Using the DirX Identity Business User Interface

The Business User Interface does not require client-side configuration.For details on how to configure the Business User Interface on the server side, see the DirX Identity Business User Interface Configuration Guide.

To access the Business User Interface, an HTML5-compatible browser must be available on the desktop.We recommend using Google Chrome for best experience and performance.

If your Business User Interface installation requires authentication with a user certificate (Public Key Infrastructure / PKI), this client certificate must be available in the certificate store that is used by your browser.

You request URL access to the Business User Interface from a DirX Identity administrator.The URL may contain different values depending on the DirX Identity installation and configuration and is defined by your company’s administrator.

For example:
https://my-server.my-domain.com/BusinessUserInterface-My-Company/

where the Business User Interface is available on the server my-server.my-domain.com at port 443.The application is installed with the name BusinessUserInterface and is configured for the DirX Identity domain *My-Company*.

Please ask your company’s administrator for the URL you need to use.

The Business User Interface does not provide any back or forward buttons.Although you can use your browser buttons for back and forward navigation, we recommend using the page navigation options within the Business User Interface.

You can launch the Business User Interface from your desktop browser.The following figure provides an example of how the Business User Interface might look, depending on how it is configured:

To log in, enter your account name and password and then click LOG IN.Your credentials are authenticated with the DirX Identity REST Service.If they are invalid, the browser will return you to the authentication page to try again.

Alternatively, you can choose Alternative login options to switch to the X.509 Public Key Infrastructure (PKI) authentication method if it is available and has been configured by your administrator.You will see the following login page:

Put your PKI card into your device’s card reader and then click LOG IN. Follow your browser instructions for getting access to your certificate.

Another authentication method provided is Windows Authentication (Kerberos). This authentication method must be configured and enabled to DirX Identity REST services. The Internet browser will automatically provide Windows credentials to the DirX Identity REST services when this method is used. The login page will look like this:

To log in to the application, click LOG IN.

Another authentication method provided is the DirX Access Policy Enforcement Point (PEP). This authentication method is enforced by DirX Access, which protects the DirX Identity REST services with a security layer that provides support for authentication. With this method, the DirX Identity REST services do not provide the authentication process; instead, the Business User Interface delegates the authentication task to DirX Access.

To log in to the application, click LOG IN. Because is no authenticated user yet, the Business User Interface redirects the Web browser to the DirX Access Authentication page. Select your preferred authentication method provided by DirX Access (Basic Authentication, PKI, etc.) and provide your authentication information (username/password, PKI card). If authentication is successful, DirX Access returns the Web browser to Business User Interface application with an authenticated session.

Another authentication method provided by the Business User Interface is the OAuth2 Open ID Connector (OAuth2 OpenID PKCE). With this method, the Business User Interface authentication process is delegated to an Identity Provider server (DirX Access, RedHat Keycloak) configured to work with the OAuth2 protocol; in particular, the OpenID variant or OAuth2.

The Business User Interface application communicates with the Identity Provider server with the PKCE extension of the OpenID protocol.

To log in into the application, click LOG IN. Because there is no authentication session, the Business User Interface redirects the Web browser to the OAuth2 OpenID Identity Provider login page. Select your preferred authentication method provided the Identity Provided and provide your authentication information (username/password, PKI card, etc.). If authentication is successful, Identity Provider server returns the browser to the Business User Interface application with an authentication token.

NOTE: You directly access the login page for a specific authentication method by using the Business User Interface application URL.

For example:

https://my-server.my-domain.com/BusinessUserInterface-My-Company/ #/login/Basic – to display Username/password login page

https://my-server.my-domain.com/BusinessUserInterface-My-Company/ #/login/X509 – to display PKI login page

https://my-server.my-domain.com/BusinessUserInterface-My-Company/ #/login/Kerberos – to display Windows Authentication login page

https://my-server.my-domain.com/BusinessUserInterface-My-Company/ #/login/DXAPEP – to display DirX Access PEP login page

https://my-server.my-domain.com/BusinessUserInterface-My-Company/ #/login/OAuth2 – to display OAuth2 login page

The login page is displayed in the language configured for use with the browser if a translation for this language is available; if it is not, English (U.S.) is used. To change the language dynamically, click the selection arrow in the upper right corner of the login page and then choose the language that best suits you from the list.

