Searching Approval Policies Oracle Fusion Middleware Online Documentation Library

18-10 Oracle Fusion Middleware Users Guide for Oracle Identity Manager 19 Managing Attestation Processes 19-1 19 Managing Attestation Processes This chapter is divided into the following sections: ■ About Attestation ■ Attestation Process Configuration ■ Creating Attestation Processes ■ Managing Attestation Processes ■ Using the Attestation Dashboard

19.1 About Attestation

Attestation enables users designated as reviewers to be notified of reports they must review. These reports describe entitlements of other users. A reviewer can attest to the accuracy of these entitlements by providing a response. The attestation action, along with the response the reviewer provides, any associated comments, and an audit view of the data that the reviewer views and attests to, is tracked and audited to provide a complete trail of accountability. In Oracle Identity Manager, this process is known as an attestation task. In Oracle Identity Manager, attestation is supported through the definition of scheduled attestation processes. An attestation process is not the same as an Oracle Identity Manager workflow. It is implemented as a configurable business process in Oracle Identity Manager, and it creates an attestation task for a user. The user acts as a reviewer, and must complete this process to provide correct audit information. Tracking of attestation activity for a provisioned resource instance is done through tasks in the provisioning processes of resource objects. You can initiate workflow activity based on attestation actions. Additional activities to be started, and a workflow that can be modeled in the process definition form or workflow designer can be initiated, based on an initial attestation action. This is possible due to attestation subflows in the provisioning processes defined in Oracle Identity Manager. Attestation activity can be initiated on a periodic basis or when required. A reviewer can delegate specific entitlements in an attestation task to another user for review. This action creates another attestation task that is assigned to the delegated user. This section discusses the following topics: ■ Definition of an Attestation Process ■ Components of Attestation Tasks ■ Attestation Request 19-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager ■ Delegation ■ Attestation Lifecycle Process ■ Attestation Engine ■ Attestation Scheduled Task ■ Attestation-Driven Workflow Capability ■ Attestation E-Mail

19.1.1 Definition of an Attestation Process

An attestation process is the mechanism by which an attestation task is set up. Input that an attestation process requires includes information about how to define the components that constitute the attestation task and how to associate the attestation task with a schedule at which the task must be run. This definition is also the basis on which the attestation task can be initiated when required. An attestation process definition includes: ■ User Scope or Resource Scope : This defines the algorithm by which the target user entitlements of the attestation process are determined. ■ Reviewer Setup : This specifies the reviewer, who attests the entitlements of other users. An attestation process can specify a particular user as the reviewer, or can specify more abstractly how to select the reviewer. For example, the reviewer can be specified as the users manager, as an administrator of the resource, as an authorizer of access to the resource, or as a member of the role that grants the entitlement. ■ Definition of Attestation Schedule : This specifies the schedule for running the attestation process. ■ Process Owner : This is a designated group of users that are responsible for monitoring activities related to the process. – They will be notified of any issues that occur when the process runs. – They will have permissions to view the process definition, but will not have administrative permissions by default. – They will be able to execute the process whenever required. A single attestation process could result in multiple attestation tasks, if that process defines a set of reviewers. In such a case, the process would result in one attestation task for each reviewer in the set.

19.1.1.1 Attestation Process Control

The following sections describe how you can control attestation processes.

19.1.1.1.1 Disabling Processes An attestation process can be disabled by the system

administrator to prevent it from running at its preconfigured schedule. This gives an administrator better control over the environment. A system administrator attestation process can be enabled, but it cannot be enabled if its Next Run Time value is in the past. A user who enables an attestation process must set its next run time in the future.

19.1.1.1.2 Deleting Processes An attestation process can be deleted. This is called a

soft-delete. It does not actually delete the records because the records must be maintained for audit purposes. Instead, the attestation process will be marked as deleted.