2.5 Granting Rights to the Use Role Mapping Administrator

Users must have a specific set of rights in the Identity Vault and specific role assignments in the Roles Based Provisioning Module to use the Role Mapping Administrator.

The best practice is to create a user that is used for administration of the Role Mapping Administrator. All other users that use the Role Mapping Administrator should have their rights limited to match their job duties.

2.5.1 Identity Vault Rights for Administration

An administrative user needs the following minimal rights to use the Role Mapping Administrator:

  • Browse entry rights so they can select objects in the configuration panel of the Role Mapping Administrator. For example the Root User Container, Driver Discover DN, and the User Application driver DN.

  • Browse entry and read rights on the users contained within the Root User container defined in the configuration panel of the Role Mapping Administrator. The list of potential role owners is derived by these rights.

  • Browse entry rights on the active Driver Set object that is located under the Driver Discovery DN as defined in the Role Mapping Administrator configuration panel.

  • Inherited browse rights and read attribute rights on the drivers that participate in role mapping. The Role Mapping Administrator needs access to the entitlements and entitlement configuration objects that are contained within the drivers that participate in role mapping.

  • Inherited browse entry and read attribute rights on the User Application driver. The Role Mapping Administrator needs access to DAL category definitions, role configuration objects, and role definition containers.

  • Inheritable supervisor rights to the roleDefs.RoleConfig.AppConfig container within the UAD. All role adds, modifies, and deletes are done with these rights. Rights can be pared down as needed.

You can make these assignments to specific users or you can make the assignments to a group or a container, then assign users to the group or add users to the container.

  1. Log in to iManager as an administrative user for your Identity Vault.

  2. Select View Objects in the toolbar, then browse to and select the user, group, or container you want to assign rights to.

  3. Select the object, then click Actions > Modify Trustees.

  4. Add the rights as defined above, then click OK to save the changes.

2.5.2 Roles Based Provisioning Module Assignments for Administration

The administration or configuration users must be members of the Role Manager role or the Role Module Administrator role in the Roles Based Provisioning Module. You can make these role assignments to specific users or you can make the assignments to a group or a container, then assign users to the group or add users to the container.

  1. Log in to the Roles Based Provisioning Module as an administration user.

  2. Click Roles > Roles Assignments.

  3. Select User, Group, or Container to make the role assignment.

  4. Search for the user, group, or container, then select the desired object.

  5. Click New Assignment.

  6. Fill in the following fields:

    Initial Request Description: Specify a reason for requesting the role.

    Select Roles: Search for the Role Manager role and the Role Module Administrator role, select the roles, then click Select.

    Effective Date: (Optional) Specify a date this assignment is effective.

    Expiration Date: (Optional) Select whether there is an expiration date for this assignment.

  7. Click Submit to make the assignments.

2.5.3 Rights Required to Use Role Mapping Administrator

A user should be only granted the minimal rights required to fulfill their job duties. You can restrict rights by restricting the rights to the roles the user is assigned to and restricting their rights in the Identity Vault as well. The extension for SAP environments solutions guide contains a solution specific to this scenario. For more information, see Managing Roles in the Novell Compliance Management Platform Extension for SAP Environments 1.0 Solutions Guide.