![]() | |
Sun Java[TM] System Identity Manager 7.1 Admininstration |
Chapter 8
Task TemplatesIdentity Manager’s task templates enable you to use the Administrator interface to configure certain workflow behaviors, as an alternative to writing customized workflows.
The following topics in this chapter explain how to make the task templates available to your system and how to use task templates to configure workflow behaviors:
Enabling the Task TemplatesIdentity Manager provides these task templates that you can configure:
Before using the task templates, you must map the task templates processes. To map process types, use the following procedure:
- From the Identity Manager Administrator interface, select Tasks, and then select Configure Tasks. Figure 8-1 illustrates the Configure Tasks page.
Figure 8-1 Configure Tasks
The Configure Tasks page contains a table with the following columns:
- Click Enable to open the Edit Process Mappings page for a template.
For example, the following page (Figure 8-2) displays for the Create User Template:
Figure 8-2 Edit Process Mappings Page
Note
The default process type (in this case, createUser) automatically displays in the Selected Process Types list. If necessary, you can select a different process type from the menu.
- Generally, you do not map more than one process type for each template.
- If you remove the process type from the Selected Process Types list and do not select a replacement, a Required Process Mappings section displays instructing you to select a new task mapping.
Figure 8-3 Required Process Mappings Section
- Click Save to map the selected process type and return to the Configure Tasks page.
Note
When the Configure Tasks page redisplays, an Edit Mapping button replaces the Enable button and the process name is listed in the Process Mapping column.
Figure 8-4 Updated Configure Tasks Table
- Repeat the mapping process for each of the remaining templates.
After successfully mapping the template process types, you can configure the task templates.
Configuring the Task TemplatesTo configure the different task templates, follow these steps:
- Select a Name link in the Task Template table. One of the following pages displays:
- Edit Task Template Create User Template — Open this page to edit the template used to create a new user account.
- Edit Task Template Delete User Template — Open this page to edit the template used to delete or deprovision a user’s account.
- Edit Task Template Update User Template — Open this page to edit the template used to update an existing user’s information.
Each Edit Task Template page contains a set of tabs that represent a major configuration area for the user workflow.
The following table describes each tab, its purpose, and which templates use that tab.
Configuring the General Tab
This section provides instructions for configuring the General tab.
Note
The Edit Task Template pages for the Create User Template and Update User Template are identical, so instructions for configuring the tabs are provided in one section.
For the Create User or Update User Templates
When you open the Edit Task Template Create User Template or the Edit Task Template Update User Template, the General tab page displays by default. This page consists of a Task Name text field and menu, as shown in the following figure.
Figure 8-5 General Tab: Create User Template
Task names can contain literal text and/or attribute references that are resolved during task execution.
To change the default task name, use the following steps:
- Type a name into the Task Name field.
You can edit or completely replace the default task name.
- The Task Name menu provides a list of attributes that are currently defined for the view associated with the task configured by this template. Select a attribute from the menu (optional).
Identity Manager appends the attribute name to the entry in the Task Name field. For example:
Create user $(accountId) $(user.global.email)
- When you are finished, you can
- Select a different tab to continue editing the templates.
- Click Save to save your changes and return to the Configure Tasks page.
- The new task name will display in the Identity Manager task bar, located at the bottom of the Home and Accounts tabs.
- Click Cancel to discard your changes and return to the Configure Tasks page.
For the Delete User Template
When you open the Edit Task Template Delete User Template, the General tab page displays by default.
To specify how user accounts are deleted/deprovisioned, use the following steps:
- Use the Delete Identity Manager Account buttons to specify whether an Identity Manager account can be deleted during a delete operation, as follows:
- Never — Enable this button to prevent accounts from being deleted.
- Only if user has no linked accounts after deprovisioning — Enable this button to allow user account deletions only if there are no linked resource accounts after deprovisioning.
- Always — Enable this button to always allow user account deletions — even if there are still resource accounts assigned.
- Use the Resource Accounts Deprovisioning boxes to control resource account deprovisioning for all resource accounts, as follows:
- Delete All — Enable this box to delete all accounts representing the user on all assigned resources.
- Unassign All — Enable this box to unassign all resource accounts from the user. The resource accounts will not be deleted.
- Unlink All — Enable this box to break all links from the Identity Manager system to the resource accounts. Users with accounts that are assigned but not linked will display with a badge to indicate that an update is required.
