3.6 Identity Management

Using Identity Management, administrators can manage fine-grained and coarse-grained entitlements. Coarse-grained entitlements consist of fewer functions than fine-grained entitlements. Authorizers can authorize the entitlement mappings.

The various components of Identity Management are:

• Users: A user is a person who has access to Admin Console and can perform specific actions based on the user group or groups they are mapped to. Before you can map a user to a user group, your Administrator must have created and authorized the user. After the user is authorized, they are added in the Users Summary. Click Users to access the Users Summary page.
• Groups: Groups are a set of users who can perform specific activities. For example, the administrator role performs administrative activities. Any user who belongs to a specific user group can access the roles mapped to that user group.

  To add a user group, click Add in the Groups tile. Click Groups to view the list of user groups in Groups Summary.

• Roles: Roles are a set of functions grouped together and having specific privileges. Any user who belongs to a specific role can access functions mapped to that role. Click Add to add a role or click Roles to view the list of roles in Roles Summary.

  To add a user role, click Add in the Roles tile. Click Roles to view the list of user groups in Roles Summary.

• Folders: Folders are used to control access rights on defined list of objects. They are mapped to a specific Information Domain. Click Folders to view the list of folders and edit the access rights in Folders Summary.
• Functions: Functions enable users to perform a specific activity. Any user who belongs to a specific function can access the folders mapped to the function. Click Functions to view the list of functions in Functions Summary.

Note:

Only those user groups and roles which are authorized are displayed in the Groups Summary page and Roles Summary page, respectively.

Use the following guidelines to manage user creation and group mappings between IDCS/OCI and the Admin Console.

• Create users only in IDCS/OCI.
• You can map users to groups in IDCS/OCI, in the Admin Console, or in both. The system automatically syncs user-to-group mappings from IDCS/OCI to the Admin Console, but not the other way around.
• To unmap a user from a group, manually remove the mapping in both IDCS/OCI and the Admin Console.

Note:

Just-in-Time (JIT) provisioning occurs when a user logs in. Therefore, user groups appear in the Admin Console only after they are associated with a user who has logged in at least once. To map groups to roles before associating them with users in Oracle IAM/IDCS, you must create the corresponding group in the Admin Console as well as in Oracle IAM/IDCS. This applies only to custom groups. Application-seeded groups are automatically available in both Oracle IAM/IDCS and the application.

• Users Summary Page
  The Users Summary page shows the list of available users. You can view the details of a user and map the user to one or more user groups.
• Groups Summary Page
  The Groups Summary page shows the list of available groups. You can view the details of a group and map the group to one or more user roles.
• Roles Summary Page
  The Roles Summary page shows the list of available user roles. You can view the details of a role and map the role to one or more user functions.
• Functions Summary Page
  The Functions Summary page shows the list of available functions. You can view the function details.
• Folders Summary Page
  Create multiple folders, store objects and assign access rights based on the security level of the user.