Access Policy Data Features of Access Policies

Managing Access Policies 16-9 The Create Access Policy - Step 5: Verify Access Policy Information page is displayed. 15. If you want to modify any of the selections you made in the preceding steps of this procedure, then click Change to go to the corresponding page of the wizard. After making the required modifications, click Continue to return to the Step 5: Verify Access Policy Information page.

16. Click Create Access Policy to create the access policy.

16.4 Managing Access Policies

You can use Oracle Identity Manager Administrative and User Console to modify information in existing access policies. To manage access policies:

1. Click Manage Access Policies under the Policies menu.

The Manage Access Policies page is displayed. Use the menu in the search criteria field to select an access policy attribute. You can use the asterisk wildcard character to search for all access policy instances that have any value for the attribute selected. Click Search Access Policies. The Manage Access Policies page is displayed with your search results.

2. To view the details of the Access Policy you want, click Access Policy Name.

The Access Policy Details page is displayed. To make modifications to this access policy, use the Change link at the end of each selection category.

3. After you make the required modifications, click Update Access Policy.

This access policy is updated, and the updated information is displayed on the Access Policy Details page.

16.5 Provisioning Multiple Instances of the Same Resource via Access Policy

Provisioning multiple instances of the same resource via access policy by using account discriminator involves the following: ■ Creating Separate Accounts for the Same User and Same Resource on a Single Target System ■ Enabling Multiple Account Provisioning ■ Provisioning Multiple Instances of a Resource to Multiple Target Systems ■ Limitation of Provisioning Multiple Instances of a Resource via Access Policy Note: When you create an access policy on a resource having a process form with Password field, the password policy is not evaluated. For information about password policies, see Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. 16-10 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

16.5.1 Creating Separate Accounts for the Same User and Same Resource on a Single Target System

Two distinct accounts can be created for the same user and same resource on a single target system via access policy. For example, it is required to create two accounts, a user account and service account on a single AD instance. The Active Directory target system is represented by the AD User resource in Oracle Identity Manager. This is implemented in the following way: 1. Create a AD User resource. 2. Create the user, such as JohnD. 3. In the process form, mark UD_ADUSER and UD_ADUSER_UID as the discriminator field so that two distinct accounts have different login IDs. 4. Create two access policies as follows: ■ For regular account: Access policy name: AP1 Associated to role: Role1 Resource to provision: AD User Process form having Discriminator field: User ID UD_ADUSER_UID Default value in access policy: Account1 ■ For service account: Access policy name: AP2 Associated to role: Role2 Resource to provision: AD User Process form having Discriminator field: User ID UD_ADUSER_UID Default value in access policy: Account2 5. Assign Role1 and Role2 to JohnD. When Role1 is assigned to JohnD, the Account1 account is created in the AD User target system via the AP1 access policy. When Role2 is assigned to JohnD, Account2 is created in AD User via AP2. Therefore, two distinct accounts can be created for the same user and same resource on a single target system via access policy.

16.5.2 Enabling Multiple Account Provisioning

By default, Oracle Identity Manager does not support multiple account provisioning. To enable multiple account provisioning:

1. Set the value of the XL.AccessPolicyMultipleResourceEnhancement system

property to TRUE. See Predefined System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about this system property. See Note: You must create a prepopulate adapter associated with dataset to generate the values for User ID so that unique values are generated for this field. Managing Access Policies 16-11 Creating and Managing System Properties in the same guide for information about setting the value of a system property. 2. Restart Oracle Identity Manager for the change in the system property to take effect. When multiple account provisioning is enabled, you must define the appropriate account discriminator attributes. To do so: 1. Log in to the Design Console. 2. Update the process form as follows:

a. Expand Development Tools, and then double-click Form Designer.

b. Search and open the process form.

c. On the Form Designer tab, click Create New Version.

d. In the Create a New Version dialog box, enter a label in the Label field, and then click Save. e. From the Current Version list, select the version that you created. f. On the Properties tab, select the field that you want to designate as the discriminator field, and then click Add Property.

g. In the Add Property dialog box, select Account Discriminator as the property

name, enter True in the Property Value field, and then click Save. h. Click Make Version Active, and then click OK. i. Click Save. 3. Run the Form Version Control FVC utility if you modified existing process forms. See Using the Form Version Control Utility for information about running the FVC utility.

16.5.3 Provisioning Multiple Instances of a Resource to Multiple Target Systems

The following are the broad-level steps to provision multiple instances of a resource object to multiple target systems via access policy: 1. Create an IT resource type by using the IT Resources Type Definition Form in the Oracle Identity Manager Design Console. For information about using this form, see IT Resources Type Definition Form in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. 2. Create multiple IT resource instances of the IT resource type that you created in step 1. For information about creating IT resources, see Creating IT Resources in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. Here, IT resource instance is the account discriminator. See Provisioning Multiple Instances of the Same Resource via Access Policy by Using Account Discriminator on page 16-5 for information about account discriminator. 3. Create a process form with a field of type that you created in step 1. For information about creating process forms, see Developing Process Forms in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. 4. Create a resource object. For information about creating a resource object, see Creating a Resource Object in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager.