Withdrawing a Request Performing Request-Related Tasks by Using the Task List Closing Requests

10-22 Oracle Fusion Middleware Users Guide for Oracle Identity Manager Part III Part III Identity Administration This part describes Oracle Identity Manager delegated administration functionalities by using the identity administration features. It contains the following chapters: ■ Chapter 11, Managing Users ■ Chapter 12, Managing Roles ■ Chapter 13, Managing Organizations ■ Chapter 14, Creating and Searching Requests 11 Managing Users 11-1 11 Managing Users The user management feature in Oracle Identity Manager includes the creation, updation, deletion, enabling and disabling, locking, and unlocking of user accounts. This feature is described in the following sections: ■ User Lifecycle ■ User Entity Definition ■ User Management Tasks ■ User Management Authorization ■ Username Reservation ■ Common Name Generation

11.1 User Lifecycle

User lifecycle is a term to describe the process flow of how a user entity is created, managed, and terminated in the system based on certain events or time factors. A user entity goes through various stages in the lifecycle. The stages are non-existent, disabled, active, and deleted. Figure 11–1 depicts the different lifecycle stages, all possible transitions, and the operations that set up those transitions: Figure 11–1 User Life Cycle 11-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager There is a possibility of process rules or business requirements being defined for each transition of the user lifecycle. You can use the sample scenarios listed in Table 11–1 to establish the link between user lifecycle transitions and business objectives. The following concepts are integral to user lifecycle management: ■ OIM Account ■ Organization ■ Role

11.1.1 OIM Account

OIM Account is an abstraction representing a means to be authenticated to access Oracle Identity Manager. In Oracle Identity Manager, the cardinality of relationship between user and OIM account is one-to-one. By default, users are associated with OIM accounts that allows users to access Oracle Identity Manager. However, there may be users who do not need to access Oracle Identity Manager, and therefore, may not be provisioned with an OIM account. Some user operations, such as lock and unlock, are explicitly account operations. When locking or unlocking a user, you lock or unlock the users OIM account. Table 11–1 User Life Cycle and Business Objectives Sample Scenarios Current State Operation Sample Scenario Process Description Non-existent Create HR enters user profile information for a new hire. If the new hire is not introduced to the system immediately, then HR sets a future start date for the user. If the start is not a future date then the user is introduced into the system in an Active state. If the Start Date is in future then the create process creates the user in a disabled state. Disabled Enable Users start date is in effect. The system initiates provisioning for the new hire. User is marked enabled in the system and the user is now able to login and use the system. By default, all necessary memberships and accounts are established as part of the workflow. Active Modify User is promoted to a new position. As a result, HR changes the job title of the user. New resources are provisioned to the user, and old irrelevant resources are deprovisioned from the user. Active Disable User takes one year sabbatical from the company. HR manually disables the user on the last working day of the user. The user re-joins the company after some period. HR can make the user Active again. User is marked disabled in the system, and the user is no longer able to login to the system. The disabled users can be made Active again. Active Deleted User retires from the company. HR manually deletes the user on the last working day of the user. User is marked disabled in the system, and the user is no longer able to login to the system. By default, all users accounts are deprovisioned as part of the workflow. Managing Users 11-3 In Oracle Identity Manager, each user has a Design Console Access attribute that controls the OIM account of the user. If the Design Console Access option for a user is selected in the UI, then the user is End-User Administrator. If this option is not selected, then the user is an End-User.

11.1.2 Organization

Organization is a logical container for authorization and permission data. A user in Oracle Identity Manager must belong to one organization only. For detailed information about organizations in Oracle Identity Manager, see Chapter 13, Managing Organizations .

11.1.3 Role

Oracle Identity Manager provides easy and controlled privilege management through roles. Roles are named groups of related privileges that you grant to users or other roles. Roles are designed to ease the administration of end-user system and schema object privileges. For detailed information about roles, see Chapter 12, Managing Roles .

11.2 User Entity Definition

Attributes are defined for the user entity in Oracle Identity Manager. These attributes are the same for all entities. You can add your own attributes to the user entity. For each attribute of an entity, the following properties are defined in Oracle Identity Manager: ■ Attribute Name: The name of the attribute. ■ Category: All entity attributes are classified into a category. This categorization is used to organize the data in the UI. The category is only for display on the UI and is not used anywhere else. The default categories are: – Basic User Information: This category contains basic user attributes such as user first name, user last name, e-mail, manager, organization, and user type. – Account Settings: This category contains account-related attributes such as user login, identity status, account status, and global unique identifier GUID. – Account Effective Dates: This category contains account start and end date attributes. – Provisioning Dates: This category contains provisioning date and deprovisioning date attributes. – Lifecycle : This category shows flags related to User Account such as manually locked, locked on, or automatically delete on. All the attributes in the category are hidden by default so the category is also not visible. – System: This category contains the system controlled attributes for the user entity such as created on, password expiration date, password reset attempts, and so on. – Other User Attributes: This category contains a list of all the FA and LDAP related attributes. – CustomAttributes: This is an empty category where the user can add all the new custom attributes. 11-4 Oracle Fusion Middleware Users Guide for Oracle Identity Manager – Preferences: This category contains the attributes related to user preferences. It contains various attributes such as locale, timezone, currency, date format, and so on. ■ Type: Indicates the type of data in the attribute. Supported types are string, number, date, and Boolean. ■ Properties: For each attribute, the following properties can be defined: – required: Determines whether or not every user in the repository must have a non-null value for this attribute – system-controlled: Determines if the value can only be set and edited by the system itself – system-can-default: Determines if the value can be set by the system to a default if no value is provided – encryption: Determines if the value stored in the repository is encrypted. If true, then the value is encrypted but this encrypted value can be decrypted producing the original value. If false, then the value is stored as CLEAR, meaning that the stored value is not encrypted. – user-searchable: Determines if the values can be used in searches – bulk-updatable: Determines if the field can be modified as part of a bulk modification of multiple users. Fields that are expected to be unique to users, such as username, name fields, and password, do not support bulk update. For fields with system-controled=Yes or Unique=Yes, this property can never be set to Yes. For information about setting the properties of an attribute, see Configuring User Attributes in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. – display-type: Determines how the field is displayed in the UI for creating and modifying users. It can have any one of the following values: TEXT, TEXTAREA, NUMBER, DOUBLE, CHECKBOX, DATE_ONLY, SECRET, LOV, and ENTITY. – multi-valued: Determines whether the attribute is multi-valued or not. The value of this property is either true or false. Oracle Identity Manager does not support multiple values, and therefore, this property is set to false for all user attributes. – max-size: Indicates the maximum allowed length for the specified attribute. – read-only: Indicates if the attribute has read-only permission only or if it is editable. – custom: Determines if the attribute is a default attribute or a user-defined attribute. – visible: Determines if the attribute is visible to the user. Table 11–2 lists the attributes defined for the user entity in Oracle Identity Manager: