Click Save. The selected roles are added to the table in the Assignment page.

Managing Authorization Policies 15-13 2. Click an authorization policy. Alternatively, you can select an authorization policy, and from the Actions menu, select Open. The page that allows you to view and modify authorization policy details is displayed. The General tab of the page is displayed by default, with details about the policy name, description, entity name, permissions, data constraints, and assignment. 3. Edit the Policy Name and Description fields to update the authorization policy name and description.

4. Click the Permissions tab. In this tab, you can check the permissions that you

want to enable in this policy. To do so, select the permissions from the table, or select Enable All Permissions to enable all permissions. Some permissions have attribute-level settings. To modify the attribute-level settings, click Edit Attributes.

5. Click the Data Constraints tab. In this tab, you can modify the roles that the user

must be a member of for this authorization policy. 6. Select any one of the following options: ■ All Roles: To specify that the authorization policy is applicable to all roles in Oracle Identity Manager including all the child roles. ■ Selected Roles: To specify that the authorization policy is applicable to selected roles only. 7. If you select the Selected Roles option, then you must select the roles for which the authorization policy is been created. This tab also allows you to remove selected roles. To add or remove roles, perform the steps described in steps 10 or 11 respectively of Creating an Authorization Policy for Role Management on page 15-9.

8. Select Hierarchy Aware include all Parent Roles to specify that all the parent

roles of the selected roles must be selected for the authorization.

9. Click the Assignment tab. This tab displays the roles that are assigned to this

policy. You can add or remove the assignment by performing steps 10 or 11 respectively of Creating Custom Authorization Policies on page 15-5 and Creating an Authorization Policy for Role Management on page 15-9.

10. Click Apply to save changes.

Alternatively, click Revert to refresh the page with old values. Note: You cannot change the entity name of an authorization policy after the policy is created. Note: Steps 6 through 8 are applicable for authorizations policies for roles. See Also: Disabling Access to Features Through the Authorization Policies in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager for information about disabling or hiding features by using authorization policies 15-14 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

15.2.5 Deleting Authorization Policies

To delete an authorization policy:

1. In the Authorization Policy tab of the Administration Console, search for the

authorization policy that you want to delete.

2. Select the policy. From the Actions menu, select Delete. A message box is

displayed asking for confirmation.

3. Click OK to confirm deletion.

15.3 Authorization Policies for Oracle Identity Manager Features

This section describes the authorization policy components for the following Oracle Identity Management features: ■ User Management ■ Authenticated User Self Service ■ Role Management ■ Authorization Policy Management ■ User Management Configuration ■ Reconciliation Management ■ Scheduler ■ Request Template Management ■ Request Creation By Using Request Templates ■ Approval Policy Management ■ Notification Management ■ System Properties ■ Diagnostic Dashboard ■ Plug In

15.3.1 User Management

The components of the authorization policies defined for the user management feature and the default authorization policy are described in the following sections: ■ Assignee ■ Functional Security ■ Data Security ■ Default Authorization Policies

15.3.1.1 Assignee

The assignee of the policy can be a set of roles. The policy is assigned to each role in the set of policies. In addition, a rule for selecting the management chain of the user being managed as an assignee is supported. There is no ability to restrict this to just the direct manager of the user being managed. See Also: Chapter 11, Managing Users for information about the user management feature