Plug In Authorization Policies for Oracle Identity Manager Features

Managing Access Policies 16-3

16.2.1 Provisioning Options

Whenever an access policy is applied, provisioning of resources can take place in any one of the following ways: ■ The resources are either directly provisioned to the user without any request being generated. ■ A request is created, and provisioning of resources is subject to request approval. Using the Administrative and User Console, you can specify whether you want to create the access policy with request approval or without request approval. In an access policy with request: ■ The default process form for access policy is supported. This means that the data entered for default process form while creating access policy is used to populate request dataset. ■ Mandatory fields of request dataset must be populated by one of the following: – Process form defaults of access policy while defining access policy: This is because process form access policy defaults are used to populate corresponding request dataset. – Prepopulate adapters defined for request dataset. – Default data in the request dataset. ■ Access policy-based request is not created if all mandatory fields of request dataset are not populated by any one of process form defaults, prepopulate adapters, or default data in request dataset. ■ If request has already been created for a user for a specific resource and it is NOT in one of the following status, then new request is not created for the same user and resource combination: – Request Closed – Request Completed – Request Withdrawn – Request Failed – Template Approval Rejected – Request Approval Rejected – Operation Approval Rejected

16.2.2 Revoking the Policy

Oracle Identity Manager access policies are not applied to subroles. Policies are only applied to direct-membership users that is, users who are not in subroles in the roles that are defined on the access policies. You can specify if a resource in a policy must be revoked when the policy no longer applies. If you do so, then these resources are automatically revoked from the users by Oracle Identity Manager when the policy no longer applies to the users.

16.2.3 Denying a Resource

While creating an access policy, you can select resources to be denied along with resources to be provisioned for roles. If you first select a resource for provisioning and then select the same resource to be denied, then Oracle Identity Manager removes the 16-4 Oracle Fusion Middleware Users Guide for Oracle Identity Manager resource from the list of resources to be provisioned. If two policies are defined for a role in which one is defined to provision a resource and the other is defined to deny the resource, then Oracle Identity Manager does not provision the resource irrespective of the priority of the policies.

16.2.4 Evaluating Policies

In Oracle Identity Manager, access policies can be evaluated in the following scenarios: ■ When a user is made a part of a role or removed from a role The policy for the user is evaluated as part of the add or remove operation. ■ If the retrofit flag is set for the policy These evaluations do not happen immediately after the action. Instead, they happen during the next run of the Evaluate User Policies schedule task. The evaluations can happen in the following scenarios: – Policy definition is updated so that the retrofit flag is set to ON. Policies are evaluated for all applicable users. – A role is added or removed from the policy definition. Policies are evaluated only for roles that is added or removed. – A resource is added, removed, or the Revoke If No Longer Applies flag value is changed for the resource. In earlier releases of Oracle Identity Manager, when the Revoke if no longer applies option is selected in an access policy and the policy is no longer applicable, both the account and entitlements child records associated with the access policy are revoked. However, when the flag is not selected and the policy is no longer applicable, the account remains and the entitlements are revoked. Therefore, entitlements are revoked irrespective of the value of the Revoke if no longer applies option set for the policy when policy ceases to apply. In Oracle Identity Manager 11g Release 1 11.1.1, the Revoke if no longer applies option works not only at the account level, but also at the entitlements level so that the entitlements are not revoked if the option is not selected. For this enhancement to work, you must set the value of the XL.AccessPolicyRevokeIfNoLongerAppliesEnhancement system property to true. When the value of the XL.AccessPolicyRevokeIfNoLongerAppliesEnhancement system property is true, then the Revoke if no longer applies option is changed to Revoke resource and entitlements if no longer applies . When the value of this system property is false, then the Revoke if no longer applies option remains the same. By default, both the options are selected. For more information about this system property, see Administering System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. – When policy data is updated or deleted. This includes both parent and child form data. Policies are evaluated for all applicable users.

16.2.5 Access Policy Priority

Policy priority is a numeric field containing a number that is unique for each access policy you create. The lower the number, the higher is the priority of the access policy. For example, if you specify Priority =1, it means that the policy has the highest Managing Access Policies 16-5 priority. When you define access policies through Oracle Identity Manager Administrative and User Console, the value 1 is always added to the value of the current lowest priority and the resultant value is automatically populated in the Priority field. Changing this value to a different number might result in readjusting the priority of all the other access policies, thus ensuring that the priorities remain consistent. The following actions are associated with the priority number: ■ If the priority number entered is less than 1, then Oracle Identity Manager will change the value to 1 highest priority. ■ If the priority number entered is greater than M, in which M is the current lowest priority, then Oracle Identity Manager will specify the value as less than or equal to M+1. ■ Two access policies cannot have the same priority number. Therefore, assigning an already existing priority number to an access policy will lower the priority by 1 for all policies of lesser priority. Conflicts can arise from multiple access policies being applied to the same user. Because a single instance of a resource is provisioned to the user through access policies, Oracle Identity Manager uses the highest priority policy data for a parent form. For child forms, Oracle Identity Manager uses cumulative records from all applicable policies.

16.2.6 Access Policy Data

There are multiple ways in which process form data is supplied for resources during provisioning. The following is the order of preference built into Oracle Identity Manager: 1. Default values from the form definition 2. Organization defaults 3. Values obtained through data flow from dataset to process form 4. Prepopulate adapters 5. Access policy data if resource is provisioned because of a policy 6. Data updated by Process Task or Entity Adapters If a given option is available, then the rest of the options that are at a lower order of preference are overridden. For example, if Option 4 is available, then Options 3, 2, and 1 are ignored. 16.2.7 Provisioning Multiple Instances of the Same Resource via Access Policy by Using Account Discriminator In earlier releases of Oracle Identity Manager, access policies can be used to manage only a single account for a resource object. In other words, if you already have resource provisioned to user account has been created in the target system and if another instance of the same resource is to be provisioned to the same user via access policy, then it is not possible in earlier releases of Oracle Identity Manager. To achieve the functionality of provisioning multiple instances of resource to a user, prior to access policy enhancement in Oracle Identity Manager 11g Release 1 11.1.1, you must clone the connector that represents the target system in Oracle Identity Manager. Cloning of connector was error prone needed lot of effort for testingmaintenance of cloned resource. Access Policy enhancement done for provisioning of multiple