Authorization for Profile Attributes

Managing Authorization Policies 15-21

15.3.3.2 Functional Security

Multiple privileges are defined for the role management feature. The privileges do not support fine-grained attribute-level controls.

15.3.3.3 Data Security

For the role management feature, data security is defined as the list of roles the assignee will have privileges over. The Assignee Must Be Member of condition restricts the grant to assignees that are also members of the role being granted privileges over. The Hierarchy Aware setting takes the role hierarchies into account when determining the data security.

15.3.3.4 Default Authorization Policies

The default authorization policy defined for this feature cannot be modified or deleted by users. The policies are describes in the following table: Policy Name Assignee Functional Security Data Security Description Role Management Administration Policy System Administrators and ROLE ADMINISTRA TORS roles The permissions are: Create Role Create Role Category Delete Role Delete Role Category Modify Role Modify Role Category Modify Role Hierarchy Modify Role Membership Search for Role Search for Role Categories View Role Category Detail View Role Detail View Role Membership All Roles This is the predefined authorization policy associated with the ROLE ADMINISTRATORS and SYSTEM ADMINISTRATORS roles. Role Management All Users Policy ALL USERS role The permissions are: Search for Role Search for Role Categories View Role Detail View Role Category Detail All Roles, in which the authorization is applied to users belonging to roles Selected Roles, in which you can select the roles that the user must be a member of for this authorization This is the predefined authorization policy associated with the ALL USERS role. 15-22 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

15.3.4 Authorization Policy Management

Access to the authorization policy management feature is controlled by a default authorization policy. This policy grants the users who belong to the System Administrators role to perform authorization policy operations, such as searching Role Management Role Owner Policy ALL USERS role The permissions are: Delete Role Modify Role Modify Role Hierarchy Modify Role Membership Search for Role Search for Role Categories View Role Category Detail View Role Detail View Role Membership All Roles that the assignee is the owner of. When a user creates a role, the person with the role created will become the role owner. This is the predefined authorization policy to enable role owners to have control of their roles. Role Management Approval and Request Policy APPROVAL POLICY ADMINISTRA TORS, REQUEST TEMPLATE ADMINISTRA TORS roles, and REQUEST ADMINISTRA TORS roles The permissions are: Search for Role Search for Role Categories View Role Category Detail View Role Detail All Roles This is the predefined authorization policy associated with the APPROVAL POLICY ADMINISTRATORS, REQUEST ADMINISTRATORS, and REQUEST TEMPLATE ADMINISTRATORS roles. Role Management Delegated Administration Policy ROLE ADMINISTRA TORS role The permissions are: Modify Role Membership Search for Role Search for Role Categories View Role Category Detail View Role Detail View Role Membership All Roles This policy can be used as an example for the Delegated Role Administrator persona. You can change the assignee and the data constraint, if required. Role Management Hierarchy Administration Policy ROLE ADMINISTRA TORS role The permissions are: Modify Role Modify Role Hierarchy Search for Role Search for Role Categories View Role Category Detail View Role Detail View Role Membership All Roles This policy can be used as an example for the Role Hierarchy Administrator persona. You can change the assignee and the data constraint, if required. Policy Name Assignee Functional Security Data Security Description