Applications and Identity Modeling Flashcards
Schemas
Definition of what data to read from the application and how to interpret that data
Schema types: Account
Represents individual accounts on a target resource (Active Directory or SAP Accounts, for example)required
Schema types: Group
- Represent native account groups from target resource (LDAP Groups or Active Directory
Groups, for example) - Certain connectors support multiple group schemas (6.4)
- JDBC, SQL Loader, Delimited File, and Oracle EBS
optional
What are the four different correlation methods?
- Correlation Wizard
- Correlation Rule
- Default Logic
- Manually
Correlation Wizard can use which two types of correlation
- Attribute based
Ex: Correlate account attribute mail with identity attribute email - Condition based Ex: Correlate accounts where app2_service = true with Admin cube
Major thing to remember when using manual correlation.
Correlation permanently retained
What do Correlation Rule do?
Build and maintain account correlations
What do customization Rule do?
Modify/normalize incoming account data prior to saving to an Identity
What do Managed Entitlement Customization Rule do?
Set fields such as owner, requestable, or descriptions on ManagedAttributes (entitlements,
groups)
Aggregation and Correlation steps:
- Non-authoritative application contains accounts
- Application/Connector defines what to read, how to connect
- Aggregation task runs
- Connector reads accounts, tries to correlate to existing
Identity Cubes - Positive Correlation – add account to existing cube
- Unsuccessful Correlation – add account to new cube (mark
as un-correlated)
Connector Rules:
What is Build Map Rule
- Runs for every line in the file
- Converts incoming data into map
Connector Rules:
What is Preiterate Rule
- Runs once for each aggregation
- Can do any pre-processing
Connector Rules:
What is Postiterate Rule
- Runs once for each aggregation
- Can do any post-processing
Connector Rules:
Map To ResourceObject Rules:
- Runs once for each account or group
- Performs final conversion to Resource Object
Connector Rules:
MergeMaps Rules:
- Performs merging processing
- If default merge capabilities aren’t enough, a rule here can control merging
Within a schema, what are attribute properties
define how attributes are used and managed, including their data type, allowed values, and whether they can be multi-valued or indexed
Properties of Attributes
Entitlement
Marking an attribute as an entitlement indicates that this is an access right you want to track for your identities (for example, to use in certifications).
Properties of Attributes
Managed
Attributes designated as Managed can be viewed and managed from the Entitlement Catalog page. Managed attributes can be made requestable, can be assigned an owner (for approvals or entitlement certifications), and can have display names and descriptions that will help users identify and understand them. They can also be used in policies and risk calculations.
Properties of Attributes
Multi-valued
For some attributes, multiple values might be returned during aggregation (for example, an attribute indicating group membership). These should be marked as Multi-valued. Values for attributes flagged as multi-valued are stored as a list. Even objects that have a single value for a multi-value attribute are stored as a single-item list.
Properties of Attributes
Correlation Key
The Correlation Key flag is only used for activity and unstructured data aggregation. If activity aggregation is not being used, Correlation Key should not be selected. This flag specifies attributes that IdentityIQ can use to correlate activity discovered in the activity logs for this application with information stored in Identity Cubes. For information about correlating aggregated accounts to existing identities, see Correlation in Application Concepts.
Properties of Attributes
Minable
Attributes that you want to use for role and profile creation should be marked as minable. This allows the Role Mining feature to mine applications for attributes and permissions when creating roles and profiles, rather than requiring manual entry of the values. Only attributes designated as minable are returned by those searches.
Properties of Attributes
Remediation Modifiable
Attributes that are remediation modifiable can have their values and permissions modified as part of a certification, for the identity being certified. Options are:
Select – in the certification, display a select list of all possible values or permissions for this attribute.
Free text – in the certification, display a text field in which a certifier can enter any value.
Readonly – the value cannot be modified.
What is the term for reading application data into IdentityIQ from external sources?
Aggregation
Aggregation is a key process in IdentityIQ for integrating external data.
