Context-Sensitive Help

Users View
Business Objects View
Ticket View
Privileges View
Policies View
Certification Campaigns View
Request Workflows View
Target Systems View
Auditing View
Domain Configuration View
Miscellaneous

Users View

The Users view shows the tree of user entries together with their organizational folders like countries, localities, domain components, organizations and organizational units.It may also hold a set of query folders for filtering a set of user entries according to various criteria.

For each selected node in the tree, the respective property pages are shown on the right-hand side.Click Edit to modify property values.Note that saving the properties of user entries will result in another resolution of their relations to groups and roles.

Related Topics

User
Domain Component
Organization
Organizational Unit
Country
Locality

Users

This tab shows the general properties for a user folder. The user folder contains either user entries or ordering folders corresponding to countries, localities, domain components, organizations or organizational units (departments, teams).

The items shown here are the following:

Name - the displayed name of the users folder.

Description - the description for the users folder.

Related Topics

User
Country
Locality
Domain component
Organization
Organizational unit

User - General Properties

The user object represents a user of an IT infrastructure. DirX Identity Provisioning manages the user’s access to all parts of the IT infrastructure.

Use this tab to display the general properties of the user object. Since it is fully configurable by the domain administrator, the items shown here may vary from installation to installation or even from domain to domain. It is also possible to set up several user types that show a different set of properties.

The following properties explain the default configuration of DirX Identity:

General (Identification) Properties

Name (mandatory) - used as the relative distinguished name (RDN) for the user entry and identifies the user uniquely within the sub-tree. Once set during adding a new user entry, it can no longer be changed by simply editing this field after the initial save operation. Use the Rename command of the user entry’s context menu instead. A change of the common name is also possible by running the user integration workflow.

First Name (optional) - the first name of the user.

Middle Name (optional) - the middle name of the user.

Salutation (optional) - the salutation of the user. Values for different countries are available.

Title (optional) - the title of this user.

Last Name (mandatory) - the last name of the user. This item corresponds to the "surname" attribute saved in the Identity Store.

Gender (optional) - the gender of this user.

Day of birth (optional) - the day of birth for this user.

Master (optional) - the name of the directory that masters the user entry.

Employee number (optional) - the employee number.

Identifier (optional) - the user’s global unique identifier.

Description (optional) - a description for the user. This field is often useful when user entries are listed in tables with only their names but with a description column to better identify them.

Employee Type (optional) - one of the following user’s employee types:

Contractor - an (outside) contractor.
Customer - a customer.
Internal - an internal employee.
Supplier - a supplier.

Business Category (optional) - the business the user works for.

Related Topics

Multi-Value Editor

Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Relationships

Use this tab to define relationships to other user objects.

Owner (optional) - the owner of the user entry. You can use this field in two ways:

To define the user administrator that can handle this user (set up an access policy to make this work).
To define the responsible user for a persona (see the section "Handling Multiple Accounts" in the chapter "Managing Target Systems" for more information).

Manager (optional) - the user’s manager. Used for user type Internal Employee.

Secretary (optional) - the user’s secretary.

Representative (optional - the user’s representative.

Sponsor (optional) - the user’s sponsor. Used mainly for user type Contractor.

Note that these links are very useful when setting up participants for request workflows. For more information see the section "Participant Calculation" in the DirX Identity Application Development Guide.

Related Topics

General
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Operational

Use this tab to display the operational parameters necessary for correct operation on this user within DirX Identity.

Status fields

To be analyzed (read-only) - indicates when checked that this entry has been changed. For example, an import workflow added or modified some attributes. The privilege resolution or the consistency checker uses this flag to detect and resolve records that are not up-to-date. After the check or resolution operation completes, the flag is cleared.

Is Inconsistent - indicates whether (unchecked) or not (checked) the stored access rights of the user are consistent with the assigned privileges. DirX Identity Provisioning checks the flag (sets the entry’s flag to TRUE), if it fails to resolve the assigned privileges due to errors in the privilege structure. In this case, the user keeps the previous access rights, but DirX Identity Provisioning sets an end date for this state: the Error expiration date. The resolution error is stored in the Error field. So the administrator has time to repair the error. The flag is unchecked if the entry is consistent.

Use as Template - indicates when checked that DirX Identity will not resolve privileges assigned to this user. A likely reason for the checked flag is that the user object has been copied from another object. In this case, the user is marked as a template until appropriate changes have been made to the copied user. If the user is set correctly, uncheck the flag to enforce privilege resolution and target system provisioning.

+ A template user may also have been deliberately created to be used as a basis for creating additional accounts that are fully controlled by DirX Identity. You can use the owner link to point from this copied user to another (primary) user. This reference can help you to understand which secondary user entries belong to a primary one.

Status - shows the status of the user entry. For more information, see the section "Managing States" in the chapter "Managing Provisioning". Possible values are:

TEMPLATE - the settings made for this user are used as a template.
NEW - the user is a new user, the privilege assignments are not activated yet.
ENABLED - the user is established; the corresponding user object is up to date and valid, the privilege assignments are active.
DISABLED - the privilege assignments for this user are currently disabled, the user does not have any rights in the domain.
TBDEL - the user object shall be deleted from the DirX Identity Provisioning system. This action is taken when all assigned accounts in the target systems are deleted or the end date for deletion is reached.

Lifetime Start - shows the date on which the privilege assignments to the user will become active for the first time (usually the date on which the user enters the company).

Lifetime End - shows the date on which the privilege assignments to the user will become inactive for the last time (usually the date on which the user leaves the company).

Deactivation Start - shows the date on which the privilege assignments will become inactive for the next time.

Deactivation End - shows the date on which the privilege assignments will be reactivated again for the next time.

Delete - shows the date on which the entry will finally be deleted despite any existing accounts in target systems.

Create time stamp - shows the date and time at which this entry was created.

Modify time stamp - shows the date and time at which this entry was last changed.

Notification fields

Notification Level - controls suppression of the first e-mail of the e-mail notification of an approval workflow. Possible values are:

0 - the first e-mail is sent.
1 - the first e-mail is not sent (but all other administrative or repetition e-mails).

