Chat now with support
Chat with Support

Identity Manager 9.3 - IT Shop Administration Guide

Setting up an IT Shop solution
One Identity Manager users in the IT Shop Implementing the IT Shop Using the IT Shop with the Application Governance Module Requestable products Preparing products for requesting Assigning and removing products Preparing the IT Shop for multi-factor authentication Assignment requests Delegations Creating IT Shop requests from existing user accounts, assignments, and role memberships Adding system entitlements automatically to the IT Shop Deleting unused application roles for product owners
Approval processes for IT Shop requests
Approval policies for requests Approval workflows for requests Determining effective approval policies Selecting responsible approvers Request risk analysis Testing requests for rule compliance Approving requests from an approver Automatically approving requests Approval by peer group analysis Approval recommendations for requests Gathering further information about a request Appointing other approvers Escalating an approval step Approvers cannot be established Automatic approval on timeout Halting a request on timeout Approval by the chief approval team Approving requests with terms of use Using default approval processes
Request sequence
The request overview Requesting products more than once Requests with limited validity period Relocating a customer or product to another shop Changing approval workflows of pending requests Requests for employees Requesting change of manager for an employee Canceling requests Unsubscribe products Notifications in the request process Approval by mail Adaptive cards approval Requests with limited validity period for changed role memberships Requests from permanently deactivated identities Deleting request procedures and deputizations
Managing an IT Shop
IT Shop base data Setting up IT Shop structures Setting up a customer node Deleting IT Shop structures Restructuring the IT Shop Templates for automatically filling the IT Shop Custom mail templates for notifications Product bundles Recommendations and tips for transporting IT Shop components with the Database Transporter
Troubleshooting errors in the IT Shop Configuration parameters for the IT Shop Request statuses Examples of request results Example of defining request properties

Determining managers or members of a role as approvers

Managers can be assigned to identities and hierarchical roles If these managers can approve requests, you can use the following approval procedures. In addition, members with a specified hierarchical role can be determined as approvers.

ClosedD0 - Manager of shelf's department
ClosedD1 - Manager of shop's department
ClosedD1 - Manager of shopping center's department
ClosedDP - Manager of department given in the request
ClosedP0 - Manager of shelf's cost center
ClosedP1 - Manager of shop's cost center
ClosedP2 - Manager of shopping center's cost center
ClosedPP - Manager of cost center given in the request
ClosedMS - Manager of the role to request
ClosedOM - Manager of a specific role
ClosedOR - Members of a certain role
Related topics

Determining owners as approvers

Special owners are assigned to various objects in One Identity Manager. Different approval procedures can be used to determine these owners as approvers.

ClosedH0 - Shelf owner
ClosedH1 - Shop owner
ClosedH2 - Shopping center owner
ClosedOA - Product owner
ClosedKA - Product owner and additional owner of the Active Directory Group
ClosedPA - Additional owner of the Active Directory group
ClosedPG - owners of the requested privileged access request
ClosedBA - Owner of the application
ClosedOX - Owner of the object in any request parameter of the request properties
Related topics

Determining approvers via products requested by request parameter

If the object to request is given as a request parameter in the request and the owners of the object are going to be determined as approvers, use the OX approval procedure.

The approval procedure determines the owner (application role) of an object specified in a request parameter to be the approver. The application role is assigned to the object through a foreign key column. The name of the request parameter is given on the approval step and the name of the table column that references the application role. The approval procedure can be used for all products that are assigned a request property that uses this request parameter.

To use the OX approval procedure

  1. Create a multi requestable/unsubscribable resource for use in the IT Shop.

  2. Create a service item for this resource and assign a request property to it.

  3. Define the request parameters for this request property. At least one parameter must have the following settings:

    • Parameter name: Name of the parameter

    • Data source: Table

    • Table column (value query): Object key (XObjectKey) of the table containing the requested objects.

  4. Create an approval workflow with an approval step that uses the OX approval procedure.

    • Parameter name: Parameter name of the previously defined request parameter.

    • Column name: Name of the column that refers to the application role from the table selected in the request parameter.

  5. Create an approval policy and assign it to the approval workflow.

  6. Assign this approval policy to the service item.

Example: Requesting Microsoft Entra ID role eligibilities

Managers can request Microsoft Entra ID role eligibilities for their employees. When making a request, the specific Microsoft Entra ID role is given as request parameter. Members of the application role assigned to this role as owners are determined as approvers.

One Identity Manager provides the following objects for such requests as default:

  • A multi requestable/unsubscribable resource: Microsoft Entra ID role eligibility

  • A service item for this resource to which the Microsoft Entra ID role eligibility request property is assigned

  • The AADRole request parameter (Microsoft Entra ID role) with the AADRole - XObjectKey column.

  • The Approval of Microsoft Entra ID role eligibility requests approval policy

  • The Approval of Microsoft Entra ID role eligibilities approval workflow with the Owner of Microsoft Entra ID role approval step

  • Approval step properties

    • Approval procedure: OX

    • Parameter name: AADRole

    • Column name: UID_AERoleOwner

The OX approval procedure determines all members of the application role entered in the UID_AERoleOwner column for the Microsoft Entra ID role given in the request.

Related topics

Determining special approvers

Special approvers are assigned to various objects in One Identity Manager. Different approval procedures can be used to determine these special approvers as approvers.

ClosedDR - Role approvers of the department given in the request
ClosedDI - Role approvers (IT) of the department given in the request
ClosedPR - Role approvers of the cost center given in the request
ClosedPI - Role approvers (IT) of the cost center given in the request
ClosedRD - Role approvers of the recipient's primary department
ClosedRL - Role approvers of the recipient's primary location
ClosedRO - Role approvers of the recipient's primary business role
ClosedRP - Role approvers of the recipient's primary cost center
ClosedID - Role approvers (IT) of recipient's department
ClosedIL - Role approvers (IT) of recipient's location
ClosedIO - Role approvers (IT) of the recipient's primary business role
ClosedIP - Role approvers (IT) of recipient's cost center
ClosedBE - Approver of the application entitlement
ClosedOT - Attestor of the service item to assign
ClosedOC - Exception approvers for violated rules
ClosedOH - Exception approver for worst rule violation
Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating