CA Identity Manager Implementation Guide - CA Technologies

Task OptimizationsTo determine the objects that appear on a relationship tab, CA Identity Managerperforms numerous security evaluations, which can significantly impactperformance.The following example shows the steps that CA Identity Manager takes to renderthe Provisioning Roles tab:1. An administrator clicks the Provisioning Roles tab in the Modify User task.2. CA Identity Manager retrieves the provisioning roles where the selected useris a member.3. If the tab is configured to allow management of role administrators, CAIdentity Manager makes a second call to retrieve the list of provisioning roleswhere the selected user is an administrator.4. CA Identity Manager evaluates each provisioning role that the user has tosee if the administrator who initiated the task can manage membership forthat role.If the administrator can manage role members, CA Identity Managerdisplays an active check box in the Membership column for that role in thelist of roles on the tab.5. CA Identity Manager evaluates each provisioning role that the user has tosee if the administrator who initiated the task can manage administrativerights for that role.If the administrator can manage administrative rights, CA Identity Managerdisplays an active check box in the Administrator column for that role in thelist of roles on the tab.CA Identity Manager must complete steps 2-5 to display the provisioningroles the user currently has. If the administrator needs to assign a newprovisioning role, the following additional steps are required.6. The administrator clicks the Add button to locate new provisioning roles toassign.7. CA Identity Manager displays a search screen that the administrator can useto search for the role to add.8. The administrator enters a search filter to find the role to add.9. CA Identity Manager returns the list of provisioning roles that meet followingcriteria:■■■■The roles match the search filter entered by the administrator.The administrator can manage membership for the roles.The user is in the administrative scope of the administrator for the roles.The user does not already have the provisioning roles.10. CA Identity Manager repeats step 9 to determine the roles where theadministrator can manage administrative privileges.Chapter 6: Optimizing Identity Manager 79