Identity Manager 9.2.1 - Web Portal User Guide

Location properties are attested using the Location attestation attestation procedure.

For this attestation procedure you can use the following attestation conditions:

Condition	Description
All locations	Attests all locations.
Specific locations	Select the locations to attest. Use and to switch between hierarchical and list view. Multi-select is possible.
Locations with defined risk index	Use the Lower limit and Upper limit fields to define a risk index range. Attests locations with a risk index in the chosen range.
Locations with matching name	Enter part of a name of locations with access to attest. All locations that have this pattern in their name are included. Example: Per finds "Person", "Personal", "Perfection" and so on.

For this attestation procedure, you can use the following attestation policies:

Attesting system roles

Approval policies	Description
Attestation by selected approvers	In the Attestors field, click Select/Change and select the identities that can make approval decisions about attestation cases.
Attestation of locations by manager	Location managers can make approval decisions through attestation cases.

System role properties are attested using the System role attestation attestation procedure.

For this attestation procedure you can use the following attestation conditions:

Condition	Description
All system roles	Attests all system roles.
Specific system roles	Select the system roles to attest. Use and to switch between hierarchical and list view. Multi-select is possible.
System roles by applications	Select the applications (Application Governance). Attests system roles that are assigned to these applications.
System roles with defined risk index	Use the Lower limit and Upper limit fields to define a risk index range. Attests system roles with a risk index in the chosen range.
System roles with matching name	Enter part of a name of system roles with access to attest. All system roles that have this pattern in their name are included. Example: Per finds "Person", "Personal", "Perfection" and so on.

For this attestation procedure, you can use the following attestation policies:

Attesting memberships in system entitlements

Approval policies	Description
Attestation by selected approvers	In the Attestors field, click Select/Change and select the identities that can make approval decisions about attestation cases.
Attestation of system roles by manager	System role managers can make approval decisions through attestation cases.

User account memberships in system entitlements are attested using the System entitlements membership attestation attestation procedure.

For this attestation procedure you can use the following attestation conditions:

Condition	Description
All system entitlements	Attests memberships in all system entitlements.
Specific identities	Select the identities. Attests this identity's memberships (or their associated user accounts) in system entitlements.
Specific identities with subidentities.	Select the identities. Attests this identity's memberships (or their associated user accounts) in system entitlements. In addition, it attests sub identities' memberships (or their associated user accounts) that the select identities are assigned to.
Specific system entitlements	Select the system entitlements. Attests memberships in these system entitlements.
Membership by attestation state	Select an attestation status Attests memberships in system entitlements that match this attestation status. Denied memberships: Attests memberships that have been denied. All Memberships: Attests all memberships. New memberships: Attests memberships that have never been attested.
New or not attested for x days	Specify a number of days. Attests memberships in system entitlements that have not been attested for the defined number of days.
No dynamic groups from Active Roles	Attests memberships in all system entitlements. Dynamic groups are ignored in the process.
System entitlements with specific owners	Select the identities. Attests memberships in system entitlements that are managed by these identities.
System entitlements in a target system container	Select the target system containers. Attests memberships in system entitlements found in these target system containers.
System entitlements in target systems	Select the target systems. Attests memberships in system entitlements assigned to these target systems.
System entitlements with defined risk index	Use the Lower limit and Upper limit fields to define a risk index range. Attests memberships in system entitlements with a risk index in the chosen range.
System entitlements with owners in departments	Select the departments. Attests memberships in system entitlements that are managed by the identities in these departments.
System entitlements with any owner	Attests user account memberships in system entitlements that only have one owner.
System entitlements with matching name	Enter part of a name of system entitlements with user account memberships to attest. All system entitlements that have this pattern in their name are included. Example: Per finds "Person", "Personal", "Perfection" and so on.
System entitlements by applications	Select the applications. Attests user account memberships in system entitlements that are assigned to these applications.
System entitlements by assignment origin	Select how user account memberships in system entitlements must be assigned to enable attestation: Directly assigned: Attests memberships that were assigned directly. By request: Attests memberships in system entitlements that were requested. By dynamic roles: Attests memberships in system entitlements that were assigned through dynamic roles. Through roles: Attests memberships in system entitlements that were assigned through roles. Through system roles: Attests memberships in system entitlements that were assigned through system roles.

For this attestation procedure, you can use the following attestation policies:

Attesting memberships in application roles

Approval policies	Description
Attestation by selected approvers	In the Attestors field, click Select/Change and select the identities that can make approval decisions about attestation cases.
Attestation by selected approvers with automatic removal of assignments	In the Attestors field, click Select/Change and select the identities that can make approval decisions about attestation cases. Memberships are deleted if attestation is denied and the configuration fits.
Attestation by entitlement owner with automatic removal of assignments	Product owners of system entitlements can be approved through attestation cases. Memberships are deleted if attestation is denied and the configuration fits.
Attestation by identity manager and product owner (with peer group analysis)	The following identities can be approved through attestation cases: Identity managers who are assigned the system entitlements Product owners of system entitlements after a peer group analysis (see Attestation by peer group analysis)
Attestation of group memberships by product owner with automatic removal of memberships	Product owners of system entitlements can be approved through attestation cases. Memberships are deleted if attestation is denied and the configuration fits.

Memberships in application roles are attested using the Application role membership attestation attestation procedure.

For this attestation procedure you can use the following attestation conditions:

Condition	Description
All roles	Attests memberships in all applications roles.
Application roles with matching name	Enter part of a name of application roles with primary memberships to attest. All application roles that have this pattern in their name are included. Example: Per finds "Person", "Personal", "Perfection" and so on.
Attesting by attestation status	Select an attestation status Attests memberships in application roles that match this attestation status. You can select the follow status: Denied memberships: Attests memberships that have been denied. All Memberships: Attests all memberships. New memberships: Attests memberships that have never been attested.
Specific identities	Select the identities. Attests identity memberships in application roles.
Specific identities with subidentities.	Select the identities. Attests identity memberships in application roles. In addition, this identity's subidentities memberships in application roles are attested.
Specific roles	Select the application roles. Attests memberships in these application roles. Use and to switch between hierarchical and list view. Multi-select is possible.
New or not attested for x days	Specify a number of days. Attests memberships in application roles that have not been attested for the defined number of days.
Roles by assignment type	Select how memberships in application roles must be assigned to enable attestation: Directly assigned: Attests memberships that were assigned directly. By request: Attests memberships that were requested. By delegation: Attests memberships that were delegated.

For this attestation procedure, you can use the following attestation policies:

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Identity Manager 9.2.1 - Web Portal User Guide

Attesting locations

Attesting system roles

Attesting memberships in system entitlements

Attesting memberships in application roles