Click Sav The selected roles are added to the Data Constraints page of the

15-14 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

15.2.5 Deleting Authorization Policies

To delete an authorization policy:

1. In the Authorization Policy tab of the Administration Console, search for the

authorization policy that you want to delete.

2. Select the policy. From the Actions menu, select Delete. A message box is

displayed asking for confirmation.

3. Click OK to confirm deletion.

15.3 Authorization Policies for Oracle Identity Manager Features

This section describes the authorization policy components for the following Oracle Identity Management features: ■ User Management ■ Authenticated User Self Service ■ Role Management ■ Authorization Policy Management ■ User Management Configuration ■ Reconciliation Management ■ Scheduler ■ Request Template Management ■ Request Creation By Using Request Templates ■ Approval Policy Management ■ Notification Management ■ System Properties ■ Diagnostic Dashboard ■ Plug In

15.3.1 User Management

The components of the authorization policies defined for the user management feature and the default authorization policy are described in the following sections: ■ Assignee ■ Functional Security ■ Data Security ■ Default Authorization Policies

15.3.1.1 Assignee

The assignee of the policy can be a set of roles. The policy is assigned to each role in the set of policies. In addition, a rule for selecting the management chain of the user being managed as an assignee is supported. There is no ability to restrict this to just the direct manager of the user being managed. See Also: Chapter 11, Managing Users for information about the user management feature Managing Authorization Policies 15-15 The Assignee must be a member of security setting restricts the grant to the users who are also members of the organizations or roles being granted privileges over. If assignee belongs to multiple organization hierarchies, then a match to at least one organization hierarchy must provide the grant.

15.3.1.2 Functional Security

Multiple privileges are defined for the user management feature such as Search for Users and View User Detail. The following privileges support the fine-grained attribute-level controls, in which the user is able to select the specific attributes applicable to that operation: ■ View User Detail ■ Modify User Profile The list of attributes are based on the list of attributes defined for the user entity.

15.3.1.3 Data Security

For the user management feature, data security is defined as the list of organizations whose members the assignee has privileges over. The set of users being managed by the authorization policy cannot be specified by attribute filtering. If the Hierarchy Aware option is selected, then the organization and role hierarchies are taken into account when determining the data security.

15.3.1.4 Default Authorization Policies

There are two default authorization policies for the user management feature. Users are not allowed to modify or delete these policies. Any User Management policy that provides the Search User permission should also provide the View User Details permission. The View User Details permission should include the User Login, Account Status, Identity Status, Full Name, and Display Name attributes. If these attributes are not provided, the user might not be fully viewable or editable. The following table lists the default authorization policy details for user management: Note: ■ Any user management policy that provides the Search User permission must also provide the View User Details permission. ■ For a complete list of privileges for the user management feature, see Privileges on page 11-50.