Tasks fields

To do - shows a list of manual working items for the administrator. DirX Identity Provisioning stores the results of consistency checks it cannot repair automatically. The items are overwritten on the next consistency check.

Possible messages in this field besides warnings from the service agent are:
INF:530:Missing values for attributes: attributelist.
*INF:531:More than one peer account exists for account DN=*dn.
*INF:532:No peer account exists for account DN=*dn.

Error - stores the list of error messages that give the detailed reason for inconsistent states or To do entries. They are cleared automatically when a privilege resolution succeeds.

Error expiration date - shows the date on which the access rights of the user will be updated despite any resolution errors. See the Is Inconsistent field.

Related Topics

General
Relationships
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Communication

Use this tab to display communication attributes for a user object.

E-Mail (optional) - the user’s e-mail addresses.

Phone (optional) - the user’s main phone number (business phone number).

Fax (optional) - the user’s fax number.

Mobile (optional) - the user’s mobile number.

Home (optional) - the user’s home phone number.

Web address (optional) - the Web address of the Internet home page for this user.

Preferred language (optional) - the preferred language of this user, which controls, for example, the language used in an e-mail if this user is referenced in the To field. For more information, see the chapter "Using Variable Substitution" in the DirX Identity Application Development Guide.

Note that the phone number might be used by default when DirX Identity Provisioning creates a new account for the user. The account name is generated using the user’s surname, given name and phone number. See the object description for the accounts.

Related Topics

General
Relationships
Operational Properties
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Authentication

Use this tab to display the authentication properties for this user.

Password Management

One-Way Password (read-only) - the user password (userPassword attribute). Authentication against the Identity Store is performed using this password. The password is usually not readable.

Encrypted Password (read-only) - the encrypted (or scrambled) password of this user (dxmPassword attribute). This attribute is used for password synchronization to target systems.

Password Changed Time (read-only) - the time at which the password was last changed.

Password Expiration Notified (read-only) - the time at which the Password Notification service notified the system about the password expiration.

Password History (read-only) - the password history (one-way encrypted). This field shows only that there is a password history.

Password Reset (read-only) - if active, the password was reset by the administrator.

Password Policy - a link to the relevant password policy. If no link is set, the default policy is used by the system.

Logins with Password

This group of fields is related to logins with password.

Failure Count (read-only) – the number of failed login attempts. The number is reset on any successful login attempt.

Last Failure Time (read-only) – the time of the last failed login attempt. The time is cleared on any successful login attempt.

Locked Until (read-only) – the time until which login attempts by the user are rejected.

Challenge Response Authentications

This group of fields is related to challenge-response authentications.

Challenges and Responses (read-only) - the challenge and response questions (one-way encrypted). This field shows only that challenge and response questions have been set up.

Failure Count (read-only) – the number of failed authentication attempts. The number is reset on any successful login attempt.

Last Failure Time (read-only) – the time of the last failed authentication attempt. The time is cleared on any successful login attempt.

Locked Until (read-only) – the time until which authentication attempts by the user are rejected.

SASL EXTERNAL Bind

Mirrored User - a link to the mirrored user for SASL EXTERNAL binds. For details, see the chapter "Configure DirX Identity - Provisioning" in the Use Case Document DXI Smart Card Login Manager.

Certificate

Certificate (read-only) - the certificate of the user.

Related Topics

General
Relationships
Operational Properties
Communication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Organization

Use this tab to display the organization and organizational unit properties of a user. These properties can be linked with the relevant business objects.

Organizations

Organization Link (optional) - sets a link to an organization object (business object).

Organization (optional) - defines the organization to which the user belongs. If the Organization Link is set, this attribute is read-only and is controlled by the linked object.

More Organizations (optional) - defines more organization links for this user.

Organizational Units

Org. Unit Link (optional) - sets a link to an organizational unit object (business object).

Organizational Unit (optional) - the organizational unit to which the user belongs. If the Org. Unit Link is set, this attribute is read-only and controlled by the linked object.

Department Number (optional) - the department number of the organizational unit. If the Org. Unit Link is set, this attribute is read-only and controlled by the linked object.

More Organizational Units (optional) - defines more organizational unit links for this user.

Cost Units

Cost Unit (optional) - defines the cost unit to which the user belongs.

More Cost Units (optional) - defines more cost units for this user.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Location

User this tab to display and set location information associated with the user.

Location Link (optional) - sets a link to a location object (business object).

Country (optional) - the country of the user. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

State (optional) - the state of the user. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Postal Code (optional) - the postal code of the location. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Location (optional) - the location(s) of the user. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Street (optional) - the street of the location. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Room (optional) - the room where this user is located.

Postal Address (optional) - the postal address of this location. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

More Locations (optional) - defines more location links for this user.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Context

This tab is an example of other context information. Pre-configured links are:

Contexts (optional) - a link to any type of context object (business object).

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Assigned Roles

Use this tab to view and manage the roles assigned to a user. The tab displays the list of roles currently assigned to the user.

For each role, the following properties are shown:

Role - the role’s name as it is displayed throughout the DirX Identity Provisioning system. If the role’s name ends with an asterisk character (*), the role has assigned one or more junior roles. These junior roles are automatically assigned to the user as well.

Description - the description for the role.

Start Date - the date on which this role became or will become active for the user; that is, the date on which the user was/is granted the permissions assigned to this role.

End Date - the date on which this role became or will become inactive for the user; that is, the date on which the permissions granted to the user was or will be revoked. If the re-approval flag is set, the end date shown is the date of the re-approval. You can change the end date to shorten the period to the next re-approval but you cannot lengthen it.

Reapproval - whether (checked) or not (unchecked) the assignment requires regular re-approval. The next re-approval will occur at the shown end date. Unchecking this flag removes the privilege from re-approval at the shown end date (re-approvals no longer occur).

Role Parameters - shows the first few assigned role parameters. Use the button to view all role parameter settings for this assignment.

Assigned by - how the assignment was made. Possible values are:

BO - the role was assigned by privilege inheritance from a business object.
UF - the role was assigned by user facet inheritance from a user facet.
manual - the role was assigned by hand.
rule - the role was assigned by a rule.

