立即与支持人员聊天
与支持团队交流

Identity Manager 8.2.1 - IT Shop Administration Guide

Setting up an IT Shop solution
One Identity Manager users in the IT Shop Implementing the IT Shop Using the IT Shop with the Application Governance Module Requestable products Preparing products for requesting Assigning and removing products Preparing the IT Shop for multi-factor authentication Assignment requests Delegations Creating IT Shop requests from existing user accounts, assignments, and role memberships Adding system entitlements automatically to the IT Shop Deleting unused application roles for product owners
Approval processes for IT Shop requests
Approval policies for requests Approval workflows for requests Determining the effective approval policies Selecting responsible approvers Request risk analysis Testing requests for rule compliance Approving requests from an approver Automatically approving requests Approval by peer group analysis Gathering further information about a request Appointing other approvers Escalating an approval step Approvers cannot be established Automatic approval on timeout Halting a request on timeout Approval by the chief approval team Approving requests with terms of use Using default approval processes
Request sequence Managing an IT Shop
IT Shop base data Setting up IT Shop structures Setting up a customer node Deleting IT Shop structures Templates for automatically filling the IT Shop Custom mail templates for notifications Request templates Recommendations and tips for transporting IT Shop components with the Database Transporter
Troubleshooting errors in the IT Shop Configuration parameters for the IT Shop Request statuses Examples of request results

Using approval roles to find approvers

Use the following approval procedure if you want to establish the approver of a hierarchical role to be approver.

Table 36: Approval procedures to determine approvers through an approval role

Approval procedure

Approver

RD

The request recipient is assigned a primary department. The department is assigned an application role in the Role approver menu.

All secondarily assigned employees of this application role are determined to be approvers.

RL

The request recipient is assigned a primary location. The location is assigned an application role in the Role approver menu.

All secondarily assigned employees of this application role are determined to be approvers.

RO

Installed modules: Business Roles Module

The request recipient is assigned a primary business role. The business role is assigned an application role in the Role approver menu.

All secondarily assigned employees of this application role are determined to be approvers.

RP

The request recipient is assigned a primary cost center. The cost center is assigned an application role in the Role approver menu.

All secondarily assigned employees of this application role are determined to be approvers.

Figure 6: Determining approvers through a department's role approver

Approval procedure

Approver

ID

The request recipient is assigned a primary department. The department is assigned an application role in the Role approver (IT) menu.

All secondarily assigned employees of this application role are determined to be approvers.

IL

The request recipient is assigned a primary location. The location is assigned an application role in the Role approver (IT) menu.

All secondarily assigned employees of this application role are determined to be approvers.

IO

Installed modules: Business Roles Module

The request recipient is assigned a primary business role. The business role is assigned an application role in the Role approver (IT) menu.

All secondarily assigned employees of this application role are determined to be approvers.

IP

The request recipient is assigned a primary cost center. The cost center is assigned an application role in the Role approver (IT) menu.

All secondarily assigned employees of this application role are determined to be approvers.

Determining the approver using the example of an approval role for the request's recipient primary department (approval procedure RD):

  1. Determine the requester’s primary department (UID_Department).

  2. The application role (UID_AERole) is determined through the department’s role approver (UID_RulerContainer).

  3. Determine the secondary employees assigned to this application role. These can issue approval.

  4. If there is no approval role given for the primary department or the approval role does not have any members, the approval role is determined for the parent department.

  5. The request cannot be approved if no approval role with members is found by drilling up to the top department.

NOTE: When approvers are found using the approval procedures RO or IO, and inheritance for business roles is defined from the bottom up, note the following:

If no role approver is given for the primary business role, the role approver is determined from the child business role.

Using cost centers to find approvers

Use the following procedure to determine the approver through a cost center given in the request.

Table 37: Approval procedures for determining approvers for a cost center

Approval procedure

Approver

PP

A cost center is entered in the request. The cost center is assigned a manager.

The manager of the given cost center is established as approver.

PR

A cost center is entered in the request. The cost center is assigned an application role in the Role approver menu.

All secondarily assigned employees of this application role are determined to be approvers.

Approvers are determined following the same method as described in Using approval roles to find approvers.

PI

A cost center is entered in the request. The cost center is assigned an application role in the Role approver (IT) menu.

All secondarily assigned employees of this application role are determined to be approvers.

Approvers are determined following the same method as described in Using approval roles to find approvers.

Using departments to find approvers

Use the following procedure to determine the approver through a department given in the request.

Table 38: Approval procedures for determining approvers for a department

Approval procedure

Approver

DP

A department is entered in the request. The department is assigned a manager.

The manager of the given department is established as approver.

DR

A department is entered in the request. The department is assigned an application role in the Role approver menu.

All secondarily assigned employees of this application role are determined to be approvers.

Approvers are determined following the same method as described in Using approval roles to find approvers.

DI

A department is entered in the request. The department is assigned an application role in the Role approver (IT) menu.

All secondarily assigned employees of this application role are determined to be approvers.

Approvers are determined following the same method as described in Using approval roles to find approvers.

Using requested roles to find approvers

If membership in or assignment to a hierarchical role is requested and the manager of the requested role is to be the approver, use the MS approval procedure. Then the manager and deputy of the requested department, cost center, business role or location are determined as the approvers. This approval procedure can only be used for assignment requests.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级