Scheduler Request Template Management Request Creation By Using Request Templates

Managing Authorization Policies 15-29 ■ Policy name: Diagnostic Dashboard Policy ■ Assignee: System Administrators role ■ Functional security: The Manage Failed Tasks permission without any fine-grained attribute-level controls ■ Data constraints: None ■ Description: Allows users with the SYSTEM ADMINISTRATORS role to access the Diagnostic Dashboard

15.3.14 Plug In

The default authorization policy for the Plug In feature allows users with the PLUGIN ADMINISTRATOR role to register unregistered policies. This policy has the following details: ■ Policy name: Plugin Administrator Policy ■ Assignee: PLUGIN ADMINISTRATOR and SYSTEM ADMINISTRATOR role ■ Functional security: The permissions are: – Register Plug In – Unregister Plug In These permissions do not support fine-grained attribute-level controls. ■ Data constraints: None ■ Description: Allows users with the PLUGIN ADMINISTRATORS or SYSTEM ADMINISTRATORS role to register and unregister plugins See Also: Working With the Diagnostic Dashboard in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about the Diagnostic Dashboard See Also: Developing Plug-ins in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager for information about plug-ins 15-30 Oracle Fusion Middleware Users Guide for Oracle Identity Manager 16 Managing Access Policies 16-1 16 Managing Access Policies Access policies are a list of roles and the resources with which roles are to be provisioned or deprovisioned. Access policies are used to automate the provisioning of target systems to users. This is explained with the help of the following example: A user belongs to multiple roles created in Oracle Identity Manager. Suppose a role Role1 have membership rule assigned to it. Membership rules can be designed based on the organization that the user belongs to, such as Organization Name = Org1. Roles can have access policies assigned to them. An access policies states which resource would be provisioned andor denied to a role when the access policy is applicable. Therefore, when a user is created in the Org1 organization, it satisfies a membership rule and grants the Role1 role to the user. This in turn triggers the access policy assigned to the role and then provisions or denies the resources mentioned in the access policy. This chapter describes how to create and use access policies for users and resources in Oracle Identity Manager. It contains the following sections: ■ Terminologies Used in Access Policies ■ Features of Access Policies ■ Creating Access Policies ■ Managing Access Policies ■ Provisioning Multiple Instances of the Same Resource via Access Policy

16.1 Terminologies Used in Access Policies

The following terminologies are associated with access policies: Resource A resource is a logical entity in Oracle Identity Manager that can be provisioned to a user or an organization in Oracle Identity Manager. For example, Microsoft Active Directory AD, Microsoft Exchange, SAP, UNIX, and Database is modeled as a resource in Oracle Identity Manager. Resources are templated definitions that are associated with one or more workflows called Provisioning Process in Oracle Identity Manager, which model the lifecycle management, such as how to provision, revoke, enable, and disable. Resources also have entities called forms associated with them. Forms represent a collection of attributes associated with the resource. For instance, a form associated with AD server includes attributes such as SAM Account Name, Common Name, and