Creating and editing dynamic roles for application roles
Use this task to assign employees to an application role through dynamic roles. For detailed information about using dynamic roles, see the One Identity Manager Identity Management Base Module Administration Guide.
NOTE: The task Create dynamic role is only available for application roles, which do not have the option Dynamic roles not allowed set.
To create a dynamic role for the application role
- In the Manager in the One Identity Manager Administration category, select the application role.
- Select the Create dynamic role task.
- Enter the required master data. The following applies to dynamic roles for application roles:
- Object class: Select Employee.
- Application role: This data is preset with the selected application role. If these objects fulfill the dynamic role conditions, they become members in the application role.
- Dynamic role: The dynamic role name is made up of the object class and the full name of the application role by default.
- Save the changes.
To edit a dynamic role
- In the Manager in the One Identity Manager Administration category, select the application role.
- Select the Application role overview task.
- In the overview form, click the dynamic role name in the Dynamic roles form element.
-
Select the Change master data task.
- Edit the dynamic role.
- Save the changes.
Related topics
Specifying mutually exclusive application roles
It is possible that employees cannot own certain system roles at the same time. Thus, for example, exception approvers for rule violations may not be rule supervisors at the same time. To implement this behavior, you can specify mutually exclusive application roles. Then you cannot assign these application roles to the same person anymore.
NOTE: Only system roles, which are defined directly as conflicting application roles cannot be assigned to the same employee. Definitions made on parent or child application roles do not effect the assignment.
To configure inheritance exclusion
- In the Designer, set the QER | Structures | ExcludeStructures configuration parameter and compile the database.
To specify inheritance exclusion for application roles
- In the Manager in the One Identity Manager Administration category, select the application role for which you want to define an inheritance exclusion.
- Select the Edit conflicting application roles task.
- In the Add assignments pane, assign the application roles that are mutually exclusive to the selected application role.
- OR -
In the Remove assignments pane, remove the application roles that are no longer mutually exclusive.
- Save the changes.
Assigning subscribable reports to application roles
Use this task to assign subscribable reports to an application role. All employee in this application role can subscribe to reports in the Web Portal. For detailed information about subscribable reports, see the One Identity Manager Report Subscriptions Administration Guide.
NOTE:
-
This function is only available if the Report Subscription Module is installed.
-
The task is only available if a permissions group is assigned to the application role (or a parent application role).
-
Subscribable reports cannot be assigned to the Base roles | Employee Managers, the Base roles | Everyone (Lookup), or the Base roles | Everyone (Change) application role.
To assign subscribable reports to an application role
-
In the Manager, select an application role in the One Identity Manager Administration category.
-
Select the Assign subscribable reports task.
-
In the Add assignments pane, assign reports.
- OR -
In the Remove assignments pane, remove the reports.
- Save the changes.
Assigning extended properties to application roles
Extended properties are meta objects, such as operating codes, cost codes, or cost accounting areas that cannot be mapped directly in One Identity Manager. For detailed information about using extended properties, see the One Identity Manager Identity Management Base Module Administration Guide.
To specify extended properties for an application role
- In the Manager, in the One Identity Manager Administration category, select the Application role.
- Select the Assign extended properties task.
-
In the Add assignments pane, assign extended properties.
TIP: In the Remove assignments pane, you can remove assigned extended properties.
To remove an assignment
- Select the extended property and double-click
.
- Save the changes.
