system entitlements for Active Directory and for SAP R/3. In order to avoid a lot of separate assignments, group these company resources into a package and assign this to the new employee. The packages are referred to as system role in the One Identity Manager.
Using system roles, you can group together arbitrary company resources. You can assign these system roles to employees, workdesks or roles or you can request them through the IT Shop. Employees and workdesks inherit company resources assigned to the system roles. You can structure system roles by assigning other system roles to them.
One Identity Manager components for managing system roles are available if the configuration parameter "QER/ESet" is set.
The following users are used for managing system roles.
Employee responsible for individual company resources
The users are defined using different application roles for administrators and managers.
Users with these application roles:
|One Identity Manager administrators||
By assigning system roles to employees, workdesks or hierarchical roles and through the associated inheritance of company resources, an employee may obtain company resources which should not be assigned to the same person at the same time in this combination. To prevent this, you can declare mutually exclusive system roles. To do this you specify which system role of a pair of system roles, should be take effect if both are assigned. No company resources are inherited by the system role which is not effective.
It is possible, to assign employees, workdesks and company resources directly, indirectly or by IT Shop request to an excluded system role. This can be done at any time. One Identity Manager subsequently determines whether the assignment takes effect and the company resources are inherited.
The effect of the assignments is mapped in the tables PersonHasESet, BaseTreeHasESet and WorkdeskHasESet through the column XIsInEffect.
Clara Harris directly assigns the system role "Marketing". She obtains the system role "Finance" through her membership in a business role, the system "Controlling" through an IT Shop request. Clara Harris obtains all the system roles without an exclusion definition and therefore the associated permissions.
By using suitable controls, you want to prevent an employee from being able to trigger a request and to pay invoices. That means, the system roles "Finance" and "Marketing" are mutually exclusive. An employee that checks invoices may not be able to make invoice payments as well. That means, the system roles "Finance" and "Controlling" are mutually exclusive.
|Effective business role||Excluded System Role|
|Employee||Member in System Role||Effective business role|
|Jan Bloggs||Marketing, finance||Finance|
|Clara Harris||Marketing, finance, controlling||Controlling|
|Jenny Basset||Marketing, Controlling||Marketing, Controlling|
Only the system role "Controlling" is in effect for Clara Harris. If the system role "Controlling" is removed from Clara, the "Finance" system role assignment is reinstated.
Jenny Basset retains the system roles "Marketing" and "Controlling" because there is no exclusion defined between the two system roles. That means that the employee is authorized to trigger request and to check invoices. If you want to prevent that as well, define further exclusion for the system role "Controlling".
|Employee||Member in System Role||Excluded System Role (UID_ESetExcluded)||Effective business role|
System role types identify the type of company resources that the system role is used to grouped together. You can, for example, define system role types for system roles in which you group different target system groups.
To edit a system role type
- OR -
Click in the result list toolbar.