Identity Manager 8.1.5 - System Roles Administration Guide

Assigning system roles to departments, cost centers, and locations Assigning system roles to business roles Adding system roles to the IT Shop Assigning system roles directly to employees Assigning system roles directly to workdesks Adding a system role to system roles

Additional tasks for managing system roles

System role overview Assigning extended properties Excluding system roles

Configuration parameters for system roles Examples of system role inheritance

Example of a system role hierarchy Example of inheritance routes Effect of exclusion definitions

Special features of inheritance through hierarchical roles

Assigning extended properties

Extended properties are meta objects, such as operating codes, cost codes, or cost accounting areas that cannot be mapped directly in One Identity Manager.

To specify extended properties for a system role

Select the Entitlements | System Roles category.
Select the system role in the result list.
Select the Assign extended properties task.
In the Add assignments pane, assign extended properties.
TIP: In the Remove assignments pane, you can remove assigned extended properties.

To remove an assignment
- Select the extended property and double-click .
Save the changes.

For detailed information about extended properties, see the One Identity Manager Identity Management Base Module Administration Guide.

Excluding system roles

Specify, which system role of a pair of system roles, should be take effect if both are assigned. No company resources are inherited by the system role which is not effective.

To exclude system roles

Select the Entitlements | System Roles category.
Select the system role in the result list.
Select the Edit conflicting system roles task.
In the Add assignments pane, assign the system roles that are mutually exclusive to the selected system role.
- OR -

In the Remove assignments pane, remove the system roles that no longer exclude each other.
Save the changes.

Detailed information about this topic

Effectiveness of system roles

Configuration parameters for system roles

The following configuration parameters are available in One Identity Manager after the module has been installed.

Table 7: Configuration parameters for the module
Configuration parameter	Description
QER \| ESet	Preprocessor relevant configuration parameter for controlling the database model components for system roles. If this parameter is set, system components are available. Changes to this parameter require the database to be recompiled.
QER \| Structures \| Inherite \| ESetExclusion	Preprocessor-relevant configuration parameter for defining the effectiveness of system roles If this parameter is set, mutually excluding system roles can be defined. Changes to this parameter require the database to be recompiled.
QER \| Structures \| Inherite \| NoESetSplitting	Specifies whether the components of a system role are already split in the hierarchical role (as previously) or not (current behavior). If this parameter is set, the system roles are not broken down into their individual components until the target of the inheritance.