Classification Module 6.1.1 - User Guide

Grammar Match Details

The person name grammar is made up of building blocks for each language/country. These entities are then referenced in the extractor as “person_all/fullnames/all”.

• person_engus

• person_engcn

• person_enggb

• person_enggr

• person_engin

• person_engjp

• person_engru

• person_frefr

• person_gerde

• person_spaes

• person_all

The following extractors not currently referenced in the sample taxonomies that are shipped with Identity Manager Data Governance Edition.

Grammar Pattern Match Details

Grammar Pattern Match Details

Grammar Pattern Match Details

Grammar Pattern Match Details

Grammar Pattern Match Details

Grammar Pattern Match Details

Grammar Pattern Match Details

Grammar Pattern Match Details

This section describes the regular expressions used within the templates.

This glossary contains definitions taken from Microsoft publications.

A

Access Control Entry (ACE)

An entry in an access-control list (ACL) that contains a set of access rights and a security identifier (SID) that identifies a trustee, such as a user or group, for whom the rights are allowed, denied, or audited.

Access Control List (ACL)

A list of access-control entries (ACEs) that define the security protections on an object. There are two kinds of ACLs that can appear in an object's security descriptor: a discretionary ACL (DACL) that controls access to the object, and a system ACL (SACL) that controls auditing of attempts to access the object.

Active Directory (AD)

The Windows directory service.

Administrative rights

The rights granted to a member of the Administrators local group. This member can perform such actions as creating user accounts, creating groups, and adding group members.

Approval Process

Process for requesting products for a customer in the IT Shop. The approval process is set up with approval policies that can contain several approval levels. There can be several approval steps defined in an approval level. A different group of approvers can be specified for each approval step.

Approver

The approver is an employee who grants or denies approval in a request procedure (renewal or cancellation).

Approval Policy

Specifies which approval workflow should be used in the IT Shop for an attestation case or a request (renewal or cancellation).

Approval Procedure

Finds the attestor for the current attestation case or the approver for the current request (renewal or cancellation) in the IT Shop.

Attestation

A method for authorizing data or internal rules. Attestation functionality in Identity Manager is used by managers or others in authority to certify the correctness of editing permissions, entitlements, requests or exception approvals on a regular or manual basis.

Attestation Instance

Objects that are created as soon as attestation is automatically or manually started. When attestation is triggered, Identity Manager creates an attestation case for each attestation object. Attestation data is saved in the attestation instance. This includes the attestation object, status (open, approved, denied), date of attestation, and the attestor.

Attestor

The person that will carry out the attestation. Attestors either approve or deny data presented in an attestation instance.

C

Child object

An object that is the immediate subordinate of another object in a hierarchy. A child object can have only one immediate superior or parent object.

Company Policy

A configurable policy based on your company guidelines. Policy violations can be found and approved in retrospect. Attestations and risk assessments can be executed through company policies.

D

Designer

The main configuration interface for Identity Manager.

Distinguished Name (DN)

The fully qualified name of an object in a hierarchical system. Distinguished names are used for all Active Directory objects and in the Domain Name System (DNS). No two objects in these systems should have the same distinguished name.

Domain Name System (DNS)

The Domain Name System (DNS) is a distributed database that manages namespaces in the internet.

Domain

In relation to a Microsoft network, a logical collection of resources consisting of computers, printers, computer accounts, user accounts, and other related objects. The domain also has a system of logon authentication of user accounts, and computer accounts.

H

Hypertext Transfer Protocol (HTTP)

Protocol for transferring data.

I

Identity Manager

The main administration tool for managing employees, user accounts and permissions within an Identity Manager network.

IT Shop

Program component for providing employees with company resources using a defined approval procedure. IT Shop solutions are setup in the Identity Manager and can then be used in the Web Portal.

M

Managed Host

Computer that is registered with Data Governance and can have its resources queried and security managed.

Managed Domain

An Active Directory domain that is configured for use by Data Governance. managed domains contain managed hosts. Each managed domain is associated with a service account, which Data Governance uses to access and manage security on objects within the domain.

