Edit the values in the fields provided, and click Apply.

19-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager ■ Delegation ■ Attestation Lifecycle Process ■ Attestation Engine ■ Attestation Scheduled Task ■ Attestation-Driven Workflow Capability ■ Attestation E-Mail

19.1.1 Definition of an Attestation Process

An attestation process is the mechanism by which an attestation task is set up. Input that an attestation process requires includes information about how to define the components that constitute the attestation task and how to associate the attestation task with a schedule at which the task must be run. This definition is also the basis on which the attestation task can be initiated when required. An attestation process definition includes: ■ User Scope or Resource Scope : This defines the algorithm by which the target user entitlements of the attestation process are determined. ■ Reviewer Setup : This specifies the reviewer, who attests the entitlements of other users. An attestation process can specify a particular user as the reviewer, or can specify more abstractly how to select the reviewer. For example, the reviewer can be specified as the users manager, as an administrator of the resource, as an authorizer of access to the resource, or as a member of the role that grants the entitlement. ■ Definition of Attestation Schedule : This specifies the schedule for running the attestation process. ■ Process Owner : This is a designated group of users that are responsible for monitoring activities related to the process. – They will be notified of any issues that occur when the process runs. – They will have permissions to view the process definition, but will not have administrative permissions by default. – They will be able to execute the process whenever required. A single attestation process could result in multiple attestation tasks, if that process defines a set of reviewers. In such a case, the process would result in one attestation task for each reviewer in the set.

19.1.1.1 Attestation Process Control

The following sections describe how you can control attestation processes.

19.1.1.1.1 Disabling Processes An attestation process can be disabled by the system

administrator to prevent it from running at its preconfigured schedule. This gives an administrator better control over the environment. A system administrator attestation process can be enabled, but it cannot be enabled if its Next Run Time value is in the past. A user who enables an attestation process must set its next run time in the future.

19.1.1.1.2 Deleting Processes An attestation process can be deleted. This is called a

soft-delete. It does not actually delete the records because the records must be maintained for audit purposes. Instead, the attestation process will be marked as deleted. Managing Attestation Processes 19-3 A deleted process is not displayed in Oracle Identity Manager Administrative and User Console. Because process names and codes are unique, a name once used is no longer available, and no new attestation process can be created with the same name.

19.1.2 Components of Attestation Tasks

The basic purpose of the attestation process is to set up an attestation task in Oracle Identity Manager. The attestation task is displayed in the Attestation tab of the TaskList in the Oracle Identity Manager Self Service, where you can manage this task or delegate it to someone else to manage. The following are the basic components of an attestation task: ■ Reviewer : This specifies the user who performs the attestation. ■ Task Source : This specifies whether or not the attestation task is a result of a process or because of delegation by another reviewer. In the case of delegation, the task must track the reviewer who delegated the task, and which task is the source of the entitlements. ■ Attestation Data : This is detailed data about user entitlements in the attestation scope. This data is from the process form of the provisioned resource instance. ■ Attestation Date : This defines the date on which the attestation task is initiated. ■ Attestation Actions : These are the actions that the reviewer can take on the attestation scope. The action is not at the level of attestation task overall, but rather against each entitlement in the attestation scope. The following are attestation actions: – Certify : The reviewer agrees that the user being reviewed is allowed to have the entitlement in its current form, including any specific data or fine-grained permissions. – Reject : The reviewer does not think that the user must have this entitlement in the form. – Decline : The reviewer does not want to accept the responsibility of attesting to the entitlement. This action is usually for cases in which processes have been configured incorrectly, and is useful in the early stages of a rollout. A reviewer declines a task when the reviewer wants someone else to act upon the task. When a task is declined, it gets assigned to a random user in the System Administrator role. – Delegate : The reviewer wants to reassign the attestation of this entitlement to another qualified person.

19.1.2.1 Attestation Inbox

From the Attestation tab of the TaskList in the Self Service, a reviewer can view the details of each attestation task. Within an attestation task, the reviewer can provide responses or comments for individual entitlements. Note: The attestation tasks are not workflow tasks in Oracle Identity Manager definition. They are not created as part of workflow. Attestation tasks do not support all the task management features that the workflow engine supports such as dynamic assignment, escalation, and proxy management.