State - the state of the assignment. Possible values include:

ToBeApproved - the assignment is still in approval. The corresponding access rights (groups) are not yet assigned.
ENABLED - the assignment is enabled. The user has the corresponding access rights (groups) assigned.
DELETED - the assignment is deleted. The corresponding access rights (groups) are not yet or no longer assigned.

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Note that DirX Identity shows assignments in approval as gray lines. Valid values for such entries are:
Add - this assignment is not yet active.
Mod - parts of this assignment (some attributes) were changed.
Del - this assignment is to be deleted.

To add or remove roles, use the assignment editor, which is displayed when you click Edit. To examine the details of a particular role, click to the right of its row.

Note that a line is displayed in gray if this assignment is still in approval. Thus you can see a white line that defines the current state and maybe several gray lines that define changes for this assignment that are still in approval.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Permissions
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Assigned Permissions

Use this tab to view and manage the permissions assigned to a user. The tab displays the list of permissions currently assigned to the user.

For each permission, the following properties are shown:

Permission - the permission’s name as it is displayed throughout the DirX Identity Provisioning system.

Description - the description for the permission.

Start Date - the date on which this permission became or will become active for the user.

End Date - the date on which this permission became or will become inactive for the user. If the re-approval flag is set, the end date shown is the date of the re-approval. You can change the end date to shorten the period to the next re-approval but you cannot lengthen it.

Reapproval - whether (checked) or not (unchecked) this assignment requires regular re-approval. The next re-approval occurs at the shown end date. If you uncheck this flag, privilege re-approval is removed at the shown end date (re-approvals no longer occur after the end date is reached).

Assigned by - how the permission assignment was made. Possible values are:

(empty) - the permission is inherited from a role.
BO - the permission was assigned by privilege inheritance from a business object.
UF - the permission was assigned by user facet inheritance from a user facet.
manual - the permission was assigned by hand.
rule - the permission was assigned by a rule.

State - The state of the assignment. Possible values are:

ToBeApproved - the assignment is still in approval. The corresponding access rights (groups) are not yet assigned.
INHERITED - the assignment is inherited from a role assignment.
DELETED - the assignment is deleted. The corresponding access rights (groups) are not yet or no longer assigned.

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Note that DirX Identity shows assignments in approval as gray lines. Valid values for such entries are:
Add - the assignment is not yet active.
Mod - parts of the assignment (some attributes) are to be changed.
Del - the assignment is to be deleted.

To add or remove permissions manually, use the assignment editor, which is displayed when you click Edit. To inspect the details of a particular permission, click to the right of its row.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Groups
Accounts
Orders
SoD Exceptions

User - Assigned Groups

Use this tab to view and manage the groups assigned to a user. The tab displays the list of groups currently assigned to the user.

For each group, the following properties are shown:

Target system - the name of the target system to which the group belongs.

Group - the group’s name as it is displayed throughout the DirX Identity Provisioning system.

Description - the description for the group.

Start Date - the date on which this direct group assignment became or will become inactive for the user.

End Date - the date on which this direct group assignment became or will become inactive for the user. If the re-approval flag is set, the end date shown is the date of the re-approval. You can change the end date to shorten the period to the next re-approval but you cannot lengthen it.

Reapproval - whether (checked) or not (unchecked) this assignment will require regular re-approval. The next re-approval will occur at the end date shown. Unchecking this flag removes the privilege from re-approval at the shown end date (re-approvals are no longer required after this date is reached).

Assigned by - how the group assignment was made:

(empty) - the group was assigned by a permission or role through privilege assignment.
BO - the group was assigned by privilege inheritance from a business object.
UF - the group was assigned by user facet inheritance from a user facet.
manual - the group was assigned by hand.
rule - the group was assigned by a rule through policy execution.

State - the status of the group assignment. Possible values are:

ADD - the assignment is requested by DirX Identity Provisioning and shall be created in the target system by the synchronization workflow.
DELETED - DirX Identity Provisioning requests the assignment to be deleted in the target system by the synchronization workflow. When it is deleted in the target system, the workflow removes the assignment physically from the dxrMemberDel attribute.
ENABLED - the assignment is established both in DirX Identity Provisioning and in the target system: they are “in-sync”.
IMPORTED - the assignment was created in the target system, but not yet requested in DirX Identity Provisioning. DirX Identity Provisioning does not delete it (ignores it), but it may be an indicator to the administrator that the user has access rights not granted by the assigned roles. DirX Identity Provisioning switches the state to ENABLED when the user is granted this access right. If it is revoked afterwards, the state switches to DELETED and not back to IMPORTED!

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Note that DirX Identity shows assignments in approval as gray lines. Valid values for such entries are:
Add - the assignment is not yet active.
Mod - parts of the assignment (some attributes) are to be changed.
Del - the assignment is to be deleted.
INACTIVE - this state is a virtual one that may have two causes:
The end date of this assignment has passed.
The privilege is already assigned (for example, by the policy execution service), but a privilege resolution has not yet run. Run the privilege resolution to solve this problem.
The privilege is already assigned but the assignment is still in approval. Completing the approval workflow will change the state.

The reason for this state is that the dxrGroupLink at the user has been populated, but the member attributes at the group or account are not yet populated.

To add or remove groups, use the assignment editor, which is visible when you click Edit. To examine the details of a particular group, click on the right of its row.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Accounts
Orders
SoD Exceptions

User - Accounts

Use this tab to display the list of accounts currently assigned to the user.

For each account, the following properties are shown:

Account - the account’s name as it is displayed throughout the DirX Identity Provisioning system.

Description - the description for the account.

State - the status of the account. Possible values are:

ENABLED - the account shall exist, be created in the target system and be enabled.
DISABLED - the account shall exist, be created in the target system and be disabled.
DELETED - the account shall be deleted in the target system.
IMPORTED - the account was created in the target system, but is not yet requested by DirX Identity Provisioning.

Target System - the target system to which this account belongs.

State in TS (target system) - the status of the account in the respective target system. This status may differ from the status of the account entry in DirX Identity Provisioning as long as the information is not synchronized. Possible values are:

ENABLED - the account exists in the target system and is enabled.
DISABLED - the account exists in the target system and is disabled.
DELETED - the object has been deleted in the target system without DirX Identity Provisioning having requested it! This state is only set by the validation workflow along with a message in the dxrToDo attribute reminding the administrator to inspect this situation.
NONE - replaces the empty value when the object is created by the DirX Identity Manager or agent.

