The Child Requests Tab

15 Managing Authorization Policies 15-1 15 Managing Authorization Policies Oracle Identity Manager controls access to the application by the users to allow or prevent the users to perform various operations in the application. This is controlled by the authorization engine embedded in Oracle Identity Manager with the help of authorization policies. The purpose of authorization policies is to control users access to Oracle Identity Manager application, which includes data, UI, and API. The authorization policies determine at runtime whether or not a particular action is allowed. You can define authorization policies that satisfy the authorization requirements within Oracle Identity Manager. In earlier releases of Oracle Identity Manager, each Oracle Identity Manager feature defines and manages its own authorization policy UI and backend implementation. In Oracle Identity Manager 11g Release 1 11.1.1, authorization policy management is centralized as an administrative feature. Oracle Identity Managers authorization policy management and enforcement engine is now based on an embedded version of Oracle Entitlements Server OES, Oracles industry-leading fine-grained entitlements administration product. These authorization policies secure access control to the Oracle Identity Manager application, thereby defining who can do what inside the application. This centralized definition of authorization policies continues to provide context-sensitive authorizations for each feature as explained in the following sections: ■ Authorization Policy ■ Creating and Managing Authorization Policies ■ Authorization Policies for Oracle Identity Manager Features

15.1 Authorization Policy

You can define and manage authorization policies in the Authorization Policies section of the Oracle Identity Administration. This section is available to users who have the Manage Authorization Policies privilege. The following are the structural components of an authorization policy: ■ Identifying details: Each authorization policy must have a name and description. ■ Oracle Identity Manager feature: Each authorization policy is defined for a specific feature in Oracle Identity Manager. Features are well-defined components in Oracle Identity Manager such as user management and role management. The See Also: Adding and Removing Roles on page 11-41 and Viewing and Administering Roles on page 12-14 for information about assigning roles and privileges 15-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager authorization requirements of multiple features cannot be covered by a single authorization policy. ■ Assignee: This is the role or roles that a policy grants privileges to. You can grant privileges to one or more roles for each policy. All members of the role direct or indirect through inheritance are granted the privileges by the authorization policy. For the user management feature, a rule based on the manager relationship is supported. Here, all the users that are in the management chain of the user being acted on are the assignees of the authorization policy. Assignee can include additional conditions that must be fulfilled by the assignee. This is a way of making the authorization policy context aware. For example, for the user management feature, a condition can state that for the assignee to have the privileges, the assignee must be a member of the same organization listed in the data security. ■ Privileges: These are the privileges that the assignees are granted. The list of privileges is defined by the feature for which this policy is being defined. For example, the user management feature defines privileges such as Search for Users, View User Detail, and Modify User Profile. For a complete list of privileges for the user management feature, see Privileges on page 11-50. Some privileges also support fine-grained attribute-level controls that define which specific entity attributes of the feature are further granted to the assignee. For instance, for the View User Detail privilege, the policy can further define which of the attributes on the user entity can be viewed by the assignee at run time. Not all privileges support attribute-level details. For example, the Delete User privilege does not require or support any attribute-level details. ■ Data security: These are the entities managed by the feature over which a privilege is granted to the assignee. This section is optional based on whether or not the feature for which the authorization policy is being defined supports data security. The data security is expressed in the form of an entity selection criteria or a search criteria that is used to determine the entities over which the privilege is granted. The data security can also be a list of specific entities. The data security capabilities depend on the feature. For instance, the criteria can specify that the assignee is granted privileges over the users belonging to a list of organizations. This criteria can provide additional security settings that apply to the data security. For example, in the user management feature, an instruction can be that the organization condition applies down the hierarchy so that users in the specified organization and all child organizations are in scope for this data security policy.

15.2 Creating and Managing Authorization Policies

Using the Administrative and User Console, you can perform the following tasks related to authorization policies: Note: ■ For information about inheritance of role membership, see Chapter 12, Managing Roles . ■ To assign policies based on user attributes, you can configure auto-group membership rules and assign policies to that role. See Viewing, Assigning, and Revoking Membership Rules on page 12-18 for details. Managing Authorization Policies 15-3 ■ Searching Authorization Policies ■ Creating Custom Authorization Policies ■ Creating Authorization Policies Based on Existing Policies ■ Viewing and Modifying Authorization Policies ■ Deleting Authorization Policies

15.2.1 Searching Authorization Policies

You can perform simple or quick search and advanced search operations for existing authorization policies. These operations are described in the following sections: ■ Simple Search ■ Advanced Search

15.2.1.1 Simple Search

To perform simple search for authorization policies: 1. Login to the Administration console with credentials that have the Manage Authorization Policies privilege.

2. In the left pane, click Authorization Policy tab.

3. Verify that Policy is selected in the lookup. 4. In the text box, enter a search criteria for authorization policies. For example, you can enter the name of the authorization policy you want to find. You can also use wildcard characters in the search criteria, such as the asterix character to search all authorization policies. 5. Click the Search icon. You can include wildcard characters in your search criterion. For performance reasons, initial prefix wildcards will be removed. However, a trailing prefix wildcard will be added to all searches. Figure 15–1 shows the result of the authorization policies simple search: Note: Creation, modification, or deletion of authorization policies does not come into effect immediately, but takes approximately 5 to 10 seconds to come into effect. Note: Authorization policy search is case sensitive, so you must ensure proper case while entering search criteria. 15-4 Oracle Fusion Middleware Users Guide for Oracle Identity Manager Figure 15–1 Authorization Policy Simple Search

15.2.1.2 Advanced Search

To perform advanced search for authorization policies:

1. In the Welcome page, under Authorization Policies, click Advanced Search -

Authorization Policies . Alternatively, you can click the Authorization Policy tab, and then click Advanced Search link on the left pane. The Advanced Search page is displayed.

2. Select any one of the following options:

■ All: On selecting this option, the search is performed with the AND condition. This means that the search operation is successful only when all the search criteria specified are matched. ■ Any: On selecting this option, the search is performed with the OR condition. This means that the search operation is successful when any search criterion specified is matched.

3. In the Policy Name field, enter the authorization policy name that you want to

search. To do so, select a search comparator in the list adjacent to the Policy Name field. The default search comparator is Contains. Other comparators are available in the pulldown list as an alternative.

4. In the Role Name field, enter the name of the role to which the policies are

assigned. You can use wildcard characters in your search criteria. Select a search condition in the list adjacent to the Role Name field. Managing Authorization Policies 15-5 5. In the Entity Type field, select the entity type for whom the authorization policies are defined.

6. Click Search. The search results are displayed in the search results table, as shown

in Figure 15–2 : Figure 15–2 Authorization Policy Advanced Search