CA Identity Manager Implementation Guide - CA Technologies

Role OptimizationsRole OptimizationsIdentity Manager includes three types of roles:■Admin rolesDetermine the privileges a user has in the User Console.When a user logs into an Identity Manager environment, the user's accounthas one or more admin roles. Each admin role contains tasks, such as CreateUser, that a user can complete in that Identity Manager environment. Theadmin roles that a user has determine the presentation of the User Console,therefore users see only the tasks that are associated with their roles.■Provisioning rolesGive users accounts in managed endpoints, such as an email system.■Access rolesOffer an additional way to provide entitlements in Identity Manager.Roles include policies that determine the following:■■■Who can use the role (for admin and access roles only) and where they canuse itWho can manage role members and administratorsWho can modify the role definitionEvaluating roles and their associated privileges can have a significant impact onIdentity Manager performance.How Role Evaluation Affects Performance at LoginWhen an Identity Manager user attempts to log into the User Console, thefollowing actions occur:1. Identity Manager prompts the user to supply credentials, such as a username and password.2. The user's credentials are authenticated using one of the following methods:■■Identity Manager native authenticationSiteMinder authentication, if the Identity Manager implementationincludes SiteMinder70 Implementation Guide