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Priv - whether the account is an assigned privileged account (checked) or a personal account that is a member in the assigned groups that define the access rights in the connected systems (unchecked). A privileged account can be used by many persons in parallel. Examples are the Administrator account in Windows or the root account in UNIX. Assignment of a privileged account means:
1) You can read the password of this account in clear text to log in to the corresponding target system.
2) Your certificates are copied to the account in the connected system, which allows you to log in with the corresponding card.

You cannot make direct assignment of accounts in this tab. To examine the details of a particular account, click to the right of the respective table row.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Orders
SoD Exceptions

User - Orders

Use this tab to display all currently pending changes for this user. This information is kept in order objects (mostly part of running request workflows).

The upper part of this tab shows pending attribute modification requests, while the lower part shows pending privilege assignments or privilege assignment attribute changes.

The Attribute Modifications pane shows a line for each relevant attribute. The columns are:

Due Date - the date on which this change will be valid. If no value is supplied, the change depends on a pending attribute approval step of a running request workflow.

Attribute - the name of the attribute.

Old values - the old value(s) of the attribute.

New values - the new value(s) of the attribute.

- opens a detail page for this line.

The Assignments to add (+), modify (*) or delete (-) pane shows a line for each assignment or change. The columns are:

Op(eration) - the type of line. Possible values are:

(+) - the privilege is to be assigned (to be added).

(*) - the assignment is subject to a change. One or more of the attributes - for example, the start or end date or a role parameter - has changed.

(-) - the privilege is to be removed (to be deleted).

Due date - the date on which this assignment or assignment change will be valid. If no value is supplied, the change is dependent on a pending attribute approval step of a running request workflow.

Type - the privilege type (role, permission or group).

Name - the privilege name.

Attribute - the name of the attribute to be changed.

Old values - the old value(s) of the attribute.

New values - the new value(s) of the attribute.

Assigned by - the type of assignment (manual or by rule).

- opens a detail page for this line. It shows the corresponding request workflow instance.

Note that the assignment information is also visible in the Assigned Roles, Assigned Permissions and Assigned Group tabs in a slightly different format.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
SoD Exceptions

User - SoD Exceptions

Use this tab to display all segregation of duty (SoD) exceptions for this user. SoD exceptions are SoD conflicts that have been approved successfully via an assignment approval workflow.

The upper part of this tab shows approved SoD violations, the lower part shows pending SoD violations.

For each SoD exception line in the Approved SoD violations table, the following columns are shown:

Policy - the SoD policy that caused this exception.

Privilege - the privilege that was assigned to the user.

Activity - the approval activity of the corresponding request workflow.

Reason - the reason why the approver accepted this SoD conflict.

Who - the approver.

When - the date of approval.

For each SoD exception line in the Pending SoD violations table, the following columns are shown:

Policy - the SoD policy that caused this exception.

Privilege - the privilege that was assigned to the user.

Click to open a detail page for this line.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders

User - Risk Parameters

Use this tab to display the risk assessment properties for a user.

The Overall Risk section displays the computed overall risk level and the compound score. It includes the following properties:

Risk Level - the overall risk level for the user. Possible values are Low, Medium or High.

Compound Score - the calculated compound score for the user. All of the user’s standard scores are used to compute the compound score.

The Risk Factors section provides the values for every risk factor defined in the domain’s risk policy. Each risk factor is listed by name; for example, GroupMemberships, ImportedAccounts, PrivilegedAccounts. Risk factors shown as RiskFactor*number - for example, *RiskFactor6 - represent risk factors that have not been configured and have so not been processed by the Risk Calculation workflow. For every risk factor, the following properties are shown:

Raw Value - the raw value for the risk factor. This value is the computed score of the factor at the user.

Standard Score - the standard score for the risk factor. This value is a normalized score for the factor at the user.

See the section "Managing Risk" in the chapter "Managing Compliance" for details on risk calculation.

Related Topics

General
Relationships
Operational Properties
Communication
Authentication
Organization
Location
Context
Assigned Roles
Assigned Permissions
Assigned Groups
Accounts
Orders

Risk Policy - General

User Facets

User Facet - General Properties

User facets are alternative representations of a user. User facets are intended for users with different capacities or positions. For example, suppose you have a student who works as a teaching assistant and as a tutor. In some instances, you might be interested in the privileges that derive from his capacity as a student; in other cases, you might want to know about the privileges that derive from his position as a tutor. You can model these different profiles by creating two user facets; both of which are linked to the real user. If you are only interested in the privileges granted from his capacity as a tutor, then look at the "tutor" user facet. At the user, you can view all of the user’s privileges with the resulting accounts.

This tab shows all general properties of the user facet object. Since it is fully configurable by the domain administrator, the items shown here may vary from installation to installation or even from domain to domain.

Note that a user facet is related via its owner link to its user. Depending on the processes in a company, it may make sense to use the master mechanism so that the user facet inherits the properties of the user. In this case, the text entry fields are not editable but are automatically populated from the owner.

The following properties explain the default configuration of DirX Identity:

General (Identification) Properties

Name (mandatory) - used as the relative distinguished name (RDN) for the user facet entry and identifies the user facet uniquely within the sub-tree. Once set during adding a new user facet entry, it can no longer be changed by simply editing this field after the initial save operation. Use the Rename command of the user facet entry’s context menu instead. A change of the common name is also possible by running the user facet integration workflow.

First Name (optional) - the first name of the user facet.

Middle Name (optional) - the middle name of the user facet.

Salutation (optional) - the salutation of the user facet. Values for different countries are available.

Title (optional) - the title of this user facet. Mastered from the user.

Last Name (mandatory) - the last name of the user facet. This item corresponds to the "surname" attribute saved in the Identity Store.

Gender (optional) - the gender of this user facet. Mastered from the user.

Day of birth (optional) - the day of birth for this user facet.

Master (optional) - the name of the directory that masters the user facet entry.