Manager

Main administration tool for displaying and editing all the information in an Identity Manager network.

P

Permission Level

Object used to group SharePoint permissions together. Permission levels that are linked to a concrete SharePoint site are mapped as SharePoint roles in the Identity Manager.

Permission

A rule associated with an object to regulate access to a particular object on the network. For example, a user may have read and write access to a file on the network.

Permissions Editor

Designer editor used to grant table and column permissions to permissions groups and system users.

Permissions Group

Different edit permissions for Identity Manager functions are grouped together in permissions groups. Permissions groups are assigned to system users. In this way, users of Identity Manager tools obtain edit permissions to Identity Manager functions.
Certain permissions groups are components of the Identity Manager installation. Other permissions groups can be custom defined in the Designer.

R

Risk Index

Security risk for the company when a company resource is assigned to an employee or a compliance rule is violated. The risk index can be entered for all company resources and compliance rules. The risk index for an employee is calculated from the risk indexes for directly and indirectly assigned company resources. It is given as a value in the range 0 (no risk) to 1 (problem). For complete information on setting and establishing a risk index, see the Identity Manager User Guide for Defining Risk Indexes.

Note: The risk index should not be confused with the Classification Risk, which is the risk associated with a classification. For details, see Working with Classification Taxonomies.

Role (SharePoint)

SharePoint permission level that is linked to a concrete SharePoint site. SharePoint roles are used to pass on permissions from concrete sites to SharePoint user accounts.

S

Service Account

Service accounts are registered credentials, used by Data Governance, to perform a number of network operations on the users behalf.

Service Pack

A service pack contains minor extensions to the functionality and includes all hotfix changes since the last major version that were already included in hotfixes.

Shelf

An IT Shop structure that is part of a shop and can be assigned products. Shelves form part of a hierarchical IT Shop solution along with customers, shops, shopping centers, and products.

Shop

An IT Shop structure that is assigned shelves and customers.
Shops form a hierarchical IT Shop solution along with customers, shelves, shopping centers and products. Each shop contains a shelves that the shop customer can request items from.

Synchronization Configuration

Settings that define data synchronization between a target system and the Identity Manager. Synchronization configuration contains the object types and assignments that should be synchronized, and a schedule for synchronization. This specifies the synchronization behavior of each object type/assignment.

System User

A predefined user that contains several entitlements to Identity Manager functions. The system user obtains these entitlements through their permissions groups assignments. A system user is assigned to user during the administration tool login procedure. Entitlements for the Identity Manager functions are passed onto the user from this system user.
Certain system users are included in the Identity Manager installation. Further system users can be defined in Designer.

System User ID

The user ID that a user enters to log onto an Identity Manager tool.
The system user ID is independent of the selected authentication module. It can be a login name for an Active Directory domain or a system user, for example, a central user account.

T

Target System

A system in which employees under Identity Manager administration have access to network resources.
Example: Active Directory, SAP R/3, Lotus Notes

U

Unified Namespace (UNS)

Unified Namespace (UNS) is a virtual target system for mapping various target systems along with their containers, user accounts, target system groups, and associated memberships. The data for all target systems connected to Identity Manager is mapped in the Unified Namespace. This allows other core Identity Manager functions, such as compliance testing, attestation or IT Shop, to be used across target system. The target systems Active Directory, Lotus Notes, SAP R/3, and LDAP can also be mapped like your own applications, for example, a telephone system.

User Account

Access entitlement to a restricted access IT system. Normally users must authenticate themselves with a user name and password when logging in.

User Account Resource

User account resources are special resource used to automatically create and manage user accounts in the connect target system. If an employee is assigned a user account resource, the Identity Manager creates a user account in the target system where the user account resource is assigned. The default manage level for a user account resource specifies what employee properties should be inherited by the user account.

User Account (SharePoint)

Object that is used to provide a SharePoint user with permissions to SharePoint sites.

W

Web Portal

Web-based application that provides various workflows. In the Web Portal, you can edit your own employee master data, edit staff data, request company resources in the IT Shop, delegate your own roles, edit approvals, attestations, and rule violations.