立即与支持人员聊天
与支持团队交流

Identity Manager 9.2 - Business Roles Administration Guide

Managing business roles
One Identity Manager users for business roles Hierarchical role structure basic principles Basic principles for assigning company resources Basics of calculating inheritance Preparing business roles for company resource assignments Base data for business roles Creating and editing business roles Assigning identities, devices, and workdesks to business roles Assigning business roles to company resources Analyzing role memberships and identity assignments Setting up IT operational data for business roles Creating dynamic roles for business roles Assigning departments, cost centers, and locations to business roles Defining inheritance exclusion for business roles Assigning extended properties to business roles Creating assignment resources for application roles Dynamic roles for business roles with incorrectly excluded identities Certification of business roles Reports about business roles
Role mining in One Identity Manager

Analyzing role memberships and identity assignments

The Overview of all assignments report is displayed for some objects, such as authorizations, compliance rules, or roles. The report finds all the roles, for example, departments, cost centers, locations, business roles, and IT Shop structures in which there are identities who own the selected base object. In this case, direct as well as indirect base object assignments are included.

Example:

  • If the report is created for a resource, all roles are determined in which there are identities with this resource.

  • If the report is created for a group or another system entitlement, all roles are determined in which there are identities with this group or system entitlement.

  • If the report is created for a compliance rule, all roles are determined in which there are identities who violate this compliance rule.

  • If the report is created for a department, all roles are determined in which identities of the selected department are also members.

  • If the report is created for a business role, all roles are determined in which identities of the selected business role are also members.

To display detailed information about assignments

  • To display the report, select the base object from the navigation or the result list and select the Overview of all assignments report.

  • Click the Used by button in the report toolbar to select the role class for which you want to determine whether roles exist that contain identities with the selected base object.

    All the roles of the selected role class are shown. The color coding of elements identifies the role in which there are identities with the selected base object. The meaning of the report control elements is explained in a separate legend. To access the legend, click the icon in the report's toolbar.

  • Double-click a control to show all child roles belonging to the selected role.

  • By clicking the button in a role's control, you display all identities in the role with the base object.

  • Use the small arrow next to to start a wizard that allows you to bookmark this list of identities for tracking. This creates a new business role to which the identities are assigned.

Figure 13: Toolbar of the Overview of all assignments report.

Table 15: Meaning of icons in the report toolbar

Icon

Meaning

Show the legend with the meaning of the report control elements

Saves the current report view as a graphic.

Selects the role class used to generate the report.

Displays all roles or only the affected roles.

Setting up IT operational data for business roles

To create user accounts for an identity with the Full managed manage level, you need to know which IT operating data is required. The operating data required for each specific target system is defined with its business roles, departments, locations, or cost centers. An identity is assigned a primary business role, primary location, primary department, or primary cost center. The necessary IT operating data is ascertained from these assignments and used in creating the user accounts. Default values are used if valid IT operating data cannot be found over the primary roles.

You can also specify IT operating data directly for a specific account definition.

Example:

Normally, each identity in department A obtains a default user account in the domain A. In addition, certain identities in department A obtain administrative user accounts in the domain A.

Create an account definition A for the default user account of the domain A and an account definition B for the administrative user account of domain A. In the IT operating data mapping rule for the account definitions A and B, specify the Department property in order to determine the valid IT operating data.

Specify the effective IT operating data of department A for the domain A. This IT operating data is used for standard user accounts. In addition, for department A, specify the effective IT operating data of account definition B. This IT operating data is used for administrative user accounts.

For more information, see the One Identity Manager Target System Base Module Administration Guide.

To define IT operating data

  1. In the Manager, select the Business roles > <role class> category.

  2. Select the role in the result list.

  3. Select the Edit IT operating data task.

  4. Click Add and enter the following data.

    • Effects on: Specify an IT operating data application scope. The IT operating data can be used for a target system or a defined account definition.

      To specify an application scope

      1. Click next to the field.

      2. Under Table, select the table that maps the target system for select the TSBAccountDef table or an account definition.

      3. Select the specific target system or account definition under Effects on.

      4. Click OK.

    • Column: Select the user account property for which the value is set.

      In the menu, you can select the columns that use the TSB_ITDataFromOrg script in their template. For more information about this, see the One Identity Manager Target System Base Module Administration Guide.

    • Value: Enter a fixed value to assign to the user account's property.

  5. Save the changes.
ClosedIt operating data for target systems

Modify IT operating data

If IT operating data changes, you must transfer the changes to the existing user accounts. To do this, templates must be rerun on the affected columns. Before you can run the templates, you can check what effect a change to the IT operating data has on the existing user accounts. You can decide whether the change is transferred to the One Identity Manager database in the case of each affected column in each affected database.

Prerequisites

  • The IT operating data of a business role have been changed.

    - OR -

  • The default values in the IT operating data template were modified for an account definition.

NOTE: If the assignment of an identity to a primary business role changes, the templates are automatically run.

To run the template

  1. In the Manager, select the <target system type> > Basic configuration data > Account definitions > Account definitions category.

  2. Select an account definition in the result list.

  3. Select the Run templates task.

    This displays a list of all user accounts that were created with the selected account definition and whose properties were changed by modifying the IT operating data. That means:

    • Old value: Value of the object property before changing the IT operating data.

    • New value: Value of the object property after changing the IT operating data.

    • Selection: Specifies whether the new value is copied to the user account.

  4. Mark all the object properties in the selection column that will be given the new value.

  5. Click Apply.

    The templates are applied to all selected user accounts and properties.

Creating dynamic roles for business roles

Use this task to define dynamic roles for individual business roles. Dynamic roles are used to specify role memberships dynamically. Identities, devices, and workdesks are not permanently assigned to a role, just when they fulfill certain conditions. A check is performed regularly to assess which identities (devices or workdesks) fulfill these conditions. This means the role memberships change dynamically. For example, company resources can be assigned dynamically to all identities in a business role in this way; if an identity leaves the department they immediately lose the resources assigned to them.

Dynamic roles always relate to the secondary role assignment of an employee object. Therefore secondary assignment of identities, devices, and workdesks to role classes must be permitted. If necessary, further configuration settings need to be made.

NOTE: The Create dynamic role task is only available for business roles that do not have the Dynamic roles not allowed option set.

For more detailed information about creating and editing dynamic roles, see the One Identity Manager Identity Management Base Module Administration Guide.

To create a dynamic role for a business role

  1. In the Manager, select the Business roles > <role class> category.

  2. Select a business role in the result list.

  3. Select the Create dynamic role task.

  4. Enter the required main data.

  5. Save the changes.

To edit a dynamic role

  1. In the Manager, select the Organizations > <role class> > Dynamic roles category.

  2. Select a business role in the result list.

  3. Open the business role's overview form.

  4. In the Dynamic roles form element, click on the name of the dynamic role.

  5. Select the Change main data task.

  6. Edit the dynamic role's main data.

  7. Save the changes.

Related topics
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级