Viewing, Assigning, and Revoking Membership Rules

Managing Roles 12-21

12.5.2.8.2 Explicit Permission Not Required

Data objects for which explicit permission is not required are the ones for which permissions do not need to be defined because either there are no permissions enforced or they simply follow parent data object permissions. Data objects that use parent data object permissions follow a simple paradigm that if a role has update permissions on a parent data object, the same role will have insert, update, and delete permissions on child data objects. Explicit permissions are required only for the objects mentioned in Table 12–7, Data Objects Requiring Explicit InsertUpdateDelete Permissions . The rest of the data objects either have derived or implicit permissions. While assigning data objects or fine-grained permissions to roles, Oracle Identity Manager uses the following permission model: ■ To modify an insert data permission, a user who is logged in must have the insert and update permissions. ■ To modify an update data permission, a user who is logged in must have the update permissions. ■ To modify a delete data permission, a user who is logged in must have the insert, update, and delete permissions. com.thortech.xl.dataobj.tcRUE Rule Element com.thortech.xl.dataobj.tcSDC User defined columns on system user-defined forms com.thortech.xl.dataobj.tcSDH Parent child hierarchy of user defined forms com.thortech.xl.dataobj.tcSDL Form Definition Version Label com.thortech.xl.dataobj.tcSDP Form Definition Properties com.thortech.xl.dataobj.tcSPD IT Resources Type Parameter Definition com.thortech.xl.dataobj.tcSRE Association between user defined columns and pre-populate adapters com.thortech.xl.dataobj.tcSRS IT Resource Link com.thortech.xl.dataobj.tcSUG IT Resources Administrators com.thortech.xl.dataobj.tcSVD IT Resources Type Definition com.thortech.xl.dataobj.tcTDV Process Event Handlers com.thortech.xl.dataobj.tcTLG System Log com.thortech.xl.dataobj.tcTSA Schedule Task Attributes com.thortech.xl.dataobj.tcTSK Scheduled Tasks com.thortech.xl.dataobj.tcUHD Users Objects History Details com.thortech.xl.dataobj.tcUPL User Defined Field Lookups com.thortech.xl.dataobj.tcUPT User Defined Field Values com.thortech.xl.dataobj.tcUPY System Configuration Users com.thortech.xl.dataobj.tcWIN Form Information Table 12–7 Cont. Data Objects Requiring Explicit InsertUpdateDelete Permissions Data Object Type Entities 12-22 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

12.5.3 Creating and Managing Role Categories

Role categories are a way of categorizing roles for the purpose of navigation and authorization. Role categories are internally stored in Oracle Identity Manager as an attribute of the role and is reconciled with the multivalued business category attribute in the LDAP identity store. If the value in LDAP is empty, then the role is assigned to the system-managed Uncategorized role category. If the value in LDAP has multiple values or a single, unrecognized value, then the role reconciliation process does not reconcile the role and generates reconciliation errors in Oracle Identity Manager. The default role categories in Oracle Identity Manager are: ■ OIM Roles: All the predefined roles in Oracle Identity Manager are assigned to this category. These are roles that exist in Oracle Identity Manager by default and are primarily used for managing permissions. There will not be any corresponding entity in LDAP store for these predefined roles ■ Default: A newly created role must have a role category. Therefore, if a role category is not specified at the time of creating the role, then the role is assigned to this category by default. This section describes the following topics: ■ Creating a Role Category ■ Searching Role Categories ■ Modifying a Role Category ■ Deleting a Role Category

12.5.3.1 Creating a Role Category

To create a role category: 1. Login to Oracle Identity Administration.

2. In the Welcome page, under Roles, click Create Role Category.

Alternatively, in the Browse tab of the left pane, expand Roles, and from the Actions menu, select Create Category. Otherwise, click Create Category icon on the toolbar. The Create Role Category page is displayed. 3. In the Category Name box, enter the name of the role category. 4. In the Description box, enter a description for the role category. This step is optional.

5. Click Save. A page is displayed with a message on the top of the page stating that

the role category is created. The page consists of the Attributes and Roles tabs. The Attributes tab displays the attributes of the role category. You can edit the fields in this tab to edit the role category. The Roles tab displays the list of roles belonging to the role category.

12.5.3.2 Searching Role Categories

To search for role categories:

1. In the Welcome page, under Roles, click Advanced Search - Role Categories. The

Advanced Search: Categories page is displayed.