Deleting Approval Policies Oracle Fusion Middleware Online Documentation Library

Managing Attestation Processes 19-3 A deleted process is not displayed in Oracle Identity Manager Administrative and User Console. Because process names and codes are unique, a name once used is no longer available, and no new attestation process can be created with the same name.

19.1.2 Components of Attestation Tasks

The basic purpose of the attestation process is to set up an attestation task in Oracle Identity Manager. The attestation task is displayed in the Attestation tab of the TaskList in the Oracle Identity Manager Self Service, where you can manage this task or delegate it to someone else to manage. The following are the basic components of an attestation task: ■ Reviewer : This specifies the user who performs the attestation. ■ Task Source : This specifies whether or not the attestation task is a result of a process or because of delegation by another reviewer. In the case of delegation, the task must track the reviewer who delegated the task, and which task is the source of the entitlements. ■ Attestation Data : This is detailed data about user entitlements in the attestation scope. This data is from the process form of the provisioned resource instance. ■ Attestation Date : This defines the date on which the attestation task is initiated. ■ Attestation Actions : These are the actions that the reviewer can take on the attestation scope. The action is not at the level of attestation task overall, but rather against each entitlement in the attestation scope. The following are attestation actions: – Certify : The reviewer agrees that the user being reviewed is allowed to have the entitlement in its current form, including any specific data or fine-grained permissions. – Reject : The reviewer does not think that the user must have this entitlement in the form. – Decline : The reviewer does not want to accept the responsibility of attesting to the entitlement. This action is usually for cases in which processes have been configured incorrectly, and is useful in the early stages of a rollout. A reviewer declines a task when the reviewer wants someone else to act upon the task. When a task is declined, it gets assigned to a random user in the System Administrator role. – Delegate : The reviewer wants to reassign the attestation of this entitlement to another qualified person.

19.1.2.1 Attestation Inbox

From the Attestation tab of the TaskList in the Self Service, a reviewer can view the details of each attestation task. Within an attestation task, the reviewer can provide responses or comments for individual entitlements. Note: The attestation tasks are not workflow tasks in Oracle Identity Manager definition. They are not created as part of workflow. Attestation tasks do not support all the task management features that the workflow engine supports such as dynamic assignment, escalation, and proxy management. 19-4 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

19.1.3 Attestation Request

When an attestation process is executed, an attestation request is created and recorded in Oracle Identity Manager database. This request records for audit purposes, when an attestation process is executed. The attestation request record consists of basic identity and audit data and statistical data that is used in reports. The data includes the following items: ■ A request ID: Each attestation request has a unique identifier. Each attestation task that Oracle Identity Manager creates as a result of a request, stores as part of its record, the request ID of the associated attestation request. ■ Date and time of execution of the process. ■ Date and time of completion of the process: The date and time of completion of the process is considered to be the date and time for that request. ■ Total number of entitlements identified for attestation. The number of provisioned resources that matched the selection criteria of the resource scope of the attestation process during this particular execution of the attestation process. ■ Number of entitlements certified. ■ Number of entitlements rejected. ■ Number of entitlements declined.

19.1.4 Delegation

The reviewer who is assigned to an attestation task may not be able to attest to all the entitlements in the task. There may be multiple reasons for this. For example: ■ There may be too many entitlements covering too many users in the attestation task ■ The reviewer is not sure about the reasons for which the entitlements were provisioned In these cases, the reviewer may want to involve other people in the review. A reviewer can delegate attestation of certain entitlements in the task. To delegate attestation, the reviewer selects a set of entitlements in the task and delegates them to another user. This creates a new attestation task that is assigned to the selected reviewer. The new task contains only those entitlements that the original reviewer selected. The original reviewer is no longer responsible for providing an attestation response for those entitlements. The new attestation task assigned to the delegate would track who performed the delegation, which task it was created from, and some other information, for example, the request ID. The new attestation task is treated in the same manner as any other attestation task. It can even be delegated. Figure 19–1 shows delegate attestation page. Managing Attestation Processes 19-5 Figure 19–1 Delegate Attestation

19.1.5 Attestation Lifecycle Process

The following is a description of the attestation lifecycle in Oracle Identity Manager.

19.1.5.1 Stage 1: Creation of an Attestation Task

This stage starts when an attestation process is run. Figure 19–2 describes the workflow involved in this stage.