Anonymous Enrollment

The anonymous enrollment feature allows a user without an Identity Manager account to obtain one by request.

Enabling Anonymous Enrollment

By default, the anonymous enrollment feature is disabled.

To Enable the Anonymous Enrollment Feature

1. In the Administrator interface, click Configure, and then click User Interface.

2. In the Anonymous Enrollment area, select the Enable option, and then click Save.

   When a user logs in to the User interface, the login page will display the text First time user? followed by a Request Account link.

   ---

   Note –

   The text First time user? Request Account is customizable. See the Sun Identity Manager Deployment Guidefor details.

   ---

   Figure 3–11 The User Interface Page With the “Request Account” Link Enabled

   
   

Configuring Anonymous Enrollment

From the Anonymous Enrollment area on the User Interface page, you can configure the following options for the anonymous enrollment process:

• Notification Template. Specify the ID of an email template to use to send notifications to the user requesting an account.

• Require Privacy Policy. If selected, then the user must accept the privacy policy before he can request an account. This is enabled by default.

• Enable Validation. If selected, then the user must validate his employment before he can request an account. This is enabled by default.

• Process Launch URL. Enter a URL to specify which workflow will be used for the anonymous enrollment process.

• Enable Notifications. If selected, then a notification email will be sent to the user when his account has been created.

• Email Domain. Enter the name of the email domain to use to construct the user’s email address.

Click Save when finished.

User Enrollment Process

When a user logs on to the User interface, that user can request an account by clicking Request Account on the login page.

Identity Manager displays the first of two registration pages, which requests a first name, last name, and employee ID. If the Enable Validation attribute is set to yes (the default), then this information must be validated before the user can proceed to the next page.

The verifyFirstname, verifyLastname, verifyEmployeeId, and verifyEligibility rules in EndUserLibrary validate the information for each attribute.

You may need to modify one or more of these rules. In particular, you should modify the rule that verifies the employee ID to use a Web services call or Java class to verify the information.

If the Enable Validation attribute is disabled, then the initial registration page does not display. In this case, you must modify the End User Anonymous Enrollment Completion form to allow the user to enter information normally captured by the initial validation form.

From the information provided on the Registration page, Identity Manager generates:

• An account ID (following the convention of first initial, last initial, employee ID).

• An email address in the form:

  FirstName.LastName@EmailDomain

  Where EmailDomain is the domain set by the Email Domain attribute in anonymous enrollment configuration.

• The manager attribute (idmManager). You can set this attribute by modifying the EndUserRuleLibrary:getIdmManager rule. By default, the manager is set to Configurator. The administrator designated as the manager must approve the user request before his account is provisioned.

• The organization attribute. You can set this attribute by customizing the EndUserRuleLibrary:getOrganization rule. By default, users are assigned to the top of the organizational hierarchy (“Top”).

If the information provided by the user on the Registration page validates correctly, then Identity Manager presents the user with the second Registration page. Here the user must enter a password and password confirmation. If the Require Privacy Policy attribute is set to yes, then the user must also select an option to accept the terms of the privacy policy.

When the user clicks Register, Identity Manager presents a confirmation page. If the Enable Notifications attribute is set to yes, then the page indicates the user will receive email notification when he account has been created.

The account is created after the standard Create User process (including approvals required by the idmManager attribute and policy settings) is complete.