- Use the Individual Resource Accounts Deprovisioning boxes to allow a
more fine-grained approach to user deprovisioning (compared to Resource Accounts Deprovisioning) as follows:
- Delete — Enable this box to delete the account that represents the user on the resource.
- Unassign — Enable this box and the user will no longer be assigned directly to the resource. The resource account will not be deleted.
- Unlink — Enable this box to break the link from the Identity Manager system to the resource accounts. Users with accounts that are assigned but not linked will display with a badge to indicate that an update is required.
- When you are finished, you can
Configuring the Notification Tab
All of the Task Templates support sending email notifications to administrators and users when Identity Manager invokes a process — usually after the process has completed. You can use the Notification tab to configure these notifications.
The following figure shows the Notification page for the Create User Template.
Figure 8-6 Notification Tab: Create User Template
To specify how Identity Manager will determine notification recipients, use the following process:
Configuring Administrator Notifications
Select an option from the Determine Notification Recipients from menu to determine the method for notifying administrator recipients.
- None (default) — No administrators will be notified.
- Attribute — Select to derive notification recipients’ account IDs from a specified attribute in the user view. Continue to Specifying Recipients by Attribute.
- Rule — Select to derive notification recipients’ account IDs by evaluating a specified rule. Continue to Specifying Recipients by Rule.
- Query — Select to derive notification recipients’ account IDs by formulating a query to a particular resource. Continue to Specifying Recipients by Query.
- Administrator List — Select to choose notification recipients’ explicitly from a list. Continue to Specifying Recipients from the Administrators List.
Specifying Recipients by Attribute
To derive notification recipients’ account IDs from a specified attribute, use the following steps:
Note
The attribute must resolve to a string that represents a single account ID or to a list in which the elements are account IDs.
- Select Attribute from the Determine Notification Recipients from menu and the following new options are displayed:
Figure 8-7 Administrator Notifications: Attribute
- Select an attribute from the Notification Recipient Attribute menu.
The attribute name displays in the text field adjacent to the menu.
- Select a template from the Email Template menu to specify a format for the administrators’ notification email.
Specifying Recipients by Rule
To derive notification recipients’ account IDs from a specified rule, use the following steps:
Note
When evaluated, the rule must return a string that represents a single account ID or to a list in which the elements are account IDs.
- Select Rule from the Determine Notification Recipients from menu and the following new options display in the Notification form:
Figure 8-8 Administrator Notifications: Rule
- Select a rule from the Notification Recipient Rule menu.
- Select a template from the Email Template menu to specify a format for the administrators’ notification email.
Specifying Recipients by Query
To derive notification recipients’ account IDs by querying a specified resource, use the following steps:
- Select Query from the Determine Notification Recipients from menu and the following new options display in the Notification form, as illustrated in Figure 8-9:
Figure 8-9 Administrator Notifications: Query
- Notification Recipient Administrator Query — Provides a table consisting of the following menus, which you can use to construct a query:
- Resource to Query — Provides a list of resources currently defined for your system.
- Resource Attribute to Query — Provides a list of resource attributes currently defined for your system.
- Attribute to Compare — Provides a list of attributes currently defined for your system.
- Email Template — Provides a list of email templates.
- Select a resource, resource attribute, and an attribute to compare from these menus to construct the query.
- Select a template from the Email Template menu to specify a format for the administrators’ notification email.
Specifying Recipients from the Administrators List
Select Administrators List from the Determine Notification Recipients from menu and the following new options display in the Notification form:
Figure 8-10 Administrator Notifications: Administrators List
Configuring User Notifications
When specifying users to be notified, you must also specify the name of an email template to be used to generate the email used for notification.
To notify the user being created, updated, or deleted enable the Notify user checkbox, as shown in Figure 8-11, and then select an email template from the list..
Figure 8-11 Specifying an Email Template
Configuring the Approvals Tab
You can use the Approvals tab to designate additional approvers and to specify attributes for the task approval form before Identity Manager executes the create, delete, or update user tasks.
Traditionally, administrators who are associated with a particular organization, resource, or role are required to approve certain tasks before execution. Identity Manager also allows you to designate additional approvers — additional administrators who will be required to approve the task.
Note
If you configure Additional Approvers for a workflow, you are requiring approval from the traditional approvers and from any additional approvers specified in the template.
The following figure illustrates the initial Approvals page administrative user interface.
