Chat now with support
Chat with Support

Identity Manager 9.1.2 - Business Roles Administration Guide

Managing business roles
One Identity Manager users for business roles Hierarchical role structure basic principles Basic principles for assigning company resources Basics of calculating inheritance Preparing business roles for company resource assignments Base data for business roles Creating and editing business roles Assigning employees, devices, and workdesks to business roles Assigning business roles to company resources Analyzing role memberships and employee assignments Setting up IT operational data for business roles Creating dynamic roles for business roles Assign organizations Defining inheritance exclusion for business roles Assigning extended properties to business roles Creating assignment resources for application roles Dynamic roles for business roles with incorrectly excluded employees Certification of business roles Reports about business roles
Role mining in One Identity Manager

Analyzing role memberships and employee assignments

The Overview of all assignments report is displayed for some objects, such as authorizations, compliance rules, or roles. The report finds all the roles, for example, departments, cost centers, locations, business roles, and IT Shop structures in which there are employees who own the selected base object. In this case, direct as well as indirect base object assignments are included.

Examples:

  • If the report is created for a resource, all roles are determined in which there are employees with this resource.

  • If the report is created for a group or another system entitlement, all roles are determined in which there are employees with this group or system entitlement.

  • If the report is created for a compliance rule, all roles are determined in which there are employees who violate this compliance rule.

  • If the report is created for a department, all roles are determined in which employees of the selected department are also members.

  • If the report is created for a business role, all roles are determined in which employees of the selected business role are also members.

To display detailed information about assignments

  • To display the report, select the base object from the navigation or the result list and select the Overview of all assignments report.

  • Click the Used by button in the report toolbar to select the role class for which you want to determine whether roles exist that contain employees with the selected base object.

    All the roles of the selected role class are shown. The color coding of elements identifies the role in which there are employees with the selected base object. The meaning of the report control elements is explained in a separate legend. To access the legend, click the icon in the report's toolbar.

  • Double-click a control to show all child roles belonging to the selected role.

  • By clicking the button in a role's control, you display all employees in the role with the base object.

  • Use the small arrow next to to start a wizard that allows you to bookmark this list of employees for tracking. This creates a new business role to which the employees are assigned.

Figure 13: Toolbar of the Overview of all assignments report.

Table 14: Meaning of icons in the report toolbar

Icon

Meaning

Show the legend with the meaning of the report control elements

Saves the current report view as a graphic.

Selects the role class used to generate the report.

Displays all roles or only the affected roles.

Setting up IT operational data for business roles

To create user accounts for an employee with the Full managed manage level, you need to know which IT operating data is required. The operating data required for each specific target system is defined with its business roles, departments, locations, or cost centers. An employee is assigned a primary business role, primary location, primary department, or primary cost center. The necessary IT operating data is ascertained from these assignments and used in creating the user accounts. Default values are used if valid IT operating data cannot be found over the primary roles.

You can also specify IT operating data directly for a specific account definition.

Example:

Normally, each employee in department A obtains a default user account in the domain A. In addition, certain employees in department A obtain administrative user accounts in the domain A.

Create an account definition A for the default user account of the domain A and an account definition B for the administrative user account of domain A. In the IT operating data mapping rule for the account definitions A and B, specify the Department property in order to determine the valid IT operating data.

Specify the effective IT operating data of department A for the domain A. This IT operating data is used for standard user accounts. In addition, for department A, specify the effective IT operating data of account definition B. This IT operating data is used for administrative user accounts.

For more information, see the One Identity Manager Target System Base Module Administration Guide.

To define IT operating data

  1. In the Manager, select the Business roles > <role class> category.

  2. Select the role in the result list.

  3. Select the Edit IT operating data task.

  4. Click Add and enter the following data.

    • Effects on: Specify an IT operating data application scope. The IT operating data can be used for a target system or a defined account definition.

      To specify an application scope

      1. Click next to the field.

      2. Under Table, select the table that maps the target system for select the TSBAccountDef table or an account definition.

      3. Select the specific target system or account definition under Effects on.

      4. Click OK.

    • Column: Select the user account property for which the value is set.

      In the menu, you can select the columns that use the TSB_ITDataFromOrg script in their template. For more information about this, see the One Identity Manager Target System Base Module Administration Guide.

    • Value: Enter a fixed value to assign to the user account's property.

  5. Save the changes.
ClosedIt operating data for target systems

Modify IT operating data

If IT operating data changes, you must transfer the changes to the existing user accounts. To do this, templates must be rerun on the affected columns. Before you can run the templates, you can check what effect a change to the IT operating data has on the existing user accounts. You can decide whether the change is transferred to the One Identity Manager database in the case of each affected column in each affected database.

Prerequisites

  • The IT operating data of a business role have been changed.

    - OR -

  • The default values in the IT operating data template were modified for an account definition.

NOTE: If the assignment of an employee to a primary business role changes, the templates are automatically run.

To run the template

  1. In the Manager, select the <target system type> > Basic configuration data > Account definitions > Account definitions category.

  2. Select an account definition in the result list.

  3. Select the Run templates task.

    This displays a list of all user accounts that were created with the selected account definition and whose properties were changed by modifying the IT operating data. That means:

    • Old value: Value of the object property before changing the IT operating data.

    • New value: Value of the object property after changing the IT operating data.

    • Selection: Specifies whether the new value is copied to the user account.

  4. Mark all the object properties in the selection column that will be given the new value.

  5. Click Apply.

    The templates are applied to all selected user accounts and properties.

Creating dynamic roles for business roles

Use this task to define dynamic roles for individual business roles. Dynamic roles are used to specify role memberships dynamically. Employees, devices, and workdesks are not permanently assigned to a role, just when they fulfill certain conditions. A check is performed regularly to assess which employees (devices or workdesks) fulfill these conditions. This means the role memberships change dynamically. For example, company resources can be assigned dynamically to all employees in a business role in this way; if an employee leaves the department they immediately lose the resources assigned to them.

Dynamic roles always relate to the secondary role assignment of an employee object. Therefore secondary assignment of employees, devices, and workdesks to role classes must be permitted. If necessary, further configuration settings need to be made.

NOTE: The Create dynamic role task is only available for business roles that do not have the Dynamic roles not allowed option set.

For more detailed information about creating and editing dynamic roles, see the One Identity Manager Identity Management Base Module Administration Guide.

To create a dynamic role for a business role

  1. In the Manager, select the Business roles > <role class> category.

  2. Select a business role in the result list.

  3. Select the Create dynamic role task.

  4. Enter the required main data.

  5. Save the changes.

To edit a dynamic role

  1. In the Manager, select the Organizations > <role class> > Dynamic roles category.

  2. Select a business role in the result list.

  3. Open the business role's overview form.

  4. In the Dynamic roles form element, click on the name of the dynamic role.

  5. Select the Change main data task.

  6. Edit the dynamic role's main data.

  7. Save the changes.

Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating