Capability Roles
One of the lesser known options within IdentityIQ is assigning Capabilities usings Roles.
Within most installations of IdentityIQ capabilities are manually assigned to either directly to Identities or using a workgroup. This works great for small and medium environments. As with only a few capabilities used is quite easy to proof who is allowed to have and has a particular capability.
Using Capability Roles, where capabilities are are assigned to identities using roles, it is possible to leverage the access rights within IdentityIQ exactly the same as the access rights within applications managed by IdentityIQ. Think of:
- Access Request for capabilities
- Access Reviews (Certification) of capabilities
- Automatic Assignment (Birthright) of capabilities
- Reporting
It would be handy to have the ‘Auditor’-capability automatic assigned to employees from the Auditor department (of have job/function of Auditor) of the organisation.
Creation of Capability Role Type
IdentityIQ has the Out-of-the-Box functionality to allow capabilities to be assigned using roles. Using this a Capability Role can be created.
- Go to the ‘gear’ → ‘Global Settings’
- Click on ‘Role Configuration’
- Below ‘Role Types’, click on ‘New Type’
- Set the check-boxes as you would for a Business Roles or even tighter as shown below.
- Make sure the option
Do not allow the Granting of IdentityIQ User Rights
is not enabled.
Create a Capability Role
To create a capability role is similar to the creation of any other role type. Here the steps to create an Auditor-role:
- Goto ‘Setup’ → ‘Roles’
- Click ‘New Role’
- Fill in for this example:
- And at the bottom:
- Click on
Submit
Assignment of a Capability Role
The assignment of a capability role depends on the options set during the creation of the capability role type. For instance assign the role based on the Identity Attribute department
where the department name is Auditors
There are many ways to Rome and this is 1 way to assign capabilities to idenities
– Remold