CA Identity Manager Implementation Guide - CA Technologies

Role-Based EntitlementsRole-Based EntitlementsWith Identity Manager, you assign privileges to users by assigning roles. A rolecontains tasks that correspond to application functions in Identity Manager oraccount templates that correspond to additional accounts. When you assign arole to a user, that user can perform the tasks contained in the role or use theaccounts associated with the role.Identity Manager provides these types of roles:■■User management roles are called admin roles.Account assignment roles are called provisioning roles.Roles simplify privilege management. Instead of associating a user with eachtask that he performs or each account that he needs, you can assign a role to theuser. The user can perform the tasks in the role or use the accounts associatedwith the role.You can then edit the role by adding tasks or account templates, which define theaccounts. Every user who has the role can now perform the new task or use thenew account. If you remove a task or account template from a role, the user canno longer perform that task or use the account.Tasks enable users to perform Identity Manager functions, such as modifying aprofile.The following illustration shows several tasks which are combined into a singleadmin role and assigned to multiple users:Task 1Task 2Task3Role 1Task 4For a provisioning role, you combine several accounts, such as an email account,a database account, and an Active Directory account. You can assign the role toseveral users, who each need these accounts.10 Implementation Guide