Approval Policy Management Authorization Policies for Oracle Identity Manager Features

16 Managing Access Policies 16-1 16 Managing Access Policies Access policies are a list of roles and the resources with which roles are to be provisioned or deprovisioned. Access policies are used to automate the provisioning of target systems to users. This is explained with the help of the following example: A user belongs to multiple roles created in Oracle Identity Manager. Suppose a role Role1 have membership rule assigned to it. Membership rules can be designed based on the organization that the user belongs to, such as Organization Name = Org1. Roles can have access policies assigned to them. An access policies states which resource would be provisioned andor denied to a role when the access policy is applicable. Therefore, when a user is created in the Org1 organization, it satisfies a membership rule and grants the Role1 role to the user. This in turn triggers the access policy assigned to the role and then provisions or denies the resources mentioned in the access policy. This chapter describes how to create and use access policies for users and resources in Oracle Identity Manager. It contains the following sections: ■ Terminologies Used in Access Policies ■ Features of Access Policies ■ Creating Access Policies ■ Managing Access Policies ■ Provisioning Multiple Instances of the Same Resource via Access Policy

16.1 Terminologies Used in Access Policies

The following terminologies are associated with access policies: Resource A resource is a logical entity in Oracle Identity Manager that can be provisioned to a user or an organization in Oracle Identity Manager. For example, Microsoft Active Directory AD, Microsoft Exchange, SAP, UNIX, and Database is modeled as a resource in Oracle Identity Manager. Resources are templated definitions that are associated with one or more workflows called Provisioning Process in Oracle Identity Manager, which model the lifecycle management, such as how to provision, revoke, enable, and disable. Resources also have entities called forms associated with them. Forms represent a collection of attributes associated with the resource. For instance, a form associated with AD server includes attributes such as SAM Account Name, Common Name, and