Common Name Generation for Create User Operation Common Name Generation for Modify User Operation

12-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

12.1 Role Membership Inheritance

Membership inheritance means that the members of the inheritor role inherit from the inherited role. For example: ■ Role B inherits memberships from Role A. Role B is parent role to Role A. ■ Role C also inherits memberships from Role A. Role C is also parent role of Role A. In this example, all members of Role A are also implicit or indirect members of Role B and Role C, but members of Role B are not automatically members of Role A. In other words, Role B and Role C are the parents of Role A. Similarly, Role A is the child of Role B and Role C. A real example for this is that the Employee Role Role B inherits memberships from the Manager Role Role A. Role membership inheritance is described with the help of the following scenario: ■ The role CEO is a parent role of the Manager role. ■ The role Manager is a parent role of the Employee role. ■ The role Software Architect is a parent role of the Software Engineer role. ■ The role Software Engineer is a parent role of the Employee role. ■ The Employee role has two parent roles - the Manager role and the SoftwareEngineer role. Figure 12–1 shows the parent and child roles in this example, along with the membership inheritance: Note: The child role that inherits membership from its parent role is called the inheritor role. The parent role from which the inheritor role inherits membership is called the inherited role. Managing Roles 12-3 Figure 12–1 Role Membership and Permission Inheritance Each user in a parent role automatically becomes a member in any of its child roles. If that child role is itself a parent, then the user is also added to its child roles, and so on. This continues until there are no more child roles. For example, a CEO is a manager and is automatically a member of the Manager role. Similarly, a manager is automatically an employee. This is why a member added to a parent role gets inherited by its children roles, and so on. This explains why the direct membership of the Employee role is empty, and considering membership inheritance, the Employee role has more members than all other roles.

12.2 Role Permission Inheritance

Permission inheritance means that the permissions of the inheritor role inherit from the inherited role. For example: ■ Role B inherits permissions from Role A. ■ Role C also inherits permissions from Role A. In this example, Role B and Role C are the children of Role A. Similarly, Role A is also the parent of Role B and Role C. A real example for this is that the Manager role inherits permissions from the Employee role. The Administrative and User Console represents role permission inheritance through the following sections in the Hierarchy tab: 12-4 Oracle Fusion Middleware Users Guide for Oracle Identity Manager ■ Inherited From: Displays the parent roles from which the open role is inherited. The base role has the same permissions and privileges on the members as the inherited roles. Only inherited roles can be added or removed from the base role, but the base role cannot be added or removed from the inherited role. ■ Inherited By: Lists the child roles that are inherited by the open role. This is a read-only display of the roles. You can use the Open Role action to modify the relationship from the base role. For example, you create three roles: role1, role2, and role3. Open role3 and assign role2 as the parent role. Similarly, open role2 and assign role1 as the parent role. When you open role3, the Inherited From section displays the role2 parent role, and role1 is displayed under role2. When you open role1, the Inherited By section displays the role2 child role, and role3 is displayed under role2. A user can be a member of a role in one of the following ways: ■ The member has been inherited from the parent role, which is called indirect membership. ■ The user is directly assigned to the role, which is called direct membership. ■ The user can be assigned directly via request in the role details page by setting the XL.RM_REQUEST_ENABLED and XL.RM_ROLE_ASSIGN_TEMPLATE system properties, which is also called direct membership. See Administering System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about system properties. An indirect member can be assigned as direct member. If the direct membership for a user is removed, then all membership for that role does not change because that user is still a member of that because of inheritance. Figure 12–1 illustrates that a permission on Employee is a permission that a Manager will have. Similarly, a permission a Manager will have is a permission a CEO will have. And this is why permissions inherit upwards. In addition, a parent role can inherit permissions from multiple child roles. For example, a CEO inherits the permissions of the Manager and Software Architect roles. Therefore, membership inheritance and permission inheritance go in different directions.

12.3 Role Entity Definition

Attributes are defined for the role entity in Oracle Identity Manager. These attributes are the same for all entities, such as user, organization, role, role hierarchy, and role membership. For a list of attributes defined for the entities, see User Entity Definition on page 11-3. This section describes the default attribute definition of the following entities: ■ Role Entity ■ Role Category Entity ■ Role Grant Relationship See Also: The Hierarchy Tab on page 12-14 for more information about the Hierarchy tab Note: You cannot add your own attributes for the role entity. Managing Roles 12-5 ■ Role Parent Relationship

12.3.1 Role Entity

The Role.xml file contains the attribute definition for the role entity. You can add your own attributes to the role entity. Table 12–1 lists the default attributes for the role entity. Table 12–1 Default Attributes for the Role Entity Attribute Name Category Type Data Type Properties LOV Key Basic Single Numeric Required: Yes System-Can-Default: Yes System-Controlled: Yes Encryption: Clear User-Searchable: Yes Bulk-Updatable: No NA Role Unique Name Basic Single Text Required: Yes System-Can-Default: Yes System-Controlled: Yes Encryption: Clear User- searchable: No Bulk-Updatable: No NA Role Display Name Basic Single Text multi-langua ge Required: Yes System-Can-Default: Yes System-Controlled: No Encryption: Clear User-Searchable: Yes Bulk-Updatable: No NA Role Namespace Basic Single Text Required: Yes System-Can-Default: Yes System-Controlled: Yes Encryption: Clear User-Searchable: Yes Bulk-Updatable: No NA Role Name Basic Single Text multi-langua ge Required: Yes System-Can-Default: No System-Controlled: No Encryption: Clear User-Searchable: Yes Bulk-Updatable: No NA