Notification Management Authorization Policies for Oracle Identity Manager Features

16 Managing Access Policies 16-1 16 Managing Access Policies Access policies are a list of roles and the resources with which roles are to be provisioned or deprovisioned. Access policies are used to automate the provisioning of target systems to users. This is explained with the help of the following example: A user belongs to multiple roles created in Oracle Identity Manager. Suppose a role Role1 have membership rule assigned to it. Membership rules can be designed based on the organization that the user belongs to, such as Organization Name = Org1. Roles can have access policies assigned to them. An access policies states which resource would be provisioned andor denied to a role when the access policy is applicable. Therefore, when a user is created in the Org1 organization, it satisfies a membership rule and grants the Role1 role to the user. This in turn triggers the access policy assigned to the role and then provisions or denies the resources mentioned in the access policy. This chapter describes how to create and use access policies for users and resources in Oracle Identity Manager. It contains the following sections: ■ Terminologies Used in Access Policies ■ Features of Access Policies ■ Creating Access Policies ■ Managing Access Policies ■ Provisioning Multiple Instances of the Same Resource via Access Policy

16.1 Terminologies Used in Access Policies

The following terminologies are associated with access policies: Resource A resource is a logical entity in Oracle Identity Manager that can be provisioned to a user or an organization in Oracle Identity Manager. For example, Microsoft Active Directory AD, Microsoft Exchange, SAP, UNIX, and Database is modeled as a resource in Oracle Identity Manager. Resources are templated definitions that are associated with one or more workflows called Provisioning Process in Oracle Identity Manager, which model the lifecycle management, such as how to provision, revoke, enable, and disable. Resources also have entities called forms associated with them. Forms represent a collection of attributes associated with the resource. For instance, a form associated with AD server includes attributes such as SAM Account Name, Common Name, and 16-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager User Principal Name. Forms also contain an attribute of type IT Resource see IT Resource Type on page 16-2 for details. Resources can be marked Allow Multiple, which would multiple instances of a resource to be provisioned to a user or an organization. Account Accounts are actual instances of a resource that are created and provisioned to a user or organization in Oracle Identity Manager. For example, an e-mail account on an Exchange server is an account instance of resource type Exchange. Accounts have specific values for the attributes of the associated form. IT Resource Type IT resource type is a logical entity in Oracle Identity Manager used to model a physical target and all its attributes including but not limited to the connectivity information and the credentials required to connect to the physical computer. For example, IT resource type AD server is used to model an actual AD server. IT Resource Instance These are actual instances of specific IT resource type that represent the actual physical target. They also have specific values for all the attributes of the physical target, such as IP address, port, user name, and password. Two physical AD servers in a deployment are represented by two instances of IT resource type AD Server. Account Discriminator Account discriminator is a collection of attributes on a form that uniquely identify the logical entity on which accounts are created. This term is sometimes loosely referred to as a target. For instance, for an AD server, an account discriminator can be a combination of AD server an attribute of type IT Resource and Organization Name. Typically account discriminators are attributes of type IT Resource. Attributes are marked as account discriminators by setting the Account Discriminator property of a Form field to True.

16.2 Features of Access Policies

This section describes the various features offered by the policy engine in the following sections: ■ Provisioning Options ■ Revoking the Policy ■ Denying a Resource ■ Evaluating Policies ■ Access Policy Priority ■ Access Policy Data ■ Provisioning Multiple Instances of the Same Resource via Access Policy by Using Account Discriminator