Template User Roles Searching and Modifying Request Templates

Managing Approval Policies 18-3

18.1.2 Operation-Level Methodology: Organization-Based Selection

This methodology is used for all user-related request types, such as Create User, Modify User, Disable User, Enable User, and Delete User, at the operation level of approval. The determination algorithm for the organization-based selection methodology at operation level is as follows:

1. Get the users organization entity for which request is created.

2. Search for all the approval policies configured for the operation level, for the

request type associated with the request, or for all organizations in ascending order of the approval policy priority. If the approval policies matching this criteria is found, then:

a. Evaluate the approval policy rules associated with each approval policy to

determine the approval workflow. When evaluating approval policy rules, for the first approval policy rule whose evaluation results in true, the corresponding approval workflow associated with that approval policy is selected. If automatic approval is specified in the approval policy, then the request is automatically approved at the operation level.

b. If none of the approval policy rules are satisfied, then it is considered that no

approval workflow is configured at the operation level for this organization.

3. If no approval workflow is configured for that organization entity, then follow the

organization hierarchy till either the root node or the domain boundary, which is the root organization in the organization hierarchy. Repeat step 2 for each organization node.

4. If no approval workflow is determined, then the default operation-level approval

is selected.

18.1.3 Operation-Level Methodology: Resource-Based Selection

This methodology is used for all resource-related request types at the operation level of approval. The determination algorithm for the resource-based selection methodology at operation level is as follows: 1. Get the resource entity associated with the request. 2. Search for all the approval policies configured for the operation level, for the request type associated with the request, or for all resources associated with the request in ascending order of the approval policy priority. If the approval policies matching this criteria is found, then: a. Evaluate the approval policy rules associated with each approval policy to determine the approval workflow. When evaluating approval policy rules, for the first approval policy rule whose evaluation results in true, the corresponding approval workflow associated with that approval policy is selected. If automatic approval is specified in the approval policy, then the request is automatically approved at the operation level. b. If none of the approval policy rules are satisfied, then it is considered that no approval workflow is configured at the operation level for this resource. 3. If no approval workflow is determined, then the default operation-level approval is selected. 18-4 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

18.1.4 Operation-Level Methodology: Role-Based Selection

This methodology is used for all role-related request types at the operation level of approval. The determination algorithm for the role-based selection methodology at operation level is as follows:

1. Get the role entity being assigned to or removed from the user.

2. Search for all the approval policies configured for the operation level, for the

request type associated with the request, or for all roles being assigned or removed in ascending order of the approval policy priority. If the approval policies matching this criteria is found, then:

a. Evaluate the approval policy rules associated with each approval policy to

determine the approval workflow. When evaluating approval policy rules, for the first approval policy rule whose evaluation results in true, the corresponding approval workflow associated with that approval policy is selected. If automatic approval is specified in the approval policy, then the request is automatically approved at the operation level.

b. If none of the approval policy rules are satisfied, then it is considered that no

approval workflow is configured at the operation level for this role.

3. If no approval workflow is determined, then the default operation-level approval

is selected.

18.2 Creating Approval Policies

To create an approval policy:

1. In Oracle Identity Manager Advanced Administration, click the Policies tab, and

then click Approval Policies. Alternatively, you can click Search Approval Policies under Policies in the Welcome page.

2. From the Actions menu on the left pane, select Create. You can also start the

Create Approval Policy wizard by clicking the icon with the plus + sign on the toolbar. The Step 1. Set Approval Policy Details page of the Create Approval Policy wizard is displayed.

3. Enter values for the following fields, and then click Next:

■ Policy Name : Enter a name for the approval policy. This is a mandatory attribute. ■ Description : Enter the details about what this approval policy will do. ■ Request Type : Select the request type by selecting from the LOV, for example, Assign Roles. This is a mandatory attribute. ■ Level : Select the approval level that you want to implement for this approval policy. This is a mandatory attribute. For more information about approval levels, see Approval Levels section in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. ■ Scope Type : Set automatically based on the request type selection. For example: – If request type is set to Create User, then Scope Type is automatically set to Organization. – If request type is set to Provision Resource, then Scope Type is automatically set to Resource.