Figure 8-12 Approvals Tab: Create User Template
To configure approvals, use the following process:
- Complete the Approvals Enablement section (see Enabling Approvals).
- Complete the Additional Approvers section (see Specifying Additional Approvers).
- Complete the Approval Form Configuration section for the Create User and Update User Templates only (see Configuring the Approval Form).
- When you are finished configuring the Approvals tab, you can
Enabling Approvals
Use the following Approvals Enablement checkboxes to require approvals before the create user, delete user, or update user tasks can proceed.
Note
By default, these checkboxes are enabled for the Create User and Update User Templates, but they are disabled for the Delete User Template.
- Organization Approvals — Enable this checkbox to require approvals from any configured organizational approvers.
- Resource Approvals — Enable this checkbox to require approvals from any configured resource approvers.
- Role Approvals — Enable this checkbox to require approvals from any configured role approvers.
Specifying Additional Approvers
Use the Determine additional approvers from menu to specify how Identity Manager will determine additional approvers for the create user, delete user, or update user tasks. The options on this menu include:
When you select any of these options (except None), additional options display in the administrative user interface. Instructions for configuring these options begin on (more...) .
Use the instructions provided in the following sections to specify a method for determining additional approvers.
From Attributes
To determine additional approvers from an attribute,
- Select Attribute from the Determine additional approvers from menu.
Note
The attribute must resolve to a string that represents a single account ID or to a list in which the elements are account IDs.
The following new options display:
Figure 8-13 Additional Approvers: Attribute
- Approver Attribute — Provides a list of attributes (currently defined for the view associated with the task configured by this template) used to determine approvers’ account IDs.
- Approval times out after — Provides a method for specifying when the approval will time out.
- Use the Approver Attribute menu to select an attribute.
The selected attribute displays in the adjacent text field.
- Decide whether you want the approval request to timeout after a specified period of time.
- If you want to specify a timeout period, continue to Configuring Approval Timeouts for instructions.
- If you do not want to specify a timeout period, you can continue to Configuring the Approval Form or save your changes and go on to configure a different tab.
From Rules
To derive the approvers’ account IDs from a specified rule, use the following steps:
- Select Rule from the Determine additional approvers from menu.
Note
When evaluated, the rule must return a string that represents a single account ID or to a list in which the elements are account IDs.
The following new options display.
Figure 8-14 Additional Approvers: Rule
- Select a rule from the Approver Rule menu.
- Decide whether you want the approval request to timeout after a specified period of time.
- If you want to specify a timeout period, continue to Configuring Approval Timeouts for instructions.
- If you do not want to specify a timeout period, you can continue to Configuring the Approval Form or save your changes and go on to configure a different tab.
From a Query
To derive approvers account IDs by querying a specified resource, use these steps:
- Select Query from the Determine additional approvers from menu and the following new options display:
Figure 8-15 Additional Approvers: Query
- Approval Administrator Query — Provides a table consisting of the following menus, which you can use to construct a query:
- Approval times out after — Provides a method for specifying when the approval will time out.
- Construct a query as follows:
- Decide whether you want the approval request to timeout after a specified period of time.
- If you want to specify a timeout period, continue to Configuring Approval Timeouts for instructions.
- If you do not want to specify a timeout period, you can continue to Configuring the Approval Form or save your changes and go on to configure a different tab.
From the Administrators List
To explicitly choose additional approvers from the Administrators List,
- Select Administrators List from the Determine additional approvers from menu and the following new options display:
Figure 8-16 Additional Approvers: Administrators List
- Administrators to Notify — Provides a selection tool with a list of available administrators.
- Approval Form — Provides a list of user forms additional approvers can use to approve or reject an approval request.
- Approval times out after — Provides a method for specifying when the approval will time out.
- Select one or more administrators in the Available Administrators list and move the selected names to the Selected Administrators list.
- Decide whether you want the approval request to timeout after a specified period of time.
- If you want to specify a timeout period, continue to Configuring Approval Timeouts for instructions.
- If you do not want to specify a timeout period, you can continue to Configuring the Approval Form or save your changes and go on to configure a different tab.
Configuring Approval Timeouts
To configure an approval timeouts,
- Enable the checkbox.
The adjacent text field and menu become active, and the Timeout Action buttons display, as shown in the following figure.
