Extra time for catalog products on job position changes

Hi Oscar,

you will find anything you need in the following link to the online documentation https://support.oneidentity.com/technical-documents/identity-manager/7.1.1/it-shop-administration-guide/42#TOPIC-666619

The topic is Requests with Limited Validity Period for Challenged Role Memberships.

OOTB the feature only covers entitlements (accounts, groups, resources) assigned to the primary assigned Business Role, Department, Location or Cost Center of the identities if they are changed by an import.

But you can customize this easily to support any change to the primary assignments.

Hi Markus,

Thanks a lot for the great and quick answer.

Just to understand the background process that 1IM executes to complete this feature, on the documentation it is wrote "If an employee changes their primary department (business role, cost center or location), they loose all company resources and system entitlements inherited through it". So, as I understand, all the entitlements are deleted as an automatically process to unsubscribe all of them and this process is auto-approved. Is it the normal process when some user changes their primary location as an automatically process or this process is usually a new manager responsibility in which he/she has to de-provisioning the old entitlement and resources? I mean, the default process is an automatically de-provisioning for all entitlement resources when some user change the location by the authoritative source or it is activated because of the property "QER\ITShop\ChallengeRoleRemoval\Department\Primary" is checked?

In case of provide a "Limited Validity Period for Challenged Role Memberships", on the request history appears as an unsubscribe request at the change location date and a temporally new request with an end date permission or it appears as a unique entitlement which starts when someone requested it in the past and finish X days after the location change?

Hi Oscar,

speaking generally if you loose a role membership in OneIM, the entitlements that are assigned to that role will be removed from the identity loosing the role membership if the role was the only source to have the entitlement assigned to the identity.

So, loosing entitlements because the authoritative source changed a location or department is the default behavior.

The configuration parameters decide if a "time-limited replacement request" should be created if an authoritative source changes something. You can control this separately for the role types.

In regards to the inheritance model of OneIM I suggest to take a look at the online documentation as well.

Basics for Mapping Company Structures in One Identity Manager

https://support.oneidentity.com/technical-documents/identity-manager/7.1.2/identity-management-base-module-administration-guide/8#TOPIC-808901

 

Especially the sections

Basics for Assigning Company Resources ff.

https://support.oneidentity.com/technical-documents/identity-manager/7.1.2/identity-management-base-module-administration-guide/9#TOPIC-808905

Basics for Calculating Inheritance ff.

https://support.oneidentity.com/technical-documents/identity-manager/7.1.2/identity-management-base-module-administration-guide/11#TOPIC-808912