Employee number (optional) - the employee number.

Identifier (optional) - the user facet’s global unique identifier.

Description (optional) - A description for the user facet. This is often useful, when user facet entries are listed in tables just with their names but with a description column to better identify them.

Employee Type (optional) - one of the following user facet’s employee types:

Contractor - an (outside) contractor.
Customer - a customer.
Internal - an internal employee.
Supplier - a supplier.

Business Category (optional) - the business the user facet works for.

User Facet - Relationships

Use this tab to define relationships to other user facet objects.

Owner (mandatory) - the owner of the user facet entry. It references the user facet’s related user.

Manager (optional) - the user facet’s manager. Used for user facet type Internal Employee. Mastered from the user.

Secretary (optional) - the user facet’s secretary.

Representative (optional) - the user facet’s representative.

Sponsor (optional) - the user facet’s sponsor. Used mainly for user type Contractor.

Note that these links are very useful when setting up participants for request workflows. For more information, see the section "Participant Calculation" in the DirX Identity Application Development Guide.

Related Topics

User Facet - General Properties
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Operational Properties

Use this tab to display the operational parameters necessary for correct operation on the user facet entry within DirX Identity.

Status fields

Is Inconsistent - indicates whether (unchecked) or not (checked) the stored access rights of the user facet are consistent with the assigned privileges. DirX Identity Provisioning checks the flag (sets the entry’s flag to TRUE), if it fails to resolve the assigned privileges due to errors in the privilege structure. In this case, the user facet keeps the previous access rights, but DirX Identity Provisioning sets an end date for this state: the Error expiration date. The resolution error is stored in the Error field. So the administrator has time to repair the error. The flag is unchecked if the entry is consistent.

Use as Template - indicates when checked that DirX Identity will not resolve privileges assigned to this user facet. A likely reason for the checked flag is that the user facet object has been copied from another object. In this case, the user facet is marked as a template until appropriate changes have been made to the copied user facet. If the user facet is set correctly, uncheck the flag to enforce privilege resolution and target system provisioning.

+ A template user facet may also have been deliberately created to be used as a basis for creating additional accounts that are fully controlled by DirX Identity. You can use the owner link to point from this user facet its main identity. This reference can help you to understand which secondary user facet entries belong to a main identity one.

Status - shows the status of the user facet entry. For more information, see the section "Managing States". Possible values are:

TEMPLATE - the settings made for this user facet are used as a template.
NEW - the user facet is a new user facet; the privilege assignments are not activated yet.
ENABLED - the user facet is established; the corresponding user facet object is up to date and valid, the privilege assignments are active.
DISABLED - the privilege assignments for this user facet are currently disabled, the user facet does not have any rights in the domain.
TBDEL - the user facet object shall be deleted from the DirX Identity Provisioning system. This action is taken when all assigned accounts in the target systems are deleted or the end date for deletion is reached.

Lifetime Start - shows the date on which the privilege assignments to the user facet will become active for the first time (usually the date on which the user facet’s privileges must be activated for the main identity).

Lifetime End - shows the date on which the privilege assignments to the user facet will become inactive for the last time (usually the date on which the user facet’s purpose has been satisfied so that the main identity no longer needs its privileges). Note that when the status of the main identity changes to TBDEL, the user facet’s state changes as well and its EndDate is set.

Deactivation Start - shows the date on which the privilege assignments will become inactive for the next time.

Deactivation End - shows the date on which the privilege assignments will be reactivated again for the next time.

Delete - shows the date on which the entry will finally be deleted despite any existing accounts in target systems.

Create time stamp - shows the date and time at which this entry was created.

Modify time stamp - shows the date and time at which this entry was last changed.

Notification fields

Notification Level - controls suppression of the first e-mail of the e-mail notification of an approval workflow. Possible values are:

0 - the first e-mail is sent.
1 - the first e-mail is not sent (but all other administrative or repetition e-mails).

Tasks fields

Error - stores the list of error messages that give the detailed reason for inconsistent states or To do entries. They are cleared automatically when a privilege resolution succeeds.

Error expiration date - shows the date on which the access rights of the user will be updated despite any resolution errors. See the Is Inconsistent field.

Related Topics

User Facet - General
User Facet - Relationships
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Accounts
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Communication

Use this tab to display communication attributes for a user facet object.

E-Mail (optional) - the user facet’s e-mail addresses. Mastered from the user.

Phone (optional) - the user facet’s main phone number (business phone number).

Fax (optional) - the user facet’s fax number.

Mobile (optional) - the user facet’s mobile number. Mastered from the user.

Home (optional) - the user facet’s home phone number. Mastered from the user.

Web address (optional) - the Web address of the Internet home page for this user facet.

Preferred language (optional) - the preferred language of this user facet (mastered from the user), which controls, for example, the language used in an e-mail if this user facet is referenced in the To field. For more information, see the chapter "Using Variable Substitution" in the DirX Identity Application Development Guide.

Note that the phone number might be used by default when DirX Identity Provisioning creates a new account for the user facet. The account name is generated using the user facet’s surname, given name and phone number. See the object description for the accounts.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Authentication

Use this tab to display the authentication properties for this user facet.

Encrypted Password - the encrypted (or scrambled) password of this user facet (dxmPassword attribute). This attribute is used for password synchronization to target systems. Authentication against the Identity Store is performed via the stored one-way password (userPassword attribute).

Password Account Locked Time (read-only) - the time at which the account was locked.

Password Changed Time (read-only) - the time at which the password was last changed.

Password Expiration Notified (read-only) - the time at which Password Notification service notified the system about the password expiration.

Password Failure Time (read-only) - the time at which the password was entered incorrectly.

Password History (read-only) - the password history (one-way encrypted). This field shows only that there is a password history.

Password Reset (read-only) - if active, the password was reset by the administrator.

Password Policy - a link to the relevant password policy. If no link is set, the default policy is used by the system.

Challenges and Responses (read-only) - the challenge and response questions (one-way encrypted). This field shows only that challenge and response questions have been set up.

Certificate (read-only) - the certificate of the user facet.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Organization

Use this tab to display the organization and organizational units properties of a user facet. These properties can be linked with the relevant business objects.