Figure 8-17 Approval Timeout Options
- Use the Approval times out after text field and menu to specify a timeout period as follows:
- Enable one of the following Timeout Action buttons to specify what happens when the approval request times out:
When you enable this button, new options display because you must specify how Identity Manager will determine approvers for an escalated approval. Continue to Escalating Approvals for instructions.
Enable this button and the Approval Timeout Task menu displays so you can specify a task to execute if the approval request times out. Continue to Executing a Task for instructions.
Escalating Approvals
When you enable the Timeout Action Escalate the approval button, the Determine escalation approvers from menu displays as follows:
Figure 8-18 Determine Escalation Approvers From Menu
Select one of the following options from this menu to specify how approvers are determined for an escalated approval.
Executing a Task
When you enable the Timeout Action Execute a task button, the Approval Timeout Task menu displays as follows:
Figure 8-23 Approval Timeout Task Menu
Specify a task to execute if the approval request times out. For example, you might allow the requester to submit a help desk request or send a report to the Administrator.
Configuring the Approval Form
Note
The Delete User Template does not contain an Approval Form Configuration section. You can configure this section for Create User and Update User Templates only.
You can use features in the Approval Form Configuration section to select an approval form, and add attributes to (or remove attributes from) the approval form.
Figure 8-24 Approval Form Configuration
By default, the Approval Attributes table contains the following standard attributes:
To configure an Approval form for additional approvers:
- Select a form from the Approval Form menu.
Approvers will use this form to approve or reject an approval request.
- Enable checkboxes in the Editable column of the Approval Attributes table to allow approvers to edit the attribute value.
For example, if you enable the user.waveset.accountId checkbox the approver can change the user’s account ID.
- Click the Add Attribute or Remove Selected Attributes buttons to specify attributes from the new user’s account data to display in the approval form.
- To add attributes to the form, see Adding Attributes.
- To remove attributes from the form, see Removing Attributes.
Adding Attributes
To add attributes to the approval form
- Click the Add Attribute button located under the Approval Attributes table.
The Attribute name menu becomes active in the Approval Attributes table, as shown in the following figure:
Figure 8-25 Adding Approval Attributes
- Select an attribute from the menu.
The selected attribute name displays in the adjacent text field and the attribute’s default display name displays in the Form Display Name column.
For example, if you select the user.waveset.organization attribute, the table will contain the following information:
- Repeat these steps to specify additional attributes.
Removing Attributes
To remove attributes from the approval form, use the following steps:
- Enable one or more checkboxes in the leftmost column of the Approval Attributes table.
- Click the Remove Selected Attributes button to immediately remove the selected attributes from the Approval Attributes table.
For example, user.global.firstname and user.waveset.organization would be removed from the following table when you clicked the Remove Selected Attributes button.
Figure 8-26 Removing Approval Attributes
Configuring the Audit Tab
All of the configurable Task Templates support configuring workflows to audit certain tasks. Specifically, you can configure the Audit tab to control whether workflow events will be audited and specify which attributes will be stored for reporting purposes.
Figure 8-27 Audit Create User Template
To configure auditing from the User Template’s Audit tab:
- Enable the Audit entire workflow checkbox to activate the workflow auditing feature.
- Click the Add Attribute button (located in the Audit Attributes section) to select attributes you want to record for reporting purposes.
- When the Select an attribute menu displays in the Audit Attributes table, select an attribute from the list.
The attribute name will display in the adjacent text field.
Figure 8-28 Adding an Attribute
To remove attributes from the Audit Attributes table, use the following steps:
When you are finished configuring this tab, you can
Configuring the Provisioning Tab
You can use the Provisioning tab to configure the following options, which are related to provisioning:
Figure 8-30 Provisioning Tab: Create User Template
When you are finished configuring the Provisioning tab, you can
Configuring the Sunrise and Sunset Tab
You use the Sunrise and Sunset tab to select a method for determining the time and date when the following actions will occur.
For example, you can specify a sunset date for a temporary worker whose contract expires after six months.
Figure 8-31 illustrates the settings on the Sunrise and Sunset tab.
Figure 8-31 Sunrise and Sunset Tab: Create User Template
The topics that follow provide instructions for configuring the Sunrise and Sunset tab.
Configuring Sunrises
Configure the sunrise settings to specify the time and date provisioning will take place for a new user, and to specify the user who will own the work item for sunrise.
