Stage 1: Creation of an Attestation Task

Managing Attestation Processes 19-9 After all the delegated attestation tasks are created, the subflow is completed and it merges back into the main flow. Figure 19–5 shows the flow of events of the follow-up action subflow. Figure 19–5 Follow-Up Action Sub-Flow With the follow-up subflow complete, the attestation task is marked as Complete.

19.1.6 Attestation Engine

The attestation engine implements the attestation lifecycle. It is a service in Oracle Identity Manager architecture that exposes APIs to receive instructions to initiate a particular attestation process. The API is called from the attestation scheduled task as well as from the Run Now button on the Attestation Process Detail page to support on-demand execution. It supports both drivers for initiation of attestation processes. The attestation engine uses the JMS messaging service to perform offline, queued processing. This ensures better performance. Note: Attestation depends on the entry in the user profile audit data. If the audit entry is not generated for a user who is part of the attestation process, then the reviewer would not be able to see the user and process form information in attestation. To avoid such situations, ensure that the Issue Audit Messages Task scheduled task is run before performing the attestation run. Were any items “Delegated” Were any items “Declined” End Task Follow-Up Sub-Flow START Send e-mail to Delegate For Each Delegate Chosen in the Task Create Attestation Task for Delegate Define and Save data for Attestation Define Task Source Source Task ID, Reviewer Send e-mail to Process Owner Yes Yes No No Gather data about the items declined 19-10 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

19.1.7 Attestation Scheduled Task

This new system scheduled task is responsible for examining the attestation processes defined in Oracle Identity Manager, and creating the necessary attestation tasks in the system. Features of this scheduled task are: ■ By default, this scheduled task is set to run every night. You can change the schedule according to your requirements. ■ This scheduled task examines the attestation process definition table for all active not system administrator attestation processes ■ If the scheduled task finds that the next scheduled start time of a process is in the past, then the task sends a call to the Attestation Engine to initiate the attestation process.

19.1.8 Attestation-Driven Workflow Capability

You can enhance the provisioning processes predefined in Oracle Identity Manager to listen to triggers coming from attestation activity. In this way, you can define custom workflows as part of the provisioning workflow that would respond to attestation taking place or not taking place, in case of a refusal, and therefore be initiated when attestation takes place. This serves two purposes: ■ The default attestation task in the flow, User Attestation Event Occurred, would provide the audit trail for the attestation history of the specific user entitlement. – There is one instance of this task for each time that resource instance is attested by the appropriate type of attestation process. – The response code set on the task indicates what the response provided by the reviewer is. – The user tagged as the person creating the task indicates who the reviewer is. – Any comment provided by the user is in the notes field for the task. ■ Using response-generated tasks, the default task can start the workflow to respond to a particular attestation response received. Therefore, for a particular resource, you can specify that the Reject response must start the appropriate workflow tasks in the provisioning process for disabling the account, as an example.

19.1.9 Attestation E-Mail

As part of the attestation processes, the Attestation Engine sends out e-mail to various interested parties. To make the e-mail configurable with respect to the content, they are made available as e-mail templates of the General type in Oracle Identity Manager Email Definition store. For context-sensitivity, the e-mail contain a set of variables that can be replaced with the required values.

19.1.9.1 Notify Attestation Reviewer

This template is used to build the e-mail to send to the reviewer when an attestation task is assigned to the reviewer.

19.1.9.1.1 Variables The following are variables in the Notify Attestation Reviewer

template: Managing Attestation Processes 19-11

19.1.9.1.2 Subject Line The following is the Subject line of e-mail messages defined by

the Notify Attestation Reviewer template: A new attestation task for attestation process Attestation Definition.Process Name has been added to your attestation inbox

19.1.9.1.3 Body The body of the e-mail message contains the following information:

The attestation task details are as follows Process Name: Attestation Definition.Process Name Process Code: Attestation Definition.Process Code Data Type: Access Rights Assigned Date: Attestation Task.Task Assigned Date

19.1.9.2 Notify Delegated Reviewers

This template is used to build the e-mail to send to a reviewer when an attestation task is delegated to the reviewer.

19.1.9.2.1 Variables The following are variables in the Notify Delegated Reviewers

template:

19.1.9.2.2 Subject Line The following is the Subject line of e-mail messages defined by

the Notify Delegated Reviewers template: Attestation Task.Delegated By User Id has delegated to you an attestation task from attestation process Attestation Definition.Process Name

19.1.9.2.3 Body The body of the message contains the following information:

The attestation task details are as follows Process Name: Attestation Definition.Process Name Process Code: Attestation Definition.Process Code Data Type: Access Rights Assigned Date: Attestation Task.Task Assigned Date Delegated By: Attestation Task.Delegated By First Name Attestation Task.Delegated By Last Name [Attestation Task.Delegated By User Id] Variable Description Attestation Definition.Process Name Name of the attestation process Attestation Definition.Process Code Code for the attestation process Attestation Task.Task Assigned Date Date the attestation task was assigned Variable Description Attestation Definition.Process Name Name of the attestation process Attestation Definition.Process Code Code for the attestation process Attestation Task.Task Assigned Date Date the attestation task is assigned Attestation Task.Delegated By First Name First name of the reviewer who performed the delegation Attestation Task.Delegated By Last Name Last name of the reviewer who performed the delegation Attestation Task.Delegated By User Id User ID of the reviewer who performed the delegation action