Organizations

Organization Link (optional) - sets a link to an organization object (business object).

Organization (optional) - defines the organization to which the user facet belongs. If the Organization Link is set, this attribute is read-only and is controlled by the linked object.

Organizational Units

Org. Unit Link (optional) - sets a link to an organizational unit object (business object).

Organizational Unit (optional) - the organizational unit to which the user facet belongs. If the Org. Unit Link is set, this attribute is read-only and controlled by the linked object.

Department Number (optional) - the department number of the organizational unit. If the Org. Unit Link is set, this attribute is read-only and controlled by the linked object.

More Organizational Units (optional) - defines more organizational unit links for this user facet.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Location

Use this tab to display and set location information associated with the user facet.

Location Link (optional) - sets a link to a location object (business object).

Country (optional) - the country of the user facet. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

State (optional) - the state of the user facet. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Postal Code (optional) - the postal code of the location. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Location (optional) - the location(s) of the user facet. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Street (optional) - the street name of the location. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Room (optional) - the room where this user facet is located.

Postal Address (optional) - the postal address of this location. If the Location Link is set, this attribute is read-only and is controlled by the linked object.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Context

This tab is an example of other context information. Pre-configured links are:

Contexts (optional) - a link to any type of context object (business object).

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Assigned Roles

Use this tab to view and manage the roles assigned to a user facet. The tab displays the list of roles currently assigned to the user facet.

For each role, the following properties are shown:

Description - the description for the role.

Start Date - the date on which this role became or will become active for the user facet; that is, when the user facet was/is granted the permissions assigned to this role.

End Date - the date on which this role became or will become inactive for the user facet; that is, when the permissions granted to the user facet was or will be revoked. If the re-approval flag is set, the end date shown is the date of the re-approval. You can change the end date to shorten the period to the next re-approval but you cannot lengthen it.

Reapproval - whether (checked) or not (unchecked) this assignment will be regularly reapproved. The next re-approval will occur at the shown end date. Unchecking this flag removes the privilege at the shown end date (re-approvals no longer occur).

Role Parameters - shows the first few assigned role parameters. Use the button to view all role parameter settings for this assignment.

Assigned by - how the assignment was made. Possible values are:

BO - the role was assigned by privilege inheritance from a business object.
manual - the role was assigned by hand.
rule - the role was assigned by a rule.

State - the state of the assignment:

ToBeApproved - the assignment is still in approval. The corresponding access rights (groups) are not yet assigned.
ENABLED - the assignment is enabled. The user facet has the corresponding access rights (groups) assigned.
DELETED - the assignment is deleted. The corresponding access rights (groups) are not yet or no longer assigned.

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Note that DirX Identity shows assignments in approval as gray lines. Valid values for such entries are:
Add - this assignment is not yet active.
Mod - parts of this assignment (some attributes) were changed.
Del - this assignment is to be deleted.

To add or remove roles, use the assignment editor, which is displayed when you click Edit. To examine the details of a particular role, click to the right of its row.

Note that a line is displayed in gray if this assignment is still in approval. Thus you may see a white line that defines the current state and possibly several gray lines that define changes for this assignment that are still in approval.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Assigned Permissions

Use this tab to view and manage the permissions assigned to a user facet. The tab shows the list of permissions currently assigned to the user facet.

For each permission, the following properties are displayed:

Permission - the permission’s name as it is displayed throughout the DirX Identity Provisioning system.

Description - the description of the permission.

Start Date - the date on which this permission became or will become active for the user facet.

End Date - the date on which this permission became or will become inactive for the user facet. If the re-approval flag is set, the shown end date is the date of the re-approval. You can change the end date to shorten the period to the next re-approval but you cannot lengthen it.

Assigned by - how the permission assignment was made. Possible values are:

(empty) - This permission is inherited from a role.
BO - the permission was assigned by privilege inheritance from a business object.
manual - the permission was assigned by hand.
rule - This permission was assigned by a rule.

State - the state of the assignment:

ToBeApproved - the assignment is still in approval. The corresponding access rights (groups) are not yet assigned.
INHERITED - this assignment is inherited from a role assignment.
DELETED - the assignment is deleted. The corresponding access rights (groups) are not yet or no longer assigned.

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Note that DirX Identity shows assignments in approval as gray lines. Valid values for such entries are:
Add - this assignment is not yet active.
Mod - parts of this assignment (some attributes) are to be changed.
Del - this assignment is to be deleted.

To add or remove permissions manually, use the assignment editor, which is visible when you click Edit. To examine the details of a particular permission, click to the right of its row.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Groups
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Assigned Groups

Use this tab to view and manage the groups assigned to a user facet. The tab displays the list of groups currently assigned to the user facet.

For each group, the following properties are shown:

Target system - the name of the target system to which the group belongs.

Group - the group’s name as it is displayed throughout the DirX Identity Provisioning system.

Description - the description of the group.

Start Date - the date on which this direct group assignment became or will become inactive for the user facet.

End Date - the date on which this direct group assignment became or will become inactive for the user facet. If the re-approval flag is set, the shown end date is the date of the re-approval. You can change the end date to shorten the period to the next re-approval but you cannot lengthen it.

Assigned by - how the assignment was made:

(empty) - the group was assigned by a permission or role through privilege assignment.
BO - the group was assigned by privilege inheritance from a business object.
manual - the group was assigned by hand.
rule - the group was assigned by a rule through policy execution.

State - the status of the group assignment. Possible values are:

ADD - the assignment is requested by DirX Identity Provisioning and shall be created in the target system by the synchronization workflow.
DELETED - DirX Identity Provisioning requests the assignment to be deleted in the target system by the synchronization workflow. When it is deleted in the target system, the workflow removes the assignment physically from the dxrMemberDel attribute.
ENABLED - the assignment is established both in DirX Identity Provisioning and in the target system: they are "in-sync".
IMPORTED - the assignment was created in the target system, but not yet requested in DirX Identity Provisioning. DirX Identity Provisioning does not delete it (ignores it), but it may be an indicator to the administrator, that the user facet has access rights not granted by the assigned roles. DirX Identity Provisioning switches the state to ENABLED, when the user facet is granted this access right. If it is revoked afterwards, the state switches to DELETED and not back to IMPORTED!

