The anonymous enrollment feature allows a user without an Identity Manager account to obtain one by request.
By default, the anonymous enrollment feature is disabled.
In the Administrator interface, click Configure, and then click User Interface.
In the Anonymous Enrollment area, select the Enable option, and then click Save.
When a user logs in to the User interface, the login page will display the text First time user? followed by a Request Account link.
The text First time user? Request Account is customizable. See the Sun Identity Manager Deployment Guidefor details.
From the Anonymous Enrollment area on the User Interface page, you can configure the following options for the anonymous enrollment process:
Notification Template. Specify the ID of an email template to use to send notifications to the user requesting an account.
Enable Validation. If selected, then the user must validate his employment before he can request an account. This is enabled by default.
Process Launch URL. Enter a URL to specify which workflow will be used for the anonymous enrollment process.
Enable Notifications. If selected, then a notification email will be sent to the user when his account has been created.
Email Domain. Enter the name of the email domain to use to construct the user’s email address.
Click Save when finished.
When a user logs on to the User interface, that user can request an account by clicking Request Account on the login page.
Identity Manager displays the first of two registration pages, which requests a first name, last name, and employee ID. If the Enable Validation attribute is set to yes (the default), then this information must be validated before the user can proceed to the next page.
The verifyFirstname, verifyLastname, verifyEmployeeId, and verifyEligibility rules in EndUserLibrary validate the information for each attribute.
You may need to modify one or more of these rules. In particular, you should modify the rule that verifies the employee ID to use a Web services call or Java class to verify the information.
If the Enable Validation attribute is disabled, then the initial registration page does not display. In this case, you must modify the End User Anonymous Enrollment Completion form to allow the user to enter information normally captured by the initial validation form.
From the information provided on the Registration page, Identity Manager generates:
An account ID (following the convention of first initial, last initial, employee ID).
An email address in the form:
Where EmailDomain is the domain set by the Email Domain attribute in anonymous enrollment configuration.
The manager attribute (idmManager). You can set this attribute by modifying the EndUserRuleLibrary:getIdmManager rule. By default, the manager is set to Configurator. The administrator designated as the manager must approve the user request before his account is provisioned.
The organization attribute. You can set this attribute by customizing the EndUserRuleLibrary:getOrganization rule. By default, users are assigned to the top of the organizational hierarchy (“Top”).
When the user clicks Register, Identity Manager presents a confirmation page. If the Enable Notifications attribute is set to yes, then the page indicates the user will receive email notification when he account has been created.
The account is created after the standard Create User process (including approvals required by the idmManager attribute and policy settings) is complete.