To configure sunrises, use the following procedure:
- Select one of the following options from the Determine sunrise from menu to specify how Identity Manager will determine a time and date for provisioning.
- Specifying a Time — Delays provisioning until a specified time in the future. Continue to (more...) for instructions.
- Specifying a Date — Delays provisioning until a specified calendar date in the future. Continue to (more...) for instructions.
- Specifying an Attribute — Delays provisioning until a specified date and time based on the attribute’s value in the user’s view. The attribute must contain a date/time string. When specifying an attribute to contain a date/time string, you can specify a data format to which the data is expected to conform.
Continue to (more...) for instructions.
Continue to (more...) for instructions.
- Select a user from the Work Item Owner menu to specify who will own the work item for sunrise.
- When you are finished configuring sunrises, you can
Specifying a Time
To delay provisioning until a specified time, use the following steps:
- Select Specified time from the Determine sunrise from menu.
- When a new text field and menu display to the right of the Determine sunrise from menu, type a number into the blank text field and select a unit of time from the menu.
For example, if you want to provision a new user in two hours, specify the following:
Figure 8-32 Provisioning a New User in Two Hours
Specifying a Date
To delay provisioning until a specified calendar date, use the following steps:
- Select Specified day from the Determine sunrise from menu.
- Use the menu options that appear to specify which week in the month, which day of the week, and which month the provisioning should occur.
For example, if you want to provision a new user on the second Monday in September, specify the following:
Figure 8-33 Provisioning a New User by Date
Specifying an Attribute
To determine the provisioning date and time based on the value of an attribute in the users account data, use the following steps:
- Select Attribute from the Determine sunrise from menu and the following options become active:
- Select an attribute from the Sunrise Attribute menu.
- If necessary, enable the Specific Date Format checkbox and when the Specific Date Format field becomes active, enter a date format string.
For example, to provision a new user based on their waveset.accountId attribute value using a day, month, and year format specify the following:
Figure 8-34 Provisioning a New User by Attribute
Specifying a Rule
To determine the provisioning date and time by evaluating a specified rule, use the following steps:
For example, to provision a new user based on the Email rule using a year, month, day, hours, minutes, and seconds format specify the following:
Figure 8-35 Provisioning a New User by Rule
Configuring Sunsets
The options and procedures for configuring sunsets (deprovisioning) are essentially the same as those provided for sunrises (provisioning) in the Configuring Sunrises section.
The only difference is that the Sunset section also provides a Sunset Task menu because you must specify a task to deprovision the user on the specified date and time.
To configure a sunset, use the following procedure:
- Use the Determine sunset from menu to specify the method for determining when deprovisioning will take place:
Note
The Determine sunset from menu defaults to the None option, which allows deprovisioning to take place immediately.
- Specified time – Delays deprovisioning until a specified time in the future. Review Specifying a Time for instructions.
- Specified date – Delays deprovisioning until a specified calendar date in the future. Review Specifying a Date for instructions.
- Attribute – Delays deprovisioning until a specified date and time based on the attribute’s value in the users’ account data. The attribute must contain a date/time string. When specifying an attribute to contain a date/time string, you can specify a date format to which the data is expected to conform.
Review Specifying an Attribute for instructions.
Review Specifying a Rule for instructions.
- Use the Sunset Task menu to specify a task to deprovision the user on the specified date and time.
- When you are finished configuring this tab, you can
Configuring the Data Transformations Tab
If you want to alter user account data as the workflow executes, you can use the Data Transformations tab to specify how Identity Manager will transform the data during provisioning.
For example, if you want forms or rules to generate email addresses that conform to company policy, or if you want to generate sunrise or sunset dates.
When you select the Data Transformations tab, the following page displays:
Figure 8-36 Data Transformations Tab: Create User Template
This page consists of the following sections:
- Before Approval Actions – Configure the options in this section if you want to transform user account data before sending approval requests to specified approvers.
- Before Provision Actions – Configure the options in this section if you want to transform user account data before a provisioning action.
- Before Notification Actions – Configure the options in this section if you want to transform user account data before notifications are sent to specified recipients.
You can configure the following options in each section:
- Form to Apply menus – Provide a list of the forms currently configured for your system. Use these menus to specify forms that will be used to transform data from the users accounts.
- Rule to Run menus – Provide a list of the rules currently configured for your system. Use these menus to specify rules that will be used to transform data from the users accounts.
When you are finished configuring this tab, you can