See the section "Managing States" in the chapter "Managing Provisioning" to understand the relationship to the states of other objects.

Note that DirX Identity shows assignments in approval as gray lines. Valid values for such entries are:
Add - the assignment is not yet active.
Mod - parts of this assignment (some attributes) are to be changed.
Del - the assignment is to be deleted.
INACTIVE - the state is a virtual one that may have two causes:
The end date of this assignment has passed.
The privilege is already assigned (for example, by the policy execution service), but a privilege resolution has not yet run. Run the privilege resolution to solve this problem.
The privilege is already assigned but the assignment is still in approval. Completing the approval workflow will change the state.

The reason for this state is that the dxrGroupLink at the user facet is already populated, but the member attributes at the group or account are not yet populated.

To add or remove groups manually, use the assignment editor, which is visible when you click Edit. To examine the details of a particular group, click to the right of its row.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Orders
User Facet - SoD Exceptions

User Facet - Orders

Use this tab to display all currently pending changes for this user facet. This information is kept in order objects (mostly part of running request workflows).

The upper part of this tab shows pending attribute modification requests, the lower part shows pending privilege assignments or privilege assignment attribute changes.

The Attribute Modifications pane shows a line for each relevant attribute. The columns are:

Due Date - the date on which this change will be valid. If no value is supplied, the change depends on a pending attribute approval step of a running request workflow.

Attribute - the name of the attribute.

Old values - the old value(s) of the attribute.

New values - the new value(s) of the attribute.

- opens a detail page for this line.

The Assignments to add (+), modify (*) or delete (-) pane shows a line for each assignment or change. The columns are:

Op(eration) - the type of line. Possible values are:

(+) - the privilege is to be assigned (to be added).

(*) - the assignment is subject to a change. One or more of the attributes - for example, the start or end date or a role parameter - has changed.

(-) - the privilege is to be removed (to be deleted).

Due date - the date on which this assignment or assignment change will be valid. If no value is supplied, the change depends on a pending attribute approval step of a running request workflow.

Type - the privilege type (role, permission or group).

Name - the privilege name.

Attribute - the name of the attribute to be changed.

Old values - the old value(s) of the attribute.

New values - the new value(s) of the attribute.

Assigned by - the type of the assignment (manual or by rule).

- opens a detail page for this line. It shows the corresponding request workflow instance.

Note that the assignment information is also visible in the Assigned Roles, Assigned Permissions and Assigned Group tabs in a slightly different format.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - SoD Exceptions

User Facet - SoD Exceptions

Use this tab to display all segregation of duty (SoD) exceptions for this user facet. SoD exceptions are SoD conflicts that have been approved successfully via an assignment approval workflow.

Note that the scope of SOD checking is limited to single users or user facets only. Thus. if a user facet has a privilege assigned that violates an SOD policy for another privilege being assigned to its user or to another user facet of its user, no violation is detected.

The upper part of this tab shows approved SoD violations, the lower part shows pending SoD violations.

For each SoD exception line in the Approved SoD violations table, the following columns are shown:

Policy - the SoD policy that caused this exception.

Privilege - the privilege that was assigned to the user facet.

Activity - the approval activity of the corresponding request workflow.

Reason - the reason why the approver accepted this SoD conflict.

Who - the approver.

When - the date of approval.

For each SoD exception line in the Pending SoD violations table, the following columns are shown:

Policy - the SoD policy that caused this exception.

Privilege - the privilege that was assigned to the user facet.

Click to open a detail page for this line.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders

User Facet - Risk Parameters

Use this tab to display the risk assessment properties for the user facet.

The Overall Risk section displays the computed overall risk level and the compound score. It includes the following properties:

Risk Level - the overall risk level for the user facet. Possible values are Low, Medium or High.

Compound Score - the calculated compound score for the user facet. All of the user facet’s standard scores are used to compute the compound score.

Raw Value - the raw value for the risk factor. This value is the computed score of the factor at the user facet.

Standard Score - the standard score for the risk factor. This value is a normalized score for the factor at the user facet.

See the section "Managing Risk" in the chapter "Managing Compliance" for details on risk calculation.

Related Topics

User Facet - General Properties
User Facet - Relationships
User Facet - Operational Properties
User Facet - Communication
User Facet - Authentication
User Facet - Organization
User Facet - Location
User Facet - Context
User Facet - Assigned Roles
User Facet - Assigned Permissions
User Facet - Assigned Groups
User Facet - Orders

Risk Policy - General

Persona

Persona - General Properties

Personas are alternative representations of a user. The user works in different functions in the company, for example as an administrator or as a project manager. The accounts and the access rights for each representation might be quite different and also auditing should be able to distinguish between these functions of a user.

The persona object represents a profile of a user of an IT infrastructure. DirX Identity Provisioning manages the persona’s access to all parts of the IT infrastructure.

This tab shows all general properties of the persona object. Since it is fully configurable by the domain administrator, the items shown here may vary from installation to installation or even from domain to domain.

Note that a persona is related via its owner link to its user. Depending on the processes in a company, it makes sense to inherit properties of the user to the persona by the master mechanism. In that case, the text entry fields are not editable but are automatically filled from the owner.

The following properties explain the default configuration of DirX Identity:

General (Identification) Properties

Name (mandatory) - used as the relative distinguished name (RDN) for the persona entry and identifies the persona uniquely within the sub-tree. Once set during adding a new persona entry, it can no longer be changed by simply editing this field after the initial save operation. Use the Rename command of the persona entry’s context menu instead. A change of the common name is also possible by running the persona integration workflow.

First Name (optional) - the first name of the persona.

Middle Name (optional) - the middle name of the persona.

Salutation (optional) - the salutation of the persona. Values for different countries are available.

Title (optional) - the title of this persona. Mastered from the user.

Last Name (mandatory) - the last name of the persona. This item corresponds to the "surname" attribute saved in the Identity Store.

Gender (optional) - the gender of this persona. Mastered from the user.

Day of birth (optional) - the day of birth for this persona.

Master (optional) - the name of the directory that masters the persona entry.

