2.9.1 Role Service Driver Configuration

After creating the Role Service driver at installation time, you can optionally modify some of the driver configuration settings in iManager. To configure the Role Service driver:

You can modify the following standard driver settings (listed under User Application/Workflow Connection on the Driver Configuration page), which get their initial values at installation time:

In addition, you can modify the following additional settings (listed under Miscellaneous on the Driver Configuration page) to customize the behavior of the Role Service driver:

nrf(Object Class)
nrf(nrfMemberOf)
nrf(nrfStatus)
nrf(nrfStartDate)
nrf(nrfNextExpiration)
nrf(nrfParentRoles)
nrf(nrfChildRoles)
nrf(nrfCategory)
nrf(nrfRoleCategoryKey)
nrf(nrfLocalizedNames)
nrf(nrfLocalizedDescrs)
nrf(nrfRoles)

2.9.2 User Application Configuration

The Configure Role Subsystem action on the Roles tab of the User Application allows you to specify administrative settings for the Role Subsystem. For details on using the Configure Role Subsystem action, see the section on configuring the role subsystem in the Identity Manager User Application: User Guide.

2.9.3 Security Roles

The Role Subsystem uses a set of system roles to secure access to functions within the Roles tab. Each menu action in the Roles tab is mapped to one or more of the system roles. If a user is not a member of one of the roles associated with an action, the corresponding menu item is not displayed on the Roles tab.

The system roles are administrative roles automatically defined by the system at install time for the purpose of delegated administration. These include the following:

To assign users to the system roles, you need to use the Role Assignments action on the Roles tab. For details on assigning users to roles, see the section “Making Role Assignments” in the Identity Manager User Application: User Guide.

The initial assignment of the Role Module Administrator is specified at installation time and processed when the Role Subsystem is first initialized at startup time.

2.9.4 Trustee Rights

The Roles Module Administrator has unlimited authorization scope within the Role Subsystem, which means that the administrator does not need to have directory browse rights to perform any tasks on the Roles tab. This is not the case for the other security roles.

The Roles Manager, Roles Auditor, and Security Officer roles need to have directory browse rights for the objects they want to work with on the Roles tab. For example, the Roles Manager can modify roles to which the user logged in with role manager privileges has browse rights. In addition, the Roles Manager can request assignment of users, groups, and containers to roles to which the user has browse rights. Similarly, the Roles Auditor must have directory browse rights to a report to run this report, and a Security Officer must have directory browse rights to an SoD constraint to modify this constraint.

Directory browse rights for roles-related objects should be defined as follows:

The Browse right setting for Entry rights is required for authorization to make role assignments. The Read right on attributes is required for attributes that are used in role searches.

Here is an example showing the trustee rights defined on the Level10 roles definition container for the IT group:

Figure 2-8 Trustee Rights for a Roles Container

Here is another example showing the trustee rights defined on the SoDDefs container for secOfficerUser, a sample user who has been assigned to the Security Officer role:

Figure 2-9 Trustee Rights for a Sample User

You can define rights for various types of trustees, including containers, subcontainers, groups, and users. One approach you might want to use is described below:

Combining the two approaches might give you the greatest flexibility and effectiveness in assigning security rights.

2.9.5 View Request Status Search Limit

By default, the View Request Status action retrieves up to 10,000 request objects. If a user attempts to retrieve a larger result set, the user will see a message indicating that the limit has been reached. In this case, the user should narrow the search (by specifying a particular user or status, for example) to limit the number of objects returned in the result set. Note that when a user applies a filter to a role name, the filter limits what the user sees and its order, not the number of objects returned.

The administrator can change the maximum number of request objects retrieved by modifying the entity definition for the nrfRequest object in iManager. To do this, the administrator needs to modify the <search-max>10000</search-max> setting by editing the XmlData attribute of the sys-nrf-request object. The sys-nrf-request object can be found under EntityDefs.DirectoryModel.AppConfig within the User Application driver for the Roles Based Provisioning Module.

2.9.6 Result Set and Pagination Settings

The Administration tab in the User Application provides several settings you can use to control how result sets are processed and displayed on pages within the application. To configure the settings for result sets and pagination:

2.9.7 E-Mail Notification

The Role Subsystem uses two templates that are specific to roles-based provisioning:

You can edit the templates to change the content and format of e-mail messages. For more information on these templates, see Section 18.4, Working with E-Mail Templates.