22.6 Assigning Administrators in Identity Applications
An administrator assignment specifies a domain type (Provisioning, Role, Resource, and Security), as well as a set of permissions for the assignment. For more information, see Administrator and Manager Categories.
To assign administrative roles, you must either be a Security Administrator or have a Domain Administrator-type of role, such as Provisioning Administrator.
NOTE:Delegated administrators (Domain Managers) of a domain have no access to page.
The permissions for an administrator assignment define the actions that administrators can take on a particular scope of object instances within the domain type selected. For example, if you select the Role domain as the domain type for an assignment, the permissions determine what actions the administrators can take on the set of role instances selected as the scope for the assignment. These permissions might specify, for the selected scope of roles, that administrators can perform actions such as assigning roles to users, viewing role assignments, and deleting on role assignments.
IMPORTANT:Compliance, Configuration, and Reports domain types are discontinued from Identity Manager 4.7.1. This change does not remove the existing assignments that have been previously made to these domain types. However, you cannot edit those assignments.
The Reports domain type is deprecated with this release. You must use the Identity Reporting functionality to manage Identity Manager reports. This requires you to assign role to any users that you want to access the reporting functionality. You can assign this role to a user in one of the following ways within the identity applications:
-
By requesting role using the page. See, Requesting Permissions in NetIQ Identity Manager - User’s Guide to the Identity Applications.
-
By selecting role and assigning to a user in the page. See, Assigning Roles to Users.
22.6.2 Creating a New Administrator Assignment
You can create an administrator assignment for a user, group, container, or role type. Perform the following steps to create a new administrator assignment:
-
Click
. -
Specify the that describes the purpose of this assignment.
-
Select the from the list.
Domain
Description
This domain defines the rights to launch and retract process requests, manage addressee tasks, and configure delegate, proxy, and availability settings.
This domain defines the rights to manage roles and SoDs, assign, revoke, and report on roles, as well as rights to configure role settings.
This domain defines the rights to manage resources, assign, revoke, and report on resources, as well as rights to configure resource settings and bind entitlements.
This domain defines the rights to manage Identity Applications security, such as assign and revoke domain administrators and managers. This also provides the right to configure teams.
-
Select the for which you want to create an assignment.
This displays the list of users, groups, container, or roles based on the selected assignment type.
-
Select the required user, group, container or a role on from the provided list to create an assignment.
-
(Conditional) Specify the for this assignment. If you do not specify any date, creates an assignment immediately.
-
(Conditional) Specify the for this assignment. If you do not specify any date, the expiration date is set to never.
-
(Conditional) To create a domain administrator assignment for the selected domain, enable .
NOTE:This option cannot be edited after creating the assignment. For a delegated administrator, you can assign permissions individually. See, Assigning Permissions to a Delegated Administrator.
If this option is disabled, a delegated administrator is created for the selected domain.
-
Click .