Oracle Role Manager Carl Terrantroy Director Market Initiatives ANZ

Roles In The Real World Org=Corporate Org=Finance Org=APAC Org=Sales Org=Marketing Org=EMEA Org=Americas Part Of Reports Into Matrix Into Job Sharing Head Of Pays For Ps=John Ps=AR Clerk Ps=Jane Ps=Ian Ps=Raj Ps=Clark Ps=Wang Ps=Irene Ps=Kelly Ps=Amit Ps=Vladimir

Challenges With HR & LDAP Functional roles usually do not match org. hierarchy Contractor management is complex Limited out-of-the-box integration

Functional roles usually do not match org. hierarchy

Contractor management is complex

Limited out-of-the-box integration

Agenda Why Role Manager IDM Integration Role Concepts <Insert Picture Here>

Why Role Manager

IDM Integration

Role Concepts

The Evolution of Identity Management Then We Added Provisioning Tool ….. Applications User The IT Dude The Helpdesk Guy The Cat Who Makes The Rules The Boss Resolving policies into WHO is not trivial Rules and polices are constantly changing But Provisioning Tools Are Not “ Business Smart ” … .. Provisioning helps with self service & administration Provisioning helps with automation & audit

The Evolution of Identity Management Enterprise Role Management Completes The Puzzle Applications Provisioning helps with self service & administration Provisioning helps with automation & audit User The IT Dude The Helpdesk Guy The Cat Who Makes The Rules The Boss Role Management helps define who has to do what Role Management helps define who should have access to what

Open Architecture Sun, IBM, CA, Novell Required Bolt-On Components Provisioning Platform User & Policy Repository LDAP Workflow & Other Meta Data Database & File Transaction & Audit Logs DB & File HR-LDAP Synchronization Workflow Role Management Reporting & Attestation SEM Log Correlation Messaging Bus Store key only No provisioning history No reconciliation history Custom Integration No rogue entitlement Detection Reporting DB Real-time scan reporting Manually configured event logging No history or User Profile History Log

Logical Architecture Role Lifecycle Manager Polyarchy Manager Services User Interfaces Role Admin Mining Reporting Auditing Data Loading Role Provider Temporal Engine Security Permissions Views Organization Hierarchies Cross Hierarchy Relationships Life Cycle Management Business And IT roles Approver Roles Privileges Role Mappings Dynamic Membership Rules Membership Rule Simulation Sphere of Influence Event Driven Role Recalculation Mining Engine Role And Rule Mining Role And Rule Export Role Clean Up Rogue Access Detection Role Cleansing For Seg. of Duties API

Organization Hierarchies

Cross Hierarchy Relationships

Life Cycle Management

Business And IT roles

Approver Roles

Privileges

Role Mappings

Dynamic Membership Rules

Membership Rule Simulation

Sphere of Influence

Event Driven Role Recalculation

Role And Rule Mining

Role And Rule Export

Role Clean Up

Rogue Access Detection

Role Cleansing For Seg. of Duties

Role & Rule Mining Role mining Rule mining Exports roles and members for ongoing role management Applications Mining Engine Role Management Accounts, Attributes, Entitlements Recommended Roles & Rules

Role mining

Rule mining

Exports roles and members for ongoing role management

Polyarchy With Relationship Resolution ORM Polyarchy Engine Show sales team grouped by geographical business unit hierarchy Ps=John VP Sales Ps=Vladimir GM, EMEA Ps=Amit GM, APAC Ps=Kelly GM, Americas Ps=Jane Account Manager Ps=Ian Account Manger Ps=Raj Account Manager

Approver Role Relationship based roles that capture approval policies Role membership resolved in real time for any service

Relationship based roles that capture approval policies

Role membership resolved in real time for any service

Role Administration Centralized enterprise role management Support for complex rules Ease of use for business users Real-time integration System Privileges IT Roles Biz Roles

Centralized enterprise role management

Support for complex rules

Ease of use for business users

Real-time integration

Business Rules ERM Can Cope With Compliance manager is the financial analyst assigned to the division Level-up manager is manager’s manager and at least one grade higher Risk manager cannot approve his own transactions When approver position is empty find the level-up manager within cost center In catastrophic events, approver changes from regional general manager to line-of-business manager Branch manager delegates must have series 9 – 10 certifications

Compliance manager is the financial analyst assigned to the division

Level-up manager is manager’s manager and at least one grade higher

Risk manager cannot approve his own transactions

When approver position is empty find the level-up manager within cost center

In catastrophic events, approver changes from regional general manager to line-of-business manager

Branch manager delegates must have series 9 – 10 certifications

Role Consolidation through Role Mining

Summary Missing link between binary IT systems and adaptable organisation structures Copes with loose structures like dotted line reporting Extend the capability of your existing IDM investment

Missing link between binary IT systems and adaptable organisation structures

Copes with loose structures like dotted line reporting

Extend the capability of your existing IDM investment