...
When users log in to the IAM Shop, they can see the pages and controls to which their roles grant them access. (See IAM Shop Management Roles for access granted.) In the below image, the logged-in user has full access to the IAM Shop and can see all pages and controls. Users can see and request access to those entitlements for which they are eligible or which the person they are shopping for is eligible. Entitlement display names and descriptions can be localized.
...
...
From the IAM Shop, users can shop for roles or other published resources and submit Business Requests for those objectsrequest access to those objects. This requesting action is known as submitting a Business Request.
The IAM Shop application includes the following controls. Depending Not all users will see all controls depending on their access to the IAM Shop, not all users will see all controls.
Control | Description | ||
|---|---|---|---|
Navigation Sidebar | Allows users to seamlessly navigate from the IAM Shop to other EmpowerID applications | ||
Resource Panel | Provides a grid or card view of the resources the user can request. Each record can be clicked to open a pane containing an Overview of the request and a Process Steps view from which users can see how far along the approval process the request is. Users can view and add comments here as well. | ||
Shopping Cart | The shopping cart contains requested business items the user has requested but not yet submitted. Users who are shopping for themselves and others will see multiple shopping carts, one containing their items and the others containing items requested for others.  | ||
Manage Access Page | The Manage Access page provides users with views of their current access, filtered by the selected resource type (Management Roles in the below image). Users caccess this page by selecting Manage Access. Once on the page, they can submit requests to revoke their access to a given resource item by clicking the Revoke button.  | ||
Workflows Page | Provides a list of workflows the current user can initiate against the selected resource type. The below image shows workflows that can be initiated against groups. Users must have access to the page and the right to initiate the workflows to see them in the IAM Shop.  | ||
Filter Pane | Provides filters to allow users to selectively filter the resources they see. | ||
Filters | |||
Resource Type | Filter available resource resources by resource type. Available resource types include:
| ||
Shopping For | Shop for self yourself or another person. | ||
Show Only Pre-Approved | Filter to show only roles for which the resources user is pre-approved to receive via Eligibility policies. This filter appears only when shopping for groups, Business Roles, Application Management Roles, and Management Rolescomputers.Show Suggested Roles | ||
Suggest Additional Resources | Filter to show roles additional resources suggested for the user via Eligibility policies. This filter appears only when shopping for Business Roles and Management Roles. | ||
Applications | Filter to show only roles that can requested for a specific application. This filter appears only when shopping for Business Roles, Application Roles, and Management Roles. | ||
Business Domains | Filter available roles by Business Domain. This filter appears only when shopping for Business Roles and Management Roles. | ||
Business Functions | Filter available Business Roles by Business Functions. This filter appears only when shopping for Business Roles, Application Role, and Management Roles. | ||
Rights | Filter available roles by external system rights granted to those roles. This filter appears only when shopping for Business Roles, Application groups, Business Roles, and Management Roles. | ||
Suggest Application Roles | Filter to show roles suggested for the user via Eligibility policies. This filter appears only when shopping for Application Roles. | ||
Target System | Filters available Application Roles based on the selected Account Store Type and/or Account Store. Filters available Application Roles based on the selected process
| Application Processes | |
Applications | Filter to show only the groups or roles that can be requested for a specific application. This filter appears only when shopping for groups, Business Roles, and Management Roles. | ||
Business Domains | Filter available roles by Business Domain. This filter appears only when shopping for Business Roles and Management Roles.  | ||
Business Functions | Filter available groups and roles by Business Functions. This filter appears only when shopping for Application groups, Business Roles, and Management Roles.  TCode | ||
SearchRights | Filters Filter available Application Roles by TCoderoles by external system rights granted to those roles. This filter appears only when shopping for Application RolesShop By groups, Business Roles, and Management Roles. | ||
Application Processes | Filters available groups based on the selected process. This filter appears only when shopping for groups. | ||
Shop by Reference Person | Filter Filters available resources to show only those given to the referenced person. This is useful for quickly requesting access to the same resources of the referenced person when that person has the same job function as the person shopping for resources. The user shopping must be able to view the reference person and have the same eligibility and visibility of the referenced person to see that person’s resources. | ||
Advanced Search | Provides advanced search capabilities to further filter the resources that appear to the shopper. | ||
Resource Panel | Provides a grid or card view of the roles for which the user can request. Each record can be clicked to open a pane that contains an Overview of the request and a Process Steps view from which users can see how far along in the approval process the request is. Users can view and add comments here as well. | ||
Shopping Cart | The shopping cart contains the business items the user has requested but not yet submitted. Users shopping for both themselves and others will see two shopping carts. One containing items for themselves and the other containing items requested for others.  | Manage Access Page | |
Shopping for resources
Users access the IAM Shop to request available resourcesresources they are eligible to receive or to activate resource assignments they are preapproved for. This requesting action is known as creating or submitting a “Business Request.” Once a Business Request is submitted, EmpowerID routes it for approval based on the Approval Flow policies configured for that request. for the requested resource.
| Easy html macro | ||||
|---|---|---|---|---|
| ||||
The following demonstrates a typical IAM Shop user experience.
The user accesses the IAM Shop and filters the available resources to those for which that user is shopping.
The user
...
clicks the Request Access button for a specific resource, which opens
...
a panel with more information about the resource
...
and options for requesting access.
...
Users then click Add to Cart to add the requested
...
resource to their cart.
...
When ready to review the items in their carts, users click the cart icon
...
When ready to submit the request, the user does the following:
...
Optionally enter a Business Request Type
...
Enters a Business Request Name.
...
to open the shopping cart.
When ready to submit their requests for approval, users do the following:
Enter a Business Request Name.
Optionally select a due date.
Optionally
...
add a comment.
...
Click Submit.
Once successfully submitted, a window appears stating that the cart was successfully submitted with a link to track the request's status
...
.
...
Clicking the link directs the user’s browser to the My Request page of the My Tasks application with the Overview card for the request open.
...
Overview cards allow users to view details about
...
their requests and the number of approvals needed for
...
access to be granted.
...
Using the Manage Access Page
The Manage Access page provides lets users with a view of their current access, filtered by resource type. When users navigate to the page, the default view they see is a grid view with records of their current resources for the selected resource type. Each record includes a Details button that users can click to open an Overview pane containing more information about the role, including who owns the role and the access granted to the user by the role. The below image shows the default view of the Manage Access page for a user with one Azure Role.
...
...
What can users do on this page?
Users can search for a specific resource and type by using the search bar and filter located at the top of the page.
Users can view all roles to which they have access by selecting the filter for that role typeassignment.
Users can view the details about a particular role they have resource assignment by clicking the Details button for the role.
Users with the authority to revoke their access to a role resource can do so by clicking the Revoke button for the role.
Users with the appropriate access can view all roles to which the resources another person has access to by selecting that person as in the Shopping Manage Forrecipient field. Users must have access to view the person and the person’s roles resources to do so.
Users can view any roles resources they have access to that are limited to specific dates and times by toggling the Show Time Constrained button.
Users can view pending requests by clicking the View Pending Access button. Clicking the button directs the user’s browser to the My Requests View of the My Tasks application.
Users can activate login sessions for computers by clicking the Unlock button.
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|
Using the Workflows Page
The Workflows page provides authorized users with workflows that can be initiated against a particular resource type. Users select the desired resource type and navigate to the Workflows page to view the workflows available for a resource type. The below image shows the workflows available for the Credential resource type.
...