Chat now with support
Chat with Support

Identity Manager 8.1 - Identity Management Base Module Administration Guide

Basics for Mapping Company Structures in One Identity Manager Managing Departments, Cost Centers and Locations Working with Dynamic Roles Employee administration
One Identity Manager users for employee administration Basic data for employee master data Entering employee master data Employee's central user account Employee's central password Employee's default email address Mapping multiple employee identities Disabling and deleting employees Password policies for employees Limited access to One Identity Manager Assigning company resources to employees Displaying the origin of an employee's roles and entitlements Analyzing role memberships and employee assignments Additional tasks for managing employees Determining an employee‘s language Determining an employee's working hours Employee reports
Managing Devices and Workdesks Managing Resources Set up Extended Properties Appendix: Configuration parameters for managing departments, cost centers, and locations Appendix: Configuration parameters for managing employees Appendix: Configuration Parameters for Managing Devices and Workdesks

One Identity Manager Users for Organizations

The following users are used for the administration of departments, cost centers and locations.

Table 5: User
User Task

Administrators for organizations

 

Administrators must be assigned to the application role Identity Management | Organizations | Administrators.

Users with this application role:

  • Set up and edit departments, cost centers and locations.
  • Assign company resources to departments, cost centers and locations.
  • Administrate application roles for role approvers, role approvers (IT), and attestors.
  • Set up other application roles as required.

One Identity Manager administrators

 

  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required.

  • Create system users and permissions groups for non-role-based login to administration tools in Designer as required.

  • Enable or disable additional configuration parameters in Designer as required.

  • Create custom processes in Designer as required.

  • Create and configures schedules as required.

  • Create and configure password policies as required.

Approvers for organizations

 

Attestors must be assigned to the application role Identity Management | Organizations | Attestors or a child application role.

Users with this application role:

  • Attest correct assignment of company resources to departments, cost centers and locations for which they are responsible.
  • Can view master data for departments, cost centers and locations but cannot edit them.

NOTE: This application role is available if the module Attestation Module is installed.

Approvers for organizations

 

Role approvers must be assigned to the Identity Management | Organizations | Role approvers application role or a child application role.

Users with this application role:

  • Are approvers for the IT Shop.
  • Approve request from departments, cost centers, and locations for which they are responsible.

Approvers (IT) for organizations

 

IT role approvers must be assigned to Identity Management | Organizations | Role approvers (IT) or a child application role.

Users with this application role:

  • Are IT role approvers for the IT Shop.
  • Approve request from departments, cost centers, and locations for which they are responsible.

Base Data for Structuring Departments, Cost Centers and Locations

The following basic information is relevant for building up hierarchical roles in One Identity Manager.

  • Configuration parameter

    Use configuration parameters to configure the behavior of the system's basic settings. One Identity Manager provides default settings for different configuration parameters. Check the configuration parameters and modify them as necessary to suit your requirements.

    Configuration parameters are defined in the One Identity Manager modules. Each One Identity Manager module can also install configuration parameters. You can find an overview of all configuration parameters in Base data | General | Configuration parameters in Designer.

  • Role classes

    Role classes form the basis of mapping from hierarchical roles in One Identity Manager. Role classes are used to group similar roles together.

  • Role types

    Create role types in order to classify roles. Roles types can be used to map roles in the user interface, for example.

  • Functional areas

    To analyze rule checks for different areas of your company in the context of identity audit, you can set up functional areas. Functional areas can be assigned to roles. You can enter criteria that provide information about risks from rule violations for functional areas and roles.

  • Attestors

    In One Identity Manager you can assign departments, cost centers and locations to employees who can be brought in as attestors in attestation cases, provided that the approval workflow is set up accordingly. To do this, assign the departments, cost centers, and locations to application roles for attestors. A default application role for attestors is available in One Identity Manager. Assign employees that are authorized to attest permissions, requests or other data stored in One Identity Manager to this application role. You may create other application roles as required. For detailed information about implementing and editing application roles, see the One Identity Manager Authorization and Authentication Guide.

  • Approvers and Approvers (IT)

    In One Identity Manager you can assign departments, cost centers and locations to employees who can be brought in as approvers in approval processes for IT Shop requests, provided that the approval workflow is set up accordingly. To do this, assign the departments, cost centers, and locations to application roles for approvers. Default application roles for approvers and approvers (IT) are available in One Identity Manager. Assign employees that are authorized to approve requests in the IT Shop to this application role. You may create other application roles as required. For detailed information about implementing and editing application roles, see the One Identity Manager Authorization and Authentication Guide.

Detailed information about this topic

Role classes

Role classes form the basis of mapping hierarchical roles in One Identity Manager. Role classes are used to group similar roles together. The following role classes are provided by default for mapping organizations in One Identity Manager:

  • Department
  • Cost center
  • Location

NOTE: You cannot delete the default role classes. However, you can edit their master data.

To edit role classes

  1. Select the Organizations | Basic configuration data | Role classes category.
  2. Select a role class in the result list. Select Change master data.

    - OR -

    Click in the result list toolbar.

  3. Edit the role class's master data.
  4. Save the changes.

Enter the following master data for a role class.

Table 6: Role class properties

Property

Description

Role classes

Role class description The role class is displayed under this name in the navigation view.

Attestors

Applications role whose members are authorized to approve attestation instances for all roles in this role class.

To create a new application role, click . Enter the application role name and assign a parent application role.

NOTE: This property is available if the Attestation Module is installed.

Description

Spare text box for additional explanation.

Inherited top-down

Direction of inheritance top-down.

Top down inheritance is defined for departments, cost centers, locations, and application roles.

Inherited bottom-up

Direction of inheritance bottom-up

Assignments allowed

Specifies whether assignments of respective object types to roles of this role class are allowed in general.

Direct assignments allowed

Specifies whether respective object types can be assigned directly to roles of this role class.

Related Topics

Role types

Create role types in order to classify roles. Roles types can be used to map roles in the user interface, for example.

To edit role types

  1. Select Organizations | Basic configuration data | Role types.
  2. Select the role type in the result list. Select Change master data.

    - OR -

    Click in the result list toolbar.

  3. Edit the role type's master data.
  4. Save the changes.

Enter the following master data for a role type:

Table 7: Role type properties
Property Description
Role type Role type description
Description Spare text box for additional explanation.
Related Documents