Employee number (optional) - the employee number.

Identifier (optional) - the persona’s global unique identifier.

Description (optional) - A description for the persona. This is often useful, when persona entries are listed in tables just with their names but with a description column to better identify them.

Employee Type (optional) - one of the following persona’s employee types:

Contractor - an (outside) contractor.
Customer - a customer.
Internal - an internal employee.
Supplier - a supplier.

Business Category (optional) - the business the persona works for.

Persona - Relationships

Use this tab to define relationships to other user objects.

Owner (mandatory) - the owner of the persona entry. It references the persona’s related user.

Manager (optional) - the persona’s manager. Used for persona type Internal Employee. Mastered from the user.

Secretary (optional) - the persona’s secretary.

Representative (optional - the persona’s representative.

Sponsor (optional) - the persona’s sponsor. Used mainly for user type Contractor.

Related Topics

Persona - General
Persona - Operational Properties
Persona - Communication
Persona - Authentication
Persona - Organization
Persona - Location
Persona - Context
Persona - Assigned Roles
Persona - Assigned Permissions
Persona - Assigned Groups
Persona - Accounts
Persona - Orders
Persona - SoD Exceptions

Persona - Operational Properties

Use this tab to display the operational parameters necessary for correct operation on the persona entry within DirX Identity.

Status fields

To be analyzed (read-only) - indicates when checked that this entry has been changed. For example, an import workflow added or modified some attributes. The privilege resolution or the consistency checker uses this flag to detect and resolve records that are not up to date. These operations clear the flag after the check or resolution completes.

Is Inconsistent - indicates whether (unchecked) or not (checked) the stored access rights of the persona are consistent with the assigned privileges. DirX Identity Provisioning checks this field (sets the entry’s flag to TRUE) if it fails to resolve the assigned privileges due to errors in the privilege structure. In this case, the persona keeps the previous access rights, but DirX Identity Provisioning sets an end date for this state: the Error expiration date. The resolution error is stored in the Error field so that the administrator has time to repair the error.

Use as Template - indicates when checked that DirX Identity will not resolve privileges assigned to this persona. When this flag is checked, a likely reason is that the persona object has been copied from another one. In this case, the persona is marked as a template until appropriate changes have been made to the copied persona. If the persona is set correctly, uncheck the flag to enforce privilege resolution and target system provisioning.

+ A template persona may also have been deliberately created to be used as a basis for creating additional accounts that are fully controlled by DirX Identity. You can use the owner link to point from this persona to its main identity. This reference can help you to understand which secondary persona entries belong to a main identity one.

Status - the status of the persona entry. For more information, see the section "Managing States". Possible values are:

TEMPLATE - the settings made for this persona are used as a template.
NEW - the persona is a new persona, the privilege assignments are not activated yet.
ENABLED - the persona is established; the corresponding persona object is up to date and valid, the privilege assignments are active.
DISABLED - the privilege assignments for this persona are currently disabled, the persona does not have any rights in the domain.
TBDEL - the persona object shall be deleted from the DirX Identity Provisioning system. This action is taken when all assigned accounts in the target systems are deleted or the end date for deletion is reached.

Lifetime Start - shows the date on which the privilege assignments to the persona will become active for the first time (usually the date on which the persona’s privileges have to become active for the main identity).

Lifetime End - shows the date on which the privilege assignments to the persona will become inactive for the last time (usually the date on which the persona’s purpose is fulfilled, so that the main identity no longer requires its privileges). Note that when the status of the main identity changes to TBDEL, the persona’s state changes as well, and its EndDate is set.

Deactivation Start - shows the date on which the privilege assignments will become inactive for the next time.

Deactivation End - shows the date on which the privilege assignments will be reactivated again for the next time.

Delete - shows the date on which the entry will be finally deleted despite any existing accounts in target systems.

Create time stamp - shows the date and time at which this entry was created.

Modify time stamp - shows the date and time at which this entry was last changed.

Notification fields

Notification Level - controls the suppression of the first e-mail of the e-mail notification of an approval workflow:

0 - the first e-mail is sent.
1 - the first e-mail is not sent (but all other administrative or repetition e-mails).

Tasks fields

Error - stores a list of error messages that show the detailed reason for inconsistent states or To do entries. They are cleared automatically when a privilege resolution succeeds.

Error expiration date - shows the date on which the access rights of the persona will be updated despite any resolution errors. See the Is Inconsistent field.

Related Topics

Persona - General
Persona - Relationships
Persona - Communication
Persona - Authentication
Persona - Organization
Persona - Location
Persona - Context
Persona - Assigned Roles
Persona - Assigned Permissions
Persona - Assigned Groups
Persona - Accounts
Persona - Orders
Persona - SoD Exceptions

Persona - Communication

Use this tab to display communication attributes for a persona object.

E-Mail (optional) - the persona’s e-mail addresses. Mastered from the user.

Phone (optional) - the persona’s main phone number (business phone number).

Fax (optional) - the persona’s fax number.

Mobile (optional) - the persona’s mobile number. Mastered from the user.

Home (optional) - the persona’s home phone number. Mastered from the user.

Web address (optional) - the Web address of the Internet home page for this persona.

Preferred language (optional) - the preferred language of this persona (mastered from the user), which controls, for example, the language used in an e-mail if this persona is referenced in the To field. For more information, see the chapter "Using Variable Substitution" in the DirX Identity Application Development Guide.

Note that the phone number might be used by default when DirX Identity Provisioning creates a new account for the persona. The account name is generated using the persona’s surname, given name and phone number. See the object description for the accounts.

Related Topics

Persona - General
Persona - Relationships
Persona - Operational Properties
Persona - Authentication
Persona - Organization
Persona - Location
Persona - Context
Persona - Assigned Roles
Persona - Assigned Permissions
Persona - Assigned Groups
Persona - Accounts
Persona - Orders
Persona - SoD Exceptions

Persona - Authentication

Use this tab to display the authentication properties for this persona.

Encrypted Password - the encrypted (or scrambled) password of this persona (dxmPassword attribute). This attribute is used for password synchronization to target systems. Authentication against the Identity Store is performed via the stored one-way password (userPassword attribute).