After a successful login, the user interface is displayed in the language that has been configured as your preferred language in DirX Identity. You can change this language manually.

If you take no action on the Business User Interface website, the session expires, and you are notified about it at the bottom of the page.

To remove this message, click DISMISS and then log in again.

If you have logged in with a client certificate (PKI), you are not allowed to log in again for security reasons after logout or an expired session.The reason is that the browser is caching your certificate information, which could be misused by a login without any authentication.As a result, you must restart the complete browser (not just the tab) to login again.

The Business User Interface home page displays a header and several large widgets:

On the home page:

In the home page header:

This menu allows you to navigate between pages that provide profile data and settings, the home page and logout.

In the navigation menu:

When you log out, a confirmation dialog is displayed:

If there are selected privileges in one of the Privilege Requests pages, the following log out dialog is displayed:

Like the Selected Privileges dialog, you can navigate to a specific user from a list, cancel the log out action by clicking Cancel or continue to log out and discard all selected privileges by clicking Discard (on the next login, these selected privileges will still be there).

The header at the top of each page indicates the page you’re currently working on and displays the home page icon, which you can click to return to the home page.

This page consists of four areas: your profile picture, pending modifications to your profile (Pending modifications), your identity status (Operational), your certificates, and your personal information.

This page allows you to see your additional identities assigned to your current user.These additional identities can be functional users where you are assigned as sponsor or personas and user facets identities attached to your user as owner.

In this page, you can search through your current identities, modify your functional user sponsor attribute to assign a selected functional user to another user, and click to create new identities.

See the chapter “Creating New Users and New Identities” for more details.

This page allows you to work on approval tasks individually or in bulk and inspect task details for currently active and closed tasks.

The Operation column contains a symbol for ADD (+), DELETE (-) or MODIFY (rotating arrows).

To work on multiple approval tasks at the same time, check the box to the left of each task.

To approve a request, click . To reject a request, click . A dialog is displayed where you can enter the reason (optional) for your action or cancel it.

A segregation of duty (SoD) violation with a role request is indicated with . For more information about SoD, see the Dirx Identity Provisioning Administration Guide.

In the example dialog shown in the previous figure, the risk feature is enabled but a calculation for the future risk is not available and is indicated by . In this case, you should look at the details page, which shows you the current risk status as well as the future risk status if this role were to be approved.

An increasing risk level for a request is indicated by .

In general, you can also approve or reject requests in the details page.You can call the requestor or the affected user directly from the details page or e-mail them.

The Closed Tasks tab provides a search feature to find and inspect your closed tasks for a specific time interval.

This page shows you the list of all privileges currently assigned to you.

You will see a single pane for each of the configured privilege types (role, permission, group).You may need to scroll down to see the other privileges.

This page allows you to manage the requests that are currently in approval for you.These requests are for roles, permissions, groups, and profile changes.

The Initiator column displays the user who initiated the request.For your own initiated request, the initiator is displayed as “Me”; otherwise, the initiator’s full name is displayed.

The Subject column contains the affected user of the request.

The Due Date column displays the due date of the request.

The Current participants column displays the number of approvers for current requests. Details about the participants are available on the Details page.

If the access policy allows it, you can change one or more participants in a request:

The Operation column contains an icon for ADD (+), DELETE (-) or MODIFY (rotating arrows).

If there is a segregation of duty violation with this role, is displayed in the last column.

The Action column contains a cancel request action button that allows you to cancel your own requests (requests where you are the initiator).

The Details column contains a link to a Details page that provides more information about request. This option may not be available for some requests.

Filtering - the vertical ellipsis to the right of Requests (Show) allows you to filter the requests according to their type: Requests for me and Requests as intiator. All options are initially activated.

