Oracle Identity Manager receives the request and creates an Assign Roles request

Using the Callback Service 4-3 4. OAACG returns an Approved with Conditions response indicating the Buyer role is acceptable but the POCreater role is in violation due to James existing POApprover role. 5. The Oracle Identity Manager request status changes and a second callback is sent to the callbacks-registered Web services indicating an SoD Remediation In Progress. It contains the same identification information as the previous callback. 6. A TAG named CFOOVERRIDE is placed in the rejection notes, indicating the Chief Financial Office CFO can approve this violation in selective cases. You must configure OBR rules to invoke an exception approval if any tag is placed with the rejection notes that uses OVERRIDE at the end. 7. AMX Rules decipher the tag and determine that CFO approval is required so that the task is assigned to the person with title CFO. 8. The CFO either approves the request, or rejects it. a. If the request is rejected, then the Oracle Identity Manager request status changes and a third callback is returned as SoD Remediation Rejected. The Oracle Identity Manager request is then closed with the SoD Remediation Rejected status. b. If the request is approved, then the Oracle Identity Manager request status changes and a third callback is returned as SOD Remediation Approved. The Oracle Identity Manager request is updated with the SOD Remediation Approved status. OAACG and requesting application is notified of the approval, and the roles are provisioned. 9. When the Oracle Identity Manager request status changes to Request Completed, then a final callback is sent to all the callbacks-registered Web services indicating that the request is completed with the Request Completed status.

4.1.2 Understanding Event Processing

Figure 4–1 illustrates how an event is processed. Oracle Identity Manager uses asynchronous invocation, giving the calling applications flexibility to process the event as needed, such as starting a human approval workflow. Note: If one portion of the request is rejected, then the entire request is rejected. Therefore, in this example, although the Buyer role does not have an SoD violation, it is not provisioned to the user.