Catalog Concepts
- Catalog : Catalog (aka Request Catalog) offers a consistent and intuitive request experience for customers to request Roles, Entitlements and Application Instances following the commonly used Shopping Cart paradigm. The catalog is a structured commodity with its own set of metadata.
- Catalog Item : A Catalog Item is an item (Roles, Entitlements or Application Instances) that can be requested by a user, either for themselves or on behalf of other users.
- Category : A Catalog Item Category is a way to organize the request catalog. Each catalog item is associated with one and only one category. A catalog item navigation category is an attribute of the catalog item. Catalog System Administrators can edit a Catalog Item and provide a value for the category.
- Note : You cannot leave Category field blank for a catalog item. Therefore, you must ensure that a value is present for the category.
- Application Instance : An Application Instance represents an account on particular target. When users request an application instance, they are requesting an account in a particular target. Application Instances can be connected, if fulfillment is automated via a Connector, or disconnected, if fulfillment is manual. Application Instances can have entitlements associated with them.
- Enterprise Roles : Enterprise Roles are defined by customers. Enterprise Roles have policies associated with them. Users can request enterprise roles via the Catalog. When a role is granted, application instances or entitlements are provisioned to the user.
- Entitlement : Entitlements are privileges in an application that govern what a user of the application can do.
- Catalog User-Defined Field : Catalog User-defined fields are additional attributes that are added by customers to the Catalog entity
- Catalog Item Metadata : Catalog Item Metadata refers to the values for the Catalog Item attributes. Metadata can be managed on a per-item basis by the Catalog System Administrator or can be populated in bulk.
- Tags : Tags are search keywords. When users search the Access Request Catalog, the search is performed against the tags. Tags are of three types
- Auto-generated: The Catalog synchronization process auto-tags the Catalog Item using the Item Type, Item Name and Item Display Name
- User-defined: User-defined Tags are additional keywords entered by the Catalog System Administrator
- Catalog System Administrator : The Catalog System Administrator is a global security role. The Catalog can be managed by members of this role only.
- Shopping Cart : The Shopping Cart refers to the collection of Catalog Items that are being requested. A user can have only one cart active at any given time and the cart can contain roles, application instances, entitlements, or any combination of the three.
- Catalog Synchronization : Catalog synchronization refers to the process of loading roles, application instances, and entitlements into the Catalog.
Access Request Catalog
- Extensible
- Automated harvesting of roles, applications, and entitlements
- Automateic loading of Catalog metadata using a CSV file
- Powerful search using keywords - complex search operators
- Flexible categorization
- Catalog search results automatically based on user authorization
- Catalog item data exposed via a web service for use in workflows
Onboarding Roles
There are no onboarding steps for enterprise roles. Roles, belonging to a role category other than Oracle Identity Manager Roles are published directly to the Catalog when they are created.
Onboarding Application Instances
Application Instances require additional configuration before they can be requested by end users. Use the following checklist items to make sure that you have performed the configuration required to onboard application instances:
Catalog Synchronization Job
Process Application Instances
Mode = Incremental
Job Frequency = 5 minutes
Onboarding Entitlements
Use the following checklist items to make sure that you have performed the configuration required to onboard entitlements.
- Ensure that the Connector is installed (for new targets)
- Verify that the process forms have an IT resource field
- Verify that you have defined the form field properties correctly
- Verify that you have correctly associated the parent and child forms
- Verify that you have run the common lookup reconciliation job for ICF-based targets
- Verify that you have run the connector-specific lookup reconciliation jobs for non-ICF connectors
- Verify that you have created application instances correctly, corresponding to the resource object and IT resource instance specified in the Lookup Reconciliation job
- Verify that you have published entitlements to relevant organizations
- Verify that you have run the entitlement list loader job, so that data can be populated in ent_list table
- Catalog Synchronization Job
- Process Entitlements
- Mode = Incremental
- Job Frequency = 5 minutes
Bootstrapping the Catalog
Catalog Synchronization Job
Process Roles
Mode = Full
Job Frequency = 5 minutes
Catalog Synchronization Job
Process Application Instances
Mode = Full
Job Frequency = 5 minutes
Catalog Synchronization Job
Process Entitlements
Mode = Full
Job Frequency = 5 minutes
Catalog Synchronization Job
Process Roles, Process Application Instances, and Process Entitlements
Mode = Incremental
Job Frequency = 5 minutes
Enriching the Catalog
- Editing a Catalog Item Online
- Enriching the Catalog in bulk from external sources
- Loading data from an external source
Catalog Synchronization Job
File Path = Absolute Path
Process Entitlements
Mode = Metadata
Job Frequency = 5 minutes
Managing Catalog Items
Deleting a Catalog Items of Type Roles
Just Delete
Deleting Catalog Items of Type Application Instances
Delete and Run the Job
Deleting Catalog Items of type Entitlements
Run Entitlement List Load
Run Catalog Synchronization Job in Incremental Mode
Configuring Catalog Auditing
- A change in the value of a catalog UDF.
- Any value of a catalog item attribute is changed from the catalog UI or any other custom UI.
- Following is the list of consolidated catalog attributes that are part of auditing during updation of catalog item:
- Category, Audit Objective, Approver User, Approver Role, Fulfillment User, Fulfillment role, Certifier User, Certifier Role, Item Risk, Certifiable
To Enable catalog auditing:
- Login to Oracle Identity System Administration.
- Under System Configuration, click Configuration Properties.
- Search for the Catalog Audit Data Collection system property with keyword XL.CatalogAuditDataCollection. The default value of this property is none, which specifies that catalog auditing is disabled.
- Set the value of the XL.CatalogAuditDataCollection system property to catalog. This enables catalog auditing.
Configuring Hierarchical Attributes of Entitlements
- You can enable the display of hierarchical attributes of entitlements to requesters, approvers, and certifiers to view additional details of entitlements (hierarchical attributes) in the catalog detail screen. The additional details of entitlements is called technical glossary. The technical glossary is displayed in a list view with bread crumbs at the top showing the navigational path.
- Catalog Synchronization Job
- Mode = Technical Glossary
Database Best Practices for Access Request Catalog
- One-Time Optimizations for Oracle Text Index
- Text Index Optimization
