A.2 Global Configuration Values

Global configuration values (GCVs) are values that can be used by the driver to control functionality. GCVs are defined on the driver or on the driver set. Driver set GCVs can be used by all drivers in the driver set. Driver GCVs can be used only by the driver on which they are defined.

The SAP GRC Access Control driver includes several predefined GCVs. You can also add your own if you discover you need additional ones as you implement policies in the driver.

To access the driver’s GCVs in iManager:

  1. Click to display the Identity Manager Administration page.

  2. Open the driver set that contains the driver whose properties you want to edit:

    1. In the Administration list, click Identity Manager Overview.

    2. If the driver set is not listed on the Driver Sets tab, use the Search In field to search for and display the driver set.

    3. Click the driver set to open the Driver Set Overview page.

  3. Click the upper right corner of the driver icon to display the Actions menu, then click Edit Properties.

    or

    To add a GCV to the driver set, click Driver Set, then click Edit Driver Set properties.

To access the driver’s GCVs in Designer:

  1. Open a project in the Modeler.

  2. Right-click the driver icon or line, then select Properties > Global Configuration Values.

    or

    To add a GCV to the driver set, right-clickthe driver set icon , then click Properties > GCVs.

Table A-7 Global Configuration Values

Option

Description

Change incoming Group Membership values to association values

If True, incoming values for Group Membership attributes are set as association-ref attributes values on the containing value elements.

Request Information > Show requestor information

Select show to display the information for the requestor.

Requestor Information > Requestor ID

Specify the ID of the GRC user that is supplied as the requestor id on all requests to GRC.

Requestor Information > First name

Specify the first name of a GRC user that is supplied as the requestor first name on all requests to GRC.

Requestor Information > Last name

Specify the last name of the GRC user that is supplied as the requestor last name on all requests to GRC.

Requestor Information > Email address

Specify the e-mail address of the GRC user that is supplied as the requestor email address on all requests to GRC.

Request Mapping > Show request mapping information

Select show to display the information for request mapping.

Request Mapping > Priority

Specify a value for the request priority. This value must correspond to a request priority value defined in GRC. It is the priority value specified with the request data.

Request Mapping > Account entitlement remove means

Select whether the account is disabled or deleted when the entitlement for a user account in the GRC system is revoked.

delete account: A Delete Account request is submitted to GRC.

disable account: A Lock Account request is submitted to GRC.

Request Mapping > New account request type

Specify the GRC request type that contains the CREATE_USER action. For more information, see Section 4.1, Configuring Request Types.

Request Mapping > New account request requires role assignment

Select true if the GRC request type used for new user accounts also contains the action ASSIGN_ROLES, otherwise select false.

Request Mapping > Role assignment request type

Specify the value of the GRC request type that contains the ASSIGN_ROLES action.

Request Mapping > Delete account request type

Specify the value of the GRC request type that contains the DELETE_USER action.

Request Mapping > Lock account request type

Specify the value of the GRC request type that contains the LOCK_USER action.

Request Mapping > Unlock account request type

Specify the value of the GRC request type that contains the UNLOCK_USER action.

Request Mapping > Modify user information request type

Specify the GRC request type that contains the CHANGE_USER action, but not the ASSIGN_ROLES action.

Request Status > Show request status retrieval parameters

Select show to display the request status parameters.

Request Status > Status check interval in minutes

Specify a value for how often GRC is polled to get the current status of a previously submitted request.

Request Status > Always perform GRC risk analysis

Select true to always obtain the results of a GRC risk analysis after submitting a request to GRC. Select false to not obtain the GRC risk analysis results.

Request Status > Get GRC audit trail on request completion

Select true to always obtain the GRC audit trail when requests are approved or rejected. Select false to not obtain the GRC audit trail for requests.

Role Mapping > Show role mapping configuration.

Select show to display the GCVs for enabling the driver to work with the Role Mapping Administrator. For more information, see the Identity Manager Role Mapping Administrator 1.0 Installation and Configuration Guide.