Requests for me – shows requests where the current user is the subject.

Requests as initiator – shows requests where the current user is the initiator.These requests can be Profile changes or Privilege assignment changes. Workflow requests or Ticket requests can also be filtered.

The tab Closed Requests provides a search function through your closed requests.You can provide a search text and a time interval from the past.

This page allows you to view and manage your team members.It displays a list of all your team members.

To switch to the user’s home page, click the circle that contains the user’s initials, the user’s name, or the arrow on the right.

This page allows you to manage your current delegations and to view the delegations assigned to you.

Note: Delegations from the Business User Interface are not compatible with delegations available in DirX Identity Web Center.These delegations are visible only in Business User Interface and DirX Identity Manager.

You can edit the delegation parameters of delegations assigned to other users and delete the delegation.

Click to create a new delegation.

When creating a new delegation, the following fields are available:

Click Create to save current values and create a new delegation.

This page allows you to change your current password with a new password.The new password must comply with DirX Identity Password Policy.

The current user must provide the old password followed by the new password and a confirmation of it.

The password policy compliance list available to DirX Identity is displayed on the right side of the page.Some password policies are evaluated by the application (for example, “Length between 6 and 8”) and some policies are evaluated by the REST service (for example, “Number of not reusable most recent passwords”).If the new password complies with application password policy checks and the confirmation of the new password matches, the user can change the password.

If Windows Password Complexity is enabled in Active Directory, an extra policy will be added to the BUI list.

The validation on the client side consists of three parts that need to be met:

Password length – this value integrated with the “custom” length policies. If there are any other policies set, the most restrictive are imposed.

For example, a Windows password policy has a minimum length of 8 characters while a custom policy requires a minimum length of 5 characters. Only the 8-character requirement will be active.

Restricted strings – a password cannot contain certain texts like the username or user ID.If these texts are entered, the Windows password policy is invalidated.

The password must meet three of the following conditions:

This feature allows you to execute tasks in a running Certification Campaign.The application displays all running Certification Campaigns where current user has tasks (approve or reject) and DirX Identity Access Policy allows to view and modify running campaigns tasks.

The campaign table shows the following information:

To navigate to a campaign, click a campaign name or the arrow from the last column.

A Certification Campaign page displays all subjects of the campaign where the current user has tasks. The campaign table shows following information:

To navigate to the certify page, click the subject name or the arrow from the last column.

The Certify page displays different content based on the campaign type:

For Privilege Certification Campaign, the certify page contains a list of all users with current privilege.

For User Certification Campaign, the certify page contains multiple lists of all privileges assigned to current user and are part of the campaign. The page contains tabs for each privilege type: roles, permissions and groups and privileges which are assigned automatically (by rule, by BO, etc.).

For both campaign type (Privilege or User Certification Campaign) you can certify available entries:

When certification successfully finishes, the application is redirected to the subjects list, or if no subjects are available, to the campaigns list.

This module offers a way to view and access all the people connected to the DirX database, including members, suppliers, and customers.

There are two search dialogs available to filter the lists: simple and advanced.The following figure shows the simple search dialog:

In the simple search, the resulting list is filtered on all criteria based on the input.

The Advanced Search dialog offers more control over the filtered criteria. The input fields are also configurable from a file so that the system administrator can add or remove them as needed.

Just like in the My Team module, you have access to a user’s home page. To do this, you can click the circle that contains the user’s initials, the user’s name, or the arrow on the right.

At login, users can be prompted by an administrator-defined message, such as a scheduled maintenance or other system-relevant information.

This dialog is visible once per session when the user enters the home page.It can be dismissed by clicking CLOSE or by clicking anywhere outside the dialog.Navigating away and then back to the home page will not trigger the message again.

Users have the option to turn off the notification for the remainder of the message validity period by clicking on the bottom-left checkbox and then closing the window.

The login information is available only in an administrator-defined period. When the message is changed, all users are notified and the option to hide for future logins is reset.