Creating Access Policies Oracle Fusion Middleware Online Documentation Library

Managing Access Policies 16-11 Creating and Managing System Properties in the same guide for information about setting the value of a system property. 2. Restart Oracle Identity Manager for the change in the system property to take effect. When multiple account provisioning is enabled, you must define the appropriate account discriminator attributes. To do so: 1. Log in to the Design Console. 2. Update the process form as follows:

a. Expand Development Tools, and then double-click Form Designer.

b. Search and open the process form.

c. On the Form Designer tab, click Create New Version.

d. In the Create a New Version dialog box, enter a label in the Label field, and then click Save. e. From the Current Version list, select the version that you created. f. On the Properties tab, select the field that you want to designate as the discriminator field, and then click Add Property.

g. In the Add Property dialog box, select Account Discriminator as the property

name, enter True in the Property Value field, and then click Save. h. Click Make Version Active, and then click OK. i. Click Save. 3. Run the Form Version Control FVC utility if you modified existing process forms. See Using the Form Version Control Utility for information about running the FVC utility.

16.5.3 Provisioning Multiple Instances of a Resource to Multiple Target Systems

The following are the broad-level steps to provision multiple instances of a resource object to multiple target systems via access policy: 1. Create an IT resource type by using the IT Resources Type Definition Form in the Oracle Identity Manager Design Console. For information about using this form, see IT Resources Type Definition Form in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. 2. Create multiple IT resource instances of the IT resource type that you created in step 1. For information about creating IT resources, see Creating IT Resources in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. Here, IT resource instance is the account discriminator. See Provisioning Multiple Instances of the Same Resource via Access Policy by Using Account Discriminator on page 16-5 for information about account discriminator. 3. Create a process form with a field of type that you created in step 1. For information about creating process forms, see Developing Process Forms in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. 4. Create a resource object. For information about creating a resource object, see Creating a Resource Object in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. 16-12 Oracle Fusion Middleware Users Guide for Oracle Identity Manager 5. Create a process definition, and associate the resource object and process form. For information about creating a process definition, see Creating a Process Definition in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. 6. Create access policies associating a role and resource object. See Creating Access Policies on page 16-7 for details. When you have two instances of the same resource on different physical server, you can use access policy to provision both the instances of a resource to the same user, JohnD. This is described with the help of the following scenario: You have tow AD instances, one hosted on server with IP as 10.151.14.82 and another hosted on server with IP 130.35.66.254. The user is to be provisioned to both the instances via access policy-based provisioning. To achieve this: 1. Create a AD User resource. 2. Create an IT resource with name ADServer1 that represents the server with IP address as 10.151.14.82. 3. Create an IT resource with name ADServer2 that represents the server with IP address as 130.35.66.254. 4. Mark the AD Server UD_ADUSER_AD process form field as the discriminator field. 5. Create two access policies as follows: ■ For the account to be created on ADServer1: Access policy name: AP3 Associated to role: Role3 Resource to provision: AD User Process form having Discriminator field: AD Server UD_ADUSER_AD Default value for ITResourceLookup field: ADServer1 ■ For the account to be created on ADServer2: Access policy name: AP4 Associated to role: Role4 Resource to provision: AD User Process form having Discriminator field: AD Server UD_ADUSER_AD Default value for ITResourceLookup field: ADServer2 6. Assign Role3 and Role4 to the user JohnD. When Role3 is assigned to JohnD, the account is created in the target system on ADServer1 via the AP3 access policy. When Role4 is assigned to JohnD, the account is created in the target system on ADServer2 via the AP4 access policy. Therefore, two distinct accounts are created for the same user and same resource on two different instances of the target system via access policy.

16.5.4 Limitation of Provisioning Multiple Instances of a Resource via Access Policy

Provisioning multiple instances of a resource via access policy has the following limitations: ■ A single access policy cannot provision multiple instances of a resource to a user. Multiple access policies must be created to provision multiple instances of