Effectiveness of entitlement assignments
When E-Business Suite entitlements are assigned to user accounts an employee may obtain two or more groups that are not permitted in this combination. To prevent this, you can declare mutually exclusive entitlements. To do this, you specify which of the two entitlements should become active on user accounts if both are assigned.
It is possible to assign an excluded entitlements directly, indirectly, or by IT Shop request at any time. One Identity Manager determines whether the assignment is effective.
NOTE:
- You cannot define a pair of mutually exclusive entitlements. This means that the definition "Entitlement A excludes entitlement B" AND "Entitlement B excludes entitlement A" is not permitted.
- Each entitlement to be excluded from another entitlement must be declared separately. Exclusion definitions cannot be inherited.
The effectiveness of the assignments is stored in the EBSUserInResp table using the ValidTo and XOrigin columns, and in the BaseTreeHasEBSResp table, using the XIsInEffect column.
Example of the effectiveness of entitlements
- The entitlements A, B, and C are defined in an E-Business Suite system.
- Entitlement A is assigned through the "Marketing" department, entitlement B through the "Finance" department, and entitlement C through the "Control group" business role.
Clara Harris has a user account in this system. She primarily belongs to the "marketing" department. The "Control group" business role and the "Finance" department are assigned to her secondarily. Without an exclusion definition, the user account obtains all the entitlements A, B, and C.
You need to use a suitable method to ensure that a employee cannot be assigned the entitlements A and B at the same time. This means that entitlements A and B are mutually exclusive. A user with entitlement C also cannot be assigned entitlement B. Entitlements B and C are therefore mutually exclusive.
Table 30: Definition of excluded entitlements (EBSRespExclusion table)
|
Entitlement A |
|
|
Entitlement B |
Entitlement A |
|
Entitlement C |
Entitlement B |
Table 31: Effective assignments
|
Ben King |
Marketing |
Entitlement A |
|
Jan Bloggs |
Marketing, finance |
Entitlement B |
|
Clara Harris |
Marketing, finance, control group |
Entitlement C |
|
Jenny Basset |
Marketing, control group |
Entitlement A
Entitlement C |
Only the entitlement C assignment is in effect for Clara Harris and is published in the target system. If Clara Harris leaves the "control group" business role at a later date, entitlement B also takes effect.
Entitlements A and C are in effect for Jenny Basset because no exclusions are defined between these two entitlements. If this should not be allowed, define a further exclusion for entitlement C.
Table 32: Excluded entitlements and effective assignments
|
Jenny Basset
|
Marketing |
Entitlement A |
|
Entitlement C
|
|
Control group |
Entitlement C |
Entitlement B
Entitlement A |
Prerequisites
- The QER | Structures | Inherite | GroupExclusion configuration parameter is set.
- Mutually exclusive entitlements belong to the same E-Business Suite system.
To exclude entitlements
- Select the Oracle E-Business Suite | Entitlements category.
- Select an entitlement in the result list.
- Select the Exclude E-Business Suite entitlements task.
- In the Add assignments pane, assign the entitlements that are excluded by the selected entitlement.
- OR -
In the Remove assignments, delete the entitlements that no longer exclude each other.
- Save the changes.
Related topics
Inheritance of E-Business Suite entitlements based on categories
In One Identity Manager, entitlements can be selectively inherited by user accounts. For this purpose, the entitlements and the user accounts are divided into categories. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains different tables. Use the user account table to specify categories for target system dependent user accounts. In the other tables enter your categories for the permissions. Each table contains the Position 1 to Position 31 category positions.
Every user account can be assigned to one or more categories. Each entitlement can also be assigned to one or more categories. If at least one of the category items between the user account and the assigned entitlement is the same, the entitlement is inherited by the user account. If the entitlement or the user account is not classified in a category, the entitlement is also inherited by the user account.
NOTE: Inheritance through categories is only taken into account when entitlements are assigned indirectly through hierarchical roles. Categories are not taken into account when entitlements are directly assigned to user accounts.
Table 33: Category examples
| 1 |
Default user |
Default permissions |
| 2 |
System users |
System user permissions |
| 3 |
System administrator |
System administrator permissions |
Figure 2: Example of inheriting through categories.
To use inheritance through categories
- Define the categories in the E-Business Suite system.
- Assign categories to user accounts through their master data.
- Assign categories to entitlements through their master data.
Related topics
Invalid entitlement assignments
Entitlement assignments cannot be deleted. Different inheritance processes in One Identity Manager can cause an entitlement assignment to become invalid. The following processes may be responsible for this:
-
Cancelation of a requested entitlement assignment or reaching the expiration date of an assignment
-
Removal of a direct entitlement assignment in One Identity Manager
-
Deletion of the assignment of an entitlement to hierarchical or dynamic roles or system roles
-
Deletion of the user account’s membership in hierarchical or dynamic roles
-
Deletion of the assignment of a user account to system roles
-
Exclusion of entitlements
-
Changes to the category to which a user account or an entitlement is classified
-
Disabling/deletion/security risk to employees and handling of user accounts through an account definition
For user accounts with the Full managed manage level, the account definition defines how entitlement assignments are handled if the employee is classified as a security risk, or the employee is disabled or marked for deletion. If you do not want to retain the entitlement assignments, they are marked as invalid.
-
Disabling user accounts
If the user account is managed by an account definition, the account definition defines how entitlement assignments are handled. If you do not want to retain the entitlement assignments, they are marked as invalid.
For invalid entitlement assignments, the validity period is in the past. If the assignments are inherited or requested, or if an entitlement assignment is deleted in the Manager, XOrigin is assigned a value of 16.
If the cause of a entitlement assignment becoming invalid is resolved, the final validity date and XOrigin are reset to their original values.
Related topics
Overview of all assignments
The Overview of all assignments report is displayed for some objects, such as authorizations, compliance rules, or roles. The report finds all the roles, for example, departments, cost centers, locations, business roles, and IT Shop structures in which there are employees who own the selected base object. In this case, direct as well as indirect base object assignments are included.
Examples
- If the report is created for a resource, all roles are determined in which there are employees with this resource.
- If the report is created for a group or another system entitlement, all roles are determined in which there are employees with this group or system entitlement.
- If the report is created for a compliance rule, all roles are determined in which there are employees who violate this compliance rule.
- If the report is created for a department, all roles are determined in which employees of the selected department are also members.
- If the report is created for a business role, all roles are determined in which employees of the selected business role are also members.
To display detailed information about assignments
Figure 3: Toolbar of the Overview of all assignments report.
Table 34: Meaning of icons in the report toolbar
|
|
Show the legend with the meaning of the report control elements |
|
|
Saves the current report view as a graphic. |
|
|
Selects the role class used to generate the report. |
|
|
Displays all roles or only the affected roles. |
button in a role's control, you display all employees in the role with the base object.